crew

The standard development protocol, widened across vendors: the coordinating session researches, plans, and signs off; tiered subagents implement. /crew wraps the existing loops — it uses /plan's decomposition discipline for phase 2 and /build's implement–test–verify–commit discipline inside each worker — and adds the model-routing and signoff layer on top, routing each task to the cheapest capable model from any vendor (the same token-optimization reason /scout reviews across vendors; /crew is the build sibling of /scout). It is human-invoked; the human gates (commit review, PR review) are unchanged.

The line: external engines never touch the main tree

This is the invariant, not a preference:

• Claude subagents write directly. A Claude worker is inside the trust boundary; it edits files in a disjoint footprint (or its own worktree) and the coordinator verifies the diff. Route by tier: fable architecture-critical, opus complex, sonnet well-scoped, haiku mechanical.
• External engines (Grok, ChatGPT) never touch the main working tree. They reach the code only inside an isolated, throwaway worktree, two ways:
  • OS-sandboxed CLI doer (preferred when the CLI is installed) — the engine's own agentic CLI edits a fresh worktree directly, with real file access, every write OS/kernel-confined there: cohort engine work gpt runs Codex under its own workspace-write sandbox; cohort engine work grok runs xAI's Grok Build under a Cohort-imposed bubblewrap jail — it ships a sandbox of its own, but a vendor confining itself is the vendor's claim, not Cohort's guarantee. An engine with no available sandbox is refused — never run unconfined.
  • Gated patch proposal (API fallback) — cohort engine propose <engine> [--agentic] has the engine return (or explore-then-return) a candidate diff that Cohort — never the engine — parses and applies in a worktree behind the egress/secret/footprint gates. This is the API-direct path used when the local CLI isn't present; with grok-cli + bwrap installed, engine propose/review/consult grok prefer the sandboxed CLI automatically (local file access), and fall back to this API path with a printed note otherwise. Either way the coordinator verifies the diff and integrates, and it still passes the unchanged human PR review.

That is the difference between "let an external model do the work" being useful and being an RCE: it writes only where a bad run is thrown away — never your working tree, which changes only when Claude integrates a reviewed diff.