feat: production-hardening Track A/B (Phases 0–8, 9 except live spend)

.archive/README.md

@@ -0,0 +1,23 @@
+# Archive
+
+Kept in the working tree on purpose. Git history is not a substitute for
+opening these files while reading the demos and backend-migration docs.
+
+**Retention:** do not delete this directory. `.gitignore` lists `.archive/` so
+*new* debris (`compare-debug/`, screenshot dumps) stays untracked; the paths
+below stay in git. Local-only files (phase plans, drafts) may also sit here —
+they are not deleted by this spec.
+
+## Tracked survivors
+
+| Path | Why it stays |
+| --- | --- |
+| `demos-removed-2026-06-28/01_hello_world/` | Retired demo 01; cited from `docs/DEMOS.md` |
+| `demos-removed-2026-06-28/03_data_pipeline/` | Retired demo 03 |
+| `demos-removed-2026-06-28/04_ml_api/` | Retired demo 04 |
+| `docs/DATA_INTEGRITY_FIXES.md` | Historical integrity notes |
+| `docs/claude-agent-sdk/CLAUDE_AGENT_SDK_PLAN.md` | SDK adoption plan (PROMPT 7 / AgentCore thread) |
+| `docs/langgraph/LANGGRAPH_MIGRATION_PLAN.md` | LangGraph migration plan |
+| `docs/ui-ux/UI_UX_IMPROVEMENT_PLAN*.md` | Pre-dashboard UI plans |
+
+Do not add new product docs here — use `docs/` or `.kiro/specs/`.

.cursor/rules/agent-roles-and-routing.mdc

@@ -1,6 +1,6 @@
 ---
 description: Agent roles and flow routing reference
-globs: ["src/ai_team/crews/**/*.py", "src/ai_team/flows/**/*.py"]
+globs: ["src/ai_team/backends/crewai_backend/crews/**/*.py", "src/ai_team/backends/crewai_backend/flows/**/*.py"]
 alwaysApply: false
 ---
 

.cursor/rules/ai-team-core.mdc

@@ -23,7 +23,9 @@ This is a portfolio-grade capstone project. All code must be production-quality,
 
 ## Project Structure (abbreviated)
 
-- `src/ai_team/` — config (settings, agents.yaml, tasks.yaml), agents/, crews/, flows/, tools/, guardrails/, memory/, models/, utils/
+- `src/ai_team/` — config, harness, tools, guardrails, memory, models, backends (`crewai_backend` holds agents/crews/tasks/flows)
 - `tests/` — unit/, integration/, e2e/, performance/, fixtures/
 - `src/ai_team/ui/` — FastAPI + Vite web dashboard (`ai-team-web`), Textual TUI (`ai-team-tui`), shared API client
 - `docs/`, `scripts/`, `demos/`, `docker/`, `.github/`
+- `.kiro/specs/<id>/` — Kiro-style specs (`README` → `requirements` → `design` →
+  `tasks`). `tasks.md` is a living checklist; see the `kiro-specs` rule.

.cursor/rules/crewai-agents-crews-flows.mdc

@@ -1,6 +1,6 @@
 ---
 description: CrewAI agent, crew, and flow patterns
-globs: ["src/ai_team/agents/**/*.py", "src/ai_team/crews/**/*.py", "src/ai_team/flows/**/*.py"]
+globs: ["src/ai_team/backends/crewai_backend/agents/**/*.py", "src/ai_team/backends/crewai_backend/crews/**/*.py", "src/ai_team/backends/crewai_backend/flows/**/*.py"]
 alwaysApply: false
 ---
 
