@forwardimpact/outpost 3.12.1 → 3.13.0

package/templates/.claude/skills/extract-entities/references/templates-projects-topics.md

@@ -3,6 +3,12 @@
 ## Projects
 
 ```markdown
+---
+type: project
+created: {YYYY-MM-DD}
+updated: {YYYY-MM-DD}
+---
+
 # {Project Name}
 
 ## Info
@@ -15,17 +21,17 @@
 {2-3 sentences}
 
 ## Priorities
-- [[Priorities/{Priority}]] — {how this project contributes}
+- [[3-Team/Priorities/{Priority}]] — {how this project contributes}
 
 ## People
-- [[People/{Person}]] — {role}
+- [[3-Team/People/{Person}]] — {role}
 
 ## Organizations
-- [[Organizations/{Org}]] — {relationship}
+- [[3-Team/Organizations/{Org}]] — {relationship}
 
 ## Related
-- [[Priorities/{Priority}]] — {relationship}
-- [[Topics/{Topic}]] — {relationship}
+- [[3-Team/Priorities/{Priority}]] — {relationship}
+- [[3-Team/Topics/{Topic}]] — {relationship}
 
 ## Timeline
 **{YYYY-MM-DD}** ({type})
@@ -42,6 +48,12 @@
 ## Topics
 
 ```markdown
+---
+type: topic
+created: {YYYY-MM-DD}
+updated: {YYYY-MM-DD}
+---
+
 # {Topic Name}
 
 ## About
@@ -53,8 +65,8 @@
 **Last mentioned:** {YYYY-MM-DD}
 
 ## Related
-- [[People/{Person}]] — {relationship}
-- [[Organizations/{Org}]] — {relationship}
+- [[3-Team/People/{Person}]] — {relationship}
+- [[3-Team/Organizations/{Org}]] — {relationship}
 
 ## Log
 **{YYYY-MM-DD}** ({type}: {title})

package/templates/.claude/skills/meeting-prep/SKILL.md

@@ -5,6 +5,9 @@ description: Prepare for meetings. Gather context from the knowledge base and ca
 
 # Meeting Prep
 
+Write tier: none (the output is personal `Briefings/`)
+Frontmatter: none
+
 Help the user prepare for meetings. Gather context from the knowledge base and
 calendar. Create personalized briefing documents with attendee history, open
 items, and suggested talking points.
@@ -22,14 +25,16 @@ meetings.
 ## Inputs
 
 - `~/.cache/fit/outpost/apple_calendar/*.json` — calendar events
-- `Knowledge/People/*.md` — attendee context
-- `Knowledge/Organizations/*.md` — company context
-- `Knowledge/Projects/*.md` — project context
-- `Knowledge/Priorities/*.md` — active priorities and strategic context to
+- `3-Team/People/*.md` — attendee context
+- `3-Team/Organizations/*.md` — company context
+- `3-Team/Projects/*.md` — project context
+- `3-Team/Priorities/*.md` — active priorities and strategic context to
   frame the brief
-- `Knowledge/Candidates/*/brief.md` — candidate context (for interview meetings)
-- `Knowledge/Roles/*.md` — role/requisition context (for interview meetings).
-  Check the `**Status:**` field to distinguish active from historical reqs
+- `2-Confidential/Candidates/*/brief.md` — candidate context (for interview
+  meetings)
+- `2-Confidential/Roles/*.md` — role/requisition context (for interview
+  meetings). Check the `**Status:**` field to distinguish active from historical
+  reqs
 
 ## Outputs
 
@@ -45,8 +50,8 @@ knowledge base.**
 When the user asks to prep for a meeting:
 
 1. **STOP** — Do not create a generic brief
-2. **SEARCH** — Look up each attendee: `rg -l "Attendee Name" Knowledge/`
-3. **READ** — Read their notes: `cat "Knowledge/People/Attendee Name.md"`
+2. **SEARCH** — Look up each attendee: `rg -l "Attendee Name" [0-9]-*/`
+3. **READ** — Read their notes: `cat "3-Team/People/Attendee Name.md"`
 4. **UNDERSTAND** — Extract role, organization, history, open items
 5. **THEN BRIEF** — Create the meeting brief with this context
 
