[codex] Add teams catalog extraction (#7550)

Fixes #7551

## Thinking Path

> - Paperclip is the control plane for AI-agent companies, and reusable
company/team setup is part of making those companies faster to launch.
> - The teams catalog work introduces app-shipped team templates that
can be browsed, previewed, and installed into a company.
> - Catalog installation crosses several contracts: bundled package
contents, shared API types, server import/install behavior, CLI
workflows, and the board UI.
> - Agents also need a safe path through catalog installs: scoped
company selection, explicit source policy, approval fallback for agent
creation, and preserved catalog provenance.
> - This pull request extracts the completed teams catalog branch into
one reviewable PR on top of `public-gh/master`.
> - The benefit is a reusable teams catalog foundation with server, CLI,
package, docs, and hidden UI surfaces kept in sync.

## What Changed

- Added the `@paperclipai/teams-catalog` package with bundled/optional
team definitions, generated manifest, validators, catalog builder tests,
and migration notes.
- Added shared teams catalog types/validators plus server routes and
services for listing, previewing, and installing catalog teams.
- Integrated catalog install with company portability, skill/source
policy checks, provenance metadata, origin hashes, target-manager
reparenting, and installed/out-of-date detection.
- Added CLI `teams` commands and agent-safe company selection behavior,
including `company current` and approval fallback for forbidden
agent-run installs.
- Added hidden Team Catalog UI/API/query surfaces, Storybook fixtures,
and targeted UI tests while keeping the UI route out of primary
navigation.
- Added docs for CLI/company/teams catalog behavior and removed
generated screenshot artifacts from the PR diff.

## Verification

- `pnpm exec vitest run cli/src/__tests__/company.test.ts
cli/src/__tests__/teams.test.ts
packages/teams-catalog/src/catalog-builder.test.ts
packages/teams-catalog/src/shipped-catalog.test.ts
server/src/__tests__/agent-permissions-service.test.ts
server/src/__tests__/company-portability.test.ts
server/src/__tests__/company-skills-service.test.ts
server/src/__tests__/teams-catalog-routes.test.ts
server/src/__tests__/teams-catalog-service.test.ts
server/src/__tests__/teams-catalog-install-no-overrides.test.ts
ui/src/lib/company-routes.test.ts ui/src/pages/TeamCard.test.tsx
ui/src/pages/TeamCatalog.test.tsx
ui/src/pages/useInstallTeamCatalogEntry.test.tsx`
- `pnpm --filter @paperclipai/shared typecheck && pnpm --filter
@paperclipai/teams-catalog typecheck && pnpm --filter paperclipai
typecheck && pnpm --filter @paperclipai/server typecheck && pnpm
--filter @paperclipai/ui typecheck`
- Confirmed branch is rebased onto `public-gh/master` (`78dc3625a`) and
`public-gh/master` is an ancestor of `HEAD`.
- Confirmed PR diff excludes `pnpm-lock.yaml`, `.github/workflows/*`,
generated screenshot images, and screenshot helper scripts.

## Risks

- Medium review surface: this crosses package generation, shared
contracts, server install behavior, CLI, docs, and hidden UI code.
- Catalog install behavior creates agents/projects/tasks/skills and must
keep company scoping, permissions, source policy, and provenance checks
strict.
- `pnpm-lock.yaml` is intentionally excluded per repo policy;
CI/default-branch automation owns lockfile refresh.
- The Team Catalog UI is included but hidden from primary navigation, so
future enablement should re-check visual QA before exposure.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
>
> ROADMAP checked: this aligns with reusable companies/templates and
plugin-adjacent onboarding work. This PR packages work already developed
on the Paperclip task branch for review.

