Version: 1.0.0 Effective: 2026-07-16 Tool-agnostic: this file is the single source of truth for any AI coding tool (Claude Code, Codex, Antigravity, Cursor, or a human). No syntax here is specific to one tool.
Airo ships code from multiple AI tools working in parallel. This council gives every module a named owner and every category of change a required set of reviewers, so correctness is enforced by the repository's structure rather than by which tool happened to write the code. See AGENT_POLICY.md for the lifecycle (Critical Agent gate, contract draft, etc.) this council's roles plug into.
Design rationale: docs/superpowers/specs/2026-07-16-engineering-council-design.md.
Airo is a super-app with sub-apps. Governance has two layers:
- Super-App Chiefs — cross-cutting, own no single package, required reviewers within their lane across every sub-app.
- Sub-App Domain Agents — one roster per sub-app, each owning real packages.
CEO is a human role (vision, budget, roadmap, final say) — not modeled as an agent, and does not review implementation, libraries, or code quality.
Owns: module boundaries, package ownership, APIs, dependency graph, ADRs. Approves: new packages, cross-package contracts, folder structure changes. Rejects: circular dependencies, layer violations, ownership-boundary violations. Default owner for any package not yet assigned below.
Owns: secrets, authentication, encryption, dependency/license risk, privacy.
Required reviewer for: core_auth, core_entitlements, core_device_identity,
core_device_merge, any new dependency, any unsafe Rust.
Owns: CPU, memory, GPU, startup time, frame time, binary size, battery, network, disk. Required reviewer for every Rust change and every new dependency.
Owns: test strategy — unit, integration, golden, E2E, TV, accessibility, regression. Required reviewer for any user-visible change and any new provider/adapter.
Owns: navigation, interaction consistency, accessibility, design system,
motion. Required reviewer for TV navigation/focus/remote-handling changes and
any core_ui change.
Owns: docs, ADRs, migration notes, examples, API docs. Nothing merges without
matching documentation (existing scripts/check-docs-completeness.sh already
enforces a version of this).
Owns: dependency scoring — license, maintenance, security, binary impact,
bus factor. Required reviewer for every new dependency in any package.
(platform_dependency_governance, its former primary-owned package, was
deleted as an orphan leaf with zero consumers — #1676.)
Owns: CI, build/release workflows, versioning, branching, signing, artifacts.
Maps to the existing "Release and DevEx Agent" in AGENT_POLICY.md.
Owns: Firebase/GCP/AWS, sync, auth backend, monitoring. Primary owner of
core_cloud_orchestration, core_auth, core_entitlements, core_sessions,
core_device_merge — auth flow, entitlement checks, and session lifecycle.
Chief Security Officer is a required reviewer on these, not the owner.
Owns: business value, feature completeness, roadmap alignment, product_capabilities.
Required reviewer for every new end-user feature. Does not review
implementation detail — that's the domain agent's job.
| Role | Owns (real packages) | Approves | Rejects |
|---|---|---|---|
| Flutter Architect | core_ui, app/, template_feature |
Riverpod usage, widget structure, navigation, design-system packages | New state-management patterns that bypass Riverpod, ad-hoc design tokens (a raw fontSize/Color(0x..)/EdgeInsets.all() instead of AiroTypography/AiroColors/AiroSpacing, or a flavor-local ThemeData instead of core_ui's AiroTheme/AiroDisplayScale/AiroDomainTheme) |
| Rust Architect | rust/, core_workers |
unsafe, SIMD, Tokio/Rayon usage, FFI boundary shape |
Unreviewed unsafe, blocking calls on async runtimes |
| Playback Architect | platform_player, platform_streams, platform_media, core_media_routing |
Decoder/renderer changes, DRM, subtitle/audio pipeline | Changes that bypass the media routing contract |
| Media Intelligence Architect | platform_epg, feature_iptv, platform_playlist, platform_playlist_export, platform_playlist_import, platform_favorites, platform_history |
Provider adapters, EPG parsing/normalization, ranking | Provider-specific hacks that leak into shared models |
| TV Experience Architect | core_remote_control, platform_receiver_modes |
Focus engine, remote input mapping, overscan handling | Focus traversal that breaks 10-foot navigation |
| Platform Architect | core_native, platform_channels, platform_calendar, core_device_identity, core_pairing, core_protocol, platform_device_profile, platform_device_qualification |
Native bridge/FFI shape, platform channel contracts | Direct native calls bypassing the channel contract |
| Edge Architect | core_orchestration_storage, core_watch_progress, core_presence |
Offline/caching/sync design, background workers | Sync logic duplicated outside these packages |
| Role | Owns | Notes |
|---|---|---|
| Coins / Finance Agent | feature_coin, platform_coin_vault, future platform_coin_* and coin plugin packages |
Airo Coin is package-first. packages/airomoney is retired; app/lib/features/coins is legacy super-app code to extract or delete, not a target for new behavior. |
| Anya / Nutrition Agent | feature_anya, feature_anya_core |
Standalone Anya diet/nutrition product (ShellId.anya). Package-first like Coins. Not a Mind chat plugin — feature_mind's draft-diet-plan addon stays a generative skill, not this product. |
| Framework Agent | core_ai, core_completion |
Runtime/model-routing (core_ai) and the shared on-device generate(prompt, {grammar}) seam (core_completion). Anya/Airovia bind via product shells, not by depending on feature_mind. |
| Meeting Intelligence Agent | (none yet) | Dormant — no packages exist for this sub-app yet |
Every real package (a directory with its own pubspec.yaml) now has a
packages/<name>/module.yaml, validated by
scripts/check-module-manifests.py in CI. packages/stubs/ is a container
of 21 independent third-party-compatibility shims, not itself a package (no
pubspec.yaml at its own root) — excluded from manifest coverage by design.
