@starlein/paperclip-plugin-company-wizard 0.4.22 → 0.6.2

package/CHANGELOG.md

@@ -4,6 +4,126 @@ All notable changes to the Company Wizard plugin are documented here.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.6.2] - 2026-09-07
+
+Follow-up review of the 0.6.1 consolidation against Paperclip source `3fb4b65f9d974d8687db8a060f20ec66b6071a79` (upstream master through 2026-09-06). Fixes two template defects that silently dropped provisioned routines and a set of instruction/doc drifts left by the Skills Store migration.
+
+### Fixed
+
+- Routines in the `dependency-management` and `release-management` modules declared `concurrencyPolicy: "forbid"`, which is not in Paperclip's `createRoutineSchema` enum (`coalesce_if_active` | `always_enqueue` | `skip_if_active`). The create/sync call was rejected with a 400 and swallowed as a warning, so both routines — and their cron triggers — were never created, in the `repo-maintenance` preset and any manual selection of those modules. Both now declare `skip_if_active`, and `routineConcurrencyPolicy()` maps the legacy spelling (and any unknown value) before the payload is sent, so a custom template source cannot lose a routine the same way.
+- The same two routines were keyed by the legacy `name` field, which the BOOTSTRAP.md renderer did not read: the CEO's bootstrap issue listed them as `### undefined`. Templates now use `title`, and both the renderer and provisioning resolve the title through the shared `routineTitle()` helper.
+- Heartbeat sections and role/skill instructions still pointed at `skills/<name>.md` files. Assembly stopped writing `agents/<role>/skills/` when skills moved to the Skills Store, so those paths did not exist. They now name the installed skill by slug (`auto-assign`, `auto-assign-fallback`, `backlog-health`, `backlog-health-fallback`, `stall-detection`, `git-workflow`, `pr-workflow`).
+- Skill markdown, module docs, and module/preset issue text referenced shared docs as `../../docs/<file>.md`, which only resolves from `{company}/agents/<role>/`. They now use `docs/<file>.md`, relative to the agent's working directory (the company dir). `roles/*/AGENTS.md` and the generated "Shared Documentation" list keep the file-relative form, which is correct there.
+- Review-gate instructions quoted the wrong 422. An author-only stage fails when Paperclip selects the participant — `No eligible <review|approval> participant is configured for this issue` — and the PATCH is refused, so the issue never enters `in_review`. `Only the active reviewer or approver can advance the current execution stage` is the separate error for a non-participant advancing a pending stage. Corrected in `pr-conventions.md` and the engineer/QA heartbeats.
+- Checkout guidance said `expectedStatuses` was used "when the API supports" it. `checkoutIssueSchema` requires both `agentId` and a non-empty `expectedStatuses`; all 17 role heartbeats now show the required request body.
+- `docs/PAPERCLIP-COMPATIBILITY.md` explained the omitted `minimumHostVersion` with a `hostVersion` default of `"0.0.0"`. `app.ts` passes `opts.hostVersion ?? serverVersion`, resolved from `git describe`, a stamped build version, then the server package version; the real reason a numeric floor is unsafe is that packaged installs report that package version (`0.3.1`) against CalVer releases.
+
+### Changed
+
+- Review-round limits are now documented where agents act on them: after 3 consecutive agent-initiated `changes_requested` rounds on one stage (`DEFAULT_MAX_REVIEW_ROUNDS`, overridable per policy via `executionPolicy.maxReviewRounds`), Paperclip keeps the stage pending and hands it to the issue's responsible/creating human; a human decision resets the counter. Added to `pr-workflow`, `code-review`, and `pr-conventions.md`.
+- Model suggestions track the current adapter catalogs: Codex gains `gpt-6-astra` and drops `gpt-5.5`, which the adapter catalog does not publish; Claude gains `claude-fable-5-1`. Defaults (`gpt-5.6-sol`, `claude-opus-4-8`) are unchanged, and the field stays free text.
+- `effectiveExecutionPolicy()` no longer computes an unreachable isolated-worktree condition for existing projects (they return earlier with their stored policy). Behavior is unchanged: only a new project on an existing external repo can start isolated.
+- New `src/logic/routines.js` helpers (`routineTitle`, `routineConcurrencyPolicy`, `ROUTINE_CONCURRENCY_POLICIES`) are shared by assembly and provisioning, with `tests/templates-contract.spec.ts` validating every shipped module/preset routine, issue, goal, and dependency against the enums Paperclip accepts.
+
+## [0.6.1] - 2026-09-07
+
+Consolidates the useful changes from PRs #44, #46 and #47 on a fresh branch from main. Compatibility reviewed against Paperclip source `856813ba3a083f23694b8554104b3e50abcb1363` (2026-09-06).
+
+### Changed
+
+- Lean delivery remains optional and unselected by built-in presets. It supplies one non-author Code Reviewer merge gate and risk-triggered evidence; standard PR review retains role-based stages. Fixed PR-count limits are removed across both modes: queue size is advisory, actual blockers and operator policies remain binding.
+- SDK/shared development dependencies and peer floor move to `2026.831.1`. The manifest omits `minimumHostVersion`: current source starts its plugin loader at `0.0.0`, so a numeric floor incorrectly rejects it. API/capability validation remains active; see `docs/PAPERCLIP-COMPATIBILITY.md` for tested contracts and limitations.
+- Default template selection is pinned to the installed release. Explicit local template directories are never overwritten; custom remote URLs use separate source-keyed caches, atomic refresh, and no implicit source change between preview and provisioning.
+- Added current-stable schema contract tests for company, goal, project, issue, governed agent hire, routine/trigger, Company Skill, and plugin-manifest payloads.
