Add Project & Workspace MCP System with role-based permissions

- Add roboco_project_* tools (list, get, create, update) with CEO bypass
  - Add roboco_workspace_* tools (ensure, status, list) for workspace management
  - Add project_slug and requires_git fields to TaskCreateInput schema
  - Validate project exists and cell matches when creating git-enabled tasks
  - Register project MCP server in orchestrator with proper permissions

  Workspace permissions by role:
  - Developer: Write to own workspace only
  - QA: Read-only access to all cell workspaces
  - Documenter: Write to all cell workspaces (add docs to dev branches)
  - Cell PM: Write to own workspace, project_update for own cell
  - Main PM: Full project access (create, update all, workspace_list all)
  - CEO: Full bypass on all permission checks

  Also includes:
  - Git templates for commits, branches, PRs (separation of concerns)
  - Updated blueprints with project/workspace tools documentation
  - Updated RAG docs with project tools reference

docs/rag/architecture/tool-permissions.md

@@ -63,3 +63,17 @@ Native tools are blocked; use `roboco_*` MCP tools instead.
 
 **Blocked:**
 - All write operations - observer role
+
+## Project Tools
+
+| Tool | Dev/QA/Doc | Cell PM | Main PM | CEO |
+|------|------------|---------|---------|-----|
+| `roboco_project_list` | Own cell | Own cell | All | All |
+| `roboco_project_get` | Yes | Yes | Yes | Yes |
+| `roboco_project_create` | No | No | Yes | Yes |
+| `roboco_project_update` | No | Own cell | All | All |
+| `roboco_workspace_ensure` | Yes | Yes | Yes | Yes |
+| `roboco_workspace_status` | Yes | Yes | Yes | Yes |
+| `roboco_workspace_list` | No | Own cell | All | All |
+
+**CEO Bypass:** CEO has full access to all project operations.

docs/rag/architecture/workspaces.md

@@ -55,17 +55,24 @@ ROBOCO_WORKSPACE_CLONE_TIMEOUT=300
 3. **Branch Flexibility**: Different branches simultaneously
 4. **Clean State**: Fresh clone if needed
 
-## Workspace Resolution
+## MCP Tools
 
-When agent needs workspace:
+| Tool | Purpose |
+|------|---------|
+| `roboco_workspace_ensure` | Create workspace if needed |
+| `roboco_workspace_status` | Check workspace state |
+| `roboco_workspace_list` | List all workspaces (PM only) |
 
 ```python
-# Service resolves path
-workspace_path = await workspace_service.get_workspace(
-    project_slug="roboco",
-    agent_id="be-dev-1"
-)
-# Returns: /data/workspaces/roboco/backend/be-dev-1
+# Ensure workspace exists (auto-clones if needed)
+roboco_workspace_ensure(project_slug="roboco")
+
+# Check status
+roboco_workspace_status(project_slug="roboco")
 ```
 
-If `auto_clone=True` and workspace doesn't exist, it's created automatically.
+## Workspace Resolution
+
+Path resolved automatically: `{workspaces_root}/{project}/{team}/{agent}/`
+
+If `auto_clone=True` and workspace doesn't exist, it's created on first access.

docs/rag/roles/cell-pm.md

@@ -122,6 +122,31 @@ See: `roboco_kb_search("tool permissions")`
 | `roboco_task_unblock` | Unblock blocked task |
 | `roboco_git_create_branch` | Create task branch |
 | `roboco_notify_send` | Send notification |
+| `roboco_project_update` | Update own cell's projects |
+| `roboco_workspace_list` | List own cell's workspaces |
+
+## Project Management
+
+Update projects assigned to your cell:
+
+```python
+roboco_project_update(
+    slug="roboco",
+    test_command="uv run pytest -v"
+)
+```
+
+Create tasks with project selection:
+
+```python
+roboco_task_create(
+    title="Backend task",
+    team="backend",
+    project_slug="roboco"  # Required for git tasks
+)
+```
+
+**Note:** Cannot create projects (Main PM only) or update other cells' projects.
 
