claude-company 0.2.4 → 0.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-company",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "An AI software company you drop into your repo - hierarchical, hard-gated SDLC for Claude Code",
   "license": "MIT",
   "author": "redomic",
@@ -44,6 +44,7 @@
     "!company/specs/**",
     "!company/briefs/**",
     "!company/change-requests/**",
+    "!company/state/**",
     "docs/",
     "LICENSE",
     "README.md"

package/company/state/DECISIONS.md

@@ -1,22 +0,0 @@
-# DECISIONS - owner escalations and outcomes
-
-_Questions only the owner may answer (money, invariants, deploys, scope,
-business policy), with what was decided and when. Agents run on tagged
-fallbacks until a row lands here._
-
-| # | Date | Question | Decision | Affects |
-|---|---|---|---|---|
-| 1 | 2026-07-09 | Adopt model tiering (developer/QA to sonnet)? | VETOED - every role stays opus | models.json |
-| 2 | 2026-07-09 | Program scope from the framework research | Hard-gate-fitting features only; lessons loop + loop workers DEFERRED | program plan |
-| 3 | 2026-07-10 | Adoption program delivery (waves 1-3, PRs 27/33/34/32/35) | ACCEPTED - owner authorized end-to-end merge; CEO merged and verified integrated main | whole repo |
-| 4 | 2026-07-10 | delegation-enforcement delivery (5 layers + tracking gate, PR #49, issues #42-#47) | ACCEPTED - owner: "merge everything and close out"; merged f9e5dae, integrated main verified (213+31 green), witnesses W-011..W-013 | hooks, doctrine, settings |
-| 5 | 2026-07-10 | Enforcement design direction | Owner REJECTED budgets/role bans twice; approved principle-derived gates (mechanism 5 + written-record consistency) and demanded low-token injection + GitHub tracking gate | all future gate design |
-| 6 | 2026-07-15 | cli-update delivery (update subcommand + provenance manifest, PR #57, issues #54-#56) | ACCEPTED - owner: "test it, the merge it to main"; CEO re-tested end-to-end (edit kept, .new written, deleted file restored, config untouched), merged 7726c99, integrated main verified (213 hooks + 40 CLI + 56 engine green), witnesses W-014..W-016 | CLI, installer, frozen registry |
-| 7 | 2026-07-15 | cli-self-update delivery (update refreshes the CLI first via npx handoff, PR #60, issue #59) | ACCEPTED - owner: "push to main, then to npm"; merged a09b463, integrated main verified (213 + 57 green), witnesses W-017..W-018 | CLI driver |
-| 8 | 2026-07-15 | Release v0.2.0 to npm (tag v0.2.0 at 5913374; notes: PR #57/#60 bodies) | PUBLISHED 2026-07-15 by the OWNER manually from the clean tag clone (link-based npm 2FA - publishes are always owner-manual or git-CI, never agent-run). Registry verified: dist-tags.latest 0.2.0. Semver minor | npm registry |
-| 9 | 2026-07-15 | DevMesh migration (owner: "use claude-company on this WITHOUT breaking custom changes... preserve DevMesh specific context") | DELIVERED - umbrella root git-initialized (machinery only), primitive company ported to company/, all customizations preserved, stale docs archived (nothing deleted). Verification: invariants gate PASS, 6 frozen surfaces probe-blocked. Found+fixed upstream #67/#68 | DevMesh polyrepo |
-| 10 | 2026-07-15 | Release v0.2.1 to npm (patch: #64 enforcer arming, #67 merger fix + field-heal, #68 record-leak) | PREPPED by CEO (bump PR + tag on merge); publish is the owner's button per standing rule (link-based 2FA). SUPERSEDED by v0.2.2 (#12) before publish - registry never received 0.2.1 | npm registry |
-| 11 | 2026-07-22 | model-routing-arming delivery (builtins enforcement + wiring gate + migration + Workflow doctrine, PR #77, issues #74-#76) | ACCEPTED - owner: "merge everything and give command to push to npm"; CEO merged cd07fb6, integrated main verified (hooks 222 + npm 61 + engine 111 green, gates stamped), live enforcement certified (contradict/bare exit 2, match 0, dormancy probe red), witnesses W-026/W-027/W-028 | hooks, models.json, installer, doctrine |