@@ -93,16 +98,16 @@ Extract: summary, start/end time, attendees (names and emails), description.
 For each attendee:
 
 ```bash
-rg -l "attendee_name" Knowledge/People/
-rg -l "attendee_email" Knowledge/People/
-cat "Knowledge/People/Attendee Name.md"
-cat "Knowledge/Organizations/Their Company.md"
-rg -l "attendee_name" Knowledge/Projects/
+rg -l "attendee_name" 3-Team/People/
+rg -l "attendee_email" 3-Team/People/
+cat "3-Team/People/Attendee Name.md"
+cat "3-Team/Organizations/Their Company.md"
+rg -l "attendee_name" 3-Team/Projects/
 ```
 
 Extract: role/title, company, key facts, previous interactions, open items.
 
-Also check `Knowledge/Priorities/` for context relevant to the meeting topic.
+Also check `3-Team/Priorities/` for context relevant to the meeting topic.
 For example, if the meeting is about hiring, surface the relevant hiring
 Priority's status and progress.
 
@@ -143,11 +148,11 @@ Suggested Talking Points
 
 When you prepare for interview meetings (title contains "Interview",
 "Screening", "Decomposition", "Panel", or a candidate name from
-`Knowledge/Candidates/`):
+`2-Confidential/Candidates/`):
 
-1. **Read the candidate brief:** `Knowledge/Candidates/{Name}/brief.md`
+1. **Read the candidate brief:** `2-Confidential/Candidates/{Name}/brief.md`
 2. **Read the Role file:** Look up the `Req` field and read the corresponding
-   `Knowledge/Roles/*.md` file. Check the `**Status:**` field for context.
+   `2-Confidential/Roles/*.md` file. Check the `**Status:**` field for context.
 3. **Include in the briefing:**
    - Candidate's current status, skills, and screening recommendation
    - Role context: hiring manager, domain lead, remaining positions

package/templates/.claude/skills/organize-files/SKILL.md

@@ -6,6 +6,9 @@ compatibility: Requires macOS filesystem access
 
 # Organize Files
 
+Write tier: none (delegates graph writes to extract-entities)
+Frontmatter: none
+
 Organize, tidy up, and find files in `~/Desktop/` and `~/Downloads/`. Always
 preview changes before you act. Never delete without explicit confirmation.
 

package/templates/.claude/skills/person-identify/SKILL.md

@@ -1,10 +1,13 @@
 ---
 name: person-identify
-description: Look up the current user's identity (real name, company, job title, department, email, employee ID, and manager) from the corporate directory through LDAP. The bind uses the existing Kerberos ticket. Use to establish who the knowledge base belongs to, when CLAUDE.md needs the user's identity, or when the user asks "who am I" / for their own directory record. To look up someone *other* than the current user, use the sibling `person-lookup` skill instead.
+description: Look up the current user's identity (real name, company, job title, department, email, employee ID, manager, and direct reports) from the corporate directory through LDAP. The bind uses the existing Kerberos ticket. Captures the user's org edges — manager and direct reports — so the KB can resolve who "our team" is. Use to establish who the knowledge base belongs to, when CLAUDE.md needs the user's identity, or when the user asks "who am I" / for their own directory record. To look up someone *other* than the current user, use the sibling `person-lookup` skill instead.
 ---
 
 # Person Identify
 
+Write tier: none (cache only)
+Frontmatter: none
+
 Resolve the current user's identity from the corporate Active Directory over
 LDAP. This is the canonical way to establish **who the knowledge base belongs
 to**. It replaces any static identity file. Results reflect the live
@@ -12,9 +15,10 @@ directory, so the skill picks up a job change or a reorg automatically.
 
 ## Trigger
 
-- CLAUDE.md (or another skill) needs the current user's identity.
+- CLAUDE.md (or another skill) needs the current user's identity, or needs to
+  resolve who "our team" is.
 - The user asks "who am I", for their own directory record, or for their
-  employee ID, title, department, or manager.
+  employee ID, title, department, manager, or direct reports.
 
