company-skill 4.6.7 → 4.6.9

package/COMPANY.md.template

@@ -1,7 +1,11 @@
 # My Company
 
 <!--
-  INSTRUCTIONS:
+  OPTIONAL hint pool. /company runs fine with NO COMPANY.md and derives the team
+  from your goal. The active roster is goal-derived, not staffed from this file.
+  Use this only to bias role names, pin a model to a role, or seed the dashboard pool.
+
+  INSTRUCTIONS (optional):
   1. Rename this file to COMPANY.md
   2. Fill in your departments and roles
   3. Add/remove departments as needed

package/MODEL_POLICY.template

@@ -18,6 +18,13 @@
 #               every inheriting role uses (lead, reviewer, critic inherit by
 #               omission, so the session choice propagates automatically).
 #
+#   CHEAP       Every Agent call passes haiku and MODEL: tags are ignored, so
+#               strong, mid and cheap all resolve to the cheap family. The whole
+#               run lands on the cheapest tier. Because the session family is
+#               effectively the cheap tier, the orchestrator opens its briefing
+#               and chat reply with the weak-verify-layer warning. Use it only
+#               for bulk low-stakes work, and flip back to TIERED when done.
+#
 # A missing or unparseable file means TIERED. Never write a versioned model
 # name here, only the policy word. The launch-time alternative is the env
 # var CLAUDE_CODE_SUBAGENT_MODEL, which forces every sub-agent to a named

package/README.md

@@ -2,14 +2,31 @@
 
 [![npm](https://img.shields.io/npm/v/company-skill)](https://www.npmjs.com/package/company-skill) [![npm downloads](https://img.shields.io/npm/dw/company-skill)](https://www.npmjs.com/package/company-skill) [![CI](https://github.com/jagmarques/company-skill/actions/workflows/check.yml/badge.svg)](https://github.com/jagmarques/company-skill/actions/workflows/check.yml) [![license](https://img.shields.io/npm/l/company-skill)](LICENSE)
 
-**The agent company that can't stop until the work is verified done.**
+**The agent company that can't stop until the work is verified done**
 
 Your agent stops when it feels done. This makes it stop only when the work is actually done.
 
+company-skill is a Claude Code skill for multi-agent orchestration. It runs your agents as a company with a verification gate, so a `/company` run cannot stop until every acceptance criterion is reproduced.
+
+## What it is
+
+You give it a goal. It splits the work across sub-agents, runs them in dependency waves, and keeps going across cycles until the result is proven instead of just claimed. It runs unattended. Each cycle re-runs every check, a reviewer attacks anything marked passing, and a stop guard blocks exit while any criterion still fails. Sub-agents get scoped delegation contracts rather than the whole problem. A digest writer compresses each finished cycle so the orchestrator stays under its context window, and work is split across models to keep cost down. Nothing is done until it is verified.
+
+## Who it's for
+
+Reach for it when "looks done" is not good enough and you want the loop to finish the job on its own:
+
+- Build a REST API and prove the tests pass before it stops.
+- Run an overnight refactor that won't quit half-done.
+- Ship a feature where every acceptance criterion is reproduced, not asserted.
+- Hand off a long task and come back to verified output instead of a half-finished draft.
+
+Compared to a single agent or a plain prompt loop, the difference is the gate. A single agent stops when it decides it is finished. A company of agents keeps running, re-checking its own claims each cycle, until the evidence is there. It does not invent work outside the goal, and it tells you plainly when it is blocked.
+
 <p align="center">
-  <img src="assets/dashboard.png" alt="Company dashboard showing org tree, context gauge, active agents, and criteria" width="900">
+  <img src="assets/dashboard.png" alt="Company dashboard showing a tokens box and a separate cost box with a model-policy toggle, a horizontal cycles-and-memory row, context gauge, active agents, the delegation tree, and criteria" width="900">
   <br>
-  <em>Live dashboard: org tree, context gauge, agent table, and criteria checklist - auto-starts with every /company run.</em>
+  <em>Live dashboard: a tokens box and a separate cost box (cache savings, hit rate and cycles live with the dollars), a horizontal cycles-and-memory row, context gauge, agent table, delegation tree, and criteria checklist - auto-starts with every /company run.</em>
 </p>
 
 ```bash
@@ -55,18 +72,44 @@ The dashboard starts automatically when you run `/company` and prints its URL in
 http://127.0.0.1:7421   <- your session's link, printed at startup and in the status bar
 ```
 
