@forwardimpact/outpost 3.12.0 → 3.13.0

package/templates/.claude/skills/person-identify/SKILL.md

@@ -1,31 +1,35 @@
 ---
 name: person-identify
-description: Look up the current user's identity (real name, company, job title, department, email, employee ID, and manager) from the corporate directory via LDAP, authenticated with the existing Kerberos ticket. Use to establish who the knowledge base belongs to, when CLAUDE.md needs the user's identity, or when the user asks "who am I" / for their own directory record. To look up someone *other* than the current user, use the sibling `person-lookup` skill instead.
+description: Look up the current user's identity (real name, company, job title, department, email, employee ID, manager, and direct reports) from the corporate directory through LDAP. The bind uses the existing Kerberos ticket. Captures the user's org edges — manager and direct reports — so the KB can resolve who "our team" is. Use to establish who the knowledge base belongs to, when CLAUDE.md needs the user's identity, or when the user asks "who am I" / for their own directory record. To look up someone *other* than the current user, use the sibling `person-lookup` skill instead.
 ---
 
 # Person Identify
 
+Write tier: none (cache only)
+Frontmatter: none
+
 Resolve the current user's identity from the corporate Active Directory over
 LDAP. This is the canonical way to establish **who the knowledge base belongs
-to** — replacing any static identity file. Results reflect the live directory,
-so a job change or reorg is picked up automatically.
+to**. It replaces any static identity file. Results reflect the live
+directory, so the skill picks up a job change or a reorg automatically.
 
 ## Trigger
 
-- CLAUDE.md (or another skill) needs the current user's identity.
+- CLAUDE.md (or another skill) needs the current user's identity, or needs to
+  resolve who "our team" is.
 - The user asks "who am I", for their own directory record, or for their
-  employee ID, title, department, or manager.
+  employee ID, title, department, manager, or direct reports.
 
 ## Prerequisites
 
 - A valid **Kerberos ticket** for the user (`klist` shows a principal).
   If absent, get one with `kinit <user>@<REALM>`.
-- Network reachability to a domain controller (on-site or via VPN).
-- `ldapsearch` and `dig` — both ship with macOS; nothing to install.
+- Network access to a domain controller (on-site or through VPN).
+- `ldapsearch` and `dig` — both ship with macOS. You install nothing.
 
-Nothing is hardcoded: the username, realm, base DN, and domain controller are
-all derived at runtime from the ticket and DNS. No password is ever entered —
-the bind uses SASL/GSSAPI against the existing ticket.
+Nothing is hardcoded. The script derives the username, realm, base DN, and
+domain controller at runtime from the ticket and DNS. You never enter a
+password. The bind uses SASL/GSSAPI against the existing ticket.
 
 ## Usage
 
@@ -33,27 +37,39 @@ the bind uses SASL/GSSAPI against the existing ticket.
 bash .claude/skills/person-identify/scripts/identify.sh
 ```
 
-This prints the user's directory record, resolves the manager to a name, and
-writes the result to the identity cache (below).
+This prints the user's directory record, resolves the manager and each direct
+report to a name, and writes the result to the identity cache (below).
 
 ## Identity cache
 
-The script writes `~/.cache/fit/outpost/state/identity.md` — the **canonical
-identity source** for the rest of the knowledge base, replacing the old static
-`USER.md`. It is auto-generated markdown with `Name`, `Email`, and `Domain`
-fields (plus title, department, company, employee ID, office, and manager):
+The script writes `~/.cache/fit/outpost/state/identity.md`. That file is the
+**canonical identity source** for the rest of the knowledge base. It replaces
+the old static `USER.md`. It is auto-generated markdown with `Name`, `Email`,
+and `Domain` fields (plus title, department, company, employee ID, office, and
+the user's two org edges — `Manager` and `Direct reports`):
 