 ## Prerequisites
 
@@ -33,8 +37,8 @@ password. The bind uses SASL/GSSAPI against the existing ticket.
 bash .claude/skills/person-identify/scripts/identify.sh
 ```
 
-This prints the user's directory record, resolves the manager to a name, and
-writes the result to the identity cache (below).
+This prints the user's directory record, resolves the manager and each direct
+report to a name, and writes the result to the identity cache (below).
 
 ## Identity cache
 
@@ -42,14 +46,25 @@ The script writes `~/.cache/fit/outpost/state/identity.md`. That file is the
 **canonical identity source** for the rest of the knowledge base. It replaces
 the old static `USER.md`. It is auto-generated markdown with `Name`, `Email`,
 and `Domain` fields (plus title, department, company, employee ID, office, and
-manager):
+the user's two org edges — `Manager` and `Direct reports`):
 
 ```markdown
 - **Name:** Jane Doe
 - **Email:** jane.doe@example.com
 - **Domain:** example.com
+- **Manager:** Roe, Richard
+- **Direct reports:**
+    - Chen, Sarah
+    - Okafor, Ada
 ```
 
+The **Manager** and **Direct reports** edges let the KB resolve who "our team"
+is — see the `## User Identity & Team` section of `CLAUDE.md` for the rule.
+`Direct reports` is always written: a list when the user manages people, or
+the explicit sentinel `- **Direct reports:** none` for an individual
+contributor. Reports are name-sorted so re-runs of the synced cache diff
+cleanly.
+
 Other skills (e.g. `extract-entities`, `anarlog-process`, `req-track`,
 `req-workday`, `candidate-report`, `sync-teams`) read this file for the user's
 name/email/domain. They use it for self-exclusion and author attribution. They
@@ -74,12 +89,29 @@ dc=$(dig +short SRV "_ldap._tcp.dc._msdcs.$dom" | awk 'NR==1{print $4}' | sed 's
 
 # 4. Look up the current user (GSSAPI = existing ticket, no password)
 ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "ldap://$dc" -b "$base" \
-  "(sAMAccountName=$user)" displayName company title department employeeID mail manager
+  "(sAMAccountName=$user)" displayName company title department employeeID mail \
+  manager directReports
 ```
 
-The `manager` attribute is a DN that may live in another domain. So the script
-resolves it against the **Global Catalog** (port 3268). The Global Catalog is
-forest-wide.
+Both org edges come back as DNs that may live in another domain. So the script
+resolves them against the **Global Catalog** (port 3268, forest-wide) through
+one shared `dn_name` helper. `manager` is single-valued. `directReports` is
+the multi-valued back-link of the same edge, so the script pulls every value
+(not just the first), resolves each to a name, and sorts the list. The
+resolver decodes the base64 `displayName:: …` form (used for accented names)
+and retries past the directory's occasional attribute-less response under
+load.
+
+**Inactive reports are filtered from the roster.** AD does not clear the
+`manager` edge when an account is offboarded — it just moves the account to a
+deprovisioned OU — so the user's `directReports` back-link keeps counting
+ex-reports as phantom team members. Reports resolve through `dn_report`, which
+drops a DN when either (1) it sits under the obsolete OU
+(`INACTIVE_OU_PATTERN`, a config knob at the top of the script; `OU=Obsolete`
+by default, empty to disable), or (2) the account is disabled in AD —
+`userAccountControl` bit `0x2` (`ACCOUNTDISABLE`), fetched in the same GC
+query as the name. The manager edge stays unfiltered: a disabled manager is a
+signal worth surfacing, not hiding.
 
 ## Output
 
@@ -95,6 +127,8 @@ Key attributes returned (names per Active Directory schema):
 | `mail`                      | Email address           |
 | `physicalDeliveryOfficeName`| Office / location       |
 | `manager`                   | Manager (DN → resolved to name) |
+| `directReports`             | Direct reports (multi-valued DN back-link → each resolved to a name; offboarded/disabled accounts filtered out) |
+| `userAccountControl`        | Fetched per report to drop disabled accounts (bit `0x2`) |
 