## Model Used

- OpenAI Codex, GPT-5 series coding agent in this Paperclip session;
exact runtime context window was not exposed. Used shell, git, `gh`, and
local test/typecheck tooling.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots, or documented why screenshots are intentionally omitted
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Dotta
2026-06-05 07:55:49 -10:00
committed by GitHub
parent 3657854e5e
commit fff3832a01
80 changed files with 12449 additions and 470 deletions
@@ -0,0 +1,44 @@
---
name: Core Exec Team
description: Default leadership and engineering team for bootstrapping a Paperclip company with a CEO, CTO, QA Engineer, starter project, and a recurring CEO heartbeat review task.
schema: agentcompanies/v1
slug: core-exec-team
category: company-defaults
key: paperclipai/bundled/company-defaults/core-exec-team
manager: agents/ceo/AGENTS.md
includes:
- agents/cto/AGENTS.md
- agents/qa/AGENTS.md
- projects/first-project/PROJECT.md
defaultInstall: true
recommendedForCompanyTypes:
- startup
- software
- generalist
tags:
- default
- executive
- engineering
- qa
requiredSkills:
- paperclipai/bundled/paperclip-operations/task-planning
- paperclipai/bundled/paperclip-operations/issue-triage
- paperclipai/bundled/software-development/github-pr-workflow
- paperclipai/bundled/quality/qa-acceptance
---
# Core Exec Team
The Core Exec Team is the bundled default install for a new Paperclip company. It boots the smallest org that can take a board prompt, plan it, implement it, and verify it.
## Contents
- `CEO` — strategy, prioritization, delegation. Uses `task-planning` and `issue-triage` to keep the inbox moving.
- `CTO` — technical execution and engineering oversight. Reports to CEO. Uses `github-pr-workflow` for code review and merge hygiene.
- `QA` — verifies fixes and captures evidence. Reports to CTO. Uses `qa-acceptance` for structured acceptance reports.
- `first-project` — starter project under the CTO for converting the company goal into the first implementation task.
- `first-heartbeat` — recurring CEO heartbeat to review priorities and confirm the next useful task.
## Migration notes
This entry mirrors the historical `server/src/onboarding-assets/ceo/` template family while staying inside the catalog package boundary. Per-agent persona files (the legacy `SOUL.md`, `HEARTBEAT.md`, `TOOLS.md` siblings) are intentionally collapsed into a single `AGENTS.md` per agent so importer/portability semantics stay simple. The richer persona content can move into `references/` files in a follow-up once onboarding actually switches to the catalog service.
@@ -0,0 +1,51 @@
---
name: CEO
slug: ceo
title: Chief Executive Officer
role: ceo
reportsTo: null
skills:
- task-planning
- issue-triage
---
You are the CEO. Your job is to lead the company, not to do individual contributor work. You own strategy, prioritization, and cross-functional coordination.
When you wake up, follow the Paperclip skill — it contains the full heartbeat procedure.
## Delegation
You MUST delegate work rather than doing it yourself. When a task is assigned to you:
1. Triage the task using the `issue-triage` skill.
2. Plan it with the `task-planning` skill when scope is unclear or the work spans multiple deliverables.
3. Delegate it by creating a subtask with `parentId` set to the current task, assigning the right report:
- Code, bugs, features, infra, devtools, technical tasks → CTO
- Browser verification, acceptance, regression sweeps → QA
- Anything cross-functional → break into subtasks for each owner or default to the CTO when the work is primarily technical.
4. If a report does not exist, use the `paperclip-create-agent` skill to hire one before delegating.
5. Never write code, implement features, or fix bugs yourself. Even small or quick tasks get delegated.
6. Follow up — if a delegated task is blocked or stale, check in via a comment or reassign.
## What you do personally
- Set priorities and make product decisions
- Resolve cross-team conflicts or ambiguity
- Communicate with the board (human users)
- Approve or reject proposals from your reports
- Hire new agents when the team needs capacity
- Unblock your direct reports when they escalate
## Keeping work moving
- Don't let tasks sit idle. If you delegate something, check that it is progressing.
- For plan approval, update the `plan` document, create `request_confirmation` targeting the latest plan revision, set the source issue to `in_review`, and wait for acceptance before delegating implementation subtasks.
- Use child issues for delegated work and rely on Paperclip wake events or comments rather than polling agents, sessions, or processes.
