Skill by skill
What each one actually does
CoSscheduled-intent + on-demand
daily-brief — the 5-3-2-1
Twice a day the Chief of Staff metabolises the signal backlog into a single
compact brief: 5 risks · 3 decisions needed · 2 customer signals · 1 fire,
plus a recommended focus block. It writes a briefs row and sends Charlie a Teams DM.
(Recurring 07:00 / 17:00 cadence is the declared intent; on-demand today.)
Readssignals, pod_intel, customer_health, open risks_issues_blockers
Writesbriefs (via the BriefIn write-view), sets delivered_to_loop when posted to Loop
Schedule (intent)cron 07:00 (slot=morning) & 17:00 (slot=evening), weekdays — evening is a valid brief_slot value (enum is {morning, afternoon, adhoc, evening}; ISS-13 resolved). Live recurring timer not yet enabled.
SACoSgated
decision-capture — the ledger gate
One skill, two branches. Technical decisions become ADRs and must pass an
adversarial Reviewer and — if they touch a regulated surface — a Compliance Checker, before Charlie
ratifies. Engagement decisions are narrative-only in decisions with no ADR.
draft→
reviewer→
reviewed→
compliance→
Charlie ack→
ratified
These stages are now DB-backed on adrs.review_stage (CHECK-constrained
{draft, reviewed, compliance-checked, ratified}), advanced through the CAS-guarded
sp_advance_adr_stage SP — distinct from adrs.status
({proposed, accepted, superseded, rejected}). Reviewer + Compliance are still enforced by the
skill and audited by the Steward (ISS-19 resolved).
Deduphash on (normalized_text, class, 7d_window) — re-runs Reviewer only on text change
ADO linkif related_ado_ids set, queues a write-back at pending_approval for Charlie sign-off (never auto-writes)
Fail-safeReviewer / Compliance unavailable → block at current state, surface to Charlie, never advance
CoSscheduled-intent + on-demand
ado-bulk-triage — the Friday sweep
A weekly pass over the Azure DevOps backlog. It summarises the state of the board,
drafts nudges to work-item owners (phrased through outbound-voice), and enqueues
recommended state changes at pending_approval on the write-back queue. Charlie's approval
flips a row to queued, and the ado-scribe drainer (built Batch 2) then applies it
to ADO. Recurring Friday cadence is the declared intent; on-demand today.
Targetthe configured azure_devops MCP project — the single source of truth for org/project/area path (ISS-05, resolved). Pointer is environment config; currently smccormick0886/Haleon-AIAQ.
Enqueue pathwrites ado_writeback_queue rows at pending_approval via AdoWritebackIn
GateDB-backed: ado-scribe only consumes queued, never pending_approval
CoSbuilt · on-demand
ado-scribe — the lease-guarded drainer
The drain half of the enqueue-then-drain ADO write-back pattern. One tick: acquire
drainer_lease (single-holder mutex; renew at TTL/2; abort immediately on lost re-acquire),
reconcile stale in_flight against ADO (idempotency-marker check), reclassify failed
rows (transient → re-queue capped at MAX_ATTEMPTS=5; permanent → dead-letter; rescue via
sp_reset_ado_writeback), select queued with per-target serialisation, claim
queued → in_flight → committed/failed via CAS-guarded sp_update_ado_writeback.
ConcurrencyCAS predicate on every UPDATE (lost race = no-row = silent skip); the lease + CAS together are the drainer's only concurrency backstop (FOR UPDATE SKIP LOCKED is unreachable through DAB)
Idempotencyinvisible <!-- idk:KEY --> marker required on every op (not just add-comment) so the reconciler can prove our identity authored the change
Schedule (intent)15-min cadence as core-tick step 4; live cadence deferred to Charlie's posture call (ISS-10)
CoSbuilt · on-demand
ring-tick — the recurring cadence (staged)
Two independently-abortable jobs sharing a 15-min timer but holding separate leases and
failure domains. core-tick (Job A, 15-min, on tick_lease): bounded
and mechanical — health-check, ado-scribe drain, rolling-2-day cost_telemetry rollup,
all level-triggered with no catch-up. scout-sweep (Job B, 2h, on
scout_lease, fired after core-tick releases — never nested): caged behind
the programmatic 3-greens gate, dual cost circuit-breakers (per-UTC-day OR rolling-24h), 1-child spawn ceiling,
watermark-bounded scans, 5-min wall-clock budget. Live recurring schedule OFF pending Charlie's posture call.
3-greens gateJob-B step 0: sp_check_scout_enabled() reads scout_enable_flags; sweep aborts if any of cost_breaker_live / drain_proven / scout_proven is FALSE
Leasesthree independent: tick_lease (A), drainer_lease (under A), scout_lease (B) — no shared mutex
Cost breakernominal baseline $50/day, band ±20% → $60/day (Charlie, 30 May; starting guess to tune by observation — no hard budget exists for this engagement)
CoSSAsub-skill
outbound-voice — the recipient-aware layer
Not usually triggered directly. Other skills call it whenever a human will read the text —
a ratification ask, an ADO comment, a customer reply — and it calibrates formality, directness, warmth
and channel to the specific recipient so the draft sounds like Charlie, not like an assistant.
Called bydecision-capture, daily-brief, ado-bulk-triage, ring-tick (cost-breaker alerts)
Privacynever embeds private M365 detail into outbound text; summarise + cite by id
StewardOperatorgeneric ceremony
bootstrap-roles & rotate-role — keeping the ring alive (workflow-agnostic)
Bootstrap spawns the long-lived roles for any workflow named under
~/.copilot/m-workflows/<name>/workflow.json (haleon: CoS/SA/Steward, DAB-backed
audit; loom: Architect/Steward, plan_md_only). Rotate runs the rotation ceremony with the
five hardened invariants baked in: rotator spawns the successor (D1/D2/D6), no boot-turn race
(D3 — await ## Context health ack before releasing with keepPendingTurn:false),
no orphan-turn race (D4 — status-probe re-adopt before the readiness smoke-test), address by
sessionId from spawn until close (D8), and a privacy-safe ZOMBIE path (D5 — cold-spawn
+ archive default; transcript-synthesis or delete:true requires Charlie ack). Step 9b writes the
audit chain detail-row-first: rotation_log / agent_snapshots rows first, then
the agent_runs spine carries detail_ref at INSERT (HS-4). Old loom-specific
bootstrap-clawpilot-roles / rotate-clawpilot-role remain as deprecated forwarding shims.
utility
cowork — Playwright bridge to the M365 Cowork agent
A general-purpose utility skill, not part of the ring-coordination set. Sends a prompt to
Charlie's pinned M365 Cowork agent over Playwright and returns Cowork's reply verbatim. First invocation in
a session starts a fresh Cowork task; subsequent invocations continue it (pass --new to force
a new task).