guild

Self-maintenance — static security audit of installed Guild scripts (SHA-256 hashes, network/filesystem flags) + the static boundary-check section. Read-only static analysis. Dispatches to guild:audit.

Development — context-assemble + dispatch lanes. Backend (agent_mode/tmux) is resolved once at intake via the run-start preflight snapshot — not selected per-phase. Snapshot effective.agent_mode drives lane dispatch (team / agent / subagent).

Manage the project config surface .guild/settings.json — the single JSON file holding every Guild option (rigor, review/adversarial, host, agent_mode/tmux dispatch ladder, auto-approve gates, loops, quality budgets, wiki, per-run role pins). `config init` (= `reconcile sync`) scaffolds it fully-documented and never-clobbers on re-run; `config reconcile check|sync|repair` reconciles `.guild/settings.json` against the typed config-schema SoT (provenance-aware, never overwrites user values, security keys fail closed); `config show` prints the resolved config; `config show --sources` annotates each key AND each phase-permission decision (host_mode/guild_gates/bypass) with its inheritance layer; `config show --render` renders the resolved config into each of the 16 registered host config shapes (fail-closed on local/secret leaks); `config set` performs a scoped hard-set write; `config role <host|advisory|adversarial> <host_id|null>` pins a per-run role to a registry host (scoped, provenance-stamped, never-clobber); `config ui list|get|sources|set` is the native CLI/agents-file settings render/edit surface — driven by CONFIG_UI_METADATA it lists config groups/keys/values/sources and edits any key, honoring the metadata's confirmation-strength (a danger/strongest key needs `--confirm`), routing every write through the config API; app/connector hosts report blocked; `config validate` / `config validate --effective` runs closed-key checks on the raw or post-inheritance resolved config; `config providers detect` probes available cross-review providers and prints a detection table; `config update-mcp-hashes` re-pins the SHA-256 MCP tool-description hashes (D-MCP). CLI flags always override settings.json (7-source precedence: builtin < workspace < workspace-local < project < project-local < rigor < CLI). Full schema: https://guildstack.dev/docs/configuration

Launch the local benchmark web dashboard over this project's runs + knowledge (runs table, knowledge-graph explorer, wiki browser). Resolves the benchmark checkout, serves on a free local port, bulk-imports the project's run logs, prints the URL. No network I/O without explicit confirmation (--install). Dispatches to guild:dashboard.

Self-maintenance — run the evolve pipeline on one skill/instance. --auto runs unattended (promotion gate still respected). Dispatches to guild:evolve-skill.

The on-demand `powerful` supervisor a stuck low-tier agent consults. Answers EXACTLY ONE escalated sub-question, seeing only the draft + question + a compact critique instruction — NEVER the raw file/project context (that withholding keeps the call cheap). Returns a `guild.handoff.v2` envelope; the cheap/mid agent continues with the answer folded in. The §3 advisor-escalation net (cost-aware-tiering ADR), NOT a standalone reviewer (O-1: no reviewer type ships). TRIGGER only via escalation: an agent emits `status: escalate` + `escalate_reason`, OR the coordinator detects an uncertainty marker / short output and routes one sub-question here. DO NOT TRIGGER for: a fresh task lane (developer/backend/frontend/mobile); a systems-design or ADR pass (architect designs, advisor critiques a slice); G6 receipt review (guild:review); the quality gate (guild:guild-quality); whole-transcript review or wholesale re-runs; direct use as a general critic. The advisor sees a draft + a question, never a repo.

The generic `mid`-tier task-lane implementer: takes a settled plan lane and writes/refactors its code (draft, reason, build), escalating to the advisor when above its tier. The default ephemeral worker for implementation lanes that are NOT domain-recognizable. TRIGGER for "implement this lane", "build this task", "write the code for X", "refactor this module" where the work has no clear domain home. DO NOT TRIGGER for: API/data-layer/migrations/integrations/queue/worker code (backend); web frontend (frontend); iOS/Android/RN/Expo (mobile); systems design, tradeoffs, ADRs (architect — developer implements after the design); test strategy / suite shape (qa — developer writes pinning tests only); deploy/CI/CD/IaC/observability (devops); security audits, threat models, auth review (security); content/commercial work (writing/commercial groups); skill/hook/command authoring — dev-team. If a lane is domain-recognizable, hand off, not absorb. A `powerful` need escalates to advisor, never self-promote.

The full guild:operations skill — the 5-runbook-class taxonomy with split autonomy posture, the 4 non-negotiable safety rails + mandatory pre-flight (machine-checkable as 5 booleans), ExecuteRunbook + the advisory G-operations trail, and the guild.release.v1 ↔ D8 close-gate three-leg field join (consume-only). TRIGGER for "run the runbook", "operations", "deploy/release runbook", "monitoring", "incident", "rollback", "maintenance", "ops". DO NOT TRIGGER for the quality gate / release readiness computation (guild:quality owns it), for authoring a runbook's content (devops-* specialists produce it), or for closing the initiative (InitiativeCloseout owns D8 closure — operations only supplies evidence).

Init-phase skill — onboard an existing repo or scaffold new-product knowledge; build the wiki and (brownfield) the cheap-scan CodebaseMap + a confidence-tagged architecture-map stub. The deep KnowledgeGraph + tour are lazy and gated, NOT produced at Init. Drives the /guild:init phase entrypoint.

The full guild:quality skill — deterministic SignalScan→SelectMatrix selection, RunChecks under sandbox + canonical budget, the advisory G-quality challenger trail, and the COMPUTED ReleaseGate predicate with the --auto-approve BLOCK-override asymmetry. TRIGGER for "run quality", "quality gate", "release readiness", "should we release", "run the checks", "quality selection", "release gate". DO NOT TRIGGER for operations/runbooks (guild:operations owns release/monitoring/incident/rollback/maintenance), for authoring or installing a test framework (qa-* specialists own that), or for the D8 initiative close-gate (InitiativeCloseout owns closure).

Guild's five operating principles — Think-before-doing, Simplicity-first, Surgical-changes, Goal-driven-execution, Evidence-over-claims — loaded as the mandatory prelude for every Guild specialist (engineering, writing, or commercial). The first four are Karpathy's 4; the fifth is Guild's addition. Includes per-group adaptations so a copywriter, a backend engineer, and an SEO specialist each read the rules in their own idiom. TRIGGER when a user or specialist asks "what are Guild's principles", "what's the specialist prelude", "how should I adapt these principles for a copywriter / marketer / engineer", "what does surgical changes mean for a technical writer", "remind me of the Karpathy 4 plus evidence rule", or any variant — including single-principle lookups scoped to a specific role. DO NOT TRIGGER for trivial one-off tasks (typo fixes, branch pushes, single-line renames) where a principles review is overkill, or for generic LLM-ethics / alignment questions unrelated to Guild.

Change/blast-radius analyser — the learn-* family member that produces the per-run DiffUnderstanding (guild.diff_understanding.v1): which graph nodes/layers a base→head diff touches, and which changed files no node explains (untraced). Feeds P2 plan-impact (guild:plan) and the P3 scope-check (guild:verify-done). TRIGGER for "analyse this diff", "what does this change affect", "blast radius of this PR", "learn diff", "plan-impact for this change", "which layers does this touch". DO NOT TRIGGER for: the cheap-scan map (guild:learn-map), the deep graph (guild:learn-graph), tour narration (guild:learn-onboard), file/module explanation (guild:learn-explain), or generic git diffing without graph grounding.

23 hooks across 10 events