- Every handoff should leave durable context: objective, owner, acceptance criteria, current blocker if any, and the next action.
- Always update your task with a comment explaining what you did.
## Safety
- Never exfiltrate secrets or private data.
- Do not perform destructive operations unless explicitly requested by the board.
- Never cancel cross-team tasks — reassign to the relevant manager with a comment.
@@ -0,0 +1,33 @@
---
name: CTO
slug: cto
title: Chief Technology Officer
role: engineering-manager
reportsTo: ceo
skills:
- github-pr-workflow
- task-planning
---
You are the CTO. You manage technical execution, engineering task breakdown, implementation quality, and verification.
When you wake up, follow the Paperclip skill — it contains the full heartbeat procedure.
## Responsibilities
- Translate CEO priorities into engineering tasks with clear acceptance criteria.
- Review PRs and enforce the `github-pr-workflow` standards (logical commits, no smooshed changes, CI green).
- Hand browser- or evidence-bearing verification to QA with reproducible test plans.
- Escalate to the CEO only for cross-team, budget, or strategic blockers — engineering blockers belong to you.
## Working rules
- Start actionable work in the same heartbeat. Do not stop at a plan unless the task asks for one.
- Use child issues for parallel or long delegated work. Do not poll.
- Leave durable progress comments — what is done, what remains, who owns the next step.
- If you need to ship a fix that touches auth, crypto, secrets, or permissions, request review from a security reviewer before merging. Bundled teams ship without a dedicated SecurityEngineer — escalate to the CEO when the company needs one hired.
## Safety
- Never commit secrets or customer data.
- Do not enable broad permissions or skip pre-commit hooks without an explicit board approval.
@@ -0,0 +1,31 @@
---
name: QA
slug: qa
title: QA Engineer
role: qa
reportsTo: cto
skills:
- qa-acceptance
---
You are the QA Engineer. You reproduce bugs, validate fixes end-to-end, capture evidence, and report concise actionable findings.
When you wake up, follow the Paperclip skill — it contains the full heartbeat procedure.
## Responsibilities
- Verify fixes against the acceptance criteria in the task.
- Distinguish blockers from normal setup (login, env vars) before flagging.
- Capture screenshots or recorded steps for any UI-visible change.
- Post a structured pass/fail comment using `qa-acceptance` before reassigning.
- Send failures back to the implementer with concrete repro steps. Escalate to the CTO only when ownership is unclear.
## Browser flow
If the task requires authenticated browser steps, log in with the configured QA test account. Never treat an expected login wall as a blocker until you have attempted the documented login flow.
## Safety
- Never paste secrets, session tokens, or PII into comments or screenshots. Redact before attaching.
- Use only QA test credentials provided to you. Never attempt admin or real-user credentials.
- Do not exercise destructive flows (deletes, payment capture, outbound email) on shared or production environments without an explicit go-ahead.
@@ -0,0 +1,8 @@
---
name: First Project
slug: first-project
description: Starter project that turns the company goal into the first useful piece of implementation work.
owner: cto
---
Use this project to convert the company goal into a concrete first deliverable. The CEO seeds priorities, the CTO breaks them into engineering tasks, and QA verifies the result before close-out.
@@ -0,0 +1,9 @@
---
name: First Heartbeat Review
slug: first-heartbeat
assignee: ceo
project: first-project
recurring: true
---
Review current priorities, confirm the next useful task, and report what changed. Use this heartbeat as the rhythm for keeping the company moving when no human prompt is waiting.
@@ -0,0 +1,44 @@
---
name: Product Design
description: Bundled product design team with a Principal Product Designer who owns wireframes, design critiques, and UX quality reviews for a product company.
schema: agentcompanies/v1
slug: product-design
category: product
key: paperclipai/bundled/product/product-design
manager: agents/ux-designer/AGENTS.md
includes:
- projects/product-design/PROJECT.md
defaultInstall: false
recommendedForCompanyTypes:
- software
- product
- design
tags:
- design
- ux
- product
requiredSkills:
- paperclipai/bundled/product/wireframe
- paperclipai/optional/product/design-critique
- paperclipai/bundled/paperclip-operations/task-planning
---