+
+### Fixed
+
+- Pending hires are listed only for this wizard run, with explicit checkbox selection and server-side company/type/status validation. Partial failures remain visible. A separate **Start bootstrap** action verifies the CEO and issue, handles skipped wakeups, and restores a missing watchdog best-effort; provisioning never auto-approves hires or invokes this start action.
+- Existing-company updates load and patch real project execution policies before hiring, preserving project IDs, workspaces, goal links, explicit concurrency/disabled settings, strategy hooks, and environment IDs. New project-scoped routines link to the existing main project.
+- AI policy normalization and both bootstrap policy renderers retain all supported fields. Fresh local repositories defer isolation; remote/non-git paths are never initialized as Git repositories. The guard is explicitly documented as inactive when the instance feature or policy is disabled, and operator/issue overrides are preserved.
+- Wizard manifests use company-scoped SDK state instead of a nonexistent company-settings REST endpoint. Retirement review issues use the correct parent issue field rather than issue IDs as project/goal IDs.
+- Company Skill slug collisions no longer overwrite imported/catalog skills; only canonical editable company-managed skills are refreshed, and listing failures stop provisioning rather than creating duplicates.
+- Review recovery uses actual execution-state ownership, managed worktree branch identity is preserved, required repository CI/protection is not disabled, and Product Owner handoffs do not close open-PR work prematurely.
+- Production build command is portable across Windows and Unix. Added worker, schema, template-matrix, project-update, approval/bootstrap, and state-persistence regressions.
+- Removed unused `esbuild-postcss-plugin` and refreshed affected development-tool dependencies (Vitest, esbuild, PostCSS and their transitive parsers/glob utilities). Documented and tested Node 24.11+ to match the published Paperclip SDK/shared host runtime requirement.
+
+- Review instructions distinguish standard executionPolicy verdicts from lean advisory assignment handoffs. Capacity waits no longer become conjunctive dependencies in backlog/stall recovery, and CEO fallbacks run only on assigned planning/routine work.
+- Review stages omit the issue's author, pending/failed required CI cannot be bypassed using local results, and baseline repair is explicitly assigned separately from the feature issue.
+- Company Skill display-name refreshes preserve existing slugs and use the rename response's key for agent skill assignments, including role-disambiguated skills. The backlog snapshot also respects optional lean capacity instead of imposing it when deselected.
+- Existing Company Skill content now updates through `PATCH /companies/:companyId/skills/:skillId/files` with `path: "SKILL.md"`, and display-name changes use the dedicated `/rename` endpoint. Newer Paperclip versions no longer silently discard `markdown` and `name` sent to the metadata-only skill PATCH route.
+- Project provisioning and generated bootstrap instructions now always include the required `executionWorkspacePolicy.enabled` boolean whenever a project execution policy is present.
+- Triggered QA, Security, Product, UI/UX, and DevOps evidence now has an explicit same-issue assignment wake-and-return path before the Code Reviewer gate, matching assignment-driven worker agents.
+- Selecting the `ci-cd` module no longer assumes required checks already exist: exact-head company CI becomes authoritative only after checks run on that head; until then the merge gate runs the complete local gate once.
+- The repo-maintenance preset assigns independently actionable setup work immediately; unspecified health fixes wait for the actual dependency-audit evidence, not a fixed repository PR count.
+- Supported older Paperclip hosts that do not expose the newer Company Skill `/rename` route now keep the existing display name and continue refreshing skill content/metadata instead of aborting provisioning on a 404.
+- Auto-assignment no longer models a dynamic repository PR cap as conjunctive blockers on every open PR; capacity waiters stay unassigned for the next assignment-driven capacity check.
+- Retained Code Reviewer, Engineer, and Security Engineer role instructions now match the lean module contracts: exact-head CI avoids duplicate full gates, Engineers do not self-claim past WIP capacity or invent acceptance, and blocking security remediation stays on the originating issue and PR.
+- QA evidence uses bounded pass/fail comments rather than executionPolicy verdicts; CEO fallback assignment follows the same non-conjunctive capacity wait as the primary skill; and inherited base-branch CI repair is explicitly isolated to one separately owned baseline-restore issue and PR.
+
+## [0.5.3] - 2026-08-28
+
+### Added
+
+**Pending hires can be approved from the wizard's final step.**
+
+Governed `/agent-hires` requests leave the agent created but *not invokable* until the board decides. Until now the wizard only logged the approval ids and told the operator to go find them in the board UI — so a freshly provisioned company sat unable to run its bootstrap heartbeat, and the bootstrap watchdog attach failed for the same reason. The Done step now lists the pending hires and offers an "Approve all hires" action.
+
+This does not weaken governance: provisioning still **never** auto-approves, the company's approval policy keeps its meaning, and approving is an explicit click by the operator — who is the board member holding that authority anyway. The `approve-pending-hires` action re-reads the pending set server-side and intersects it with any requested ids, so it can only ever approve `hire_agent` approvals; a caller cannot use it to resolve a budget or strategy approval.
