@starlein/paperclip-plugin-company-wizard 0.3.24 → 0.4.1

package/dist/worker.js

@@ -9381,11 +9381,7 @@ function normalizeExecutionBaseRef(ref, fallbackRef) {
     (value) => typeof value === "string" && value.trim()
   );
   const selected = candidates.length > 0 ? String(candidates[0]).trim() : "";
-  if (!selected) return "origin/main";
-  if (selected.startsWith("origin/") || selected.startsWith("refs/")) {
-    return selected;
-  }
-  return `origin/${selected}`;
+  return selected || null;
 }
 async function assembleCompany({
   companyName,
@@ -9400,7 +9396,7 @@ async function assembleCompany({
   presetRoutines = [],
   presetLabels = [],
   enableIsolatedWorktrees = false,
-  enableEnrichedPersonas = false,
+  enableEnrichedPersonas = true,
   outputDir,
   templatesDir,
   onProgress = () => {
@@ -10013,6 +10009,9 @@ Read: \`docs/${doc}\`
   if (allGoals.length > 0) {
     bootstrap += `## Goals
 
+`;
+    bootstrap += `> **Goal focus:** keep the top-level goal outcome-first and product-first. Secondary constraints (compliance, security, accessibility, performance, tech stack) are quality bars unless the user explicitly made one of them the primary project. Seed issues should lead with core product capabilities and include constraints as acceptance criteria/risk notes, not let one side constraint dominate the backlog.
+
 `;
     for (const g of allGoals) {
       bootstrap += `### ${g.title}
@@ -10079,21 +10078,34 @@ Read: \`docs/${doc}\`
   const isFreshLocalRepo = (workspace) => workspace?.sourceType !== "git_repo";
   const effectiveExecutionPolicy = (proj, workspace) => {
     const policy = proj?.executionWorkspacePolicy;
-    if (!policy || typeof policy !== "object") return null;
+    const canUseIsolatedWorktrees = enableIsolatedWorktrees && !isFreshLocalRepo(workspace);
+    if (!policy || typeof policy !== "object") {
+      if (!canUseIsolatedWorktrees) return null;
+      const baseRef = normalizeExecutionBaseRef(null, workspace?.defaultRef || workspace?.repoRef);
+      return {
+        enabled: true,
+        defaultMode: "isolated_workspace",
+        workspaceStrategy: {
+          type: "git_worktree",
+          ...baseRef ? { baseRef } : {}
+        }
+      };
+    }
     if (policy.defaultMode === "isolated_workspace") {
-      if (!enableIsolatedWorktrees || isFreshLocalRepo(workspace)) return null;
+      if (!canUseIsolatedWorktrees) return null;
       const strategy = policy.workspaceStrategy;
-      if (!strategy || typeof strategy !== "object") return policy;
-      if (strategy.type !== "git_worktree") return policy;
+      if (!strategy || typeof strategy !== "object")
+        return { ...policy, enabled: policy.enabled ?? true };
+      if (strategy.type !== "git_worktree") return { ...policy, enabled: policy.enabled ?? true };
       const workspaceStrategy = { ...strategy };
-      const normalizedBaseRef = normalizeExecutionBaseRef(
+      const resolvedBaseRef = normalizeExecutionBaseRef(
         workspaceStrategy.baseRef,
-        workspace?.repoRef || workspace?.defaultRef
+        workspace?.defaultRef || workspace?.repoRef
       );
-      if (normalizedBaseRef) {
-        workspaceStrategy.baseRef = normalizedBaseRef;
+      if (resolvedBaseRef) {
+        workspaceStrategy.baseRef = resolvedBaseRef;
       }
-      return { ...policy, workspaceStrategy };
+      return { ...policy, enabled: policy.enabled ?? true, workspaceStrategy };
     }
     return policy;
   };
@@ -10113,24 +10125,34 @@ Read: \`docs/${doc}\`
   };
   const renderDeferredIsolationNote = (workspace) => {
     if (!enableIsolatedWorktrees || !isFreshLocalRepo(workspace)) return "";
-    return `> **Enable isolated worktrees once the repo exists.** This instance has isolated worktrees enabled, but this project starts as a fresh local repository, so the \`executionWorkspacePolicy\` is intentionally omitted now \u2014 worktrees need an existing base ref and would fail on the first run. As the final step of **"Prepare GitHub repository"**, after the initial commit is pushed to \`main\`, switch this project to isolated worktrees (Project settings \u2192 isolated workspaces, or set \`executionWorkspacePolicy: { defaultMode: "isolated_workspace", workspaceStrategy: { type: "git_worktree", baseRef: "main" } }\` on the project). Until then agents share the project workspace; do not flip it before the repo has its first commit.