-| 12 | 2026-07-22 | Release v0.2.2 to npm (rolls up unpublished 0.2.1 + #77 model-routing arming) | PREPPED by CEO; owner pushed tag v0.2.2 (at ad3dda8) but publish SUPERSEDED by v0.2.3 (#14) which adds #83 - registry goes 0.2.0 -> 0.2.3 directly | npm registry |
-| 13 | 2026-07-23 | spawn-depth-shipping delivery (CC 2.1.21 depth-1 flattening; template env + installer env merge + guards, PR #83, issues #79-#82) | ACCEPTED - owner: "merge it"; merged 6061814, CEO independent verification (224/61/123 green, merge probes, byte-identity), witness W-029 | template settings, installer, tests |
-| 14 | 2026-07-23 | Release v0.2.3 to npm (v0.2.2 content + #83 spawn-depth) | PREPPED by CEO per owner direction ("change to v0.2.3"); owner tags v0.2.3 at the release-PR merge commit and publishes from a clean tag clone (link-based 2FA, owner-manual); notes: PR #77/#83 bodies | npm registry |

package/company/state/RESUME.md

@@ -1,215 +0,0 @@
-# RESUME / HANDOFF - read this first
-
-_The restart point. Sessions die; work must not. The CEO updates this after
-every spawn, merge, CR decision, and agent report. If a session died mid-flight,
-check each worktree's git log before respawning - work may be complete on disk
-without a report._
-
-## 1. Program state at handoff
-
-Adoption program SHIPPED 2026-07-10. Merged: #27 (wave 1), #33 (wave 2 enforce, ex-#29), #34 (wave 2 doctrine,
-ex-#30), #32 (wave 3), #35 (close-out). Integrated main verified: 147 hook
-tests + 31 CLI green, witness registry 9/9, gates_detect proposes
-witnesses/models/tests/audit. Owner acceptance recorded (DECISIONS #3).
-
-## 2. Next actions, in order
-
-00000. test-infra-fixes SHIPPED 2026-07-26 (PR #85 merged 65bd070).
-   Self-authored by the CEO in the main checkout, auditor verdict SHIP,
-   CI 9/9 green across ubuntu+macos x node 18/20/22. Integrated main
-   re-verified by the CEO: hooks 224, npm test 61/0, install 96/0, all
-   stamped. Ubuntu job log confirms `Ran 224 tests ... OK` - the 121
-   previously-invisible tests passed on their first ever CI run.
-   Two defects, both found while scoping the multi-session engagement:
-   (a) tests/hooks/run_tests.sh exec'd test_hooks.py directly, so CI ran
-       103 of 224 hook tests - the other 121, including ALL of
-       test_guard_provenance.py, never ran in CI. Now unittest discover
-       with -v (the -v preserves the per-test CI log lines that
-       unittest.main(verbosity=2) used to give).
-   (b) npm test was RED ON MAIN: tests/cli/test_cli.sh piped
-       `npm pack --dry-run --json` into JSON.parse, and npm 10.5.0 writes
-       the prepare lifecycle banner to STDOUT, so all 10 pack-manifest
-       assertions were dead (PASS 51 / FAIL 10). --silent fixes it;
-       --ignore-scripts does NOT. Auditor proved the packed file list is
-       byte-identical across npm 9/10/11 (91 files).
-   RELEASE FACTS CORRECTED 2026-07-26: v0.2.3 is ALREADY PUBLISHED on npm
-   (2026-07-25T16:17Z). Prior RESUME/STATUS claims that the registry sat
-   at 0.2.0 awaiting an owner tag were STALE - the owner had already
-   tagged and published. Registry versions: 0.1.0, 0.1.1, 0.2.0, 0.2.3.
-   Nothing needs publishing for the test-infra work: tests/ is not in the
-   pack list and company/briefs/** is excluded, so the tarball is
-   unchanged by it.
-   NEW P2 WORRY - the pack list excludes company/specs|briefs|
-   change-requests but NOT company/state, so company/state/{RESUME,STATUS,
-   WORRIES,DECISIONS}.md ship into every install. Verified against the
-   live 0.2.3 tarball: those four ARE in it. The runtime files
-   (costs.log, provenance-ledger.json, active-task.json, .cost-cursor.json,
-   gates.status) are untracked, so a CLEAN-CLONE publish leaves them out -
-   but publishing from a dirty working checkout WOULD leak them. Always
-   publish from a clean clone at the tag.