+
+New API-client methods `listApprovals(companyId, { status })` and `approveApproval(approvalId, { decisionNote })`, plus the `list-pending-hires` and `approve-pending-hires` worker actions.
+
+## [0.5.2] - 2026-08-28
+
+### Added
+
+**Shared project workspaces are now provisioned with a concurrency guard.**
+
+Projects are provisioned with an explicit `executionWorkspacePolicy` carrying `sharedWorkspaceConcurrency: "serialize"`. Previously the wizard emitted no policy at all whenever isolated worktrees were not in play and let the server fall back to `shared_workspace` with `auto` concurrency — and `auto` only serializes runs on non-local environments. On a local driver that meant every agent run entered the *same* working tree at once and collided on git index and branch state. With `serialize`, a run defers while another holds the workspace; the deferral is bounded by holder liveness (60–120 s backoff), not by an attempt counter, so a deferred run resumes rather than starving.
+
+The guard is applied on every resolution path (shared, isolated, and the deferred-isolation path for fresh local repos) and is carried into the project-creation step the CEO follows in BOOTSTRAP.md, so CEO-created projects do not silently fall back to `auto`. A project that pins its own `sharedWorkspaceConcurrency` keeps it.
+
+Per-issue isolation is unaffected: Paperclip resolves an issue's `executionWorkspaceSettings.mode` before consulting the project policy, so the `backlog-health` guidance to give every top-level issue its own worktree still wins. `backlog-process.md` now explains the interplay — serialization protects git state, but only isolation buys parallelism.
+
+### Fixed
+
+- A project policy that set only some fields (for example just `sharedWorkspaceConcurrency`) was forwarded verbatim without `enabled`, which Paperclip's project-policy schema requires — the project creation would have failed with a 400. Every resolution path now defaults `enabled` to `true`.
+- Corrected the deferred-isolation note in BOOTSTRAP.md, which claimed `executionWorkspacePolicy` was "intentionally omitted" for fresh local repos. A shared-workspace policy is now emitted; what is deferred is the isolated `git_worktree` mode.
+
+## [0.5.1] - 2026-08-28
+
+Compatibility review against Paperclip as of 2026-08-26. No API breakage was found: all 30 REST endpoints used by `src/api/client.js`, all 22 endpoints taught to agents in templates, every `paperclipRole` value, the declared manifest capabilities, and the agent-hire/issue/routine/project/skill payloads all still validate against the current server. The changes below correct staleness that accumulated since the last review.
+
+### Changed
+
+- **Codex model default is now `gpt-5.6-sol` instead of the bare `gpt-5.6` alias** (`DEFAULT_CEO_MODEL`, `roles/ceo/role.meta.json`, and the CEO-setup suggestion list). OpenAI publishes no model metadata for the bare slug, so the Codex CLI warns (`Model metadata for gpt-5.6 not found`) and falls back to generic context-window limits. Paperclip's `codex_local` adapter still rewrites the alias for legacy agents, but new companies are no longer provisioned onto it. This also matches the OpenAI company-generation path, which already used `gpt-5.6-sol`.
+- Added `claude-opus-5` and `claude-sonnet-5` to the Claude model suggestions; both ship in Paperclip's `claude_local` adapter and the plugin already advertises Opus 5 for AI company generation.
+- Added the `gemini_local`, `grok_local`, `kimi_local`, and `pi_local` adapters to the CEO-setup picker, which had drifted behind Paperclip's built-in `AGENT_ADAPTER_TYPES`.
+- Bumped `@paperclipai/plugin-sdk` and `@paperclipai/shared` from `2026.722.0` to `2026.824.1`. The host-method surface diff is purely additive (9 new methods, none removed), and typecheck, build, and both test suites pass unchanged.
+
+### Fixed
+
+- **`stall-detection` no longer races Paperclip's own review-path recovery.** Paperclip now maintains the `in_review` review path as an invariant and queues an `issue_review_path_lost` wake to repair it. The skill records that as `WAITING-REVIEW-PATH-RECOVERY` and stands down, intervening only when the recovery is absent or has itself gone stale.
+- **`stall-detection` no longer retries denied cross-issue repairs.** Paperclip contains cross-issue agent writes, so a `403 ... outside this actor's authorization boundary` is final. The skill now records the denial and escalates to the responsible human in the same pass instead of looping on a call that cannot succeed.
+
+## [0.5.0] - 2026-08-10
+
+### Added
+
+- AI company generation can now use a governed OpenAI API key as an alternative to Anthropic. The OpenAI path uses the Responses API with `gpt-5.6-sol` and high reasoning effort.
+- Added an `aiProvider` plugin setting (`anthropic` or `openai`) and an `openaiApiKey` governed Secret field. Existing configurations remain on Anthropic by default.
+
+### Changed
+
+- Anthropic generation now uses `claude-opus-5` with adaptive thinking, max effort, and a 65,536-token output ceiling. Text extraction ignores thinking blocks and returns only final text blocks.
+- Both providers use the existing asynchronous start/poll generation path, keeping API keys and resolved Secret values inside the worker.
+- Incomplete, truncated, empty, or refused provider responses fail the generation job instead of being accepted as a valid company configuration.
+
+## [0.4.23] - 2026-08-10
+
+### Fixed
+
+- Anthropic configuration now accepts both direct/legacy string keys and Paperclip's object-shaped governed Secret bindings. Selecting a `local_encrypted` company Secret no longer fails the host's `instanceConfigSchema` validation before the binding can be authorized and persisted.
+
 ## [0.4.22] - 2026-08-10
 
