CROW (Continuous Remediation & Optimization Workflows)

CROW is a public package of agents and skills for agentic software development. It supports brownfield architecture, application development, Java, .NET, and PHP CI across GitHub Actions, Azure Pipelines, and Jenkins, framework and dependency maintenance, accessible B.C. government UX, analytics design, testing, security review and remediation, and the project setup needed to use those capabilities across repositories.

Crow is distributed through the Agent Package Manager (APM) and as a Copilot CLI plugin. The full package remains available, and curated collections are available when a project needs only part of Crow.

The Crow vision and capability governance draft describes the principles used to decide which agents and skills belong in Crow.

Install Crow

1. Install APM

On Windows:

irm https://aka.ms/apm-windows | iex

On macOS or Linux:

curl -sSL https://aka.ms/apm-unix | sh

2. Install a package

Install the Starter Package for daily brownfield development:

apm install bcgov/crow/collections/starter-package#stable --global --target copilot

Install the Security Remediation collection for application security scanning and remediation:

apm install bcgov/crow/collections/security-remediation#stable --global --target copilot

Install the complete Crow package when all capabilities are needed:

apm install bcgov/crow#stable --global --target copilot

Replace copilot with claude, codex, or cursor for another client. The --global option installs into the selected client's user profile rather than copying Crow into every project.

For an exact, reproducible install of this release, use:

apm install bcgov/crow#v0.17.0 --global --target copilot

Updating an installation

Update global APM packages for Copilot to the latest version according to the configured package ref:

apm update --global --target copilot

For Crow installed from #stable, this picks up the latest published stable release. An exact version tag such as #v0.17.0 remains pinned to that release; to follow future releases, install the full package from #stable above once. APM refreshes the resolved commit in the global lockfile; do not edit it manually.

Direct Copilot CLI plugin

Copilot CLI users can install the complete Crow plugin directly instead of using APM:

copilot plugin install bcgov/crow

Verify the plugin and its assets with:

copilot plugin list
/agent
/skills list

3. Set up Raven and code intelligence

After installation, invoke the Crow Raven Setup Agent first:

/agent Crow Raven Setup Agent

The guided setup checks prerequisites, lets you choose Raven capability groups or codebase-memory-mcp, pins server versions, verifies attested release bundles, and generates a Crow-owned MCP fragment. After a separate preview and approval it can merge the selected servers into Copilot Global's mcp-config.json, also used by VS Code Copilot sessions. VS Code may migrate old profile entries there; Crow does not write mcp.json or settings.json. The merge preserves existing entries and backs up changed files. For other editors, use the portable configuration only when the editor supports its schema; otherwise follow its native MCP setup flow. Setup never collects credentials. When new servers are added, it points to Raven's installed Windows or macOS credential setup script if available. When Sonar MCP is already configured (sonar in the Raven catalog or sonar-mcp) or selected during setup, it also sets up the local SonarScanner CLI and .NET/MSBuild scanner when a compatible .NET SDK is available, checks official stable releases during setup or maintenance, and asks before upgrades.

Setup state is user-local under ~/.crow/raven-setup by default. Do not commit it or put Raven credentials in a repository.

For Copilot users, setup offers once to install an optional user-level hook for update reminders. If enabled, it checks Crow's stable release and any bundled Raven or codebase-memory-mcp release recorded by Crow Setup on an agent prompt at most once every 24 hours. It creates no scheduled task and never installs updates automatically. The hook does not track SonarScanner releases. Run the Raven Setup Agent directly to check scanner versions when Sonar MCP is configured or selected during setup.

4. Verify the installation

Use the selected client's normal discovery commands:

/agent
/skills list

Choose a collection

• Starter Package — Raven setup, architecture and code review, application architecture and development, B.C. UX, application CI, project context, testing, and framework/dependency maintenance for daily brownfield work.
• Security Remediation — Raven setup, architecture review and handoff, project context, security review, Sonar scanning, secure architecture, application development, testing, and remediation.

APM selectors control update behavior: #stable follows published releases, while an exact version tag such as #v0.17.0 remains fixed. Installing bcgov/crow without a ref follows the default branch and can include unreleased commits. Collections use the same stable branch as the full package.