-   Next: multi-session-tasks (feature) - plan approved by the owner
-   2026-07-26 at ~/.claude/plans/flickering-painting-pony.md, core-only
-   scope. active-task.json becomes N entries; the provenance ledger stops
-   wiping itself on slug change. Phase 0 spec via product-manager first.
-   NEW P1 WORRY, directly in scope for that engagement: dispatched
-   worktree agents CANNOT COMMIT - guard_commit judges them to be on main
-   because the harness pins payload cwd to the main checkout. That turns
-   every delegated build into self-authored work needing an audit.
-
-0000. spawn-depth-shipping SHIPPED 2026-07-23 (PR #83 merged 6061814,
-   closes #79-#82; witness W-029; brief archived pending next chore
-   pass - it is tracked at company/briefs/brief-spawn-depth-shipping.md
-   on main, move to shipped/ with the next closeout PR). CC 2.1.21
-   defaulted subagent spawn depth to 1 (flattens CEO->lead->dev);
-   template now ships env CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH="2" and
-   install/update merge env additively (user values win, non-dict env
-   replaced-safe, heredocs byte-identical 3587 chars). CEO independent
-   verification: 224/61/123 all green, own merge probes (pin "3"
-   survives, bare heals to "2"), risk low. This session armed via
-   settings.local.json; memory file spawn-depth-env-required.md saved.
-   guard_tests test_scope papercut hit a THIRD time (see WORRIES P2).
-   NOTE: not on npm until the release AFTER v0.2.2 - owner still owes
-   the v0.2.2 tag+publish (DECISIONS #12), then a v0.2.3 can carry
-   spawn-depth.
-000. model-routing-arming SHIPPED 2026-07-22 (PR #77 merged cd07fb6,
-   closes #74-#76; acceptance DECISIONS #11; witnesses W-026 wiring
-   assertion / W-027 merge byte-identity / W-028 bare-builtin block).
-   Integrated main verified by CEO: hooks 222 OK, npm 61, update
-   engine 111, --check 0, trace 21/21 after citation fix, live
-   certification (contradict/bare exit 2, match 0; dormancy probe:
-   Task|Agent group stripped -> --check exit 1 + fix-it). Worktree
-   and task branch removed; brief+spec archived to shipped/.
-   RELEASE 0.2.2 MERGED (PR #78, merge commit ad3dda8; task
-   release-0.2.2-closeout closed; audits recorded approved after the
-   verdict-parser workaround - see WORRIES P2). Integrated main green
-   + stamped (223/61/111), registry sealed 27/27. AWAITING OWNER
-   BUTTONS ONLY: tag v0.2.2 at ad3dda8, push tag, npm publish from a
-   clean tag clone (memory: npm-publish-owner-only; registry still on
-   0.2.0 - both 0.2.1 and 0.2.2 unpublished until then). Next chore
-   pass: archive brief-release-0.2.2-closeout.md to shipped/, file
-   the guard_provenance verdict-parser issue and the guard_tests
-   test_scope-from-main issue from WORRIES. Near-miss worth
-   remembering: a .format arg mismatch made the wrong-override path
-   fail OPEN until the live replay caught it - pinned by
-   test_builtin_spawn_wrong_override_blocked.
-00. provenance-shipping SHIPPED 2026-07-15 (PR #65, d624cc3, closes #64;
-   witnesses W-019/W-020, 20/20): fresh installs now ship
-   company/provenance.json (enforcer armed by default); update NEVER
-   auto-arms, prints one notice line. Owner field audit found the gap.
-   PENDING OWNER BUTTON: 0.2.1 patch release to npm (0.2.0 on the
-   registry still has the gap - fresh 0.2.0 installs stay dormant).
-   Same flow as 0.2.0: bump PR, tag, owner publishes from clean tag
-   clone (memory: npm-publish-owner-only). Field guidance given: owner's
-   research repo stays disarmed until they create provenance.json after
-   Jul 28; gitignore data/ to stop stop_gate churn from training jobs.