 ### Fixed

package/README.md

@@ -7,7 +7,7 @@
     <a href="https://www.npmjs.com/package/@starlein/paperclip-plugin-company-wizard"><img src="https://img.shields.io/npm/v/@starlein/paperclip-plugin-company-wizard?color=cb3837&label=npm" alt="npm version"></a>
     <a href="https://github.com/starlein/paperclip-plugin-company-wizard/actions/workflows/ci.yml"><img src="https://github.com/starlein/paperclip-plugin-company-wizard/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
     <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="License"></a>
-    <a href="https://nodejs.org"><img src="https://img.shields.io/badge/node-%3E%3D20-brightgreen" alt="Node.js"></a>
+    <a href="https://nodejs.org"><img src="https://img.shields.io/badge/node-%3E%3D24.11-brightgreen" alt="Node.js"></a>
   </p>
 <hr>
   <img src="https://raw.githubusercontent.com/starlein/paperclip-plugin-company-wizard/main/docs/GIF-Screencast-Paperclip-Plugin-Company-Wizard.gif" alt="Screencast Paperclip Plugin Company Wizard" height="240">
@@ -15,9 +15,13 @@
 
 ---
 
-> **Fork:** This is a community-maintained fork of [yesterday-AI/paperclip-plugin-company-wizard](https://github.com/yesterday-AI/paperclip-plugin-company-wizard), updated for Paperclip plugin API v1 and the current published SDK with substantial bug fixes. End-to-end company setup is governed through current Paperclip workflows as of v0.4.22.
+> **Fork:** This is a community-maintained fork of [yesterday-AI/paperclip-plugin-company-wizard](https://github.com/yesterday-AI/paperclip-plugin-company-wizard), updated for Paperclip plugin API v1 and the current published SDK with substantial bug fixes. End-to-end company setup is governed through current Paperclip workflows as of v0.5.0.
 
-**Update Company:** If you have provisioned your company before with some older version of this plugin or you have an existing company, since version 0.4.6 you can update your existing company by providing the company ID in the wizard summary page. It will make a soft update of agent instructions and workflow/instruction documents.
+**Version 0.6.2:** re-reviewed against Paperclip master through 2026-09-06. Fixes routines that were silently rejected (invalid `concurrencyPolicy`) or rendered as `undefined` in the bootstrap issue, repoints instructions at Skills Store slugs and working-directory doc paths, and corrects the review-gate error/round-cap guidance. 0.6.1 consolidated PRs #44, #46 and #47 with run-scoped hire approvals and explicit bootstrap start. See [compatibility notes](docs/PAPERCLIP-COMPATIBILITY.md).
+
+Requires Node **24.11+**, matching the current Paperclip SDK/shared runtime requirement.
+
+**Update Company:** select an existing company to refresh its agent instructions, documents, skills, routines, and live project execution policies. Preview shows policy changes; existing workspace paths, explicit operator policies, and goal links are preserved. Partial failures never delete an existing company.
 
 <details>
 <summary><strong>What changed vs. upstream</strong></summary>
@@ -26,8 +30,8 @@
 
 - Bootstrap metadata fields renamed to match the Paperclip API exactly: `parentId`, `assigneeAgentId`, `projectId`, `goalIds`
 - CEO is provisioned with correct `capabilities` metadata so newly created CEOs are no longer saved with empty summaries
-- The manifest installation floor uses Paperclip's package semver (`>=0.3.1`) rather than the SDK release CalVer, allowing compatible source-derived and `npx paperclipai` hosts that report `0.3.1`; plugin API and declared-capability validation remain the authoritative install-time compatibility checks
-- `@paperclipai/plugin-sdk` and `@paperclipai/shared` declared as `peerDependencies` with minimum version `>=2026.707.0` — the host provides the SDK at runtime (externalized from the bundle)
+- No numeric manifest host floor: current Paperclip source initializes its plugin loader with `0.0.0`, unrelated to SDK release versions. Plugin API and declared-capability validation remain active; older hosts are not implied to be supported
+- `@paperclipai/plugin-sdk` and `@paperclipai/shared` use tested stable `2026.831.1`, with peer floor `>=2026.831.1`; the host provides the externalized SDK at runtime
 - `security-engineer` role now maps to the dedicated Paperclip `security` enum value (was `general`)
 
 #### Bootstrap reliability
@@ -53,8 +57,8 @@
 
 #### AI wizard
 
-- Config generation uses `claude-opus-4-8` with `max_tokens: 32768` so a full-spec config is never truncated mid-JSON
-- All Anthropic calls run as background jobs in the worker (start + poll), eliminating the 30 s RPC timeout that previously crashed config generation
+- Choose Anthropic or OpenAI in plugin settings. Anthropic generation uses `claude-opus-5` with adaptive thinking, max effort, and a 65,536-token ceiling; OpenAI/Codex generation uses `gpt-5.6-sol` with high reasoning effort and the same output ceiling.
+- All provider calls run as background jobs in the worker (start + poll), eliminating the 30 s RPC timeout that previously crashed config generation
 - AI wizard now generates domain-specific initial issues from the project brief that lead the bootstrap backlog ahead of generic scaffolding issues
 - Preset roles are defensively merged with AI-selected roles so preset roles are no longer silently dropped
 
@@ -67,7 +71,7 @@
 
 - **Existing-company provisioning** — target an existing Paperclip company instead of creating a new one (`existingCompanyId`); partial-failure cleanup never deletes existing companies
 - **Governed agent hiring** — submits agent creation through `/agent-hires`, preserves pending approval IDs, and does not auto-approve board-gated hires
-- **`disableBoardApprovalOnNewCompanies` setting** — optionally patches new companies to skip board approval for fully-autonomous bootstrap
+- **Explicit approval and bootstrap controls** — select pending hires from this run, approve them with board authority, then explicitly start bootstrap; the wizard never disables the company's approval policy
 - **Repository workspace setup** — choose between a fresh local Git repo or an existing external repository (GitHub, GitLab, etc.) via the manual wizard step or inline on the review/summary screen (available in both the manual and AI paths; the external option opens a repo-URL field)
 - **Routine schedules** tightened to run every few hours around the clock (auto-assign every 2 h, stall-detection every 3 h, backlog grooming every 4 h) with `skip_if_active` concurrency policy
 - **"Update templates" button** on the onboarding screen — deletes the cached templates dir and re-downloads from GitHub without restarting the plugin
@@ -85,7 +89,7 @@
 ## Why Company Wizard?
 