Agents

• Crow CI Pipeline Agent — Assesses and builds Java/.NET/PHP CI across GitHub Actions, Azure Pipelines, and Jenkins. Inventories classic Azure builds and releases, analyzes supplied definition details, and creates Azure YAML and Declarative Jenkinsfiles.
• Crow B.C. Government UX Agent
• Crow Solution Architecture Agent
• Crow Data Architecture Agent — Documents, designs, and evolves relational and file-storage models, keeping descriptions, B.C. classifications, and records schedules with the schema.
• Crow Analytics Design Agent — Guides analytics requirements, local source analysis, dimensional design, and signed-off design handoffs without implementing or deploying a solution.
• Crow Architecture Review Agent
• Crow Legacy Modernization Agent — Guides a legacy application through business and process discovery, portable baseline tests, approved architecture and implementation, and comparison without changing system-facing contracts or the datastore.
• Crow Security & Dependency Review Agent
• Crow Executive Summary Report Agent
• Crow Business Rule Documentation Agent
• Crow Security Remediation Agent
• Crow Framework & Dependency Update Agent
• Crow Agent & Skill Authoring Agent
• Crow Agent & Skill Review Agent
• Crow Code Review Agent — Read-only, evidence-backed reviews of local diffs and hosted changes in GitHub or Azure DevOps, reporting only actionable findings.
• Crow Simplification Review Agent
• Crow Testing Agent
• Crow Raven Setup Agent

Skills

• crow-ci-pipelines — Java/.NET/PHP CI assessment, troubleshooting, and authoring with conditional GitHub Actions, Azure Pipelines, and Jenkins guidance. Includes existing automated tests, applicable database-change artifacts, and application-version discovery when Sonar runs as part of CI.
• crow-bcgov-ux — B.C. Design System and WCAG 2.2 AA UX guidance.
• crow-solution-architecture — B.C.-aligned solution architecture and stakeholder decisions. Interactive sessions can keep dated, context-specific choices in user-local ~/.crow/technology-preferences.json after asking permission for each update; preferences never replace project constraints. See the technology preferences guide for review, removal, and supported categories.
• crow-data-architecture — Existing schema documentation and relational data modelling for Oracle, SQL Server, PostgreSQL/PostGIS, and MySQL/MariaDB with Entity Framework, JPA/Hibernate, Doctrine, or Eloquent. Covers filesystem, object-store, and database LOB designs, in-database metadata, and bcgov/wwwsqldesigner portable-v1 XML, with a model validator and metadata SQL generator.
• crow-analytics-design — Analytics requirements interviews, local-first source analysis, dimensional design, and user-confirmed handoffs; it does not build or deploy.
• crow-application-architecture — Application boundaries, dependencies, platforms, Zero Trust, and stateful invariants; technology modules include .NET, Java, and PHP.
• crow-application-development — Production application code, stateful operations, persistence, integrations, and CI with .NET, Java, and PHP modules.
• crow-architecture-review — Evidence-based architecture documentation.
• crow-legacy-modernization — Cross-workflow phase gates for equivalent legacy application replacement. Available in the full Crow package, not the focused collections.
• crow-code-review — Read-only local and hosted code review, also used after application changes.
• crow-business-rules — Business-rule extraction, reconciliation, and reporting.
• crow-executive-report — Executive security and architecture reporting.
• crow-project-context — Safe public project memory and provider references.
• crow-raven-setup — Selective Raven and codebase-memory-mcp setup and maintenance.
• crow-security-review — Manual security, invariant-driven logic review, dependency, data-flow, PHP runtime, and issue-publication guidance.
• crow-framework-updates — Supported runtime, SDK, and primary framework upgrades.
• crow-dependency-updates — Evidence-backed routine updates for libraries, plugins, and development tools.
• crow-sonar-scan — Sonar scan execution through the Sonar MCP server.
• crow-simplification-review — Opt-in review for unnecessary complexity and tracked Crow debt.
• crow-agent-skill-authoring — Crow asset creation, packaging, and release hygiene.
• crow-agent-skill-review — Read-only Crow asset quality and release review.
• crow-release — Versioned package preparation, validation, and publication.
• crow-testing — Reviewed feature scenarios organized by repository features, automated unit/integration tests (including PHP), and business-readable manual QA coverage; includes HTTP characterization and differential testing for REST/SOAP API modernization.

Optional reporting prerequisite

The Crow Business Rule Documentation Agent requires a preinstalled Mermaid CLI (mmdc) only when diagrams are needed:

npm install -g @mermaid-js/mermaid-cli

Local development and release

From a Crow checkout, install dependencies and build a versioned bundle:

apm install
apm pack --archive --output build

The resulting archive is build/bcgov-crow-0.17.0.zip. See crow-release for release gates and crow-agent-skill-authoring for the asset authoring workflow.