+    const configuredRef = normalizeExecutionBaseRef(
+      null,
+      workspace?.defaultRef || workspace?.repoRef
+    );
+    const refHint = configuredRef ? `When you later enable the project policy, use that configured ref (currently \`${configuredRef}\`) as the worktree \`baseRef\`.` : `When you later enable the project policy, first set the project/worktree base ref to the branch Paperclip should branch from.`;
+    return `> **Enable isolated worktrees once the repo exists.** This instance has isolated worktrees enabled, but this project starts as a fresh local repository, so the \`executionWorkspacePolicy\` is intentionally omitted now \u2014 worktrees need an existing base ref and would fail on the first run. After the initial commit exists on the configured base branch, switch this project to isolated worktrees in Project settings. ${refHint} Until then agents share the project workspace; do not flip it before the repo has its first commit.
 
 `;
   };
   const mainProject = resolvedProjects[0];
   const mainProjectName = mainProject?.name || companyName;
-  const mainProjectInfo = mainProject ? {
-    name: mainProjectName,
-    description: mainProject.description || "",
-    workspace: normalizeProjectWorkspace(mainProject)
-  } : null;
+  const mainProjectInfo = mainProject ? (() => {
+    const workspace = normalizeProjectWorkspace(mainProject);
+    const executionWorkspacePolicy = effectiveExecutionPolicy(mainProject, workspace);
+    return {
+      name: mainProjectName,
+      description: mainProject.description || "",
+      workspace,
+      ...executionWorkspacePolicy ? { executionWorkspacePolicy } : {}
+    };
+  })() : null;
   const mainProjectPreCreated = initialRoutines.length > 0 && mainProjectInfo !== null;
   if (resolvedProjects.length > 0) {
     bootstrap += `## Projects
 
 `;
     if (mainProjectPreCreated) {
-      bootstrap += `> **The Company Wizard has already created the main project "${mainProjectName}"** (with board authority) so the scheduled routines could be linked to it. Do NOT recreate it \u2014 create issues against it, and link the goals above to it.
+      bootstrap += `> **The Company Wizard has already created the main project "${mainProjectName}"** (with board authority) so the scheduled routines could be linked to it. Do NOT recreate it \u2014 create issues against it. After creating the goals above, resolve their real ids and link them with \`PATCH /api/projects/{projectId}\` using \`{ "goalIds": [...] }\`.
 
 `;
     }
@@ -10278,7 +10300,7 @@ Read: \`docs/${doc}\`
 `;
     if (moduleNames.includes("pr-review")) {
       const ciClause = hasCi ? "CI (lint/test/build) must be green before the Engineer merges \u2014 this is the hard gate and cannot be skipped" : "no CI is configured, so the Engineer must run the test suite/build and paste the real output into the merge-gate verdict before merging \u2014 this is the hard gate";
-      bootstrap += `- Required PR reviews use the issue's \`executionPolicy\`. The substantive gate is execution, not opinion: ${ciClause}. Stages, in order: a \`review\` stage for QA when present (test adequacy / running the tests), a \`review\` stage for the Security Engineer **only when the change is security-relevant** (auth, secrets, input boundaries, crypto, dependencies, infra exposure), an \`approval\` stage for the Product Owner (intent/scope), then a final \`approval\` merge-gate stage for the Engineer (who satisfies the hard gate above, merges the PR, then records approval to close the issue). The merge gate must be last so the Product Owner's approval does not auto-close the issue with the PR still open. The Code Reviewer and other domain reviewers may add advisory, non-blocking comments but do not gate the merge. Every verdict must cite executed verification. Resolve each role to its agentId. Do not create separate child review issues and do not use @-mentions.