 - 🗣️ **Describe it, don't configure it.** AI mode reads a plain-language brief and picks the right preset, modules, and roles for you. Manual mode is there for the steps you want to control yourself.
-- 🧩 **Composable, not monolithic.** 15 curated presets layered from 26 modules and 17 roles. Mix and match freely — modules add skills, tasks, and heartbeat logic to the roles that are present, and degrade gracefully when they're not.
+- 🧩 **Composable, not monolithic.** 15 curated presets layered from 27 modules and 17 roles. Mix and match freely — modules add skills, tasks, and heartbeat logic to the roles that are present, and degrade gracefully when they're not.
 - 🤝 **Works from day one with a single CEO.** Every capability has an owner chain. Add a specialist and responsibilities shift to them automatically; leave one out and the next-best person — ultimately the CEO — steps in. No setup ever leaves a gap.
 - ✏️ **Review and edit before anything ships.** Preview every generated file, tweak a persona, workflow, or the repository setup inline on the review screen, then provision.
 - 🚀 **Real end-to-end provisioning.** Not just scaffolded files — it creates the company, CEO, goals, projects, and backlog in Paperclip via the API. Target a brand-new or existing company, with a fresh local or existing external Git repo.
@@ -286,6 +290,7 @@ Modules are composable capabilities you layer on top of the base team. Each modu
 | :----- | :----------- | :----------- |
 | **`github-repo`** | Git workflow and commit conventions | Engineer initializes repo |
 | **`pr-review`** | PR-based review workflow | Engineer configures PR workflow and branch protection (requires PRs, no approval gate) |
+| **`lean-delivery`** | Optional single merge gate, risk-triggered evidence, and bounded WIP (requires `pr-review`) | — |
 | **`backlog`** | Auto-generate issues from goals when backlog runs low | Primary owner creates initial backlog |
 | **`auto-assign`** | Assign unassigned issues to idle agents | — |
 | **`stall-detection`** | Detect stuck handovers, nudge or escalate | — |
@@ -346,11 +351,17 @@ Git workflow and commit conventions.
 
 PR-based review workflow. Requires `github-repo`. Activates with `code-reviewer`, `product-owner`, `ui-designer`, `ux-researcher`, `qa`, or `devops`.
 
-Reviews run through the issue's native `executionPolicy` (stages), not child issues: a `review` stage for QA when present, a `review` stage for the Security Engineer only on security-relevant changes, an `approval` stage for the Product Owner when present, then a final `approval` **merge gate** owned by the Code Reviewer (a non-author) — who is woken last to merge the PR before recording the verdict that closes the issue. The merge gate is deliberately the last stage so the Product Owner's approval does not auto-close the issue with the PR still open. The engineer (the issue's executor) is never a stage participant — Paperclip excludes the original executor, so a self-stage stalls with `422 No eligible approval participant`; this is why the merge gate is the Code Reviewer, not the engineer. Domain reviewers (UI Designer, UX Researcher, DevOps) are advisory — they post PR comments and escalate concerns to a blocking reviewer; they are never themselves a stage. When no Code Reviewer is on the team, no `executionPolicy` stages are set and the engineer self-merges via `gh pr merge <N> --merge` (PR Self-Merge Flow).
+Standard review uses the issue's native `executionPolicy`: QA review when present, Security review only for security-relevant changes, Product Owner approval when present, then a non-author Code Reviewer **merge gate**. The merge owner verifies the exact reviewed head, merges the PR, and only then records approval to close the issue. Omit absent roles and the executor from every stage — Paperclip excludes the author and an author-only stage stalls. Without an eligible non-author Code Reviewer, set no stages and use `gh pr merge <N> --merge` (PR Self-Merge Flow).
 
 - **Task:** Engineer configures PR workflow and branch protection (requires PRs, no approval gate)
 - **Doc:** `docs/pr-conventions.md`
 
+#### lean-delivery (optional)
+
+Select **`lean-delivery`** in the setup wizard's **Modules** step; `pr-review` and `github-repo` are automatically included as dependencies. It is not selected by any built-in preset. Deselect it to keep standard review. In AI setup, explicitly request lean delivery.
+
+With this module, the policy has exactly one default stage: the non-author Code Reviewer merge gate. Product acceptance is finalized before implementation; QA, Security, Product, UI/UX, and DevOps provide risk-triggered same-issue evidence instead of serial executionPolicy stages. The `docs/lean-delivery.md` contract uses advisory queue signals, not a fixed PR-count gate. In both modes, real dependencies, workspace safety, required CI, and explicit company capacity policies remain binding. Selecting this module never disables repository protections.
+
 #### backlog
 