 ## Notes
 
@@ -102,5 +136,19 @@ Key attributes returned (names per Active Directory schema):
   free-text input (email or name). It searches the Global Catalog forest-wide
   (`ldap://$dc:3268 -b ''`). It handles multiple matches. It does **not** touch
   the identity cache.
+- `directReports` is the back-link stored on the user's own home-domain
+  record, so a report whose account lives in *another* forest domain may be
+  omitted. For a single-domain manager (the common case) it is complete. If
+  cross-domain reports matter, swap it for a forest-wide reverse search over
+  the GC — `(manager=<userDN>)`, where the user's DN is the `dn:` line of the
+  fetched record — feeding the same `dn_report` resolver.
+- **Offboarded reports linger in AD.** The `directReports` back-link keeps
+  counting a report after they leave, because offboarding moves the account to
+  a deprovisioned OU without clearing its `manager` edge. `dn_report` filters
+  these out (obsolete-OU DN, or a disabled `userAccountControl`). Tune
+  `INACTIVE_OU_PATTERN` at the top of `scripts/identify.sh` to your
+  directory's convention — it mirrors `person-lookup`'s `VENDOR_OU_PATTERN`
+  knob. The real fix is upstream (clear the manager edge at offboarding); the
+  filter shields the KB until then.
 - Active Directory is not required. The same `ldapsearch -Y GSSAPI` shape works
   against any Kerberos-backed LDAP directory. Only the attribute names differ.

package/templates/.claude/skills/person-identify/scripts/identify.sh

@@ -12,6 +12,15 @@ set -u
 
 CACHE="$HOME/.cache/fit/outpost/state/identity.md"
 
+# Org-specific: substring of the DN's OU under which offboarded/deprovisioned
+# accounts are parked. AD keeps the `manager` edge on such accounts when they
+# are moved here at offboarding, so the user's `directReports` back-link still
+# counts them — surfacing ex-reports as phantom team members. Reports whose DN
+# matches this pattern are dropped. Set to your directory's convention (empty
+# disables the OU filter; disabled-account filtering via userAccountControl
+# still applies). `OU=Obsolete` is a common AD default.
+INACTIVE_OU_PATTERN="OU=Obsolete"
+
 # 1. Take the user principal from the Kerberos ticket: USER@REALM.EXAMPLE.COM
 princ=$(klist 2>/dev/null | sed -n 's/.*[Pp]rincipal: *//p' | head -1)
 if [ -z "$princ" ]; then
@@ -34,15 +43,24 @@ if [ -z "$dc" ]; then
 fi
 
 # 4. Look up the current user's record (GSSAPI = use the existing ticket, no password)
-attrs="displayName givenName sn company title department employeeID mail telephoneNumber physicalDeliveryOfficeName manager"
+attrs="displayName givenName sn company title department employeeID mail telephoneNumber physicalDeliveryOfficeName manager directReports"
 rec=$(ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "ldap://$dc" -b "$base" "(sAMAccountName=$user)" $attrs 2>/dev/null)
 if [ -z "$rec" ]; then
   echo "No directory record found for '$user' under $base on $dc." >&2
   exit 1
 fi
 
-# Pull a single attribute value out of the LDIF record.
-field() { printf '%s\n' "$rec" | sed -n "s/^$1: //p" | head -1; }
+# Pull a single attribute value out of the LDIF record. Decode the base64
+# `attr:: <b64>` form that LDIF uses for any non-ASCII value (accented names,
+# and DNs whose CN is accented — e.g. the manager attribute).
+field() { # $1=attr
+  local attr="$1" line
+  line=$(printf '%s\n' "$rec" | grep -m1 -E "^$attr:: ?|^$attr: ")
+  case "$line" in
+    "$attr:: "*) printf '%s' "${line#"$attr":: }" | base64 -D 2>/dev/null ;;
+    "$attr: "*)  printf '%s' "${line#"$attr": }" ;;
+  esac
+}
 
 disp=$(field displayName); gn=$(field givenName); sn=$(field sn)
 company=$(field company); title=$(field title); dept=$(field department)
@@ -54,14 +72,85 @@ name="$gn $sn"; name=$(printf '%s' "$name" | sed 's/^ *//;s/ *$//')
 [ -z "$name" ] && name="$disp"
 domain=$(printf '%s' "$mail" | sed 's/.*@//' | tr '[:upper:]' '[:lower:]')
 