@@ -9,7 +9,7 @@ alwaysApply: false
 Agents: YAML config (agents.yaml) + Python class extending BaseAgent. Use `role_name` (maps to YAML key), `create()` → `load_yaml_config()`, `get_ollama_llm()`, return `Agent(...)`.
 
 ```python
-from ai_team.agents.base import BaseAgent
+from ai_team.backends.crewai_backend.agents.base import BaseAgent
 
 class ArchitectAgent(BaseAgent):
     """Solutions Architect agent for system design."""

.cursor/rules/crewai-tools.mdc

@@ -4,6 +4,9 @@ globs: "src/ai_team/tools/**/*.py"
 alwaysApply: false
 ---
 
+CrewAI agents, crews, tasks, and flows live under `src/ai_team/backends/crewai_backend/`.
+Tools stay in `src/ai_team/tools/`.
+
 # Tool Definition Pattern
 
 - Use `@tool("Display Name")`; docstring with Args and Returns

.cursor/rules/github-ci.mdc

@@ -0,0 +1,28 @@
+---
+description: How to start and watch GitHub Actions without hanging on gh or MCP auth
+alwaysApply: true
+---
+
+# GitHub CI
+
+`.github/workflows/ci.yml` runs on **push to `main`/`develop`** and **pull_request into those**. A feature-branch push is a no-op until a PR exists.
+
+## Watch CI on the public site
+
+Do **not** block on `gh auth login` or GitHub MCP `mcp_auth` (that prompt has hung this repo). Git push already works over HTTPS.
+
+Monitor with unauthenticated HTTP:
+
+- Actions: https://github.com/RickZee/ai-team/actions
+- Branch runs: https://github.com/RickZee/ai-team/actions?query=branch%3Afeature%2Fphase-harness-alignment
+- API: `https://api.github.com/repos/RickZee/ai-team/actions/runs?branch=<branch>`
+- Releases: https://github.com/RickZee/ai-team/releases
+- Compare / open PR: https://github.com/RickZee/ai-team/compare/main...<branch>
+
+`gh run view` is optional when `gh` is already authenticated.
+
+## After a push that should run CI
+
+1. Confirm a PR into `main` or `develop` exists (or open one via the compare URL / git credentials).
+2. Poll the public Actions API or page until jobs complete.
+3. If red, follow `.cursor/skills/fix-ci/SKILL.md` from the failed job name.

.cursor/rules/how-to-add-features.mdc

@@ -6,7 +6,7 @@ alwaysApply: true
 # When creating a new agent
 
 1. Add YAML config to `config/agents.yaml` (role, goal, backstory, verbose, memory, allow_delegation, max_iter)
-2. Create Python class in `agents/` extending `BaseAgent`
+2. Create Python class in `src/ai_team/backends/crewai_backend/agents/` extending `BaseAgent`
 3. Define tools as `@tool` in `tools/`
 4. Add model in `config/settings.py` `OllamaModelConfig`
 5. Register in the appropriate crew's agent list
@@ -32,8 +32,8 @@ alwaysApply: true
 
 # When creating a new crew
 
-1. Create in `src/ai_team/crews/` with `kickoff()` method
-2. Define tasks in tasks/ (YAML + Python)
+1. Create in `src/ai_team/backends/crewai_backend/crews/` with `kickoff()` method
+2. Define tasks in `src/ai_team/config/tasks.yaml` and `src/ai_team/backends/crewai_backend/tasks/`
 3. Set process (hierarchical or sequential)
 4. Configure memory, planning, verbose
 5. Add context dependencies between tasks
@@ -42,7 +42,7 @@ alwaysApply: true
 
 # When adding to the flow
 
-1. Add `@listen` to `AITeamFlow` in `flows/main_flow.py`
+1. Add `@listen` to `AITeamFlow` in `src/ai_team/backends/crewai_backend/flows/main_flow.py`
 2. Add `@router` for branching if needed
 3. Update `ProjectState` if needed
 4. Add phase to `ProjectPhase` enum if new

.cursor/rules/kiro-specs.mdc

@@ -0,0 +1,45 @@
+---
+description: How to execute and update Kiro-style specs under .kiro/specs/
+alwaysApply: true
+---