+      bootstrap += `- Required PR reviews use the issue's \`executionPolicy\`. The substantive gate is execution, not opinion: ${ciClause}. Stages, in order: a \`review\` stage for QA when present (test adequacy / running the tests), a \`review\` stage for the Security Engineer **only when the change is security-relevant** (auth, secrets, input boundaries, crypto, dependencies, infra exposure), an \`approval\` stage for the Product Owner (intent/scope), then a final \`approval\` merge-gate stage for the Engineer (who satisfies the hard gate above, merges the PR, then records approval to close the issue). The merge gate must be last so the Product Owner's approval does not auto-close the issue with the PR still open. The Code Reviewer and other domain reviewers may add advisory, non-blocking comments but do not gate the merge. Every verdict must cite executed verification. Resolve each role to its agentId. Model review stages in executionPolicy rather than child issues or @-mentions.
 `;
     }
     bootstrap += `
@@ -10312,7 +10334,7 @@ Read: \`docs/${doc}\`
   bootstrap += `## Provisioning Steps
 
 `;
-  bootstrap += `The Company Wizard "Provision" step creates the company, the CEO, and this bootstrap issue. The CEO heartbeat creates the remaining Paperclip objects below by following this task.
+  bootstrap += `The Company Wizard "Provision" step creates the company, board-operations issue, hiring-plan issue, agent hire requests, routines, and this bootstrap issue. Approve any pending hires before running dependent team workflows. The CEO heartbeat completes the remaining setup below by following this task.
 
 `;
   bootstrap += `Manual setup order (respects Paperclip object dependencies):
@@ -10333,7 +10355,7 @@ Read: \`docs/${doc}\`
     const activePolicy = effectiveExecutionPolicy(proj, workspace);
     const policy = activePolicy?.defaultMode ? `, executionWorkspacePolicy.defaultMode: "${activePolicy.defaultMode}"` : "";
     if (idx === 0 && mainProjectPreCreated) {
-      const goalLinkInstruction = goalLinks ? ` After creating the goals above, link them to it (${goalLinks.replace(/^, /, "")}).` : "";
+      const goalLinkInstruction = goalLinks ? ` After creating the goals above, resolve their real ids and link them with PATCH /api/projects/{projectId} (${goalLinks.replace(/^, /, "")}).` : "";
       bootstrap += `${stepN++}. **Main project already created** \u2014 the Company Wizard provisioned project "${proj.name}" (with board authority) so the scheduled routines could be linked to it. Do NOT recreate it.${goalLinkInstruction}
 `;
     } else {
@@ -10369,6 +10391,22 @@ Read: \`docs/${doc}\`
   };
 }
 
+// src/logic/version.js
+function compareSemver(a, b) {
+  const parse = (value) => String(value || "").trim().replace(/^v/i, "").split("-", 1)[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const left = parse(a);
+  const right = parse(b);
+  const max = Math.max(left.length, right.length, 3);
+  for (let i = 0; i < max; i += 1) {
+    const diff = (left[i] || 0) - (right[i] || 0);
+    if (diff !== 0) return diff > 0 ? 1 : -1;
+  }
+  return 0;
+}
+function isNewerVersion(candidate, current) {
+  return compareSemver(candidate, current) > 0;
+}
+
 // src/api/client.js
 var BASE_ROLE_MAP = {
   ceo: "ceo",
@@ -10551,7 +10589,9 @@ var PaperclipClient = class {
       budgetMonthlyCents,
       permissions,
       metadata,
-      instructionsBundle
+      instructionsBundle,
+      sourceIssueId,
+      sourceIssueIds
     } = agent || {};
     const payload = {
       name,
@@ -10568,49 +10608,28 @@ var PaperclipClient = class {
       ...budgetMonthlyCents !== void 0 ? { budgetMonthlyCents } : {},
       ...permissions ? { permissions } : {},
       ...metadata !== void 0 ? { metadata } : {},
-      ...instructionsBundle !== void 0 ? { instructionsBundle } : {}
+      ...instructionsBundle !== void 0 ? { instructionsBundle } : {},
+      ...sourceIssueId !== void 0 ? { sourceIssueId } : {},
+      ...sourceIssueIds !== void 0 ? { sourceIssueIds } : {}
     };
-    try {
-      return await this._fetch(`/api/companies/${companyId}/agents`, {
-        method: "POST",
-        body: JSON.stringify(payload)
-      });
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      const requiresApproval = message.includes("Direct agent creation requires board approval") || message.includes("/agent-hires");
-      if (!requiresApproval) throw err;