-What you see, panel by panel:
+A per-session identity header sits at the top: the project, the session id, the active model, and an "All projects" link to the cross-project roll-up. The project name is read from your `.company` directory, so two companies launched from the same folder stay labelled apart.
+
+Every block is a card with the same tile look, so cost, cycles, agents, and criteria all read the same way. What you see, panel by panel:
+
+**Cost and usage** - two stacked bands so dollars never interleave with token counts. The Tokens band shows the volumes (input, output, cache-write, this session) as plain counts. The Cost band shows every dollar figure together (today, this session, and "Saved by cheaper models vs all-opus"), with the list-price "not billed" note attached only to the dollars. The dollars come from ccusage at public list prices and are notional on a subscription plan, which the card says plainly. A model-policy toggle sits on the savings tile, reusing the same Apple-style pill as the auto-restart control: off is adaptive (cheaper models run sub-tasks for more savings), on forces the best model everywhere. It writes `.company/MODEL_POLICY` (`TIERED` or `FORCE_BEST`), the file the orchestrator reads at the start of each cycle, so the change applies next cycle.
 
-**Context fill** - the live fill percentage, computed with the same formula the context-guard uses. When the session hits the restart threshold (default 50%), the bar shows "restart due" so you can see the gate before it fires. A toggle in the dashboard controls the auto-restart per session.
+**Context fill** - the live fill percentage, computed with the same formula the context-guard uses. When the session hits the restart threshold (default 50%), the gauge marks the gate before it fires. Next to it sits an Apple-style auto-restart pill, locked on - the restart block is always enforced and the toggle cannot turn it off.
 
-**Delegation tree** - SVG tree of orchestrator, department leads, and workers, with org-chart context filled from COMPANY.md. Click any node to expand its current task and status. Zoom with +/- buttons or the mouse wheel. Drag to pan. Fullscreen button expands it. Zero external JS libraries.
+**Delegation tree** - SVG tree of orchestrator, department leads, and workers, showing only the agents running right now. COMPANY.md is the source pool and the activated roster decides which departments are eligible, but a role node paints only when a currently-active agent maps to it, and a department appears only when at least one of its roles is live, so a finished or stale agent leaves no node behind. The orchestrator (CEO) root always shows. Long role names wrap inside their node instead of spilling out. Click any node to expand its current task and status. Zoom only with the pill-shaped +/- buttons, or use the expand button to blow the tree up to fill the screen and the contract button to bring it back. Drag to pan. A refresh resets the tree to its default view. Zero external JS libraries.
+
+**Cycles and memory** - a savings card that shows cycle and memory counts plus the cache-read volume and the dollars saved by prompt caching, marked approximate. The model-tiering saving lives in the Cost band above, next to the policy toggle.
 
 **Active agents** - centered live table of every agent the orchestrator has spawned this session, with model, status, and token count.
 
 **Criteria** - compact progress view with a click-to-expand toggle for the full pass/fail list and reproduced evidence.
 
+**All projects** - the "All projects" link near the session header opens `/all`, a cross-project roll-up. It reads `~/.claude/company-dashboards.json`, a small index every dashboard writes itself into, and shows aggregate cost, tokens, and cache reuse grouped by project. It lists only dashboards seen in the last 5 minutes, costs come from ccusage and are notional on a subscription plan, and a session whose usage row is missing shows `?` rather than zero. Each row links back to that session's own dashboard. A dashboard whose owning session has ended drops itself from the index, so `/all` never lists a stale one.
+
 The dashboard binds 127.0.0.1 only, reads local files, and sends nothing anywhere. Override the port with `COMPANY_DASHBOARD_PORT`.
 