 ```markdown
 - **Name:** Jane Doe
 - **Email:** jane.doe@example.com
 - **Domain:** example.com
+- **Manager:** Roe, Richard
+- **Direct reports:**
+    - Chen, Sarah
+    - Okafor, Ada
 ```
 
+The **Manager** and **Direct reports** edges let the KB resolve who "our team"
+is — see the `## User Identity & Team` section of `CLAUDE.md` for the rule.
+`Direct reports` is always written: a list when the user manages people, or
+the explicit sentinel `- **Direct reports:** none` for an individual
+contributor. Reports are name-sorted so re-runs of the synced cache diff
+cleanly.
+
 Other skills (e.g. `extract-entities`, `anarlog-process`, `req-track`,
 `req-workday`, `candidate-report`, `sync-teams`) read this file for the user's
-name/email/domain — for self-exclusion and author attribution. They run this
-skill first if the cache is missing or stale. Never hand-edit the cache; re-run
-the skill to refresh it.
+name/email/domain. They use it for self-exclusion and author attribution. They
+run this skill first if the cache is missing or stale. Never hand-edit the
+cache. Run the skill again to refresh it.
 
 ## How it works
 
@@ -73,11 +89,29 @@ dc=$(dig +short SRV "_ldap._tcp.dc._msdcs.$dom" | awk 'NR==1{print $4}' | sed 's
 
 # 4. Look up the current user (GSSAPI = existing ticket, no password)
 ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "ldap://$dc" -b "$base" \
-  "(sAMAccountName=$user)" displayName company title department employeeID mail manager
+  "(sAMAccountName=$user)" displayName company title department employeeID mail \
+  manager directReports
 ```
 
-The `manager` attribute is a DN that may live in another domain, so the script
-resolves it against the **Global Catalog** (port 3268), which is forest-wide.
+Both org edges come back as DNs that may live in another domain. So the script
+resolves them against the **Global Catalog** (port 3268, forest-wide) through
+one shared `dn_name` helper. `manager` is single-valued. `directReports` is
+the multi-valued back-link of the same edge, so the script pulls every value
+(not just the first), resolves each to a name, and sorts the list. The
+resolver decodes the base64 `displayName:: …` form (used for accented names)
+and retries past the directory's occasional attribute-less response under
+load.
+
+**Inactive reports are filtered from the roster.** AD does not clear the
+`manager` edge when an account is offboarded — it just moves the account to a
+deprovisioned OU — so the user's `directReports` back-link keeps counting
+ex-reports as phantom team members. Reports resolve through `dn_report`, which
+drops a DN when either (1) it sits under the obsolete OU
+(`INACTIVE_OU_PATTERN`, a config knob at the top of the script; `OU=Obsolete`
+by default, empty to disable), or (2) the account is disabled in AD —
+`userAccountControl` bit `0x2` (`ACCOUNTDISABLE`), fetched in the same GC
+query as the name. The manager edge stays unfiltered: a disabled manager is a
+signal worth surfacing, not hiding.
 
 ## Output
 
@@ -93,12 +127,28 @@ Key attributes returned (names per Active Directory schema):
 | `mail`                      | Email address           |
 | `physicalDeliveryOfficeName`| Office / location       |
 | `manager`                   | Manager (DN → resolved to name) |
+| `directReports`             | Direct reports (multi-valued DN back-link → each resolved to a name; offboarded/disabled accounts filtered out) |
+| `userAccountControl`        | Fetched per report to drop disabled accounts (bit `0x2`) |
 
 ## Notes
 
-- To look up **someone else**, use the sibling `person-lookup` skill — it takes
-  free-text input (email or name), searches the Global Catalog forest-wide
-  (`ldap://$dc:3268 -b ''`), handles multiple matches, and does **not** touch
+- To look up **someone else**, use the sibling `person-lookup` skill. It takes
+  free-text input (email or name). It searches the Global Catalog forest-wide
+  (`ldap://$dc:3268 -b ''`). It handles multiple matches. It does **not** touch
   the identity cache.
-- Not Active Directory? The same `ldapsearch -Y GSSAPI` shape works against any
-  Kerberos-backed LDAP directory; only the attribute names differ.
+- `directReports` is the back-link stored on the user's own home-domain
+  record, so a report whose account lives in *another* forest domain may be
+  omitted. For a single-domain manager (the common case) it is complete. If
+  cross-domain reports matter, swap it for a forest-wide reverse search over
+  the GC — `(manager=<userDN>)`, where the user's DN is the `dn:` line of the
+  fetched record — feeding the same `dn_report` resolver.
+- **Offboarded reports linger in AD.** The `directReports` back-link keeps
+  counting a report after they leave, because offboarding moves the account to
+  a deprovisioned OU without clearing its `manager` edge. `dn_report` filters
+  these out (obsolete-OU DN, or a disabled `userAccountControl`). Tune
+  `INACTIVE_OU_PATTERN` at the top of `scripts/identify.sh` to your
+  directory's convention — it mirrors `person-lookup`'s `VENDOR_OU_PATTERN`
+  knob. The real fix is upstream (clear the manager edge at offboarding); the
+  filter shields the KB until then.
+- Active Directory is not required. The same `ldapsearch -Y GSSAPI` shape works
+  against any Kerberos-backed LDAP directory. Only the attribute names differ.