-# 5. Resolve the manager DN to a name, if present. The manager may live in
-#    another domain. Query the Global Catalog (port 3268). It is forest-wide.
-mgr=$(field manager)
-mgr_name=""
-if [ -n "$mgr" ]; then
-  mgr_name=$(ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "ldap://$dc:3268" -b "$mgr" -s base \
-    displayName 2>/dev/null | sed -n 's/^displayName: //p' | head -1)
-fi
+# 5. Resolve the user's org edges — the manager (up) and the direct reports
+#    (down) — to names. Both are DNs that may live in another domain, so
+#    resolve against the Global Catalog (port 3268). It is forest-wide.
+gc="ldap://$dc:3268"
+
+# One shared DN -> displayName resolver. Decodes the base64 `displayName:: <b64>`
+# form (accented names are encoded that way) and retries past the directory's
+# occasional attribute-less response under load, mirroring person-lookup.
+dn_name() { # $1=DN  -> displayName ("" if unresolvable)
+  local dn="$1" line tries=0
+  [ -z "$dn" ] && return 0
+  while [ "$tries" -lt 4 ]; do
+    line=$(ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "$gc" -b "$dn" -s base \
+             displayName 2>/dev/null | grep -m1 -E '^displayName:: ?|^displayName: ')
+    case "$line" in
+      "displayName:: "*) printf '%s' "${line#displayName:: }" | base64 -D 2>/dev/null; return 0 ;;
+      "displayName: "*)  printf '%s' "${line#displayName: }"; return 0 ;;
+    esac
+    tries=$((tries + 1)); sleep "$tries"
+  done
+}
+
+# Resolve a direct-report DN to a name, but ONLY if the account is still active.
+# A report is inactive — and therefore dropped from the team roster — when either:
+#   1. its DN sits under the obsolete/deprovisioned OU ($INACTIVE_OU_PATTERN), or
+#   2. its account is disabled in AD (userAccountControl bit 0x2, ACCOUNTDISABLE).
+# Offboarding leaves the `manager` edge dangling, so without this filter ex-reports
+# linger in the roster forever. Fetches displayName + userAccountControl together,
+# reusing dn_name's base64 decode and retry-under-load behaviour. Prints the name,
+# or nothing to skip the report.
+dn_report() { # $1=DN -> displayName if active, else ""
+  local dn="$1" out line uac tries=0
+  [ -z "$dn" ] && return 0
+  # (1) Obsolete-OU filter — case-insensitive substring match on the DN.
+  if [ -n "$INACTIVE_OU_PATTERN" ]; then
+    if printf '%s' "$dn" | grep -qiF "$INACTIVE_OU_PATTERN"; then return 0; fi
+  fi
+  while [ "$tries" -lt 4 ]; do
+    out=$(ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "$gc" -b "$dn" -s base \
+            displayName userAccountControl 2>/dev/null)
+    line=$(printf '%s\n' "$out" | grep -m1 -E '^displayName:: ?|^displayName: ')
+    if [ -n "$line" ]; then
+      # (2) Disabled-account filter. userAccountControl is a GC-replicated
+      # attribute; if absent (older DC / partial reply) we simply don't filter.
+      uac=$(printf '%s\n' "$out" | sed -n 's/^userAccountControl: *//p' | head -1)
+      case "$uac" in
+        ''|*[!0-9]*) : ;;                          # missing/non-numeric -> can't judge
+        *) [ $((uac & 2)) -ne 0 ] && return 0 ;;   # ACCOUNTDISABLE set -> skip
+      esac
+      case "$line" in
+        "displayName:: "*) printf '%s' "${line#displayName:: }" | base64 -D 2>/dev/null; return 0 ;;
+        "displayName: "*)  printf '%s' "${line#displayName: }"; return 0 ;;
+      esac
+    fi
+    tries=$((tries + 1)); sleep "$tries"
+  done
+}
+
+# Up-edge: the manager (single-valued DN on the user's own record).
+mgr_name=$(dn_name "$(field manager)")
+
+# Down-edges: direct reports — a multi-valued back-link on the user's OWN record.
+# field() keeps only the first value, so pull EVERY value: emit one report DN per
+# line (decoding the base64 `directReports:: <b64>` form), resolve each to a name
+# via dn_report (which drops offboarded/disabled accounts), and sort for stable,
+# diff-friendly cache output. Kept in a function because a `case` inside `$(...)`
+# trips the bash 3.2 parser that macOS ships.
+resolve_reports() {
+  printf '%s\n' "$rec" | while IFS= read -r line; do
+    case "$line" in
+      "directReports:: "*) printf '%s' "${line#directReports:: }" | base64 -D 2>/dev/null; echo ;;
+      "directReports: "*)  printf '%s\n' "${line#directReports: }" ;;
+    esac
+  done | while IFS= read -r dn; do
+    [ -n "$dn" ] || continue
+    n=$(dn_report "$dn"); [ -n "$n" ] && printf '%s\n' "$n"
+  done | sort
+}
+reports=$(resolve_reports)
 