+**You get this automatically.** Installing company-skill (npm or the install script) copies `dashboard.js` and `statusline.js` alongside the rest of the skill. Running `/company` then starts the dashboard for you and prints its localhost URL at startup and in the status line. No extra setup.
+
+### Status line
+
+`scripts/statusline.js` appends a labelled link to the per-session dashboard so the URL is one glance away on every turn. The appended segment is `📊 company dashboard <url>`.
+
+With no status line of your own configured, it also renders the model and context fill. The context fill draws as a progress bar using Claude's native used_percentage so the number matches the session indicator, so the full line reads:
+
+```
+Opus 4.8 (1M context)  |  [████░░░░░░] 25%  |  📊 company dashboard http://127.0.0.1:7421
+```
+
+If you already have a status line, the setup step stores your prior command in `.company/statusline-base.json` and runs it first. Your line leads, the script appends only the link, and it does not re-print model or context since your own line owns those:
+
+```
+<your status line>  |  📊 company dashboard http://127.0.0.1:7421
+```
+
 
 ## Unattended auto-restart loop
 
@@ -95,26 +138,26 @@ It runs with `--permission-mode bypassPermissions` for the autonomy an unattende
 
 Multi-agent orchestration buys quality with tokens. /company's answer to the token cost: spend strong-model tokens only where they buy quality, and report the bill every cycle.
 
-**Tiered model delegation.** Each delegation contract carries a `MODEL: cheap|mid|strong` tag. The orchestrator maps the tag to a model at spawn time. Effort scales with both ROI and stakes - high-stakes or high-value work gets heavier spawn. Override every sub-agent with `CLAUDE_CODE_SUBAGENT_MODEL` at launch, or write `FORCE_BEST` into `.company/MODEL_POLICY` mid-run.
+**Tiered model delegation** - each delegation contract carries a `MODEL: cheap|mid|strong` tag. The orchestrator maps the tag to a model at spawn time. Effort scales with both ROI and stakes - high-stakes or high-value work gets heavier spawn. Override every sub-agent with `CLAUDE_CODE_SUBAGENT_MODEL` at launch, or write `FORCE_BEST` into `.company/MODEL_POLICY` mid-run.
 
-**Per-cycle cost reporting.** Every cycle produces a `COST:` line in the briefing and a `cycles/cycle-{N}-cost.json` artifact.
+**Per-cycle cost reporting** - every cycle produces a `COST:` line in the briefing and a `cycles/cycle-{N}-cost.json` artifact.
 
-**Prompt caching.** Agent prompts are laid out stable-first so repeated spawns hit a shared cache prefix.
+**Prompt caching** - agent prompts are laid out stable-first so repeated spawns hit a shared cache prefix.
 
-**Fable 5 / adaptive thinking.** On models that support adaptive thinking (Fable 5 and later), the orchestrator and verify layers run with thinking enabled. No `budget_tokens` param - reflection depth is model-controlled.
+**Fable 5 / adaptive thinking** - on models that support adaptive thinking (Fable 5 and later), the orchestrator and verify layers run with thinking enabled. No `budget_tokens` param - reflection depth is model-controlled.
 
 
 ## Key features
 
-**Stop guard** - blocks session exit until every criterion has `passes: true` and reproduced evidence. Malformed state blocks rather than fails open. Deleting a hard criterion blocks instead of unlocking. [34-check test](tests/stop-guard.test.js).
+**Stop guard** - blocks session exit until every criterion has `passes: true` and reproduced evidence. Malformed state blocks rather than fails open. Deleting a hard criterion blocks instead of unlocking. [42-check test](tests/stop-guard.test.js).
 