-      const hireResult = await this._fetch(`/api/companies/${companyId}/agent-hires`, {
-        method: "POST",
-        body: JSON.stringify(payload)
-      });
-      const hiredAgent = hireResult?.agent || null;
-      const approvalId = hireResult?.approval?.id || null;
-      if (!hiredAgent) {
-        throw new Error("Agent hire endpoint returned no agent.");
-      }
-      if (approvalId) {
-        try {
-          await this._fetch(`/api/approvals/${approvalId}/approve`, {
-            method: "POST",
-            body: JSON.stringify({ decisionNote: "Auto-approved by Company Wizard provisioning" })
-          });
-          try {
-            return await this._fetch(`/api/agents/${hiredAgent.id}`, { method: "GET" });
-          } catch {
-            return hiredAgent;
-          }
-        } catch (approveErr) {
-          return {
-            ...hiredAgent,
-            _pendingApprovalId: approvalId,
-            _approvalAutoApproveError: approveErr instanceof Error ? approveErr.message : String(approveErr)
-          };
-        }
-      }
-      return hiredAgent;
+    const hireResult = await this._fetch(`/api/companies/${companyId}/agent-hires`, {
+      method: "POST",
+      body: JSON.stringify(payload)
+    });
+    const hiredAgent = hireResult?.agent || null;
+    const approvalId = hireResult?.approval?.id || null;
+    if (!hiredAgent) {
+      throw new Error("Agent hire endpoint returned no agent.");
     }
+    if (approvalId) {
+      return {
+        ...hiredAgent,
+        _pendingApprovalId: approvalId
+      };
+    }
+    return hiredAgent;
   }
-  async createProject(companyId, { name, description, goalIds, workspace }) {
+  async createProject(companyId, { name, description, goalIds, workspace, executionWorkspacePolicy }) {
     const workspacePayload = typeof workspace === "string" ? { sourceType: "local_path", cwd: workspace, isPrimary: true } : workspace || void 0;
     return this._fetch(`/api/companies/${companyId}/projects`, {
       method: "POST",
@@ -10618,10 +10637,17 @@ var PaperclipClient = class {
         name,
         description: description || null,
         ...goalIds?.length ? { goalIds } : {},
-        workspace: workspacePayload
+        workspace: workspacePayload,
+        ...executionWorkspacePolicy ? { executionWorkspacePolicy } : {}
       })
     });
   }
+  async updateProject(projectId, updates = {}) {
+    return this._fetch(`/api/projects/${projectId}`, {
+      method: "PATCH",
+      body: JSON.stringify(updates || {})
+    });
+  }
   async createGoal(companyId, { title, description, level, parentId, status, ownerAgentId }) {
     return this._fetch(`/api/companies/${companyId}/goals`, {
       method: "POST",
@@ -10681,6 +10707,17 @@ var PaperclipClient = class {
       body: JSON.stringify(updates || {})
     });
   }
+  async putIssueDocument(issueId, key, { title, format, body, baseRevisionId }) {
+    return this._fetch(`/api/issues/${issueId}/documents/${encodeURIComponent(key)}`, {
+      method: "PUT",
+      body: JSON.stringify({
+        title,
+        format: format || "markdown",
+        body: body || "",
+        ...baseRevisionId !== void 0 ? { baseRevisionId } : {}
+      })
+    });
+  }
   async createRoutine(companyId, {
     title,
     description,
@@ -10901,6 +10938,9 @@ function collectPresetBootstrapData(preset) {
 var __dirname = path2.dirname(fileURLToPath2(import.meta.url));
 var DEFAULT_TEMPLATES_REPO_URL = "https://github.com/starlein/paperclip-plugin-company-wizard/tree/main/templates";
 var BUNDLED_TEMPLATES_DIR = path2.resolve(__dirname, "..", "templates");
+var PLUGIN_PACKAGE_NAME = "@starlein/paperclip-plugin-company-wizard";
+var CURRENT_PLUGIN_VERSION = "0.4.1";
+var NPM_LATEST_URL = "https://registry.npmjs.org/@starlein%2Fpaperclip-plugin-company-wizard/latest";
 function copyDirSync(src, dest) {
   fs2.mkdirSync(dest, { recursive: true });
   for (const entry of fs2.readdirSync(src, { withFileTypes: true })) {
@@ -11194,6 +11234,57 @@ async function syncAgentInstructionsIntoManagedBundle({
     );
   }
 }
+function buildDecisionLogBody({
+  companyName,
+  companyDescription,
+  preset,
+  moduleNames,
+  roles,
+  repositoryMode,
+  approvalMode
+}) {
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  return `# Decision Log \u2014 ${companyName}
+
+## ${today}
+- Created or selected company "${companyName}"${companyDescription ? ` with mission: ${companyDescription}` : ""}.