 Owns the product backlog lifecycle — from goal decomposition to a steady pipeline of actionable issues.
@@ -594,17 +605,20 @@ Configure the plugin via **Settings → Plugins → Company Wizard** in the Pape
 | Field | Required | Description |
 | --- | --- | --- |
 | `companiesDir` | No | Where assembled company workspaces are written. Defaults to `~/.paperclip/instances/default/companies`. Override for Docker setups. |
-| `templatesPath` | No | Path to the templates directory. Defaults to `~/.paperclip/plugin-templates` (auto-downloaded from `templatesRepoUrl` if missing). |
-| `templatesRepoUrl` | No | GitHub tree URL to pull templates from when the templates directory does not exist. Defaults to the official @starlein/paperclip-plugin-company-wizard templates. |
+| `templatesPath` | No | Existing operator-managed template directory. Never overwritten by refresh. Default: bundled templates from this installed plugin release. |
+| `templatesRepoUrl` | No | Custom GitHub tree URL opts into a source-specific remote cache. The official default uses bundled templates. Refresh explicitly before preview to update a custom source. |
 | `paperclipUrl` | No | Paperclip instance URL. Defaults to `http://localhost:3100` or `PAPERCLIP_PUBLIC_URL` env var. |
 | `paperclipEmail` | No | Board login email. Required for authenticated (non-`local_trusted`) instances. |
 | `paperclipPassword` | No | Board login password. Stored as a secret ref. |
-| `anthropicApiKey` | No | Anthropic API key for AI wizard mode. Stored as a secret ref. Required to use the AI-powered setup path. |
-| `disableBoardApprovalOnNewCompanies` | No | If `true`, the wizard PATCHes new companies to set `requireBoardApprovalForNewAgents=false` during provisioning. Leave `false` to preserve approval-gated hiring. Defaults to `false`. |
+| `aiProvider` | No | AI wizard provider: `anthropic` (default) or `openai`. |
+| `anthropicApiKey` | No | Anthropic API key for AI wizard mode. Stored as a governed secret ref. Required when `aiProvider` is `anthropic`. |
+| `openaiApiKey` | No | OpenAI API key for GPT/Codex AI wizard mode. Stored as a governed secret ref. Required when `aiProvider` is `openai`. |
 For enriched personas: there is no plugin setting. Template fragments are applied automatically when present.
 
 For isolated worktrees: there is no plugin setting. The policy is controlled by Paperclip instance settings under **Settings → Instance → Experimental → enableIsolatedWorkspaces** and is consumed by the plugin during provisioning. External repository base refs are taken from project/worktree settings; leaving the ref blank lets Paperclip resolve its default instead of the wizard inventing `main`, `master`, or `origin/*`.
 
+**Shared workspace guard:** new policies default to `sharedWorkspaceConcurrency: "serialize"`. Current Paperclip enforces this only for project-bound shared runs when `enableIsolatedWorkspaces` and the project policy are enabled. Explicit `auto`/`allow` and per-issue settings can override it; the wizard preserves these choices and does not turn on instance settings. A stored policy alone is not proof that a run is serialized.
+
 <br>
 
 ## Development
@@ -818,7 +832,7 @@ Create `templates/presets/<name>/preset.meta.json`:
 6. Creates scheduled routines with board authority and links them to the pre-created main project when needed
 7. Creates a **Bootstrap task** assigned to the CEO
 
-The CEO then continues setup on its first heartbeat: approve/confirm any pending hire gates, create goals and initial backlog issues, link pre-created projects to goals when needed, and start normal assigned-work workflows. If provisioning fails after a **new** company is created, the partial company is automatically deleted — existing target companies are never deleted on error.
+On the final step, review and approve selected pending hires, then click **Start bootstrap**. The CEO creates remaining goals/backlog work and links newly created projects where needed; existing project goal links remain untouched. Starting is separate from approval, and normal scheduled/assignment wakes remain governed by Paperclip. If provisioning fails after a **new** company is created, the partial company is automatically deleted — existing target companies are never deleted on error.
 
 <br>
 

package/dist/manifest.js

@@ -2,16 +2,16 @@
 var manifest = {
   id: "starlein.paperclip-plugin-company-wizard",
   apiVersion: 1,
-  version: "0.4.22",
+  version: "0.6.2",
   displayName: "Company Wizard",
   description: "AI-powered wizard to bootstrap agent companies from composable templates",
   author: "Sascha Pietrowski <sp@speednetwork.de>",
   categories: ["workspace", "ui"],
-  // Some source-derived and npx installations report Paperclip's package
-  // semver instead of its release CalVer. API shape is gated separately by
-  // apiVersion and capability validation, so keep the install floor on the
-  // package-version axis rather than rejecting an otherwise compatible host.
-  minimumHostVersion: "0.3.1",
+  // No numeric host floor: the loader compares this against the host version
+  // `createApp` resolves (git describe → stamped build version → the server
+  // package version), so a packaged install reports its package version (0.3.1)
+  // and `compareSemver` would reject any CalVer floor on a current host.
+  // Keep API v1/capabilities explicit and validate feature availability at runtime.
   capabilities: [
     "companies.read",
     "issues.create",
@@ -38,18 +38,33 @@ var manifest = {
       },
       templatesPath: {
         type: "string",
-        description: "Path to the templates directory. Auto-detected: ~/plugin-templates in Docker setups, ~/.paperclip/plugin-templates otherwise. Rarely needs manual override."
+        description: "Optional operator-managed templates directory. Defaults to templates bundled with this plugin release. Local files are never overwritten by refresh."
       },
       templatesRepoUrl: {
         type: "string",
         default: "https://github.com/starlein/paperclip-plugin-company-wizard/tree/main/templates",
-        description: "GitHub tree URL for template downloads. The default is correct for most setups \u2014 only change this if using a custom fork."
+        description: "Optional custom GitHub tree URL. The official default uses bundled release templates; a custom URL opts into a refreshable remote cache."
       },
-      anthropicApiKey: {
+      aiProvider: {
         type: "string",
+        enum: ["anthropic", "openai"],
+        default: "anthropic",
+        description: "AI provider used for company generation. Anthropic uses Claude Opus 5 at max effort; OpenAI uses GPT-5.6 Sol at high reasoning effort."
+      },
+      anthropicApiKey: {
+        // Paperclip's secret picker submits an EnvSecretRefBinding object,
+        // while direct keys and older hosts still submit strings. Keep both
+        // representations schema-valid; the host validates governed bindings
+        // and the worker resolves them before calling Anthropic.
+        type: ["string", "object"],
         format: "secret-ref",
         description: "Anthropic API key for the AI wizard. Paste a key or select a saved Paperclip company secret; Paperclip stores pasted values as governed secret references."
       },
+      openaiApiKey: {
+        type: ["string", "object"],
+        format: "secret-ref",
+        description: "OpenAI API key for GPT/Codex company generation. Paste a key or select a saved Paperclip company secret; required when AI Provider is openai."
+      },
       paperclipUrl: {
         type: "string",
         description: "Paperclip instance URL. Defaults to http://localhost:3100 or the PAPERCLIP_PUBLIC_URL env var."

