v0.8.0 — External engines & guardrails

Added

• Grok as an agentic doer: cohort engine propose --agentic. The external engine
  now EXPLORES the repository read-only (list_dir/read_file/grep/find_files, each
  read egress-gated, the whole exploration recorded to an inspectable transcript) to
  gather its own multi-file context, then proposes a patch — instead of working from a
  Claude-packaged bundle. The trust boundary is unchanged: the proposed patch is parsed,
  re-gated (footprint + sensitive class + secret backstop), and applied only inside an
  isolated worktree by the same path the one-shot proposer uses. Grok writes real code
  that lands, coordinator-verified and PR-reviewed; it is never handed a write tool.

• /crew is the single orchestration command (renamed from /orchestrate), carrying
  the full protocol plus the cross-vendor doer rule: Claude subagents write directly,
  external engines only ever propose gated patches.

• External engines (RFC 0004): Grok, API-direct. /consult-grok brings xAI's
  Grok into the office as an advisory second opinion (a sibling of /consult-gpt), and
  cohort engine propose lets Grok act as a patch_proposal engine — Cohort, never the
  engine, parses its reply and applies it inside a throwaway git worktree behind
  code-enforced gates (egress opt-out block, fail-closed secret scan, footprint +
  sensitive-path denylist) and the unchanged human PR gate. Reached over the xAI HTTP API
  (stdlib urllib, GROK_API_KEY from the environment); the community grok-cli was
  rejected on security/privacy/procurement review (a 400-round agentic editor with no
  read-only mode conflicts with the untrusted-input invariant). Stdlib-only, no new deps.

• Orchestration gains a worker kickback (escalation from below). A non-Fable
  worker that judges a task genuinely beyond its tier returns it — with a specific
  reason — instead of shipping a plausible-but-uncertain attempt; the coordinator
  escalates a tier immediately (skipping the same-tier retry), or raises a
  Fable-suited one to the user. Complements the coordinator's top-down routing and
  signoff so a tier mismatch is caught before the attempt, not only after. Lives in
  fable-mode's scope gate, with an abuse guard (name the mismatch, never "too hard").

• Dashboard: project memories show their git state. A tracked / untracked /
  uncommitted / no git chip on project-memory cards, so "this instruction ships to
  everyone who clones" vs "local-only, no audit trail" reads at a glance. Batched git
  lookup (constant calls, not per-file) since the endpoint is polled. Informs, never
  gates (#182).

• Project-scoped memories are authorable: cohort add-memory --to project.
  Writes a scope: project memory into <repo>/.cohort/canonical/memories/; the project
  tier compiles it and wires @import cohort/CLAUDE.cohort.md into the repo's CLAUDE.md
  (and unwires it when the last one goes) — the compile half already existed, only the
  authoring path was missing. A project memory loads in every session in the repo and
  travels with it, so Cohort surfaces the new git_state signal (tracked / untracked /
  uncommitted) at authoring time — tracked means changes are reviewable, untracked means no
  audit trail. It reports and never blocks: the choice is the user's (#182).

• docs/model-tiers.md — the single tier→model mapping, lint-guarded. One
  documented home for both the agent model: tiers and /orchestrate's routing
  tiers; cohort lint fails if it drifts from the renderer's _MODEL_MAP or lists
  an orchestration tier the canon no longer uses, so a model-generation sweep is
  enumerable and can't miss a file.

• cohort lint — documentation-parity check. Guards the drift the golden
  locks don't: counts stated in human docs (an "N-agent roster" line) must match
  the real number of canonical artifacts, derived from the filesystem. Runs in CI.

• operational-hard-limits memory — blast-radius rules in every session.
  Non-negotiable limits (no destructive data ops, prod read-only, PR-only changes,
  no force-push, secrets never move) compiled into the memory corpus. Complements
  the advisory invariant (which governs tools) by governing actions; a coordinator
  restates them per fanned-out worker.

Fixed

• RFC 0004 gate hardening (pre-merge review). Five defects found reviewing the
  Grok engine before merge, each with a regression test that fails without the fix:
  cohort engine consult ran no gates at all — the per-repo egress opt-out and the
  secret scan existed only as prose in the compiled command, so an opted-out repo still
  egressed; a proposed path could traverse a symlink to redirect an in-footprint
  write to a sensitive location inside the worktree while the manifest reported the
  lexical path, showing the reviewer a file that was not the one on disk; a footprint
  entry sensitive in one class laundered paths sensitive in another (authors/**
  granted .git writes, via prefix matching that also mis-classified innocuous names);
  a Windows drive-qualified path (C:\…) passed the scope gate on every platform; the
  proposal worktree leaked on any unanticipated exception or Ctrl-C, and is now
  created only once the reply is parsed and gated; and apply_patch wrote CRLF on
  Windows, violating the repo's eol=lf byte-stability invariant. Also: engine replies
  are now escaped before reaching the terminal on the consult path, and non-PatchError
  stdlib exceptions (UnicodeDecodeError, OSError) fold into PatchApplyError.
• Dashboard: a project-scoped artifact in a focused project now loads. The
  detail pane rendered an agent's card from the focused project's inventory but then
  reported no agent '<name>' in project, because /api/artifact dropped the
  project param and resolved against the dashboard's launch directory instead of
  the switched-to repo. It now carries the focused project through, resolved via the
  registry index like /api/state and run_action already did (never a client path).