+- Selected preset: ${preset || "custom/manual"}.
+- Selected modules: ${moduleNames.length > 0 ? moduleNames.join(", ") : "none"}.
+- Initial roles: ${roles.join(", ")}.
+- Repository setup: ${repositoryMode}.
+- Hiring governance: ${approvalMode}.
+- Company Wizard generated the initial bootstrap package, agent instruction bundles, routines, and backlog seed from templates.
+`;
+}
+function buildHiringPlanBody({
+  companyName,
+  roles,
+  moduleNames
+}) {
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  return `# Hiring Plan \u2014 ${companyName}
+
+Generated by Company Wizard on ${today}.
+
+## Instruction Source
+
+Company Wizard uses curated role templates from its template library. When proposing additional hires after bootstrap, follow the Paperclip \`paperclip-create-agent\` workflow: choose an exact, adjacent, or generic template; run the draft-review checklist; submit via \`/agent-hires\`; link this issue as \`sourceIssueId\`; and wait for board approval when required.
+
+## Initial Roles
+
+${roles.map((role) => `- ${formatRoleName(role)}`).join("\n")}
+
+## Selected Modules
+
+${moduleNames.length > 0 ? moduleNames.map((mod) => `- ${mod}`).join("\n") : "- none"}
+
+## Follow-up Review
+
+- Reassess capacity after the first roadmap/backlog pass.
+- Do not hire for capabilities already covered by existing roles.
+- If a gap remains, submit a governed hire request with a concrete AGENTS.md draft, adapter config, desiredSkills justification, and sourceIssueId pointing to this hiring plan issue.
+`;
+}
 var plugin = definePlugin({
   async setup(ctx) {
     ctx.data.register("templates", async () => {
@@ -11220,6 +11311,46 @@ var plugin = definePlugin({
         return { ok: false, error: err instanceof Error ? err.message : String(err) };
       }
     });
+    ctx.actions.register("check-update", async () => {
+      try {
+        const response = await fetch(NPM_LATEST_URL, {
+          headers: { accept: "application/json" }
+        });
+        if (!response.ok) {
+          return {
+            ok: false,
+            currentVersion: CURRENT_PLUGIN_VERSION,
+            packageName: PLUGIN_PACKAGE_NAME,
+            error: `npm registry returned ${response.status}`
+          };
+        }
+        const data = await response.json();
+        const latestVersion = typeof data.version === "string" ? data.version.trim() : "";
+        if (!latestVersion) {
+          return {
+            ok: false,
+            currentVersion: CURRENT_PLUGIN_VERSION,
+            packageName: PLUGIN_PACKAGE_NAME,
+            error: "npm registry response did not include a version"
+          };
+        }
+        return {
+          ok: true,
+          packageName: PLUGIN_PACKAGE_NAME,
+          currentVersion: CURRENT_PLUGIN_VERSION,
+          latestVersion,
+          updateAvailable: isNewerVersion(latestVersion, CURRENT_PLUGIN_VERSION),
+          url: "https://www.npmjs.com/package/@starlein/paperclip-plugin-company-wizard"
+        };
+      } catch (err) {
+        return {
+          ok: false,
+          currentVersion: CURRENT_PLUGIN_VERSION,
+          packageName: PLUGIN_PACKAGE_NAME,
+          error: err instanceof Error ? err.message : String(err)
+        };
+      }
+    });
     ctx.actions.register("preview-files", async (params) => {
       let tmpDir;
       try {
@@ -11272,7 +11403,7 @@ var plugin = definePlugin({
           presetRoutines: presetBootstrapData.routines,
           presetLabels: presetBootstrapData.labels,
           enableIsolatedWorktrees: await resolveEnableIsolatedWorkspacesFromInstance(cfg),
-          enableEnrichedPersonas: cfgBool(cfg, "enableEnrichedPersonas"),
+          enableEnrichedPersonas: true,
           outputDir: tmpDir,
           templatesDir
         });