package/templates/.claude/skills/person-identify/scripts/identify.sh

@@ -1,18 +1,27 @@
 #!/usr/bin/env bash
-# Identify the current user from the corporate directory (Active Directory over LDAP)
-# and cache the result at ~/.cache/fit/outpost/state/identity.md for other skills.
+# Identify the current user from the corporate directory (Active Directory over LDAP).
+# Cache the result at ~/.cache/fit/outpost/state/identity.md for other skills.
 #
-# Generic by design: nothing is hardcoded. The user, realm, and base DN are all
-# derived from the existing Kerberos ticket, and the domain controller is found
-# via DNS SRV records. Works for any AD domain, on or off VPN, as long as a
-# Kerberos ticket exists and a DC is reachable.
+# The script is generic. Nothing is hardcoded. It derives the user, the realm,
+# and the base DN from the existing Kerberos ticket. It finds the domain
+# controller with DNS SRV records. It works for any AD domain, on or off VPN.
+# It needs a Kerberos ticket and a reachable DC.
 #
-# Auth uses SASL/GSSAPI against the existing ticket — no password is ever entered.
+# Auth uses SASL/GSSAPI against the existing ticket. You never enter a password.
 set -u
 
 CACHE="$HOME/.cache/fit/outpost/state/identity.md"
 
-# 1. Who are we? Take the principal from the Kerberos ticket: USER@REALM.EXAMPLE.COM
+# Org-specific: substring of the DN's OU under which offboarded/deprovisioned
+# accounts are parked. AD keeps the `manager` edge on such accounts when they
+# are moved here at offboarding, so the user's `directReports` back-link still
+# counts them — surfacing ex-reports as phantom team members. Reports whose DN
+# matches this pattern are dropped. Set to your directory's convention (empty
+# disables the OU filter; disabled-account filtering via userAccountControl
+# still applies). `OU=Obsolete` is a common AD default.
+INACTIVE_OU_PATTERN="OU=Obsolete"
+
+# 1. Take the user principal from the Kerberos ticket: USER@REALM.EXAMPLE.COM
 princ=$(klist 2>/dev/null | sed -n 's/.*[Pp]rincipal: *//p' | head -1)
 if [ -z "$princ" ]; then
   echo "No Kerberos ticket found. Get one first, e.g.:  kinit <user>@<REALM>" >&2
@@ -25,52 +34,132 @@ realm=${princ#*@}
 base=$(printf '%s' "$realm" | awk -F. '{for(i=1;i<=NF;i++) printf "%sDC=%s",(i>1?",":""),$i}')
 dom=$(printf '%s' "$realm" | tr '[:upper:]' '[:lower:]')
 
-# 3. Find a reachable domain controller via DNS SRV (msdcs first, then plain ldap)
+# 3. Find a reachable domain controller with DNS SRV (msdcs first, then plain ldap)
 dc=$(dig +short SRV "_ldap._tcp.dc._msdcs.$dom" | awk 'NR==1{print $4}' | sed 's/\.$//')
 [ -z "$dc" ] && dc=$(dig +short SRV "_ldap._tcp.$dom" | awk 'NR==1{print $4}' | sed 's/\.$//')
 if [ -z "$dc" ]; then
-  echo "Could not find a domain controller for $dom via DNS SRV." >&2
+  echo "Could not find a domain controller for $dom with DNS SRV." >&2
   exit 1
 fi
 
 # 4. Look up the current user's record (GSSAPI = use the existing ticket, no password)
-attrs="displayName givenName sn company title department employeeID mail telephoneNumber physicalDeliveryOfficeName manager"
+attrs="displayName givenName sn company title department employeeID mail telephoneNumber physicalDeliveryOfficeName manager directReports"
 rec=$(ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "ldap://$dc" -b "$base" "(sAMAccountName=$user)" $attrs 2>/dev/null)
 if [ -z "$rec" ]; then
   echo "No directory record found for '$user' under $base on $dc." >&2
   exit 1
 fi
 