 # 6. Write the cache. It keeps the Name/Email/Domain shape other skills already
 #    parse, plus extra fields. The script generates it. Never edit it by hand.
@@ -81,6 +170,16 @@ mkdir -p "$(dirname "$CACHE")"
   echo "- **Employee ID:** $empid"
   echo "- **Office:** $office"
   [ -n "$mgr_name" ] && echo "- **Manager:** $mgr_name"
+  # Always emit Direct reports so the "our team" rule in CLAUDE.md can branch
+  # explicitly: a list => the user manages people (the team is in this cache);
+  # `none` => an individual contributor (peers resolved on demand from the
+  # manager). An omitted line would be indistinguishable from "not yet resolved".
+  if [ -n "$reports" ]; then
+    echo "- **Direct reports:**"
+    printf '%s\n' "$reports" | while IFS= read -r r; do echo "    - $r"; done
+  else
+    echo "- **Direct reports:** none"
+  fi
 } > "$CACHE"
 
 # 7. Show the result.

package/templates/.claude/skills/person-lookup/SKILL.md

@@ -1,10 +1,13 @@
 ---
 name: person-lookup
-description: Look up ANY person in the corporate directory from free-text input (an email address, or a first / last / full name) and return their record: real name, title, department, company, email, employee ID, office, and manager. Searches the Global Catalog forest-wide through LDAP. The bind uses the existing Kerberos ticket. Use when the user asks "who is X", needs someone's title / department / manager / email, or wants to disambiguate a name. For the *current* user's own identity, use the sibling `person-identify` skill instead.
+description: Look up ANY person in the corporate directory from free-text input (an email address, or a first / last / full name) and return their record: real name, title, department, company, email, employee ID, office, manager, and direct reports. Searches the Global Catalog forest-wide through LDAP. The bind uses the existing Kerberos ticket. Use when the user asks "who is X", needs someone's title / department / manager / reports / email, wants to disambiguate a name, or needs to resolve a team around a person (a person's peers = their manager's other reports). For the *current* user's own identity, use the sibling `person-identify` skill instead.
 ---
 
 # Person Lookup
 
+Write tier: none (cache only)
+Frontmatter: none
+
 Resolve **any** person in the corporate Active Directory from natural-language
 input. The input is an email, a login, or any part of a name. This skill is the
 sibling of `person-identify`, and it aims at *other* people. It searches the
@@ -56,8 +59,9 @@ The argument is free text: an email, a full name, or just a surname.
    nothing, fall back to a substring search on `mail` / `displayName` /
    `proxyAddresses`.
 4. **Resolve per match.** For a single hit, print the full record and resolve
-   the `manager` DN to a name. For several hits, print a compact
-   disambiguation list and suggest a narrower search by email.
+   both org edges — the `manager` DN and each `directReports` DN — to names.
+   For several hits, print a compact disambiguation list and suggest a
+   narrower search by email (org edges resolve only for an exact, single hit).
 
 ## Output
 
@@ -72,6 +76,7 @@ The argument is free text: an email, a full name, or just a surname.
 | Employee ID | `employeeID` |
 | Phone / Office | `telephoneNumber` / `physicalDeliveryOfficeName` |
 | Manager | `manager` (DN → resolved to a name) |
+| Direct reports | `directReports` (multi-valued DN back-link → each resolved to a name; single hit only, shown when non-empty) |
 | DN | distinguished name (region + OU, useful for disambiguation) |
 
 ## Notes

package/templates/.claude/skills/person-lookup/scripts/lookup.sh

@@ -53,7 +53,7 @@ fi
 
 # Global Catalog: forest-wide, base "" spans every domain.
 GC="ldap://$dc:3268"
-ATTRS="displayName givenName sn company title department employeeID mail telephoneNumber physicalDeliveryOfficeName objectClass manager"
+ATTRS="displayName givenName sn company title department employeeID mail telephoneNumber physicalDeliveryOfficeName objectClass manager directReports"
 MAX_SHOW=12   # cap detailed output for very broad name matches
 