@@ -11378,7 +11509,7 @@ var plugin = definePlugin({
           "disableBoardApprovalOnNewCompanies"
         );
         const enableIsolatedWorktrees = await resolveEnableIsolatedWorkspacesFromInstance(cfg, log);
-        const enableEnrichedPersonas = cfgBool(cfg, "enableEnrichedPersonas");
+        const enableEnrichedPersonas = true;
         const companyName = typeof params.companyName === "string" ? params.companyName.trim() : "";
         const existingCompanyId = typeof params.existingCompanyId === "string" && params.existingCompanyId.trim() ? params.existingCompanyId.trim() : "";
         if (!companyName) return { error: "companyName is required", logs };
@@ -11484,8 +11615,58 @@ var plugin = definePlugin({
         }
         let ceoAgentId;
         const teamAgentIds = {};
+        let boardOperationsIssue = null;
+        let hiringPlanIssue = null;
         let bootstrapIssue;
         try {
+          const allRoleNames = [...assembleResult.allRoles ?? []].filter(Boolean).sort();
+          const repositoryMode = userProjects.some(
+            (project) => project?.repoUrl || project?.workspace?.sourceType === "git_repo"
+          ) ? "existing git repository" : "fresh local repository";
+          const approvalMode = disableBoardApprovalOnNewCompanies ? "board approval disabled for this new company by plugin setting" : "board approval preserved; /agent-hires may create pending approvals";
+          log("Creating board operations and hiring plan records...");
+          const createdBoardOperationsIssue = await client.createIssue(companyId, {
+            title: "Board Operations",
+            description: "Standing issue for board decision log and operations tracking.",
+            status: "in_progress",
+            priority: "medium"
+          });
+          boardOperationsIssue = createdBoardOperationsIssue;
+          await client.putIssueDocument(createdBoardOperationsIssue.id, "decision-log", {
+            title: "Decision Log",
+            format: "markdown",
+            body: buildDecisionLogBody({
+              companyName,
+              companyDescription,
+              preset: selectedPreset?.name,
+              moduleNames: effectiveModules,
+              roles: allRoleNames,
+              repositoryMode,
+              approvalMode
+            })
+          });
+          log(
+            `\u2713 Board Operations issue created${createdBoardOperationsIssue.identifier ? `: ${createdBoardOperationsIssue.identifier}` : ""}`
+          );
+          const createdHiringPlanIssue = await client.createIssue(companyId, {
+            title: "Hiring Plan",
+            description: "Develop and execute the governed team hiring plan.",
+            status: "in_progress",
+            priority: "high"
+          });
+          hiringPlanIssue = createdHiringPlanIssue;
+          await client.putIssueDocument(createdHiringPlanIssue.id, "hiring-plan", {
+            title: "Hiring Plan",
+            format: "markdown",
+            body: buildHiringPlanBody({
+              companyName,
+              roles: allRoleNames,
+              moduleNames: effectiveModules
+            })
+          });
+          log(
+            `\u2713 Hiring Plan issue created${createdHiringPlanIssue.identifier ? `: ${createdHiringPlanIssue.identifier}` : ""}`
+          );
           const userCeoAdapter = params.ceoAdapter || {};
           const adapterType = normalizeCeoAdapterType(userCeoAdapter);
           const ceoTemplate = roleTemplateByName.get("ceo") || {};
@@ -11511,9 +11692,6 @@ var plugin = definePlugin({
             log(
               `\u26A0 CEO hire is pending approval: ${agent._pendingApprovalId}. Approve it in the board before the bootstrap heartbeat can run.`
             );