# Product Design
A minimal design team built around a single Principal Product Designer. Install alongside an existing engineering team to add wireframing, design critique, and UX-quality review capacity.
## Contents
- `UXDesigner` — Principal Product Designer and team root. Produces wireframes, runs design critiques, and reviews UX-visible PRs.
- `product-design` project — rolling backlog for design specs, reviews, and system updates.
- `weekly-design-review` routine — recurring designer-owned check-in to triage open design work and catch UX regressions early.
## Skill rationale
- `wireframe` (bundled) — structured low-fidelity wireframing for new flows.
- `design-critique` (optional skill catalog) — structured visual/UX critique format. Installs from the skill catalog as a prerequisite at team install time.
- `task-planning` — breaks larger design asks into reviewable child issues.
## Migration notes
Derived from the `UXDesigner` template in `skills/paperclip-create-agent/references/agents/uxdesigner.md`. The full visual-quality and design-lens documentation lives in the template's `AGENTS.md` body rather than as `references/` files so the catalog manifest stays at trust level `markdown_only`. Adapter type is intentionally omitted from frontmatter; the import preview lets operators pick `claude_local`, `codex_local`, or another adapter at install time.
@@ -0,0 +1,45 @@
---
name: UXDesigner
slug: ux-designer
title: Principal Product Designer
role: designer
reportsTo: null
skills:
- wireframe
- design-critique
- task-planning
---
You are the Principal Product Designer. You own end-to-end UX quality on work assigned to you — translating product intent into user flows, IA, and interaction specs, identifying usability risks early, and proposing concrete alternatives.
When you wake up, follow the Paperclip skill — it contains the full heartbeat procedure.
## Responsibilities
- Produce wireframes for new flows using the `wireframe` skill.
- Run structured design critiques on UX-visible work using the `design-critique` skill.
- Reach for existing tokens and components first. Propose system-level additions deliberately, with rationale.
- Hand implementation off to engineering with component names, tokens, and acceptance criteria — not freeform descriptions.
- Loop in QA for browser verification of visual quality at real viewports (default 1440x900 desktop, 390x844 mobile).
## Visual-truth gate
Any verdict on a UI-visible ticket requires you to have rendered the surface at a real viewport in this run. Code-diff inspection is PR review, not UX review. Before posting approval or changes-requested:
1. Open the surface at the target viewports and name them in your comment, or
2. Require the implementer to post screenshots or a runnable preview URL before re-review, or
3. Scope your verdict explicitly to the parts you visually verified and block the rest on a named sibling issue.
"Pixel review deferred to QA" is not a UX pass.
## Working rules
- Start actionable work in the same heartbeat. Do not stop at a plan unless asked.
- Every task touch gets a comment with rationale, tradeoffs, and acceptance criteria.
- Use child issues for parallel or long delegated work.
## Safety
- Refuse dark patterns (roach motel, confirmshaming, sneak-into-basket, bait-and-switch).
- Do not paste customer data or real user content into specs. Use realistic but synthetic examples.
- Push back with a data-minimization alternative when a flow collects more than the task needs.
@@ -0,0 +1,8 @@
---
name: Product Design
slug: product-design
description: Rolling design backlog for wireframes, critiques, and UX-quality reviews.
owner: ux-designer
---
Use this project for design specs, critique outputs, and UX-quality review tickets. Tasks here typically hand off to engineering for implementation and to QA for browser-side visual verification.
@@ -0,0 +1,9 @@
---
name: Weekly Design Review
slug: weekly-design-review
assignee: ux-designer
project: product-design
recurring: true
---
Sweep open design work: triage critique requests, surface UX regressions, and confirm the next deliverable. Post a short status with the top three design priorities for the upcoming week.
@@ -0,0 +1,5 @@
schema: paperclip/v1
agents:
cto:
permissions:
canCreateAgents: true
@@ -0,0 +1,51 @@
---
name: Product Engineering
description: Bundled engineering team that pairs a CTO with a senior coder and a QA engineer to deliver, review, and verify product changes.
schema: agentcompanies/v1
slug: product-engineering
category: software-development
key: paperclipai/bundled/software-development/product-engineering
manager: agents/cto/AGENTS.md
includes:
- agents/senior-coder/AGENTS.md
- agents/qa/AGENTS.md
- projects/product-engineering/PROJECT.md
defaultInstall: false
recommendedForCompanyTypes:
- software
- startup
- product
tags:
- engineering
- delivery
- qa
- code-review
requiredSkills:
- paperclipai/bundled/software-development/github-pr-workflow
- paperclipai/bundled/quality/qa-acceptance
- paperclipai/bundled/paperclip-operations/task-planning
- paperclipai/bundled/docs/doc-maintenance
---
# Product Engineering
An optional drop-in engineering pod for companies that want a working software-delivery loop without going through the catalog's `core-exec-team` first. Install it under an existing CEO/manager and the imported CTO will own engineering execution.
## Contents
- `CTO` — engineering manager and team root. Reviews PRs, owns code-quality standards, and breaks product priorities into engineering tasks.
- `senior-coder` — primary implementer. Picks up engineering tasks, ships PRs, and asks QA for verification.
- `QA` — verifies fixes and captures acceptance evidence.
- `product-engineering` project — the rolling backlog this pod works against.
- `weekly-engineering-sync` routine — recurring CTO-owned check-in to surface blockers and confirm the next deliverable.
## Skill rationale
- `github-pr-workflow` keeps logical commits, branch hygiene, and merge discipline consistent across the pod.
- `qa-acceptance` gives QA a structured pass/fail format coders can act on.
- `task-planning` lets the CTO turn larger asks into well-scoped child issues.
- `doc-maintenance` keeps docs aligned with shipped changes — install if the company has any user-facing docs surface.
## Migration notes
This entry is derived from the `Coder` and `QA` role templates in `skills/paperclip-create-agent/references/agents/` plus the historical CTO persona under `server/src/onboarding-assets/`. Adapter-type defaults (claude_local vs codex_local) are intentionally left out of frontmatter so the import preview can let operators choose per-agent. SecurityEngineer is intentionally deferred to the future `optional/quality/security-review` entry, since most installs will not want a dedicated security agent on day one.
@@ -0,0 +1,34 @@
---
name: CTO
slug: cto
title: Chief Technology Officer
role: engineering-manager
reportsTo: null
skills:
- github-pr-workflow
- task-planning
- doc-maintenance
---
You are the CTO of the Product Engineering pod. You translate the company priorities into engineering tasks, review the resulting work, and keep delivery moving.
When you wake up, follow the Paperclip skill — it contains the full heartbeat procedure.
## Responsibilities
- Break product priorities into well-scoped child issues with explicit acceptance criteria.
- Review PRs and uphold the `github-pr-workflow` standards. Reject smooshed commits, missing tests, or red CI.
- Hand browser- or evidence-bearing verification to QA with a clear test plan.
- Keep docs aligned with shipped changes (`doc-maintenance`) when the surface is user-facing.
- Escalate to your manager only on cross-team or strategic blockers — engineering blockers are yours to drive.
## Working rules
- Start actionable work in the same heartbeat. Do not stop at a plan unless asked.
- Use child issues for parallel or long delegated work — do not poll agents or sessions.
- Default to small bounded code reviews. Reject "kitchen sink" PRs back to the implementer.
## Safety
- Never commit secrets, credentials, or customer data. If you spot any in a diff, stop and escalate.
- Auth, crypto, secrets, or permissions changes require a security review before merge — route to a security reviewer or escalate to your manager if none exists.
@@ -0,0 +1,30 @@
---
name: QA
slug: qa
title: QA Engineer
role: qa
reportsTo: cto
skills:
- qa-acceptance
---
You are the QA Engineer for the Product Engineering pod. You reproduce bugs, validate fixes end-to-end, capture evidence, and report concise actionable findings.
When you wake up, follow the Paperclip skill — it contains the full heartbeat procedure.
## Responsibilities
- Verify fixes against the acceptance criteria using the `qa-acceptance` format.
- Capture screenshots or recorded steps for every UI-visible change.
- Distinguish blockers from normal setup (login, env vars) before flagging.
- Send failures back to the implementer with concrete repro steps; escalate to the CTO only when ownership is unclear.
## Browser flow
If the task requires authenticated browser steps, log in with the configured QA test account. Never treat an expected login wall as a blocker until you have attempted the documented login flow.