-**Context-fill guard** - a second Stop hook forces `/company restart` once context reaches the threshold (default 50%). Reads the model id from the transcript to detect the context window. Per-session auto-restart toggle in the dashboard. [37-check test](tests/context-guard.test.js).
+**Context-fill guard** - a second Stop hook forces `/company restart` once context reaches the threshold (default 50%). Reads the model id from the transcript to detect the context window. The restart block is always on and the dashboard shows it as a locked Apple-style pill toggle. [63-check test](tests/context-guard.test.js).
 
-**Delegation contracts** - a task does not exist without a filled contract. `check-contracts.js` rejects missing fields, vacuous VERIFY-WITH commands, invalid MODEL tiers, and cyclic dependencies. [17-check test](tests/check-contracts.test.js).
+**Delegation contracts** - a task does not exist without a filled contract. `check-contracts.js` rejects missing fields, vacuous VERIFY-WITH commands, invalid MODEL tiers, and cyclic dependencies. [29-check test](tests/check-contracts.test.js).
 
-**Multi-level verification.** The Internal Reviewer re-runs every VERIFY-WITH command independently. The Devil's Advocate attacks everything marked passing. For criteria tagged `stakes: "high"` in `criteria.json` (irreversible action, security surface, or public-facing claim), the critic runs in three fresh contexts with distinct lenses - correctness, security, reproducibility - and unanimous ACCEPT is required. Normal criteria keep the single critic. The completeness probe enumerates every surface the GOAL names and auto-rejects any unchecked one.
+**Multi-level verification** - the Internal Reviewer re-runs every VERIFY-WITH command independently. The Devil's Advocate attacks everything marked passing. For criteria tagged `stakes: "high"` in `criteria.json` (irreversible action, security surface, or public-facing claim), the critic runs in three fresh contexts with distinct lenses - correctness, security, reproducibility - and unanimous ACCEPT is required. Normal criteria keep the single critic. The completeness probe enumerates every surface the GOAL names and auto-rejects any unchecked one.
 
-**Design judge-panel.** For criteria tagged `kind: design`, the lead may emit up to three contracts from materially different angles plus one synthesis contract, reserved for genuine design forks.
+**Design judge-panel** - for criteria tagged `kind: design`, the lead may emit up to three contracts from materially different angles plus one synthesis contract, reserved for genuine design forks.
 
 **Git isolation** - workers never push to main and never merge. Every code change lands as a draft PR. The merge gate is yours.
 
@@ -122,7 +165,7 @@ Multi-agent orchestration buys quality with tokens. /company's answer to the tok
 
 **Codebase graph** - on repos with >200 tracked files, `scripts/codegraph.js` builds a commit-keyed ranked symbol map into `.company/codegraph/` for lead prompts.
 
-**Status-line link** - `scripts/statusline.js` appends the per-session dashboard URL to the Claude Code status bar, enforced idempotently on every `/company` run.
+**Status-line link** - `scripts/statusline.js` appends a labelled `📊 company dashboard <url>` segment to the Claude Code status bar, enforced idempotently on every `/company` run. The link resolves in any session through a cwd-independent global registry, with an `/all` fallback. It chains any status line you already have and never re-prints model or context when one is present. See [Status line](#status-line).
 
 
 ## Commands
@@ -154,7 +197,7 @@ State lives in `./.company/` (relocate with `COMPANY_DIR`):
 
 ## Examples
 
-[`startup.md`](examples/startup.md), [`research-lab.md`](examples/research-lab.md), [`dev-team.md`](examples/dev-team.md), [`nexusquant.md`](examples/nexusquant.md).
+[`startup.md`](examples/startup.md), [`research-lab.md`](examples/research-lab.md), [`dev-team.md`](examples/dev-team.md).
 