 # Pull one attribute out of an LDIF record (passed as $2). Decode base64 (::).
@@ -90,6 +90,23 @@ name_of_dn() { # $1=dn
   field displayName "$(fetch "$1")"
 }
 
+# List a person's direct reports — the multi-valued `directReports` back-link
+# on their record — as one resolved name per line, sorted. $1 = the person's
+# fetched LDIF record. field() keeps only the first value, so pull EVERY value
+# here, decoding the base64 `directReports:: <b64>` form. Kept in a function
+# because a `case` inside $(...) trips the bash 3.2 parser that macOS ships.
+reports_of() { # $1=record
+  printf '%s\n' "$1" | while IFS= read -r line; do
+    case "$line" in
+      "directReports:: "*) printf '%s' "${line#directReports:: }" | base64 -D 2>/dev/null; echo ;;
+      "directReports: "*)  printf '%s\n' "${line#directReports: }" ;;
+    esac
+  done | while IFS= read -r dn; do
+    [ -n "$dn" ] || continue
+    n=$(name_of_dn "$dn"); [ -n "$n" ] && printf '%s\n' "$n"
+  done | sort
+}
+
 # Classify an entry: internal employee, external contact, or vendor account.
 kind_of() { # $1=record  $2=dn
   local oc; oc=$(printf '%s\n' "$1" | grep -i '^objectClass:' | tr 'A-Z' 'a-z')
@@ -136,6 +153,15 @@ if [ "${#DNS[@]}" -eq 1 ]; then
   echo "- **Phone:** $(field telephoneNumber "$rec")"
   echo "- **Office:** $(field physicalDeliveryOfficeName "$rec")"
   [ -n "$mgr" ] && echo "- **Manager:** $mgr"
+  # Direct reports — the down-edge, symmetric to person-identify. Lets a
+  # caller resolve a team from any person: an IC's peers are their manager's
+  # other reports (look up the manager, read this list). Printed only when
+  # non-empty.
+  reports=$(reports_of "$rec")
+  if [ -n "$reports" ]; then
+    echo "- **Direct reports:**"
+    printf '%s\n' "$reports" | while IFS= read -r r; do echo "    - $r"; done
+  fi
   echo "- **DN:** ${DNS[0]}"
   exit 0
 fi

package/templates/.claude/skills/req-assess/SKILL.md

@@ -9,6 +9,9 @@ description: >
 
 # Assess Interview
 
+Write tier: `2-Confidential`
+Frontmatter: candidate (stamps `status`, `updated`)
+
 Analyze a candidate's interview transcripts. Update their skill and behaviour
 profile with **observed** (not claimed) evidence. Interview evidence is
 higher-fidelity than CV evidence. It confirms or contradicts the screening
@@ -22,7 +25,7 @@ This is **Stage 2** of the three-stage hiring pipeline:
 
 ## Trigger
 
-- A new `transcript-*.md` file appears in `Knowledge/Candidates/{Name}/`.
+- A new `transcript-*.md` file appears in `2-Confidential/Candidates/{Name}/`.
 - The user asks to analyze an interview or debrief.
 - The user asks to prepare a panel brief.
 - The concierge agent processes an Anarlog interview recording.
@@ -30,22 +33,23 @@ This is **Stage 2** of the three-stage hiring pipeline:
 ## Prerequisites
 
 - `fit-pathway` CLI installed.
-- At least one transcript in `Knowledge/Candidates/{Name}/`.
+- At least one transcript in `2-Confidential/Candidates/{Name}/`.
 - `screening.md` should exist. If it is missing, run `req-screen` first.
   Proceed regardless.
 
 ## Inputs
 
-- `Knowledge/Candidates/{Name}/transcript-{date}.md`.
-- `Knowledge/Candidates/{Name}/screening.md`.
-- `Knowledge/Candidates/{Name}/brief.md` — target role.
+- `2-Confidential/Candidates/{Name}/transcript-{date}.md`.
+- `2-Confidential/Candidates/{Name}/screening.md`.
+- `2-Confidential/Candidates/{Name}/brief.md` — target role.
 