-# Pull a single attribute value out of the LDIF record.
-field() { printf '%s\n' "$rec" | sed -n "s/^$1: //p" | head -1; }
+# Pull a single attribute value out of the LDIF record. Decode the base64
+# `attr:: <b64>` form that LDIF uses for any non-ASCII value (accented names,
+# and DNs whose CN is accented — e.g. the manager attribute).
+field() { # $1=attr
+  local attr="$1" line
+  line=$(printf '%s\n' "$rec" | grep -m1 -E "^$attr:: ?|^$attr: ")
+  case "$line" in
+    "$attr:: "*) printf '%s' "${line#"$attr":: }" | base64 -D 2>/dev/null ;;
+    "$attr: "*)  printf '%s' "${line#"$attr": }" ;;
+  esac
+}
 
 disp=$(field displayName); gn=$(field givenName); sn=$(field sn)
 company=$(field company); title=$(field title); dept=$(field department)
 empid=$(field employeeID); mail=$(field mail)
 office=$(field physicalDeliveryOfficeName)
 
-# Real name from given+surname, falling back to displayName. Domain from the email.
+# Real name from given+surname. Fall back to displayName. Domain from the email.
 name="$gn $sn"; name=$(printf '%s' "$name" | sed 's/^ *//;s/ *$//')
 [ -z "$name" ] && name="$disp"
 domain=$(printf '%s' "$mail" | sed 's/.*@//' | tr '[:upper:]' '[:lower:]')
 
-# 5. Resolve the manager DN to a name, if present. Manager may live in another
-#    domain, so query the Global Catalog (port 3268), which is forest-wide.
-mgr=$(field manager)
-mgr_name=""
-if [ -n "$mgr" ]; then
-  mgr_name=$(ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "ldap://$dc:3268" -b "$mgr" -s base \
-    displayName 2>/dev/null | sed -n 's/^displayName: //p' | head -1)
-fi
+# 5. Resolve the user's org edges — the manager (up) and the direct reports
+#    (down) — to names. Both are DNs that may live in another domain, so
+#    resolve against the Global Catalog (port 3268). It is forest-wide.
+gc="ldap://$dc:3268"
+
+# One shared DN -> displayName resolver. Decodes the base64 `displayName:: <b64>`
+# form (accented names are encoded that way) and retries past the directory's
+# occasional attribute-less response under load, mirroring person-lookup.
+dn_name() { # $1=DN  -> displayName ("" if unresolvable)
+  local dn="$1" line tries=0
+  [ -z "$dn" ] && return 0
+  while [ "$tries" -lt 4 ]; do
+    line=$(ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "$gc" -b "$dn" -s base \
+             displayName 2>/dev/null | grep -m1 -E '^displayName:: ?|^displayName: ')
+    case "$line" in
+      "displayName:: "*) printf '%s' "${line#displayName:: }" | base64 -D 2>/dev/null; return 0 ;;
+      "displayName: "*)  printf '%s' "${line#displayName: }"; return 0 ;;
+    esac
+    tries=$((tries + 1)); sleep "$tries"
+  done
+}
+
+# Resolve a direct-report DN to a name, but ONLY if the account is still active.
+# A report is inactive — and therefore dropped from the team roster — when either:
+#   1. its DN sits under the obsolete/deprovisioned OU ($INACTIVE_OU_PATTERN), or
+#   2. its account is disabled in AD (userAccountControl bit 0x2, ACCOUNTDISABLE).
+# Offboarding leaves the `manager` edge dangling, so without this filter ex-reports
+# linger in the roster forever. Fetches displayName + userAccountControl together,
+# reusing dn_name's base64 decode and retry-under-load behaviour. Prints the name,
+# or nothing to skip the report.
+dn_report() { # $1=DN -> displayName if active, else ""
+  local dn="$1" out line uac tries=0
+  [ -z "$dn" ] && return 0
+  # (1) Obsolete-OU filter — case-insensitive substring match on the DN.
+  if [ -n "$INACTIVE_OU_PATTERN" ]; then
+    if printf '%s' "$dn" | grep -qiF "$INACTIVE_OU_PATTERN"; then return 0; fi
+  fi
+  while [ "$tries" -lt 4 ]; do
+    out=$(ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "$gc" -b "$dn" -s base \
+            displayName userAccountControl 2>/dev/null)
+    line=$(printf '%s\n' "$out" | grep -m1 -E '^displayName:: ?|^displayName: ')
+    if [ -n "$line" ]; then
+      # (2) Disabled-account filter. userAccountControl is a GC-replicated
+      # attribute; if absent (older DC / partial reply) we simply don't filter.
+      uac=$(printf '%s\n' "$out" | sed -n 's/^userAccountControl: *//p' | head -1)
+      case "$uac" in
+        ''|*[!0-9]*) : ;;                          # missing/non-numeric -> can't judge
+        *) [ $((uac & 2)) -ne 0 ] && return 0 ;;   # ACCOUNTDISABLE set -> skip
+      esac
+      case "$line" in
+        "displayName:: "*) printf '%s' "${line#displayName:: }" | base64 -D 2>/dev/null; return 0 ;;
+        "displayName: "*)  printf '%s' "${line#displayName: }"; return 0 ;;
+      esac
+    fi
+    tries=$((tries + 1)); sleep "$tries"
+  done
+}
+
+# Up-edge: the manager (single-valued DN on the user's own record).
+mgr_name=$(dn_name "$(field manager)")
+
+# Down-edges: direct reports — a multi-valued back-link on the user's OWN record.
+# field() keeps only the first value, so pull EVERY value: emit one report DN per
+# line (decoding the base64 `directReports:: <b64>` form), resolve each to a name
+# via dn_report (which drops offboarded/disabled accounts), and sort for stable,
+# diff-friendly cache output. Kept in a function because a `case` inside `$(...)`
+# trips the bash 3.2 parser that macOS ships.
+resolve_reports() {
+  printf '%s\n' "$rec" | while IFS= read -r line; do
+    case "$line" in
+      "directReports:: "*) printf '%s' "${line#directReports:: }" | base64 -D 2>/dev/null; echo ;;
+      "directReports: "*)  printf '%s\n' "${line#directReports: }" ;;
+    esac
+  done | while IFS= read -r dn; do
+    [ -n "$dn" ] || continue
+    n=$(dn_report "$dn"); [ -n "$n" ] && printf '%s\n' "$n"
+  done | sort
+}
+reports=$(resolve_reports)
 