+
+# Kiro-style specs
+
+Specs live at `.kiro/specs/<id>/` as four files. Read **in order**: `README.md` →
+`requirements.md` → `design.md` → `tasks.md`. Do not implement from memory of an
+older spec.
+
+## `tasks.md` is a living checklist
+
+It is not a read-only brief. After each task whose **Definition of done** is
+literally true:
+
+1. Flip `- [ ]` to `- [x]` in that file in the same sitting (same commit if you
+   are already committing).
+2. Leave **human-triggered / live-spend / budget-capped** tasks unchecked.
+3. If you batched work, still update every completed box before you stop. An
+   all-empty checklist after a landed implementation is a process bug.
+
+Do **not** check a box because the code exists. Check it because each DoD
+bullet is true (tests, fixtures, journal note, flag default, etc.).
+
+## How to execute
+
+- Prefer **one task at a time**, in order. The spec's Cursor prompt shape is the
+  default: implement N.M, run the listed quality commands, stop.
+- When the user says "implement this spec", do every in-repo task; skip only
+  tasks marked human-triggered spend unless they explicitly approve spend.
+- New behavior on a normal run ships **off by default** until the spec says it
+  earned its place.
+- Record suite/CI failures in a journal entry (what failed, why, the fix). Do
+  not bury that trail only in chat.
+- Watch GitHub Actions on the **public** repo pages/API (see
+  `.cursor/rules/github-ci.mdc`). Do not hang on `gh auth` or GitHub MCP
+  `mcp_auth`. Feature-branch pushes do not run CI until a PR targets
+  `main`/`develop`.
+
+## Do not
+
+- Invent a fifth spec document or rewrite requirements/design unless asked.
+- Treat "I built it" as "the checklist can stay empty".
+- Enable a billed eval, live arm, or `--execute` sweep from an agent session.

.cursor/rules/models-and-state.mdc

@@ -1,6 +1,6 @@
 ---
 description: Pydantic output and flow state models reference
-globs: ["src/ai_team/models/**/*.py", "src/ai_team/flows/state.py"]
+globs: ["src/ai_team/models/**/*.py", "src/ai_team/backends/crewai_backend/flows/state.py"]
 alwaysApply: false
 ---
 
@@ -13,7 +13,7 @@ alwaysApply: false
 - **DeploymentConfig**: dockerfile, docker_compose, ci_pipeline, environment_variables, infrastructure
 - **ProjectReport**: project_id, project_name, status, files, test_results, summary, duration
 
-# Flow State (src/ai_team/flows/state.py)
+# Flow State (src/ai_team/backends/crewai_backend/flows/state.py)
 
 **ProjectState**: project_id, project_description, current_phase, requirements, architecture, generated_files, test_results, deployment_config, phase_history, errors, retry_counts, max_retries, started_at, completed_at, metadata
 

.cursor/rules/pydantic-and-errors.mdc

@@ -9,11 +9,11 @@ alwaysApply: false
 - Use Pydantic v2 `BaseModel`; `Field(description=...)` for all fields
 - Validators: `@field_validator` or `@model_validator`; `model_config` with `json_schema_extra` where helpful
 - Settings: `pydantic_settings.BaseSettings` with `SettingsConfigDict`
-- Output models: `src/ai_team/models/outputs.py`; state models: `src/ai_team/flows/state.py`
+- Output models: `src/ai_team/models/outputs.py`; state models: `src/ai_team/backends/crewai_backend/flows/state.py`
 
 # Error Handling
 
-- Custom exceptions in `src/ai_team/utils/exceptions.py`: `AITeamError` → `AgentError`, `ToolError`, `GuardrailError`, `FlowError`
+- Custom exceptions live next to the code that raises them; never use a catch-all ``utils.exceptions`` module.