package/dist/manifest.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/manifest.ts"],
-  "sourcesContent": ["import type { PaperclipPluginManifestV1 } from '@paperclipai/plugin-sdk';\n\nconst manifest: PaperclipPluginManifestV1 = {\n  id: 'starlein.paperclip-plugin-company-wizard',\n  apiVersion: 1,\n  version: '0.4.22',\n  displayName: 'Company Wizard',\n  description: 'AI-powered wizard to bootstrap agent companies from composable templates',\n  author: 'Sascha Pietrowski <sp@speednetwork.de>',\n  categories: ['workspace', 'ui'],\n  // Some source-derived and npx installations report Paperclip's package\n  // semver instead of its release CalVer. API shape is gated separately by\n  // apiVersion and capability validation, so keep the install floor on the\n  // package-version axis rather than rejecting an otherwise compatible host.\n  minimumHostVersion: '0.3.1',\n  capabilities: [\n    'companies.read',\n    'issues.create',\n    'issues.read',\n    'issues.update',\n    'goals.create',\n    'goals.read',\n    'agents.read',\n    'projects.read',\n    'skills.managed',\n    'plugin.state.read',\n    'plugin.state.write',\n    'secrets.read-ref',\n    'events.subscribe',\n    'ui.page.register',\n    'ui.sidebar.register',\n  ],\n  instanceConfigSchema: {\n    type: 'object',\n    properties: {\n      companiesDir: {\n        type: 'string',\n        description:\n          'Directory where assembled company workspaces are written. Auto-detected: ~/instances/default/companies in Docker setups, ~/.paperclip/instances/default/companies otherwise. Rarely needs manual override.',\n      },\n      templatesPath: {\n        type: 'string',\n        description:\n          'Path to the templates directory. Auto-detected: ~/plugin-templates in Docker setups, ~/.paperclip/plugin-templates otherwise. Rarely needs manual override.',\n      },\n      templatesRepoUrl: {\n        type: 'string',\n        default: 'https://github.com/starlein/paperclip-plugin-company-wizard/tree/main/templates',\n        description:\n          'GitHub tree URL for template downloads. The default is correct for most setups \u2014 only change this if using a custom fork.',\n      },\n      anthropicApiKey: {\n        type: 'string',\n        format: 'secret-ref',\n        description:\n          'Anthropic API key for the AI wizard. Paste a key or select a saved Paperclip company secret; Paperclip stores pasted values as governed secret references.',\n      },\n      paperclipUrl: {\n        type: 'string',\n        description:\n          'Paperclip instance URL. Defaults to http://localhost:3100 or the PAPERCLIP_PUBLIC_URL env var.',\n      },\n      paperclipEmail: {\n        type: 'string',\n        description: 'Board login email (for authenticated instances).',\n      },\n      paperclipPassword: {\n        type: 'string',\n        description: 'Board login password (for authenticated instances).',\n      },\n    },\n  },\n  entrypoints: {\n    worker: './dist/worker.js',\n    ui: './dist/ui',\n  },\n  ui: {\n    slots: [\n      {\n        type: 'page',\n        id: 'company-wizard',\n        displayName: 'Company Wizard',\n        exportName: 'WizardPage',\n        routePath: 'company-creator',\n      },\n      {\n        type: 'sidebar',\n        id: 'company-wizard-link',\n        displayName: 'Create Company',\n        exportName: 'SidebarLink',\n      },\n    ],\n  },\n};\n\nexport default manifest;\n"],
-  "mappings": ";AAEA,IAAM,WAAsC;AAAA,EAC1C,IAAI;AAAA,EACJ,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,aAAa;AAAA,EACb,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,YAAY,CAAC,aAAa,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9B,oBAAoB;AAAA,EACpB,cAAc;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,sBAAsB;AAAA,IACpB,MAAM;AAAA,IACN,YAAY;AAAA,MACV,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA,eAAe;AAAA,QACb,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA,kBAAkB;AAAA,QAChB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,aACE;AAAA,MACJ;AAAA,MACA,iBAAiB;AAAA,QACf,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,aACE;AAAA,MACJ;AAAA,MACA,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA,gBAAgB;AAAA,QACd,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,mBAAmB;AAAA,QACjB,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,IAAI;AAAA,EACN;AAAA,EACA,IAAI;AAAA,IACF,OAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,WAAW;AAAA,MACb;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,aAAa;AAAA,QACb,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,mBAAQ;",