-# 6. Write the cache. Same Name/Email/Domain shape other skills already parse,
-#    plus extra fields. Auto-generated — never hand-edited.
+# 6. Write the cache. It keeps the Name/Email/Domain shape other skills already
+#    parse, plus extra fields. The script generates it. Never edit it by hand.
 mkdir -p "$(dirname "$CACHE")"
 {
   echo "# User Identity"
   echo
-  echo "Auto-generated by the \`person-identify\` skill from the corporate directory."
-  echo "Do not edit by hand — re-run the skill to refresh."
+  echo "The \`person-identify\` skill generates this file from the corporate directory."
+  echo "Do not edit it by hand. Run the skill again to refresh it."
   echo
   echo "- **Name:** $name"
   echo "- **Email:** $mail"
@@ -81,6 +170,16 @@ mkdir -p "$(dirname "$CACHE")"
   echo "- **Employee ID:** $empid"
   echo "- **Office:** $office"
   [ -n "$mgr_name" ] && echo "- **Manager:** $mgr_name"
+  # Always emit Direct reports so the "our team" rule in CLAUDE.md can branch
+  # explicitly: a list => the user manages people (the team is in this cache);
+  # `none` => an individual contributor (peers resolved on demand from the
+  # manager). An omitted line would be indistinguishable from "not yet resolved".
+  if [ -n "$reports" ]; then
+    echo "- **Direct reports:**"
+    printf '%s\n' "$reports" | while IFS= read -r r; do echo "    - $r"; done
+  else
+    echo "- **Direct reports:** none"
+  fi
 } > "$CACHE"
 
 # 7. Show the result.

package/templates/.claude/skills/person-lookup/SKILL.md

@@ -1,37 +1,40 @@
 ---
 name: person-lookup
-description: Look up ANY person in the corporate directory from free-text input (an email address, or a first / last / full name) and return their record — real name, title, department, company, email, employee ID, office, and manager. Searches the Global Catalog forest-wide via LDAP, authenticated with the existing Kerberos ticket. Use when the user asks "who is X", needs someone's title / department / manager / email, or wants to disambiguate a name. For the *current* user's own identity, use the sibling `person-identify` skill instead.
+description: Look up ANY person in the corporate directory from free-text input (an email address, or a first / last / full name) and return their record: real name, title, department, company, email, employee ID, office, manager, and direct reports. Searches the Global Catalog forest-wide through LDAP. The bind uses the existing Kerberos ticket. Use when the user asks "who is X", needs someone's title / department / manager / reports / email, wants to disambiguate a name, or needs to resolve a team around a person (a person's peers = their manager's other reports). For the *current* user's own identity, use the sibling `person-identify` skill instead.
 ---
 