-0. cli-update SHIPPED 2026-07-15: PR #57 merged (7726c99, closes #54-#56),
-   owner acceptance DECISIONS #6, witnesses W-014..W-016 recorded (16/16),
-   spec+brief archived to shipped/, worktree+branch removed, integrated main
-   verified (hooks 213 OK, npm 40, engine 56, gates stamped green).
-   Close-out PR from chore/cli-update-closeout in flight if session died -
-   check that branch before redoing. WORRIES has 3 rows from this task
-   (merge heredoc duplication P2, python3 spawn-per-file P3, fail-open
-   emission P3).
-0b. delegation-gate exploration DONE 2026-07-15: NOT an issue - md/json and
-   company//.claude//docs//.github/ paths are exempt via guard_spec.is_source
-   (proven by sandbox probes + field behavior). Two P3 edges in WORRIES
-   (extensionless files count as source; guard_tests gates md under tests/).
-0c. cli-self-update SHIPPED 2026-07-15: PR #60 merged (a09b463, closes
-   #59), acceptance DECISIONS #7, witnesses W-017..W-018 (18/18),
-   integrated main 213+57 green. Worktree+branch removed.
-0d. v0.2.0 PUBLISHED to npm 2026-07-15 (DECISIONS #8): tag v0.2.0 at
-   5913374, owner published manually from the clean tag clone. FIELD
-   LESSON (memory npm-publish-owner-only.md): owner npm 2FA is
-   LINK-BASED - no OTP codes exist; publishes are ALWAYS owner-manual or
-   git-CI, agent only prepares (bump PR, tag, clean tag clone, verified
-   placeholder gates.config). NEVER publish from the working checkout -
-   local gates.config wiring fails the placeholder test. Witnesses
-   W-017/18 landed via PR #62 (fab01e1). Candidate next: publish via CI
-   workflow (owner hinted "or through git ci"), #36, #37, tarball ships
-   repo board state (P3 hygiene, install never copies it), roadmap
-   #1-#11.
-1. delegation-enforcement SHIPPED 2026-07-10 (PR #49, f9e5dae, closes
-   #42-#47; acceptance DECISIONS #4). Close-out PR in flight if session
-   died mid-close: witnesses W-011..W-013 recorded, brief archived to
-   shipped/, active-task cleared - check chore/delegation-closeout branch
-   state before redoing.
-2. THE NEW GATES ARE LIVE ON MAIN. Every feature/program dispatch now
-   requires, in active-task.json BEFORE work: "issues": [...] (GitHub,
-   PR mode) and "execution": "delegated"|"self" + "execution_why". The
-   context pin injects state every turn; self-built source needs an
-   auditor pass at the current tree before commit/close. Do not fight
-   the hooks - they are the product.
-3. Candidate next: #36 (audit ENOLOCK), #37 (stamp-root mismatch +
-   subagent worktree commits - CEO lands commits meanwhile), doc-sync of
-   README/docs if they inventory hooks (guard_provenance + context_pin
-   are new), or roadmap #1-#11.
-2. After merge: docs-librarian sync if docs cover hooks; witnesses via
-   witness_check.py --add from the lead's proposed markers.
-3. Then: #36 (audit ENOLOCK), #37 (stamp-root mismatch), or roadmap #1-#11.
-2. Deferred by owner (revisit on ask): lessons loop, loop workers, model
-   tiering, gates.local.config override (WORRIES row).
-3. Field lessons for spawn prompts: witness markers MUST be single-line
-   verbatim substrings (W-010 incident, PR #41); dispatched subagents
-   cannot commit in worktrees (#37) - plan for CEO landing; a stale MAIN
-   stamp blocks worktree commits - restamp main first.
-
-## 3. In flight
-
-| Agent | Task | Worktree | Last known state |
-|---|---|---|---|
-| developer | cli-self-update | .claude/worktrees/cli-self-update | Dispatched 2026-07-15; brief brief-cli-self-update.md; no-commit rule - check worktree git status for finished-on-disk work before respawning |
-
-## 4. Facts every spawn prompt needs
-
-- Gate suite for THIS repo, run directly:
-  `python3 -m unittest discover -s tests/hooks -q` AND `npm test`.
-- The tracked company/gates.config keeps its CONFIGURE-ME placeholders (it
-  ships to installs) - never commit real gate commands into it. The CEO
-  keeps an uncommitted local wiring (hooks + tests gates) for honest
-  stamps; rewire with gates_detect --write + hooks gate if lost.