 
 ## Contributing

package/agents/company-critic.md

@@ -25,6 +25,7 @@ Probe checklist, applied to every passing criterion and every merged-or-mergeabl
 9. ROI probe: did the worker take the highest-ROI approach to the task, or just the minimum that clears the bar? A trivially better approach within the same scope is a soft flag. This is NOT a license to demand out-of-scope work - it is the inverse of probe 6 (simplicity) and checks whether the best result within scope was delivered.
 10. Anti-vacuous test (SKILL.md ANTI-VACUOUS TEST): does the new test FAIL against the pre-change code? If the test passes unconditionally (before and after the fix), it is vacuous - REJECT.
 11. Feature reachability (SKILL.md FEATURE REACHABILITY): for any feature that gates on a field or condition, is there an authoring or runtime path that sets that field? Probe by reading the skill/agent authoring instructions - if no instruction tells the orchestrator to write the gating field, the feature is dead - REJECT.
+12. Parallelization (SKILL.md CONCURRENCY FLOOR): read the cycle review's REALIZED-WIDTH against the briefing's PARALLEL-WIDTH. If independent contracts existed (DEPENDS-ON: none) but the realized width fell materially below that independent-contract count, or independent agents took a blocking join with no named downstream consumer, flag UNDER-PARALLELIZED with the count gap. This is a SOFT flag, not a hard REJECT: correct work shipped serially is slower than the plan declared, not wrong, and a hard block would punish a harness-cap-limited run. Record it in the review so the next cycle's effort scaling corrects it.
 
 Audit each probe claim against a tool result from THIS session. Never accept a passing verdict you did not personally re-derive this run.
 

package/agents/company-digest.md

@@ -18,6 +18,8 @@ Your prompt names the finished cycle's findings files, its review file (`.compan
 5. The review's feedback for the next cycle.
 6. Append this cycle's FAILED -> USE INSTEAD and INEFFICIENT -> FASTER lessons to `.company/playbook.md` now. Dedup gate: grep the playbook for the lesson's key tokens first. On a hit, update the existing line (append "seen again {date}") instead of appending a near-duplicate.
 7. Cost line: run `npx ccusage@latest session --id "$CLAUDE_CODE_SESSION_ID" --json` (if it fails for any reason, write `COST: unavailable` and continue), write `.company/cycles/cycle-{N}-cost.json` (totalCost, totalTokens), and put a one-line `COST:` delta in the briefing. Never paste the raw JSON anywhere.
+8. PARALLEL-DEBT: compare the review's REALIZED-WIDTH against the briefing's planned PARALLEL-WIDTH. When realized fell below planned for 2 consecutive cycles with no harness-cap reason, write `PARALLEL-DEBT: {gap}` into the next briefing so the next THINK must explain or fix it.
+9. PLAYBOOK-HITS: count the `PLAYBOOK-CITED` tags in the cycle review and write `PLAYBOOK-HITS: {n}` into the next briefing. After two goals with zero hits, add a line that the playbook is not influencing planning.
 
 Never drop a SOURCE line when compressing an importance 4-5 finding, and never write a pointer whose anchor does not appear in the file it points to. A compressed claim without its source is unverifiable and worse than dropping the claim. Never editorialize and never add new claims.
 

