Crew shared model

Identity & policy

Each operator is a principal with workload identity and short-lived brokered credentials.
Actions are deny-by-default RBAC on hobo:* control-plane verbs.
Mandatory org policy is a deny ceiling — operators cannot widen what policy denies.
Credential audit answers: what did this operator access, with which token, when?

Family	Use
`crew.*`	Roster-level: dispatched, proposed, applied/denied, handoff
`run.*`	Durable agent run lifecycle
Domain families	`incident.`, `pipeline.`, `deployment.`, `gen.`, …

No per-agent event silos. Remediation facts stay on domain streams.

Concern	Default	Optional swap
SRE reasoning	Built-in	HolmesGPT adapter
Runbooks	Pipelines engine	StackStorm-class engines
Coding	Built-in / configured coding agent	External coding engine port
UI generation	`ui-render` adapters	OpenUI / json-render / mcp-apps
Cost advice	Built-in FinX projections	External recommender port

Swapping an engine is per-Yard config; the deterministic core (events, gates, RBAC) stays.

Observe signal (projection, alert, burn, drift, gate fail).
Dispatch operator (crew.AgentDispatched).
Propose action + blast radius (crew.ActionProposed).
Policy decides (policy.Decided) → apply or deny (crew.ActionApplied / ActionDenied).
Escalate via crew.HandoffRequested (agent→agent or agent→human / A2H).

Crew drives:

issue-tracker — JIRA / GitHub Issues / Linear
knowledge — Confluence / Obsidian / Wikis (runbooks, postmortems-by-replay)

Writes ride crew.ActionApplied + policy.Decided.

Jailbreak/PII-laden prompts → guardrail.Blocked + policy.Decided, replayable. Operators stay sandboxed under AI governance.