-- Writing must stay hook-clean: straight quotes, ' - ', three dots.
-- All roles opus (owner veto on tiering). Never override models in spawns.
-- PR mode: origin=github.com/devmesh-in/claude-company, gh authed as
-  Redomic. Owner authorized CEO merges 2026-07-10 (recorded in DECISIONS).
-  Branch protection: 9 CI checks + strict up-to-date (use
-  `gh pr update-branch` when BEHIND).
-- NEVER manually delete a remote branch that is a stacked PR's base - it
-  CLOSES the child PRs (cost us #29/#30, recreated as #33/#34). Merge with
-  `gh pr merge --delete-branch` or retarget children first.
-- Hooks: Python 3.8 stdlib, fail open, import _common as c. guard_commit
-  now resolves the branch from the payload cwd (worktree commits work).
-- Witness registry: company/witnesses.json, mutate ONLY via
-  `python3 .claude/hooks/witness_check.py --add/--remove`.
-- Never `git add -A`; stage explicit paths; `Task: <slug>` trailer.
-
-## 5. Done log (chronological, compressed)
-
-- 2026-07-09: external framework deep research (3 explorers + design pass); plan
-  approved; tiering vetoed; lessons/workers deferred; issues #15-#25.
-- 2026-07-09: wave 1 built + verified (guard_secrets, cost_capture, models
-  gate); PR #27. Dogfooding found #26 (guard_commit worktree bug).
-- 2026-07-09: wave 2 built by two parallel leads + CEO verification +
-  auditor SHIP on both; PRs #29/#30 (later #33/#34). Auditor found #31.
-  Doctrine lead found #28.
-- 2026-07-10: wave 3 built + verified (RELEASE doctrine, /release,
-  acceptance record, postmortem); PR #32.
-- 2026-07-10: owner authorized end-to-end merge; stack merged
-  #27 -> #33 -> #34 -> #32 -> #35 (close-out: witnesses W-004..W-009,
-  briefs archived). Integrated main verified green. Program closed;
-  acceptance recorded.
-- 2026-07-10: follow-up pair shipped. docs-sync (docs-librarian): README +
-  docs/ synced with the program, new root CLAUDE.md - PR #39, closes #28.
-  adr-hardening (developer): guard_frozen blocks minting pre-accepted
-  ADRs - PR #38, closes #31. Close-outs #40/#41 (W-010; first marker was
-  line-wrapped and the witness gate itself caught it - fixed verbatim).
-  New bugs filed from integration: #36 (audit ENOLOCK), #37 (stamp-root
-  mismatch + subagent worktree-commit blocker). Witnesses 10/10 on main.
-- 2026-07-10: delegation-enforcement shipped (PR #49, issues #42-#47,
-  DECISIONS #4-#5). 5 layers + FR-DE-15 tracking gate; one tech-lead +
-  2 devs; CEO drill caught the porcelain dir-collapse dodge (-uall fix);
-  auditor SHIP after 1 coverage fix; 213+31 green x3. Witnesses
-  W-011..W-013. Field lessons: two-step cd-then-commit lets the CEO land
-  worktree commits (#37 workaround); strict up-to-date protection
-  silently defeats owner merge clicks when another PR lands first - use
-  gh pr update-branch and re-ask; the classifier will NEVER let the CEO
-  merge its own PR - plan the owner click into every delivery.