-            if (agent._approvalAutoApproveError) {
-              log(`  Auto-approve failed: ${agent._approvalAutoApproveError}`);
-            }
           };
           if (existingCompanyId) {
             log("Looking for an existing CEO agent...");
@@ -11558,7 +11736,8 @@ var plugin = definePlugin({
                 adapterConfig,
                 instructionsBundle: ceoInstructionsBundle,
                 runtimeConfig: ceoRuntimeConfig,
-                permissions: { canCreateAgents: true }
+                permissions: { canCreateAgents: true },
+                ...boardOperationsIssue?.id ? { sourceIssueId: boardOperationsIssue.id } : {}
               });
               ceoAgentId = ceoAgent.id;
               log(`\u2713 CEO agent created (${ceoAgentId})`);
@@ -11577,7 +11756,8 @@ var plugin = definePlugin({
               adapterConfig,
               instructionsBundle: ceoInstructionsBundle,
               runtimeConfig: ceoRuntimeConfig,
-              permissions: { canCreateAgents: true }
+              permissions: { canCreateAgents: true },
+              ...boardOperationsIssue?.id ? { sourceIssueId: boardOperationsIssue.id } : {}
             });
             ceoAgentId = ceoAgent.id;
             log(`\u2713 CEO agent created (${ceoAgentId})`);
@@ -11654,7 +11834,8 @@ var plugin = definePlugin({
               adapterType,
               adapterConfig: roleAdapterConfig,
               instructionsBundle: roleInstructionsBundle,
-              runtimeConfig: roleRuntimeConfig
+              runtimeConfig: roleRuntimeConfig,
+              ...hiringPlanIssue?.id ? { sourceIssueId: hiringPlanIssue.id } : {}
             });
             teamAgentIds[roleName] = roleAgent.id;
             log(`\u2713 ${roleTitle} created (${roleAgent.id})`);
@@ -11662,9 +11843,6 @@ var plugin = definePlugin({
               log(
                 `\u26A0 ${roleTitle} hire pending approval: ${roleAgent._pendingApprovalId}. Approve it in the board.`
               );
-              if (roleAgent._approvalAutoApproveError) {
-                log(`  Auto-approve failed: ${roleAgent._approvalAutoApproveError}`);
-              }
             }
           }
           if (!existingCompanyId) {
@@ -11676,7 +11854,8 @@ var plugin = definePlugin({
                 const createdProject = await client.createProject(companyId, {
                   name: mainProject.name,
                   description: mainProject.description,
-                  workspace: mainProject.workspace
+                  workspace: mainProject.workspace,
+                  executionWorkspacePolicy: mainProject.executionWorkspacePolicy
                 });
                 mainProjectId = createdProject?.id;
                 log(
@@ -11753,14 +11932,17 @@ var plugin = definePlugin({
         log("");
         log("Provisioning complete!");
         log(
-          existingCompanyId ? "Bootstrap task created in existing company. Trigger the CEO heartbeat to continue setup." : "The CEO agent is ready. Trigger its first heartbeat to hire the rest of the team and create the initial backlog."
+          existingCompanyId ? "Bootstrap task created in existing company. Trigger the CEO heartbeat to continue setup." : "The CEO agent and initial team hire requests are ready. Approve any pending hires, then trigger the CEO heartbeat to continue setup."
+        );
+        const issueIds = [boardOperationsIssue?.id, hiringPlanIssue?.id, bootstrapIssue.id].filter(
+          Boolean
         );
         return {
           companyId,
           issuePrefix: company.issuePrefix,
           paperclipUrl,
           agentIds: { ceo: ceoAgentId, ...teamAgentIds },
-          issueIds: [bootstrapIssue.id],
+          issueIds,
           logs
         };
       } catch (err) {