 # Person Lookup
 
+Write tier: none (cache only)
+Frontmatter: none
+
 Resolve **any** person in the corporate Active Directory from natural-language
-input — an email, a login, or any part of a name. The sibling of
-`person-identify`, but aimed at *other* people: it searches the **Global
-Catalog** (forest-wide), handles multiple matches, flags external contacts and
-vendor accounts, and — unlike `person-identify` — never writes the identity
-cache. It's a read-only, throwaway lookup.
+input. The input is an email, a login, or any part of a name. This skill is the
+sibling of `person-identify`, and it aims at *other* people. It searches the
+**Global Catalog** (forest-wide). It handles multiple matches. It flags
+external contacts and vendor accounts. Unlike `person-identify`, it never
+writes the identity cache. It is a read-only, throwaway lookup.
 
 ## Trigger
 
 - The user asks "who is <name>", or for someone's title, department, manager,
   email, or employee ID.
-- A name is ambiguous and needs disambiguating against the directory.
+- A name is ambiguous, and you must disambiguate it against the directory.
 - Another skill needs to resolve a person who is **not** the current user.
 
-For the current user's own record (and to populate the identity cache that other
-skills read), use `person-identify` instead.
+For the current user's own record, use `person-identify` instead. It also
+populates the identity cache that other skills read.
 
 ## Prerequisites
 
-- A valid **Kerberos ticket** (`klist` shows a principal). If absent:
+- A valid **Kerberos ticket** (`klist` shows a principal). If absent, run
   `kinit <user>@<REALM>`.
-- Network reachability to a domain controller (on-site or VPN).
-- `ldapsearch` and `dig` — both ship with macOS; nothing to install.
+- Network access to a domain controller (on-site or VPN).
+- `ldapsearch` and `dig` — both ship with macOS. You install nothing.
 
-Nothing is hardcoded: the realm and a domain controller are derived at runtime
-from the ticket and DNS. The bind uses SASL/GSSAPI against the existing ticket —
-no password is ever entered.
+Nothing is hardcoded. The script derives the realm and a domain controller at
+runtime from the ticket and DNS. The bind uses SASL/GSSAPI against the existing
+ticket. You never enter a password.
 
 ## Usage
 
@@ -44,20 +47,21 @@ The argument is free text: an email, a full name, or just a surname.
 
 ## How it works
 
-1. **Derive a domain controller** from the Kerberos principal's realm via DNS
-   SRV (same bootstrap as `person-identify`).
+1. **Derive a domain controller** from the Kerberos principal's realm through
+   DNS SRV (same bootstrap as `person-identify`).
 2. **Search the Global Catalog** (`ldap://$dc:3268`, base `""`). The GC spans
-   *every* domain in the forest, so a colleague in another region is found from
-   your own ticket — a plain domain-scoped search would miss them. It also
+   *every* domain in the forest. So you find a colleague in another region from
+   your own ticket. A plain domain-scoped search would miss them. It also
    returns the common attributes (title, department, mail, manager), so one
    query is enough.
-3. **Match with ANR** (Ambiguous Name Resolution): the `(anr=<input>)` filter
+3. **Match with ANR** (Ambiguous Name Resolution). The `(anr=<input>)` filter
    matches an email, a login, or any name part in one shot. If ANR finds
    nothing, fall back to a substring search on `mail` / `displayName` /
    `proxyAddresses`.
 4. **Resolve per match.** For a single hit, print the full record and resolve
-   the `manager` DN to a name. For several hits, print a compact
-   disambiguation list and suggest narrowing by email.
+   both org edges — the `manager` DN and each `directReports` DN — to names.
+   For several hits, print a compact disambiguation list and suggest a
+   narrower search by email (org edges resolve only for an exact, single hit).
 