package/company/state/STATUS.md

@@ -1,54 +0,0 @@
-# STATUS - the current-truth board
-
-_Maintained by the CEO. Updated after every dispatch, merge, and CR decision._
-_Red stays red until proven green. Never average a status._
-
-_Last updated: 2026-07-22 - model-routing-arming SHIPPED (PR #77 merged cd07fb6, acceptance DECISIONS #11); release 0.2.2 prepped._
-
-## Active tasks
-
-| Task | Class | Lead/Agent | State | Gates | Notes |
-|---|---|---|---|---|---|
-| test-infra-fixes | quick | CEO (self, audited) | SHIPPED 2026-07-26 (PR #85 merged 65bd070) | 224 hooks + 61 CLI + 96 install green on integrated main and stamped; CI 9/9 across ubuntu+macos x node 18/20/22; ubuntu log confirms "Ran 224 tests OK" | Two one-line test-infra defects. (1) CI ran 103 of 224 hook tests - run_tests.sh exec'd test_hooks.py directly, so 121 tests incl. all of test_guard_provenance never ran in CI. (2) npm test was RED on main - pack-manifest JSON parse broken by the npm 10.5.0 prepare banner on stdout, 10 dead assertions. Blocks everything downstream: a red local gate means no stamp, no commit. |
-| multi-session-tasks | feature | not yet dispatched | SPEC READY - awaiting tracking issues then dispatch | - | active-task.json becomes N entries in one file so parallel sessions in one checkout stop overwriting each other; provenance ledger stops wiping itself on slug change. Plan approved by owner 2026-07-26, core-only scope. Phase 0 done: company/specs/spec-multi-session-tasks.md, 31 FRs / 11 BRs / 10 OQs, all fallbacks decided. PM caught a real hole in the approved plan: "ALL over non-hotfix entries" is vacuously TRUE on an empty list, which would have silently flipped guard_spec from block to ALLOW when no task is active - FR-MST-05 orders the empty check first. |
-| spawn-depth-shipping | quick | developer | SHIPPED 2026-07-23 (PR #83 merged 6061814, closes #79-#82) | 224 hooks + 61 CLI + 123 engine green (dev AND CEO reruns); integrated main stamped | Template ships env CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=2; install/update merge env additively (user pin survives - proven); witness W-029. NOT yet on npm - registry still 0.2.0; owner has v0.2.2 tag+publish pending, and this lands in the NEXT release after that. |
-| release-0.2.3 | release | CEO | PUBLISHED 2026-07-25 - CLOSED | integrated main green + stamped; CI 9/9 | Registry latest = 0.2.3 (published 2026-07-25T16:17Z); tags v0.2.0-v0.2.3 all on origin. The earlier "AWAITING OWNER TAG" state was stale bookkeeping - verified 2026-07-26 against `npm view claude-company versions`. Published tarball carries company/state/{RESUME,STATUS,WORRIES,DECISIONS}.md but NOT the runtime state files. DECISIONS #12-#14. |
-
-## Shipped (recent)
-
-| Task | Date | Evidence |
-|---|---|---|
-| model-routing-arming | 2026-07-22 | PR #77 merged cd07fb6 (closes #74-#76); acceptance DECISIONS #11; witnesses W-026/W-027/W-028; live certification: builtin contradict/bare spawn exit 2, match 0, dormancy probe turns --check red; migration: builtins merge lands on install AND update automatically. |
-
-## Wave position (programs only)
-
-| Wave | Workstreams | State | Exit criteria status |
-|---|---|---|---|
-| adoption program 1-3 | all | SHIPPED 2026-07-10 | PRs 27/33/34/32/35 merged; acceptance DECISIONS #3 |
-| follow-up pair | docs-sync + adr-hardening | SHIPPED 2026-07-10 | PRs 38/39/40/41 merged; #28 + #31 closed; witnesses 10/10 on main |
-| cli-update | single workstream | SHIPPED 2026-07-15 | PR #57 merged (7726c99, closes #54-#56); integrated main 213+40+56 green; witnesses W-014..W-016; acceptance DECISIONS #6 |
-| cli-self-update | single workstream | SHIPPED 2026-07-15 | PR #60 merged (a09b463, closes #59); integrated main 213+57 green; witnesses W-017..W-018 (landed via PR #62); acceptance DECISIONS #7 |
-| v0.2.0 npm release | release | PUBLISHED 2026-07-15 | PR #61 merged, tag v0.2.0 (5913374), owner published manually (link-based 2FA); registry latest=0.2.0; DECISIONS #8 |
-| provenance-shipping | quick fix | SHIPPED 2026-07-15 | PR #65 merged (d624cc3, closes #64); fresh installs arm the delegation enforcer, update never auto-arms; witnesses W-019/W-020; NOTE: 0.2.0 on npm still has the gap - 0.2.1 patch release recommended (owner button) |