 - Never use bare `except:`; catch specific exceptions
 - Use `tenacity` for retry with exponential backoff
 - Log errors with structlog including context (agent, tool, phase)

.cursor/rules/quality-pitfalls-and-deps.mdc

@@ -36,3 +36,6 @@ Guardrail <100ms; guardrail overhead <10% of task time; memory op <50ms
 - **Commits**: Conventional Commits — `feat(scope):`, `fix(scope):`, `test(scope):`, `docs(scope):`
 - **PR**: one phase or one feature per PR
 - **Checks**: ruff, mypy, pytest (unit), pytest (integration)
+- **CI**: watch https://github.com/RickZee/ai-team/actions (public). Do not hang
+  on `gh auth` or GitHub MCP `mcp_auth`. Feature-branch push is a no-op until a
+  PR targets `main`/`develop`.

.cursor/skills/fix-ci/SKILL.md

@@ -17,7 +17,11 @@ For **pip-audit / bandit** only, same skill.
 
 ## 0. Systematic triage (start here)
 
-1. Open the [failed run](https://github.com/RickZee/ai-team/actions) → note **which job** is red (ignore **cancelled** matrix legs).
+1. Open the public [Actions](https://github.com/RickZee/ai-team/actions) page (or
+   `https://api.github.com/repos/RickZee/ai-team/actions/runs?branch=<branch>`).
+   Do **not** hang on `gh auth login` or GitHub MCP `mcp_auth`. Note **which job**
+   is red (ignore **cancelled** matrix legs). Feature-branch pushes do not run CI
+   until a PR targets `main`/`develop`.
 2. Map the job to a local command (table in §1).
 3. Reproduce locally. Prefer `./scripts/ci_check.sh --matrix` before push to main (lint + 3.12 cov + 3.11 + security).
 4. Fix root cause — do not lower coverage threshold or skip tests without evidence.

.dockerignore

@@ -22,6 +22,13 @@ htmlcov
 venv
 .venv
 env
+.coverage-data
+
+# Frontend (built in the Node stage)
+**/node_modules
+**/dist
+src/ai_team/ui/web/frontend/node_modules
+src/ai_team/ui/web/frontend/dist
 
 # IDE and editor
 .idea
@@ -30,18 +37,14 @@ env
 *.swp
 *.swo
 
-# Docs and dev (not needed in image)
+# Docs and dev
 docs
 *.md
 !README.md
 
-# Tests (not needed in runtime image)
+# Tests
 tests
 
-# Demos and scripts (optional; include if app needs them)
-# demos
-# scripts
-
 # Local env and secrets
 .env
 .env.*
@@ -52,8 +55,10 @@ Dockerfile
 docker-compose*.yml
 .dockerignore
 
-# Output (mounted at runtime)
+# Runtime mounts / generated
 output
+workspace
+logs
 
 # OS
 .DS_Store

.env.example

@@ -25,3 +25,8 @@ AI_TEAM_ENV=dev
 # AI_TEAM_USE_REAL_LLM=1          # Live OpenRouter in integration/evals
 # AI_TEAM_TEST_MEMORY=1           # Live memory/embedder integration tests
 # AI_TEAM_EVAL_BUDGET_USD=5.00    # Live eval suite hard ceiling (Tier B/C); Tier A is $0
+# AI_TEAM_WEB_TOKEN=          # Shared control-plane token. Required to bind 0.0.0.0.
+# AI_TEAM_CORS_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
+# AI_TEAM_SESSION_LOOP=1      # Dormant multi-session continuation (off by default)
+# AI_TEAM_MAX_SESSIONS=3      # Used only when AI_TEAM_SESSION_LOOP=1
+

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @RickZee

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,13 @@
+---
+name: Bug report
+about: Something is wrong
+labels: bug
+---
+
+**What happened**
+
+**What you expected**
+
+**How to reproduce** (offline if possible)
+
+**Backend** (crewai / langgraph / claude-agent-sdk / n/a)

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,5 @@
+*What changed, and why it matters.*
+
+* [ ] Unit tests (`uv run pytest tests/unit`)
+* [ ] Frontend (`npm test` / `npm run lint`) if UI changed
+* [ ] No live model calls unless the PR says so