 ## Outputs
 
-- `Knowledge/Candidates/{Name}/interview-{date}.md`.
-- `Knowledge/Candidates/{Name}/panel.md` — only when more interviews are
+- `2-Confidential/Candidates/{Name}/interview-{date}.md`.
+- `2-Confidential/Candidates/{Name}/panel.md` — only when more interviews are
   planned.
-- Updated `Knowledge/Candidates/{Name}/brief.md`.
+- Updated `2-Confidential/Candidates/{Name}/brief.md` — frontmatter `status`
+  and `updated` stamped.
 
 <do_confirm_checklist goal="Verify the assessment is grounded in transcript
 evidence">
@@ -55,6 +59,8 @@ evidence">
 - [ ] Assess the level with standard progression criteria. Ignore gut feel.
 - [ ] Attribute interviewer observations by name.
 - [ ] Distinguish confirmed strengths from new concerns.
+- [ ] Assessment prose about the candidate stays in the candidate's own
+      folder. Wider notes record only that the interview happened.
 - [ ] Write the panel brief (if created) for non-technical readers. Tie the
       suggested questions to the remaining gaps.
 - [ ] Update the brief's Pipeline section, links, and Status.
@@ -105,7 +111,7 @@ Apply the [level signals](references/rubric.md#level-signals).
 
 ### 6. Write the interview assessment
 
-Save to `Knowledge/Candidates/{Name}/interview-{date}.md` with
+Save to `2-Confidential/Candidates/{Name}/interview-{date}.md` with
 [references/interview-template.md](references/interview-template.md). Include
 only skills with new evidence. Do not repeat the full matrix.
 
@@ -118,20 +124,22 @@ candidates:
 bunx fit-pathway interview {discipline} {level} --track={track}
 ```
 
-Save `Knowledge/Candidates/{Name}/panel.md` with
+Save `2-Confidential/Candidates/{Name}/panel.md` with
 [references/panel-template.md](references/panel-template.md). The audience is
 next-stage interviewers, often non-engineers. Explain without jargon. Tie the
 suggested questions to the remaining gaps.
 
 ### 8. Update the candidate brief
 
-Apply targeted Edit operations to `Knowledge/Candidates/{Name}/brief.md`:
+Apply targeted Edit operations to `2-Confidential/Candidates/{Name}/brief.md`:
 
 - Append a Pipeline entry with date, type, and outcome.
 - Add `## Interview Notes` if missing, with key observations.
 - Append `- [Interview Assessment](./interview-{date}.md)`.
 - Append `- [Panel Brief](./panel.md)` when one was created.
 - Update `Status` to reflect the current pipeline stage.
+- Stamp the frontmatter: set `updated` to the interview date and `status` to
+  the closest registry value (agents select from `registry.yaml`).
 
 Never rewrite the file. Never update the Gender field from interview
 observations.

package/templates/.claude/skills/req-assess/references/interview-template.md

@@ -1,9 +1,14 @@
 # Interview Assessment Template
 
 Reference template for `req-assess` Step 6. Save to
-`Knowledge/Candidates/{Name}/interview-{date}.md`. Include only skills the
+`2-Confidential/Candidates/{Name}/interview-{date}.md`. Include only skills the
 interview produced new evidence for. Do not repeat the full matrix.
 
+Interview-outcome prose about the candidate lives only in the candidate's own
+folder. A wider note (an interviewer's People note, a project note) records
+only that the interview happened. Interviewer names may appear here; write no
+assessment of the interviewers.
+
 ```markdown
 # Interview Assessment — {Full Name}
 

package/templates/.claude/skills/req-assess/references/panel-template.md

@@ -1,10 +1,14 @@
 # Panel Brief Template
 
 Reference template for `req-assess` Step 7. Save to
-`Knowledge/Candidates/{Name}/panel.md`. The audience is **next-stage
+`2-Confidential/Candidates/{Name}/panel.md`. The audience is **next-stage
 interviewers, often non-engineers**. Explain without jargon. Focus on
 behaviours and scope.
 
+The brief goes to the panel as an export. The note keeps its tier. Assessment
+prose about the candidate stays in this folder; never copy it into panel
+members' People notes.
+
 ```markdown
 # Panel Brief — {Full Name}
 ## {Role Title} — {Level}