Add Project & Workspace MCP System with role-based permissions

- Add roboco_project_* tools (list, get, create, update) with CEO bypass
  - Add roboco_workspace_* tools (ensure, status, list) for workspace management
  - Add project_slug and requires_git fields to TaskCreateInput schema
  - Validate project exists and cell matches when creating git-enabled tasks
  - Register project MCP server in orchestrator with proper permissions

  Workspace permissions by role:
  - Developer: Write to own workspace only
  - QA: Read-only access to all cell workspaces
  - Documenter: Write to all cell workspaces (add docs to dev branches)
  - Cell PM: Write to own workspace, project_update for own cell
  - Main PM: Full project access (create, update all, workspace_list all)
  - CEO: Full bypass on all permission checks

  Also includes:
  - Git templates for commits, branches, PRs (separation of concerns)
  - Updated blueprints with project/workspace tools documentation
  - Updated RAG docs with project tools reference

agents/prompts/base.md

@@ -65,6 +65,28 @@ Use `roboco_task_substitute(task_id, reason, details)` if:
 | `max_retries` | Tried multiple times without success |
 | `blocked_external` | Need skills outside your capabilities |
 
+## Projects and Workspaces
+
+**Projects** are git repositories registered with RoboCo. **Workspaces** are your personal clones.
+
+### Your Workspace
+
+Each agent gets their own isolated workspace per project:
+```
+/data/workspaces/{project}/{team}/{your-agent-id}/
+```
+
+**You can ONLY write to your own workspace.** Other agents' workspaces are off-limits.
+
+### Project Tools (ALL Agents)
+
+- `roboco_project_list()` - List projects you can access
+- `roboco_project_get(slug)` - Get project details
+- `roboco_workspace_ensure(project_slug)` - Create/access your workspace
+- `roboco_workspace_status(project_slug)` - Check workspace state
+
+**PM-only project tools are listed in role prompts.**
+
 ## Git Integration
 
 **Not all tasks require git.** Tasks with `requires_git=True` follow the git workflow.

agents/prompts/roles/cell_pm.md

@@ -141,6 +141,14 @@ When ALL subtasks done: reflect + complete your task.
 - `roboco_kb_search`, `roboco_rag_query`, `roboco_kb_stats`
 - `roboco_kb_index_code`, `roboco_kb_index_docs`
 
+**Project & Workspace (Your Cell Only):**
+- `roboco_project_list(cell)` - List your cell's projects
+- `roboco_project_get(slug)` - Get project details
+- `roboco_project_update(slug, ...)` - Update your cell's project settings
+- `roboco_workspace_ensure(project_slug)` - Create/access your workspace
+- `roboco_workspace_status(project_slug)` - Check workspace state
+- `roboco_workspace_list(project_slug)` - List all workspaces in your cell
+
 **Agent-to-Agent (A2A) - Cross-Cell Coordination:**
 - `roboco_agent_discover(role, team, skill)` - Find agents across cells
 - `roboco_agent_request(target_agent, skill, message, task_id)` - Send message (task_id required)

agents/prompts/roles/developer.md

@@ -29,9 +29,9 @@ Use `roboco_task_claim()`. Status: pending → claimed.
 
 ### 4. CHECKOUT (Git Tasks)
 **For tasks with `requires_git=True`:**
-- Branch already created by PM: `roboco_git_status(project_slug)` to verify
-- Switch to task branch: Branch name is in task context
-- Pull latest: Ensure you have current code
+- Branch already created by PM
+- **Auto-checkout happens on `roboco_task_start()`** - no manual checkout needed
+- System blocks if you have uncommitted changes
 
 ### 5. RESEARCH
 Search KB and journals before planning: `roboco_kb_search()`, `roboco_rag_query()`, `roboco_journal_search()`.
@@ -45,7 +45,7 @@ Use `roboco_task_start()` then `roboco_message_send()` to announce. **`task_id`
 ### 8. EXECUTE + COMMIT (Loop)
 1. Write code, make changes
 2. Test your changes locally
-3. Stage and commit: `roboco_git_commit(project_slug, message, task_id)`
+3. Stage and commit: `roboco_git_commit(project_slug, message, task_id, commit_type)`
 4. Update progress: `roboco_task_progress()`
 5. Journal decisions/learnings
 6. If blocked: `roboco_task_block()` + `roboco_task_escalate()`
@@ -89,9 +89,7 @@ When QA passes, you receive a notification. The task is now in `awaiting_documen
 