 ## Output
 
@@ -72,6 +76,7 @@ The argument is free text: an email, a full name, or just a surname.
 | Employee ID | `employeeID` |
 | Phone / Office | `telephoneNumber` / `physicalDeliveryOfficeName` |
 | Manager | `manager` (DN → resolved to a name) |
+| Direct reports | `directReports` (multi-valued DN back-link → each resolved to a name; single hit only, shown when non-empty) |
 | DN | distinguished name (region + OU, useful for disambiguation) |
 
 ## Notes
@@ -80,18 +85,17 @@ The argument is free text: an email, a full name, or just a surname.
   external **Contact** object (e.g. a vendor email alias), returns several
   entries. The **Type** column distinguishes an internal **Employee** from an
   external **Contact** (standard `objectClass=contact`). Some directories also
-  park external/vendor *user* accounts under a dedicated OU; set
+  park external/vendor *user* accounts under a dedicated OU. Set
   `VENDOR_OU_PATTERN` at the top of `scripts/lookup.sh` to your directory's OU
-  substring (e.g. `OU=Contractors`) to flag those too. It is empty by default,
-  since the OU convention is organization-specific. Narrow with an email for an
-  exact hit.
+  substring (e.g. `OU=Contractors`). This flags those accounts too. It is empty
+  by default, since the OU convention is organization-specific. Narrow with an
+  email for an exact hit.
 - **Silent partial results.** Under load the directory occasionally returns an
   entry's DN with no attributes (exit 0, no error). Every attribute fetch
   retries with backoff, so a throttled response never masquerades as a person
   with a blank title or email.
 - **No cache.** This skill prints and exits. It never touches
-  `~/.cache/fit/outpost/state/identity.md` — that file is owned solely by
-  `person-identify`.
+  `~/.cache/fit/outpost/state/identity.md`. `person-identify` owns that file
+  alone.
 - **Ethics.** This reads objective, work-relevant directory data only, in line
-  with the knowledge base's integrity rules. It is not a tool for building
-  dossiers.
+  with the knowledge base's integrity rules. Never use it to build dossiers.

package/templates/.claude/skills/person-lookup/scripts/lookup.sh

@@ -3,17 +3,19 @@
 # input (an email address, or a first / last / full name) and print their
 # directory record(s).
 #
-# Sibling to `person-identify`, but for *other* people, not the current user:
+# Sibling to `person-identify`. Use it for *other* people. Do not use it for
+# the current user:
 #   - Searches the Global Catalog (port 3268, base "") so it reaches EVERY
-#     domain in the forest from a single ticket — colleagues in other regions
-#     are found, not just your own domain.
+#     domain in the forest from a single ticket. It finds colleagues in other
+#     regions. It does not stop at your own domain.
 #   - Uses Active Directory ANR (Ambiguous Name Resolution), so one filter
 #     matches an email, a login, or any part of a name.
-#   - Handles 0, 1, or many matches, and flags external Contacts / vendor
-#     accounts so an internal employee is never confused with an outside one.
-#   - NEVER writes the identity cache — this is a throwaway lookup.
+#   - Handles 0, 1, or many matches. Flags external Contacts / vendor
+#     accounts so you never confuse an internal employee with an outside one.
+#   - NEVER writes the identity cache. This is a throwaway lookup.
 #
-# Auth uses SASL/GSSAPI against the existing Kerberos ticket — no password.
+# Auth uses SASL/GSSAPI against the existing Kerberos ticket. It needs no
+# password.
 #
 # Robustness note: under load the directory intermittently returns an entry's
 # DN with NO attributes (exit 0, no error). Every attribute fetch below retries
@@ -22,9 +24,10 @@
 set -u
 
 # Org-specific: substring of the DN's OU that marks external/vendor *user*
-# accounts (external Contact objects are detected generically via objectClass).
-# Empty by default — set it to your directory's convention, e.g. "OU=Contractors"
-# or "OU=External", to label those accounts as "User (external / vendor)".
+# accounts. The script detects external Contact objects generically through
+# objectClass. Empty by default. Set it to your directory's convention, e.g.
+# "OU=Contractors" or "OU=External", to label those accounts as
+# "User (external / vendor)".
 VENDOR_OU_PATTERN=""
 
 QUERY="$*"
@@ -44,16 +47,16 @@ dom=$(printf '%s' "$realm" | tr '[:upper:]' '[:lower:]')
 dc=$(dig +short SRV "_ldap._tcp.dc._msdcs.$dom" | awk 'NR==1{print $4}' | sed 's/\.$//')
 [ -z "$dc" ] && dc=$(dig +short SRV "_ldap._tcp.$dom" | awk 'NR==1{print $4}' | sed 's/\.$//')
 if [ -z "$dc" ]; then
-  echo "Could not find a domain controller for $dom via DNS SRV." >&2
+  echo "Could not find a domain controller for $dom with DNS SRV." >&2
   exit 1
 fi
 