 ## Handling Escalations
 

docs/rag/roles/main-pm.md

@@ -101,6 +101,32 @@ See: `roboco_kb_search("tool permissions")`
 | `roboco_kb_clear_index` | Clear KB index |
 | `roboco_reindex_all` | Trigger full reindex |
 | `roboco_session_create_for_tasks` | Group related tasks |
+| `roboco_project_create` | Register new project |
+| `roboco_project_update` | Update any project |
+| `roboco_workspace_list` | List all workspaces |
+
+## Project Management
+
+Register new git repositories:
+
+```python
+roboco_project_create(
+    name="New Project",
+    slug="new-project",
+    git_url="git@github.com:org/repo.git",
+    assigned_cell="backend"
+)
+```
+
+Create tasks with project:
+
+```python
+roboco_task_create(
+    title="Backend task",
+    team="backend",
+    project_slug="roboco"  # Required for git tasks
+)
+```
 
 ## Handling Cell PM Escalations
 

docs/rag/tools/git-tools.md

@@ -35,7 +35,7 @@ branches = roboco_git_branch_list(project_slug="roboco")
 roboco_git_create_branch(
     project_slug="roboco",
     task_id=task_id,
-    branch_type="feature"  # feature, fix, refactor, docs
+    branch_type="feature"  # feature, bug, chore, docs, hotfix
 )
 # Creates: feature/backend/a1b2c3d4
 
@@ -53,12 +53,13 @@ roboco_git_checkout(
 roboco_git_commit(
     project_slug="roboco",
     task_id=task_id,
-    message="Add rate limiting endpoint"
+    message="Add rate limiting endpoint",
+    commit_type="feat"  # Required
 )
-# Creates: [a1b2c3d4] Add rate limiting endpoint
+# Creates: [a1b2c3d4] feat: Add rate limiting endpoint
 
 # Push to remote
-roboco_git_push(project_slug="roboco")
+roboco_git_push(project_slug="roboco", task_id=task_id)
 ```
 
 ## Pull Requests
@@ -76,6 +77,7 @@ roboco_git_create_pr(
 roboco_git_merge_pr(
     project_slug="roboco",
     pr_number=123,
+    task_id=task_id,
     merge_method="squash"  # squash, merge, rebase
 )
 ```
@@ -89,6 +91,7 @@ roboco_git_merge_pr(
 | Type | Use |
 |------|-----|
 | `feature/` | New functionality |
-| `fix/` | Bug fixes |
-| `refactor/` | Code restructuring |
+| `bug/` | Bug fixes |
+| `chore/` | Maintenance |
 | `docs/` | Documentation |
+| `hotfix/` | Urgent fixes |

docs/rag/tools/project-tools.md

@@ -0,0 +1,105 @@
+# Project Tools
+
+## Overview
+
+Project tools manage git repositories and agent workspaces.
+
+## List Projects
+
+```python
+roboco_project_list()           # All accessible projects
+roboco_project_list(cell="backend")  # Filter by cell
+```
+
+Returns projects you have access to (cell-scoped for non-PMs).
+
+## Get Project Details
+
+```python
+roboco_project_get(slug="roboco")
+```
+
+Returns: `name`, `git_url`, `assigned_cell`, `default_branch`, `test_command`, etc.
+
+## Create Project (PM+ Only)
+
+```python
+roboco_project_create(
+    name="RoboCo Panel",
+    slug="roboco-panel",
+    git_url="git@github.com:org/roboco-panel.git",
+    assigned_cell="frontend",
+    default_branch="main",
+    test_command="pnpm test",
+    lint_command="pnpm lint"
+)
+```
+
+**Who can create:** Main PM, Board, CEO
+
+## Update Project
+
+```python
+roboco_project_update(
+    slug="roboco-panel",
+    test_command="pnpm test:ci",
+    lint_command="pnpm lint:fix"
+)
+```
+
+**Who can update:**
+- CEO, Main PM: Any project
+- Cell PM: Own cell's projects only
+
+## Workspace Tools
+
+### Ensure Workspace
+
+```python
+roboco_workspace_ensure(project_slug="roboco")
+```
+
+Creates your workspace if it doesn't exist. Auto-clones the repository.
+
+### Check Workspace Status
+
+```python
+roboco_workspace_status(project_slug="roboco")
+```
+
+Returns: `exists`, `branch`, `has_uncommitted`, `staged_files`, `unstaged_files`
+
+### List Workspaces (PM Only)
+
+```python
+roboco_workspace_list(project_slug="roboco")
+```
+
+Lists all agent workspaces for a project. Cell PM sees own cell only.
+
+## Permission Matrix
+
+| Tool | Dev/QA/Doc | Cell PM | Main PM | CEO |
+|------|------------|---------|---------|-----|
+| `project_list` | Own cell | Own cell | All | All |
+| `project_get` | Yes | Yes | Yes | Yes |
+| `project_create` | No | No | Yes | Yes |
+| `project_update` | No | Own cell | All | All |
+| `workspace_ensure` | Yes | Yes | Yes | Yes |
+| `workspace_status` | Yes | Yes | Yes | Yes |
+| `workspace_list` | No | Own cell | All | All |
+
+## Task Creation with Project
+
+When creating git-enabled tasks:
+
+```python
+roboco_task_create(
+    title="Add rate limiting",
+    team="backend",
+    project_slug="roboco",    # Required for git tasks
+    requires_git=True         # Default: True
+)
+```
+
+Use `project_slug="roboco"` for internal RoboCo codebase work.

