A package is a folder of published workflows, their sub-workflows, and the instruction files they use, for one job — a code-quality assessment, a security review, a change made the Boy Scout way. A workflow's folder is /-separated and its first segment is the package it belongs to; workflows with no folder live in default.
Files a workflow produces that are neither source nor documentation go to {outputDir}/{package}, so each package's reports land in their own directory.
What ships
Each plan includes its own set of packages, and higher plans include everything below them. What each package runs, in what order, and what comes out is on its own page:
- Code Quality — ISO/IEC 5055 and Clean Code. Included with every license.
- Architecture Basic — Clean Architecture, twenty-nine chapters. From Pro.
- Security Review — OWASP Top 10 and a STRIDE threat model. From Pro.
- Boy Scout Coding — a change behind two gates, reviewed three ways. From Pro.
- Team Review — process health from git history. From Team.
- Code as Crime Scene — hotspots, coupling, knowledge maps. From Team.
- Full SDLC — the whole lifecycle as workflows: requirements through release. From Pro.
Running one
Some packages do their deterministic work — history mining, metrics, maps — in shipped Python helpers that the agent executes through shell steps. Code Quality, Boy Scout Coding, Code as Crime Scene and Full SDLC need python3 3.8+ (and git, for the three that read history) on the machine where the agent works; see install.
The Full SDLC package is the largest of them, and the only one that spans a whole project rather than a single assessment: twenty-nine workflows across ten numbered phases. It has its own documentation — overview, building a new system, working with existing code, deploying and releasing and a workflow reference.
Every package workflow is started the same way: ccw_list to see it and its input schema, ccw_start with the inputs — typically a target directory and a reportPath. The larger assessments run their chapters as child workflows, so one ccw_start is the whole run.