package/agents/company-lead.md

@@ -30,8 +30,10 @@ Rules that bind you:
 - No command, no task. If you cannot write a VERIFY-WITH command (or an equally concrete check, like a named URL to screenshot), the task is not ready and you must not emit it.
 - ROI is required on every contract. It is your value rationale: why this task over an alternative. State it in one line. After writing all contracts, rank them by ROI and call out that ranking in your reply so the orchestrator sequences waves highest-value-first.
 - Contracts must be self-contained. Paste the needed playbook lines and paths in. A worker never sees this conversation or the skill text.
-- List the surfaces (files, pages, endpoints) each task touches so the orchestrator can dedup. Two of your own tasks must not touch the same surface.
+- List the surfaces (files, pages, endpoints) each task touches so the orchestrator can dedup. Two of your own tasks must not touch the same surface. Define surfaces at the finest safe granularity (a file, an endpoint, a page), never a whole directory or repo. Coarse surfaces collapse independent work into one serialized worker and narrow the wave.
+- DEPENDS-ON only for a genuine output-to-input need. If task B does not consume task A's produced artifact, B's DEPENDS-ON is `none`. Over-declaring dependencies serializes waves that could run in parallel. Default DEPENDS-ON to none and justify any edge you add in one line.
 - If you see a skill gap on your team, add a line `HIRE: {role}, {why}`.
+- If a pasted playbook lesson shaped a contract's plan, tag that contract `PLAYBOOK-CITED: {lesson anchor}` so the digest can count playbook usage (PLAYBOOK-HITS) and surface a playbook that has stopped influencing planning.
 - If a needed check or fact is missing, you may use Read, Grep, Bash, or WebFetch to inspect state before writing contracts. Verify external facts before baking them into a contract. Never write a contract around a guess.
 - **Tool-use heuristics.** Grep/Bash for local state, WebFetch for a known URL, WebSearch when you
   do not know the URL. Make independent lookups in parallel. Read only the slice you need.

package/agents/company-worker.md

@@ -15,11 +15,12 @@ Execution rules, all binding:
 - **Scope.** Do ONLY the assigned task. Respect OUT-OF-SCOPE literally. Adjacent problems get one line in your findings (`ALSO-FOUND: ...`) and nothing else. Never fix unbidden. For genuinely high-leverage opportunities spotted during the work, add: `PROPOSE: {opportunity} - ROI: {why high value}`. The orchestrator triages it at the next THINK. Surface it, do not execute it.
 - **Maximize within scope.** Within the assigned task, deliver the best-achievable result, not the literal minimum that clears DONE-WHEN. If a higher-ROI approach to the SAME task exists (same surfaces, same scope), take it. Example: if the contract says "fix the bug", also add a regression test if one is trivially missing - that is best-achievable on the same surface, not scope creep.
 - **Skill first.** If the contract assigns a skill, invoke it via the Skill tool before anything else. If it is not installed, fall back to raw tools and note `SKILL-MISSING` in your findings. Never loop retrying a skill that does not exist.
-- **Git isolation.** If the task touches a repo: work in your own worktree on your own branch (`git worktree add ../wt-{task-id} -b company/{task-id}`), commit there, push the branch, open a DRAFT PR. NEVER commit to a shared checkout, NEVER push to main, NEVER merge anything. Merging happens after review, by the orchestrator, not by you. Every draft PR body ends with a `Proof of work` block: the VERIFY-WITH command + its pasted output, the CI link, and the diff stat. Evidence stays verbatim inside the block, no humanizing.
+- **Git isolation.** If the task touches a repo: work in your own worktree on your own branch (`git worktree add "${COMPANY_DIR:-$HOME/.company}/worktrees/{repo-name}/{task-id}" -b company/{task-id}`, the grouped worktree home, never a cryptic `../wt-*` sibling that clutters the repo list), commit there, push the branch, open a DRAFT PR. NEVER commit to a shared checkout, NEVER push to main, NEVER merge anything. Merging happens after review, by the orchestrator, not by you. Every draft PR body ends with a `Proof of work` block: the VERIFY-WITH command + its pasted output, the CI link, and the diff stat. Evidence stays verbatim inside the block, no humanizing.
 - **Run your check.** Before reporting done, run the contract's VERIFY-WITH command and paste its real output in your findings. If the output does not prove DONE-WHEN, you are not done.
 - **EXTERNAL FACT RULE (highest priority).** Before writing ANY public-facing output (GitHub comments, PR descriptions, emails, posts) that states a specific fact about an external project (versions, APIs, features, architecture), verify it first with WebFetch or `gh api` against their actual docs, source, or README. If you cannot verify, write "not sure" instead of guessing. Never cite external numbers from memory. ONE STRIKE: if corrected, post a one-line factual correction and stop. Never argue and never guess a second time.
 - **Blocked is a result.** If the task is impossible or blocked, report `BLOCKED: reason + what would unblock it`. Never return nothing and never expand scope to compensate.
 - **Ask, don't guess.** If the contract is executable but ambiguous on a point that changes the output, do not guess: report `BLOCKED: NEEDS-SPEC: {one concrete question}` with `STATUS: blocked` and stop. One question, not a list.
+- **Pre-act checkpoint.** If your criterion is stakes: high AND the action is irreversible (the VERIFY-WITH has side effects, or you are about to publish, deploy, or delete), emit `CHECKPOINT: about to {action} on {target}; PLAN: {1 line}; ROLLBACK: {1 line or NONE}; CONFIRM?` and STOP before the irreversible step. The orchestrator confirms or returns a corrected plan, same as NEEDS-SPEC. Do not fire a one-way door before the confirm.
 - **Long waits.** For CI, builds, or deploys, start a background watcher and read its output. Never blind-sleep and never assume success. A watcher must fail loud: distinguish "the status command errored" from "nothing pending", or an outage reads as success.
 - **You cannot spawn agents.** You are a leaf: the platform gives sub-agents no agent-spawning tool. If your contract seems to need a sub-agent (a debate, a parallel sweep), report `BLOCKED: needs orchestrator fan-out` instead of improvising.
 - **Deferred tools.** If a tool you need is not directly callable, try loading it via ToolSearch first (`select:<name>` or keywords). Only after ToolSearch returns nothing do you report the gap.