Packages assigned to Chief Architect as primary owner (no dedicated domain
fits): airo (super-app host/routing), airo_pro_bootstrap, core_data,
core_domain, core_media_data (data/benchmark
models, not decoder/DRM/subtitle logic — not a real Playback fit),
platform_worker_jobs (generic resource-scheduler contracts, no UI —
not a real Flutter fit). These stay Chief-Architect-owned until a future
pass finds a better-fitting domain, not because they're unimportant.
(core_experimentation was deleted as an orphan leaf with zero consumers
and no feature-flag call site anywhere in the repo — #1676.)
| Change | Required reviewers |
|---|---|
| Add/change Flutter package or widget | Flutter Architect + Chief Performance Officer + Chief Open Source Officer |
Add/change Rust crate or unsafe code |
Rust Architect + Chief Performance Officer + Chief Security Officer |
| Add/change a provider/source adapter | Media Intelligence Architect + Platform Architect + Chief QA Officer |
| Change playback pipeline (decoder, DRM, renderer) | Playback Architect + Chief Performance Officer + Chief Security Officer |
| Change TV navigation/focus/remote handling | TV Experience Architect + Flutter Architect + Chief UX Officer |
| Change architecture/module boundaries | Chief Architect + Platform Architect |
| Add a dependency (any package) | Owning domain agent + Chief Open Source Officer + Chief Security Officer |
| Change sync/offline/storage engine | Edge Architect + Chief Cloud Officer + Chief Performance Officer |
| New end-user feature | Product Manager + Chief Architect + Chief QA Officer |
| Release cut | Entire council |
One file per package, at packages/<name>/module.yaml. Enforced in CI by
scripts/check-module-manifests.py (name/pubspec match, valid roles,
allowed/forbidden dependencies vs. real pubspec path deps) — wired into
pr-checks.yml. Fields are omitted, never fabricated, when a value isn't
measured.
name: <package name, must match pubspec.yaml name>
owner: <one role from the roster above>
reviewers:
- <additional roles required for non-trivial changes, per Decision Matrix>
contracts:
- <versioned contract/IR name this package implements — omit if none yet>
allowed_dependencies:
- <packages or package groups this module may depend on>
forbidden_dependencies:
- <packages this module must never depend on>
quality_gates:
test_coverage: ">NN%" # omit fields with no measured baseline
status: <optional, one of pre-wired | tool-only | template — omit entirely
for the default, active (reachable from an app flavor's dependency
graph). "pre-wired": built ahead of the app flavor that will reach it
(#1675, #1677). "tool-only": intentionally never reachable — release
scripting, benchmarking. "template": a scaffold, not a real module.
`scripts/check-package-reachability.py` (#1681) treats any non-active
status as its own allowlist; a package outside the reachable graph with
no status set is a real gate failure, not a declaration gap.>Reference examples: packages/platform_epg/module.yaml,
packages/platform_player/module.yaml.
Before a release, each Chief and relevant domain agent records a pass/fail
against their lane (architecture, performance, security, QA, docs, product,
release). This is the same shape as AGENT_POLICY.md's existing "Release
Ready" gate — this council supplies the specific named reviewers for it.
- Claude Code: invoke a role via
.claude/agents/<role-slug>.md(thin files pointing back to this document's relevant section). - Codex: reviewed via the user's global
codex-delegatehook; cite the relevant section of this file in the review prompt when a change touches an owned package. - Any other tool: read
AGENTS.mdat the repo root, which points here.
- Agent Policy — lifecycle, gates, contracts
- Workflow — branches, validation, device choice, CI spend, PRs
- Design spec