+  "sourcesContent": ["import type { PaperclipPluginManifestV1 } from '@paperclipai/plugin-sdk';\n\nconst manifest: PaperclipPluginManifestV1 = {\n  id: 'starlein.paperclip-plugin-company-wizard',\n  apiVersion: 1,\n  version: '0.6.2',\n  displayName: 'Company Wizard',\n  description: 'AI-powered wizard to bootstrap agent companies from composable templates',\n  author: 'Sascha Pietrowski <sp@speednetwork.de>',\n  categories: ['workspace', 'ui'],\n  // No numeric host floor: the loader compares this against the host version\n  // `createApp` resolves (git describe \u2192 stamped build version \u2192 the server\n  // package version), so a packaged install reports its package version (0.3.1)\n  // and `compareSemver` would reject any CalVer floor on a current host.\n  // Keep API v1/capabilities explicit and validate feature availability at runtime.\n  capabilities: [\n    'companies.read',\n    'issues.create',\n    'issues.read',\n    'issues.update',\n    'goals.create',\n    'goals.read',\n    'agents.read',\n    'projects.read',\n    'skills.managed',\n    'plugin.state.read',\n    'plugin.state.write',\n    'secrets.read-ref',\n    'events.subscribe',\n    'ui.page.register',\n    'ui.sidebar.register',\n  ],\n  instanceConfigSchema: {\n    type: 'object',\n    properties: {\n      companiesDir: {\n        type: 'string',\n        description:\n          'Directory where assembled company workspaces are written. Auto-detected: ~/instances/default/companies in Docker setups, ~/.paperclip/instances/default/companies otherwise. Rarely needs manual override.',\n      },\n      templatesPath: {\n        type: 'string',\n        description:\n          'Optional operator-managed templates directory. Defaults to templates bundled with this plugin release. Local files are never overwritten by refresh.',\n      },\n      templatesRepoUrl: {\n        type: 'string',\n        default: 'https://github.com/starlein/paperclip-plugin-company-wizard/tree/main/templates',\n        description:\n          'Optional custom GitHub tree URL. The official default uses bundled release templates; a custom URL opts into a refreshable remote cache.',\n      },\n      aiProvider: {\n        type: 'string',\n        enum: ['anthropic', 'openai'],\n        default: 'anthropic',\n        description:\n          'AI provider used for company generation. Anthropic uses Claude Opus 5 at max effort; OpenAI uses GPT-5.6 Sol at high reasoning effort.',\n      },\n      anthropicApiKey: {\n        // Paperclip's secret picker submits an EnvSecretRefBinding object,\n        // while direct keys and older hosts still submit strings. Keep both\n        // representations schema-valid; the host validates governed bindings\n        // and the worker resolves them before calling Anthropic.\n        type: ['string', 'object'],\n        format: 'secret-ref',\n        description:\n          'Anthropic API key for the AI wizard. Paste a key or select a saved Paperclip company secret; Paperclip stores pasted values as governed secret references.',\n      },\n      openaiApiKey: {\n        type: ['string', 'object'],\n        format: 'secret-ref',\n        description:\n          'OpenAI API key for GPT/Codex company generation. Paste a key or select a saved Paperclip company secret; required when AI Provider is openai.',\n      },\n      paperclipUrl: {\n        type: 'string',\n        description:\n          'Paperclip instance URL. Defaults to http://localhost:3100 or the PAPERCLIP_PUBLIC_URL env var.',\n      },\n      paperclipEmail: {\n        type: 'string',\n        description: 'Board login email (for authenticated instances).',\n      },\n      paperclipPassword: {\n        type: 'string',\n        description: 'Board login password (for authenticated instances).',\n      },\n    },\n  },\n  entrypoints: {\n    worker: './dist/worker.js',\n    ui: './dist/ui',\n  },\n  ui: {\n    slots: [\n      {\n        type: 'page',\n        id: 'company-wizard',\n        displayName: 'Company Wizard',\n        exportName: 'WizardPage',\n        routePath: 'company-creator',\n      },\n      {\n        type: 'sidebar',\n        id: 'company-wizard-link',\n        displayName: 'Create Company',\n        exportName: 'SidebarLink',\n      },\n    ],\n  },\n};\n\nexport default manifest;\n"],
+  "mappings": ";AAEA,IAAM,WAAsC;AAAA,EAC1C,IAAI;AAAA,EACJ,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,aAAa;AAAA,EACb,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,YAAY,CAAC,aAAa,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9B,cAAc;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,sBAAsB;AAAA,IACpB,MAAM;AAAA,IACN,YAAY;AAAA,MACV,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA,eAAe;AAAA,QACb,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA,kBAAkB;AAAA,QAChB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,aACE;AAAA,MACJ;AAAA,MACA,YAAY;AAAA,QACV,MAAM;AAAA,QACN,MAAM,CAAC,aAAa,QAAQ;AAAA,QAC5B,SAAS;AAAA,QACT,aACE;AAAA,MACJ;AAAA,MACA,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKf,MAAM,CAAC,UAAU,QAAQ;AAAA,QACzB,QAAQ;AAAA,QACR,aACE;AAAA,MACJ;AAAA,MACA,cAAc;AAAA,QACZ,MAAM,CAAC,UAAU,QAAQ;AAAA,QACzB,QAAQ;AAAA,QACR,aACE;AAAA,MACJ;AAAA,MACA,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,aACE;AAAA,MACJ;AAAA,MACA,gBAAgB;AAAA,QACd,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,mBAAmB;AAAA,QACjB,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,IAAI;AAAA,EACN;AAAA,EACA,IAAI;AAAA,IACF,OAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,WAAW;AAAA,MACb;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,aAAa;AAAA,QACb,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,mBAAQ;",
   "names": []
 }