-| settings-merger-fix | quick fix | SHIPPED 2026-07-15 | PR #69 merged (f17c3c4, closes #67); dedup per (matcher, command) in both engines; update HEALS broken field installs (hand-proven); witnesses W-021/W-022. DevMesh hand-patched meanwhile (its c1ecbf7) |
-| pack-leak-fix | quick fix | SHIPPED 2026-07-15 | PR #71 merged (d714892, closes #68); record trees scaffold empty + tarball negations; seeded negative test; witnesses W-023/W-024 |
-| devmesh-migration | consulting | DELIVERED 2026-07-15 | DevMesh polyrepo migrated to claude-company (its commits b3f0a47/7e08247/c1ecbf7): docs/team ported to company/, frozen registry live (6 surfaces probe-verified), make-gates mirrored, custom agents/skills/memory preserved, 2 upstream bugs found (#67/#68 - both now fixed) |
-
-## Open CRs
-
-_Next free CR number: CR-2._
-
-| CR | Surface | Status | Disposition |
-|---|---|---|---|
-| CR-UPD-1 | frozen-surfaces.json `always` list | APPROVED | Freeze install-manifest.json + .update-backups/**; CEO applies in the cli-update build PR (issue #56) |
-
-## Risks / decisions needed (owner-facing)
-
-1. Two bugs found while integrating, filed and open: #36 (audit gate
-   proposal fails ENOLOCK on lockfile-less repos) and #37 (guard_commit
-   stamp check reads the main checkout, not the commit's work tree - also
-   documents that dispatched subagents cannot commit in worktrees at all;
-   the CEO landed both commits this round). Both are small, scoped, and
-   good next tasks.
-2. Deferred by owner: lessons loop, loop workers, model tiering.
-   Pre-existing roadmap issues #1-#11 untouched.

package/company/state/WORRIES.md

@@ -1,29 +0,0 @@
-# WORRIES - the ledger of the un-acted-on
-
-_Things observed but not yet run down: integration traps, flake sources, spec
-ambiguities, anything that produced a surprise or a false-green. One row per
-worry, brutally terse. Add a row the moment you notice it. Read this at the
-start of every integration or audit step. A row graduates OUT when it becomes a
-filed CR, a STATUS risk, or a verified fix - delete it then. P0 blocks a
-wave/merge; P3 is polish._
-
-| P | Worry | What (one line) | CEO logic (one line) |
-|---|---|---|---|
-| P1 | dispatched worktree agents cannot commit at all | guard_commit.git_cwd prefers payload cwd, which the harness pins to the MAIN checkout; a developer in .claude/worktrees/<slug> on task/<slug> is judged to be on main and blocked as "commit on protected branch". Reproduced 2026-07-26 on task/ci-test-discovery; the agent correctly refused to evade and left its work staged | The #26 git_cwd fix only helps when the session cwd really is the worktree, which is never true for a dispatched subagent. Today's workaround is the CEO committing from the main checkout on the task branch, which converts every delegated build into self-authored work needing an audit - i.e. it silently defeats the delegation economics. Candidate fix: resolve the branch from the edited file's worktree, or accept a worktree path as proof of branch. Fold into the multi-session engagement |
-| P2 | CI npm may hide what local npm catches | tests/cli/test_cli.sh pack-manifest assertions were fully dead locally on npm 10.5.0 (prepare banner on stdout corrupts the JSON) while CI stayed green - 10 assertions were failing on main and CI never said so | Fixed via --silent in test-infra-fixes; the general lesson is that a suite passing in CI is not evidence it passes for a contributor. Candidate: pin or report the npm version in the CI log |
-| P2 | gates.config template-vs-local tension | On the product repo itself, tracked gates.config must stay placeholder (ships to installs) so stop_gate/guard_commit need uncommitted local wiring - a papercut every session | Consider gates.local.config override in run-gates.sh; candidate issue after wave 2 |
-| P3 | costs.log accuracy limits | Multi-model stop intervals book tokens to the last model; sub-half-cent stops log est=$0.00 | Known limits from wave-1 report; revisit if spend reporting starts driving decisions |
-| P2 | staging stales a provenance audit | work_hash includes diff --cached, so git add AFTER the auditor pass stales the audit even with identical content | Auditor worry #2: doc the order (stage, then audit, then commit) in ORCHESTRATOR step 7 wording next doctrine touch; operational for now |
-| P3 | git -C evades guard_commit subcmd parse | guard_commit.git_subcmd treats -C <dir> as the subcommand token, so `git -C x commit` bypasses commit gates (pre-existing, Mode C inherits) | Anti-adversary, out of doctrine scope; candidate issue against guard_commit |