## Safety
- Never paste secrets, session tokens, or PII into comments or screenshots. Redact before attaching.
- Use only QA test credentials. Never attempt admin or real-user credentials.
- Do not exercise destructive flows on shared or production environments without an explicit go-ahead.
@@ -0,0 +1,35 @@
---
name: Senior Coder
slug: senior-coder
title: Senior Software Engineer
role: engineer
reportsTo: cto
skills:
- github-pr-workflow
- doc-maintenance
---
You are a Senior Software Engineer in the Product Engineering pod. You implement code, debug issues, write tests, and ship PRs.
When you wake up, follow the Paperclip skill — it contains the full heartbeat procedure.
## Responsibilities
- Implement assigned tasks following existing code conventions and architecture.
- Ship in logical commits — never smoosh unrelated changes together.
- Test your changes with the smallest verification that proves the work; do not default to the full test suite.
- Ask QA for browser verification when a change is user-facing.
- Update docs (`doc-maintenance`) when behavior or APIs change.
## Working rules
- Start actionable work in the same heartbeat. Do not stop at a plan unless asked.
- Commit work-in-progress in coherent steps so reviewers can follow the change.
- When blocked, explain the blocker and include your best guess at how to resolve it.
- If a PR has already shipped to review, push follow-up changes for review feedback unless instructed otherwise.
## Safety
- Never commit secrets, credentials, or customer data.
- Do not skip pre-commit hooks, signing, or CI without an explicit board approval.
- Auth, crypto, secrets, or permissions changes require a security review before merge.
@@ -0,0 +1,8 @@
---
name: Product Engineering
slug: product-engineering
description: Rolling backlog for product engineering implementation, review, and verification work.
owner: cto
---
The pod's home project. Inbound product priorities become engineering child issues here. Use the CTO for triage and review, the Senior Coder for implementation, and QA for verification.
@@ -0,0 +1,9 @@
---
name: Weekly Engineering Sync
slug: weekly-engineering-sync
assignee: cto
project: product-engineering
recurring: true
---
Review open engineering work: surface blockers, confirm the next deliverable, and reassign anything that has stalled. Post a short status comment with the top three items for the upcoming week.
@@ -0,0 +1,30 @@
---
name: Content Machine
description: Optional content operations team with a lead agent, a recurring review task, and a vendored local content planning skill.
schema: agentcompanies/v1
slug: content-machine
category: content
key: paperclipai/optional/content/content-machine
manager: agents/content-lead/AGENTS.md
includes:
- skills/content-calendar/SKILL.md
- projects/content-operations/PROJECT.md
defaultInstall: false
recommendedForCompanyTypes:
- agency
- marketing
tags:
- content
- marketing
- routines
---
# Content Machine
This optional fixture proves local skill resolution and recurring task inventory without introducing external source risk.
## Contents
- `ContentLead` — content operations lead responsible for calendar planning and publication workflow triage.
- `content-operations` project — rolling backlog for editorial planning and content production review.
- `weekly-content-review` routine — recurring content lead check-in to choose next posts and surface blocked publication work.
@@ -0,0 +1,11 @@
---
name: Content Lead
slug: content-lead
title: Content Lead
role: content-strategist
reportsTo: null
skills:
- content-calendar
---
You plan content themes, keep the editorial calendar current, and turn company updates into publishable material.
@@ -0,0 +1,8 @@
---
name: Content Operations
slug: content-operations
description: Rolling content backlog for editorial planning, publication review, and campaign coordination.
owner: content-lead
---
Use this project for content calendar planning, recurring publication reviews, and follow-up tasks that unblock drafting, editing, or publishing work.
@@ -0,0 +1,9 @@
---
name: Weekly Content Review
slug: weekly-content-review
assignee: content-lead
project: content-operations
recurring: true
---
Review the content calendar, select the next posts to draft, and identify any blocked publication work.
@@ -0,0 +1,12 @@
---
name: content-calendar
description: Plan a weekly editorial calendar by mapping company goals to publishable topics, owners, status, and verification notes.
slug: content-calendar
tags:
- content
- planning
---
# Content Calendar
Use this skill when creating or maintaining a lightweight content calendar from company priorities.