docs/rag/workflows/git-branch-naming.md

@@ -0,0 +1,14 @@
+# Git Branch Naming
+
+Branches follow: `{type}/{team}/{root-uuid}[/{subtask-uuid}[/{sub-sub-uuid}]]`
+
+**Types:** `feature`, `bug`, `chore`, `docs`, `hotfix`
+
+**Max depth:** 3 levels (root → subtask → sub-subtask)
+
+**Examples:**
+- Root: `feature/backend/550e8400-e29b-41d4-a716-446655440000`
+- Subtask: `feature/backend/550e8400.../6ba7b810...`
+- Sub-sub: `feature/backend/550e8400.../6ba7b810.../f47ac10b...`
+
+PM creates branches via `roboco_git_create_branch()`.

docs/rag/workflows/git-commit-format.md

@@ -0,0 +1,26 @@
+# Git Commit Format
+
+Commits use conventional format with traceability:
+
+```
+[{root-id:8}:{task-id:8}] {type}({scope}): {description}
+
+{body}
+
+---
+Task: {task-id}
+Root: {root-task-id}
+Agent: {agent-slug}
+Session: {session-id}
+
+Links:
+- Task: {api}/tasks/{task-id}
+- Root: {api}/tasks/{root-task-id}
+- Journal: {api}/journals/{agent-slug}
+```
+
+**Required:** `commit_type` (feat, fix, chore, docs, refactor, test, style, perf, ci, build)
+
+**Optional:** `scope` (api, auth, db, ui), `body`, `files`
+
+Use `roboco_git_commit()` - message built automatically with task context.

docs/rag/workflows/git-commits.md

@@ -19,7 +19,8 @@ Example:
 roboco_git_commit(
     project_slug="roboco",
     task_id="a1b2c3d4-e5f6-7890-abcd-ef1234567890",
-    message="Add rate limiting endpoint"
+    message="Add rate limiting endpoint",
+    commit_type="feat"  # Required
 )
 ```
 
@@ -62,7 +63,7 @@ Co-authored-by: {agent-name}
 ## Push Commits
 
 ```python
-roboco_git_push(project_slug="roboco")
+roboco_git_push(project_slug="roboco", task_id="a1b2c3d4...")
 ```
 
 Push before:

docs/rag/workflows/git-pr-types.md

@@ -0,0 +1,10 @@
+# Git PR Types
+
+| `is_root_pr` | Target | Reviewer | Content |
+|--------------|--------|----------|---------|
+| `True` | main | CEO | Full task tree, all commits, all agent links |
+| `False` | parent branch | PM | Simple summary, task commits only |
+
+**Auto-checkout:** `roboco_task_start()` checks out branch automatically. Blocks if uncommitted changes exist.
+
+**PR creation:** Use `roboco_git_create_pr()`. Title/body auto-generated from templates.