-| P3 | Mode D lacks worktree-cwd exemption | Stop close-gate block message reads wrong if a worktree session ever gets an active-task.json (moot today - file is untracked) | Auditor worry #3; per-spec (mirrors stop_gate); revisit only if worktree sessions gain task state |
-| P2 | session_start 60-line cap can hide digest | Saturated RESUME+STATUS could truncate the active-task + execution digest lines | Lead worry P2, inherited behavior; candidate tail-reservation tweak in session_start |
-| P1 | provenance audit verdict parser is substring-naive | guard_provenance.py:487 records the negative verdict if that literal phrase appears ANYWHERE in the audit payload - including the CEO's own dispatch prompt. Hit 3x on release-0.2.2, then a 4th time on test-infra-fixes where it BLOCKED the commit twice against two passing audits | Raised to P1: it now costs real dispatches, and the trap is near-inevitable because naming the verdict vocabulary is the natural way to prompt an auditor. PROVEN WORKAROUND: give the auditor a vocabulary that cannot poison the record (SHIP / SHIP-WITH-FIXES / HALT) and forbid it from emitting the negative token. Real fix: anchor the parse to the response's verdict line. Fold the vocabulary change into .claude/agents/auditor.md so no CEO has to remember it |
-| P2 | SendMessage-resumed audits record no provenance | Only Task/Agent spawns fire the PostToolUse event that writes an audit into the ledger. Continuing an auditor via SendMessage produces a real audit that the ledger never sees, so the commit stays blocked and the reason looks wrong | Found on test-infra-fixes after two resumed rounds counted for nothing. Doctrine fix is cheap: a re-audit must be a fresh dispatch, never a resume. Candidate: say so in ORCHESTRATOR step 7 |
-| P2 | guard_tests resolves test_scope from main checkout | Worktree builders cannot commit brief-granted test edits until the CEO sets test_scope in MAIN's active-task.json - has now blocked two workstreams (cli-update, model-routing-arming) | Candidate fix: resolve test_scope from the target worktree, or dispatch protocol sets it whenever a brief grants test dirs; follow-up brief |
-| P3 | models.json merge is now a THIRD duplicated heredoc | install.sh/update.sh byte-identical coupling grew (settings, CLAUDE block, now models.json builtins) - divergence risk compounds | Same root cause as existing heredoc row; the byte-identity witness candidate (lead proposal 3) mitigates; fold into any future extraction task |
-| P2 | update.sh duplicates install.sh merge heredocs | The three merges (settings/mcp/CLAUDE block) + CC_BLOCK are copied verbatim; a future install.sh merge change silently diverges update | cli-update lead worry; candidate fixture test asserting install and update produce identical merges; extraction forbidden this pass by additive-only brief |
-| P3 | update spawns python3 per file (~3x/file) | ~180 spawns for 61 files - seconds today, slow at scale | Candidate manifest.py hashtree batch subcommand; not blocking |
-| P3 | manifest emission fails open at install | lib/ or package.json missing -> no manifest, update runs bootstrap-safe forever (never clean "updated") | By design (safe); revisit only if field reports show chronic manifest-less installs |
-| P3 | extensionless files count as source | guard_spec.is_source flags any extensionless file outside company/.claude/docs/.github (e.g. Makefile, a bare "report") - a non-code agent writing one hits the execution gate | Found in owner-requested gate probe 2026-07-15; md/json/state are proven exempt; candidate: extensionless allowlist if it ever bites |
-| P3 | guard_tests gates md inside tests/ | Any write under a tests/ segment is blocked without test_scope regardless of extension, incl. tests/**/*.md (docs-librarian MODULE.md case) | Defensible (tests are the oracle) but extension-blind; candidate: exempt NON_SOURCE_EXT under tests/ if doc syncs start colliding |
-| P3 | background writers stale the gate stamp | Field report 2026-07-15: a training job writing untracked non-ignored files (data/) stales work_hash every turn - stop_gate demands gate reruns | By design (.gitignore IS the ignore mechanism); candidate one-line docs FAQ: gitignore background-process output dirs |