 ### 13. CREATE PR
 1. Ensure all changes pushed: `roboco_git_push(project_slug, task_id)`
-2. Create PR: `roboco_git_create_pr(project_slug, task_id, title, body)`
-   - Title: Clear description of changes
-   - Body: Summary, testing notes, link to task
+2. Create PR: `roboco_git_create_pr(project_slug, task_id, is_root_pr=False)` or `roboco_git_create_pr(project_slug, task_id, is_root_pr=True)` for root tasks merging to main. Title/body auto-generated if not provided
 3. This sets `pr_created=True` on the task
 4. When BOTH `pr_created` AND `docs_complete` are true → task moves to `awaiting_pm_review`
 
@@ -120,9 +118,11 @@ If PMs request changes:
 - `roboco_git_diff(project_slug, staged)` - View changes
 
 **Git (Write - Developer):**
-- `roboco_git_commit(project_slug, message, task_id)` - Create commit (must be on task branch)
+- `roboco_git_commit(project_slug, task_id, message, commit_type, options={})` - Create commit
+  - `commit_type` REQUIRED: feat, fix, chore, docs, refactor, test, style, perf, ci, build
+  - `options`: scope, body, files (all optional)
 - `roboco_git_push(project_slug, task_id)` - Push to remote
-- `roboco_git_create_pr(project_slug, task_id, title, body)` - Create PR (after QA + Docs)
+- `roboco_git_create_pr(project_slug, task_id, is_root_pr=False)` - Create PR (title/body auto-generated)
 
 **Communication:**
 - `roboco_message_send`, `roboco_channel_history`, `roboco_channel_list`
@@ -137,6 +137,10 @@ If PMs request changes:
 - `roboco_kb_search`, `roboco_rag_query`, `roboco_kb_stats`
 - `roboco_kb_index_code` (index code for search)
 
+**Workspace:**
+- `roboco_workspace_ensure(project_slug)` - Create/access your workspace
+- `roboco_workspace_status(project_slug)` - Check workspace state (branch, uncommitted changes)
+
 **Agent-to-Agent (A2A) - Direct Collaboration:**
 - `roboco_agent_discover(role, team, skill)` - Find agents who can help
 - `roboco_agent_request(target_agent, skill, message, task_id)` - Send message (task_id required)

agents/prompts/roles/documenter.md

@@ -112,6 +112,11 @@ Use `roboco_task_docs_complete()`. This sets `docs_complete=True`.
 - `roboco_kb_search`, `roboco_rag_query`, `roboco_kb_stats`
 - `roboco_kb_index_docs` (index documentation for search)
 
+**Workspace (Cell Access):**
+- `roboco_workspace_ensure(project_slug)` - Create/access workspace
+- `roboco_workspace_status(project_slug)` - Check workspace state
+- You can WRITE to ALL cell workspaces to add docs to dev branches
+
 **Documentation:**
 - `roboco_docs_write(task_id, filename, doc_type, title, content)` - Write/update docs
 - `roboco_docs_read(path)` - Read existing doc

agents/prompts/roles/main_pm.md

@@ -132,6 +132,15 @@ When CEO approves and PR is merged: reflect + complete your task.
 - `roboco_kb_search`, `roboco_rag_query`, `roboco_kb_stats`
 - `roboco_kb_index_code`, `roboco_kb_index_docs`
 
+**Project & Workspace (All Cells):**
+- `roboco_project_list()` - List all projects
+- `roboco_project_get(slug)` - Get project details
+- `roboco_project_create(...)` - Register new git repositories
+- `roboco_project_update(slug, ...)` - Update any project settings
+- `roboco_workspace_ensure(project_slug)` - Create/access your workspace
+- `roboco_workspace_status(project_slug)` - Check workspace state
+- `roboco_workspace_list(project_slug)` - List all workspaces across cells
+
 ## NOT Your Tools
 
 - `roboco_session_create_for_tasks` → Cell PM creates sessions

agents/prompts/roles/qa.md

@@ -74,6 +74,10 @@ Use `roboco_journal_reflect()` before decision. REQUIRED.
 **Knowledge Base:**
 - `roboco_kb_search`, `roboco_rag_query`, `roboco_kb_stats`
 
+**Workspace (Read-Only):**
+- `roboco_workspace_status(project_slug)` - Check workspace state
+- You can READ all cell workspaces to review code, but CANNOT write
+
 **Agent-to-Agent (A2A) - Direct Collaboration:**
 - `roboco_agent_discover(role, team, skill)` - Find agents who can help
 - `roboco_agent_request(target_agent, skill, message, task_id)` - Send message (task_id required)