From add98a9451afe47e5ed6e0f41f335fae38b7668a Mon Sep 17 00:00:00 2001
From: Brandon McAnsh <git@bmcreations.dev>
Date: Wed, 30 Sep 2026 15:17:54 -0400
Subject: [PATCH] chore(agent-team): add the agent-team config with a red-team
 reviewer

Blocks keystores, signing keys, local.properties, google-services.json
and .env files from reaching member CLIs.
---
 .claude/agent-team.json | 70 +++++++++++++++++++++++++++++++++++++++++
 .gitignore              |  3 ++
 2 files changed, 73 insertions(+)
 create mode 100644 .claude/agent-team.json

diff --git a/.claude/agent-team.json b/.claude/agent-team.json
new file mode 100644
index 0000000000..e9e939c6bb
--- /dev/null
+++ b/.claude/agent-team.json
@@ -0,0 +1,70 @@
+{
+  "members": {
+    "orchestrator": {
+      "agent": "claude",
+      "model": "claude-opus-5-5",
+      "effort": "high",
+      "advisor": "fable",
+      "charter": "Break an objective into scoped tasks for your reports, then combine their results into one decision. Does not implement.",
+      "isolation": "read-only",
+      "deliverable": "decision"
+    },
+    "explorer": {
+      "agent": "claude",
+      "model": "sonnet",
+      "effort": "medium",
+      "advisor": "fable",
+      "reports_to": "orchestrator",
+      "charter": "Locate code and report it as path:line. Never edits.",
+      "isolation": "read-only",
+      "deliverable": "document"
+    },
+    "worker": {
+      "agent": "claude",
+      "model": "sonnet",
+      "effort": "medium",
+      "advisor": "fable",
+      "reports_to": "orchestrator",
+      "charter": "Make one scoped change and run the narrowest check that proves it.",
+      "isolation": "workspace",
+      "deliverable": "diff"
+    },
+    "researcher": {
+      "agent": "claude",
+      "model": "sonnet",
+      "effort": "medium",
+      "advisor": "fable",
+      "reports_to": "orchestrator",
+      "charter": "Answer from outside sources, with a cited URL next to each claim.",
+      "isolation": "none",
+      "deliverable": "document"
+    },
+    "reviewer": {
+      "agent": "claude",
+      "model": "claude-opus-5-5",
+      "effort": "high",
+      "advisor": "fable",
+      "reports_to": "orchestrator",
+      "skill": "red-team",
+      "charter": "Red-team the worker's diff before it is accepted: find what will fail undiscovered, then write a self-contained handoff. Never edits.",
+      "isolation": "read-only",
+      "deliverable": "review"
+    }
+  },
+  "deny_paths": [
+    "contributors.keystore",
+    "**/*.keystore",
+    "**/*.jks",
+    "**/*.p8",
+    "**/*.p12",
+    "**/*.pem",
+    "**/local.properties",
+    "**/google-services.json",
+    "**/.env*"
+  ],
+  "defaults": {
+    "on_unavailable": "claude",
+    "max_depth": 1,
+    "max_delegations": 12
+  }
+}
diff --git a/.gitignore b/.gitignore
index 1bc9b1800a..48ac7375f8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,3 +48,6 @@ docs/superpowers/
 # Raw spike capture: full device logcat, so it can carry unrelated personal
 # content. Keep the summarised results, not the source logs.
 docs/spikes/raw/
+
+# agent-team
+.claude/workspaces/