package/bin/install.js

@@ -24,12 +24,19 @@ const INSTALL_SCRIPTS = [
   'codegraph.js',
   'check-contracts.js',
   'check-findings.js',
+  'check-criteria.js',
+  'check-playbook.js',
   'restart-debate.js',
   'dashboard.js',
   'secret-scan.js',
   'reset-company-guard.js',
   'cleanup.js',
   'statusline.js',
+  'workspace-guard.js',
+  'migrate-state.js',
+  'check-isolation.js',
+  'check-roster.js',
+  'clean-stale-dashboards.js',
 ];
 const scriptsDestDir = path.join(skillDir, 'scripts');
 for (const script of INSTALL_SCRIPTS) {
@@ -51,7 +58,12 @@ const hookFiles = {
   'stop-guard.js': 'company-stop-guard.js',
   'context-guard.js': 'company-context-guard.js',
   'precompact.js': 'company-precompact.js',
-  'session-restore.js': 'company-session-restore.js'
+  'session-restore.js': 'company-session-restore.js',
+  'intake-log.js': 'company-intake-log.js',
+  'company-prepush-guard.js': 'company-prepush-guard.js',
+  'orchestrator-guard.js': 'company-orchestrator-guard.js',
+  'post-merge-cleanup.js': 'company-post-merge-cleanup.js',
+  'owner-bootstrap.js': 'company-owner-bootstrap.js'
 };
 