 # Global Catalog: forest-wide, base "" spans every domain.
 GC="ldap://$dc:3268"
-ATTRS="displayName givenName sn company title department employeeID mail telephoneNumber physicalDeliveryOfficeName objectClass manager"
+ATTRS="displayName givenName sn company title department employeeID mail telephoneNumber physicalDeliveryOfficeName objectClass manager directReports"
 MAX_SHOW=12   # cap detailed output for very broad name matches
 
-# Pull one attribute out of an LDIF record (passed as $2), decoding base64 (::).
+# Pull one attribute out of an LDIF record (passed as $2). Decode base64 (::).
 field() { # $1=attr  $2=record
   local attr="$1" line
   line=$(printf '%s\n' "$2" | grep -m1 -E "^$attr:: ?|^$attr: ") || return 0
@@ -63,13 +66,13 @@ field() { # $1=attr  $2=record
   esac
 }
 
-# List matching DNs for a filter (no attributes requested → reliable under load).
+# List the DNs that match a filter. Request no attributes → reliable under load.
 dns_for() { # $1=filter
   ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "$GC" -b "" "$1" 1.1 2>/dev/null \
     | sed -n 's/^dn: //p'
 }
 
-# Fetch one entry's attributes by DN, retrying past the silent DN-only response.
+# Fetch one entry's attributes by DN. Retry past the silent DN-only response.
 fetch() { # $1=dn
   local dn="$1" out tries=0
   while [ "$tries" -lt 4 ]; do
@@ -87,6 +90,23 @@ name_of_dn() { # $1=dn
   field displayName "$(fetch "$1")"
 }
 
+# List a person's direct reports — the multi-valued `directReports` back-link
+# on their record — as one resolved name per line, sorted. $1 = the person's
+# fetched LDIF record. field() keeps only the first value, so pull EVERY value
+# here, decoding the base64 `directReports:: <b64>` form. Kept in a function
+# because a `case` inside $(...) trips the bash 3.2 parser that macOS ships.
+reports_of() { # $1=record
+  printf '%s\n' "$1" | while IFS= read -r line; do
+    case "$line" in
+      "directReports:: "*) printf '%s' "${line#directReports:: }" | base64 -D 2>/dev/null; echo ;;
+      "directReports: "*)  printf '%s\n' "${line#directReports: }" ;;
+    esac
+  done | while IFS= read -r dn; do
+    [ -n "$dn" ] || continue
+    n=$(name_of_dn "$dn"); [ -n "$n" ] && printf '%s\n' "$n"
+  done | sort
+}
+
 # Classify an entry: internal employee, external contact, or vendor account.
 kind_of() { # $1=record  $2=dn
   local oc; oc=$(printf '%s\n' "$1" | grep -i '^objectClass:' | tr 'A-Z' 'a-z')
@@ -100,7 +120,7 @@ kind_of() { # $1=record  $2=dn
 }
 
 # 2. Primary search (ANR), then a substring fallback if it finds nothing.
-#    (Portable array fill — macOS ships bash 3.2, which has no `mapfile`.)
+#    (Portable array fill. macOS ships bash 3.2, which has no `mapfile`.)
 read_dns() { # $1=filter  -> populates global DNS array
   DNS=()
   local line
@@ -133,12 +153,21 @@ if [ "${#DNS[@]}" -eq 1 ]; then
   echo "- **Phone:** $(field telephoneNumber "$rec")"
   echo "- **Office:** $(field physicalDeliveryOfficeName "$rec")"
   [ -n "$mgr" ] && echo "- **Manager:** $mgr"
+  # Direct reports — the down-edge, symmetric to person-identify. Lets a
+  # caller resolve a team from any person: an IC's peers are their manager's
+  # other reports (look up the manager, read this list). Printed only when
+  # non-empty.
+  reports=$(reports_of "$rec")
+  if [ -n "$reports" ]; then
+    echo "- **Direct reports:**"
+    printf '%s\n' "$reports" | while IFS= read -r r; do echo "    - $r"; done
+  fi
   echo "- **DN:** ${DNS[0]}"
   exit 0
 fi
 
 # 3b. Several matches → a compact disambiguation list (no per-row manager call).
-echo "${#DNS[@]} matches for \"$QUERY\" — narrow with an email for an exact hit:"
+echo "${#DNS[@]} matches for \"$QUERY\". Narrow with an email for an exact hit:"
 echo
 shown=0
 for dn in "${DNS[@]}"; do