 for (const [src, dest] of Object.entries(hookFiles)) {
@@ -85,12 +97,41 @@ try {
   if (!settings.hooks.SessionStart.some(h => h.hooks?.some(hh => hh.command?.includes('company-session-restore')))) {
     settings.hooks.SessionStart.push({ matcher: 'compact', hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-session-restore.js')}"`, timeout: 10 }] });
   }
+  // SessionStart on a fresh start or resume: bootstrap OWNER so the owning session is
+  // recorded mechanically. Fail-open, idempotent, only writes inside an active run.
+  if (!settings.hooks.SessionStart.some(h => h.hooks?.some(hh => hh.command?.includes('company-owner-bootstrap')))) {
+    settings.hooks.SessionStart.push({ matcher: 'startup|resume', hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-owner-bootstrap.js')}"`, timeout: 10 }] });
+  }
+
+  if (!settings.hooks.UserPromptSubmit) settings.hooks.UserPromptSubmit = [];
+  if (!settings.hooks.UserPromptSubmit.some(h => h.hooks?.some(hh => hh.command?.includes('company-intake-log')))) {
+    settings.hooks.UserPromptSubmit.push({ hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-intake-log.js')}"`, timeout: 10 }] });
+  }
+
+  // PreToolUse: mechanical secret-scan-before-push gate. Matcher 'Bash' so it only
+  // fires on shell commands; the hook itself filters to git push / gh pr create|ready.
+  if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
+  if (!settings.hooks.PreToolUse.some(h => h.hooks?.some(hh => hh.command?.includes('company-prepush-guard')))) {
+    settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-prepush-guard.js')}"`, timeout: 15 }] });
+  }
+
+  // PostToolUse: lean-orchestrator advisory guard. Warns (never blocks) when the owner
+  // session loads oversized content inline instead of delegating it to a worker.
+  if (!settings.hooks.PostToolUse) settings.hooks.PostToolUse = [];
+  if (!settings.hooks.PostToolUse.some(h => h.hooks?.some(hh => hh.command?.includes('company-orchestrator-guard')))) {
+    settings.hooks.PostToolUse.push({ hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-orchestrator-guard.js')}"`, timeout: 10 }] });
+  }
+  // PostToolUse: post-merge cleanup reminder. Fires after a Bash gh pr merge to nudge
+  // the orchestrator to prune the merged branch + worktree. Advisory, fail-open.
+  if (!settings.hooks.PostToolUse.some(h => h.hooks?.some(hh => hh.command?.includes('company-post-merge-cleanup')))) {
+    settings.hooks.PostToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-post-merge-cleanup.js')}"`, timeout: 10 }] });
+  }
 
   // Atomic write: a crash mid-write must not corrupt the user's settings.
   const tmpPath = settingsPath + '.tmp';
   fs.writeFileSync(tmpPath, JSON.stringify(settings, null, 2));
   fs.renameSync(tmpPath, settingsPath);
-  console.log('Hooks installed: Stop guard + Context guard + PreCompact + SessionStart restore');
+  console.log('Hooks installed: Stop guard + Context guard + PreCompact + SessionStart restore + intake log + PreToolUse prepush guard');
 } catch (e) {
   console.log('Could not register hooks. Add manually to settings.json.');
 }

package/hooks/company-prepush-guard.js

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+
+// PreToolUse hook: mechanical secret-scan-before-push gate. The SKILL.md rule to run
+// scripts/secret-scan.js before every push is prose-only, so a weak model that forgets
+// it can push secrets ungated. This hook enforces it in the harness, not the model: it
+// matches Bash commands that publish (git push, gh pr create, gh pr ready), runs the
+// secret scanner over the worktree, and DENIES the tool call on a confirmed secret.
+//
+// FAIL-OPEN-EXCEPT-SECRET: a bug in this guard must never brick all pushes, so every
+// error path (bad stdin, missing scanner, scanner crash) ALLOWS the command. The one
+// hard block is a scanner exit 1 (BLOCKED-SECRET): there it fails CLOSED and denies.
+//
+// Output contract (PreToolUse): exit 0 with
+//   { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny'|'allow', permissionDecisionReason } }
+// A bare exit 0 with no JSON also allows (normal permission flow), which is the
+// fail-open default when the command is not a push.
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+function allow(reason) {
+  // permissionDecision 'allow' lets the call proceed; emit a reason for auditability.
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'allow',
+      permissionDecisionReason: reason || 'company-prepush-guard: allowed'
+    }
+  }));
+  process.exit(0);
+}
+
+function allowSilently() {
+  // No JSON: normal permission flow decides. Used for non-push commands so this guard
+  // never inserts itself into unrelated tool calls.
+  process.exit(0);
+}
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason
+    }
+  }));
+  process.exit(0);
+}
+
+// 1. Parse stdin. Any failure => fail open (allow silently).
+let input;
+try {
+  input = JSON.parse(fs.readFileSync(0, 'utf8'));
+} catch (e) {
+  allowSilently();
+}
+
+// 2. Only gate Bash tool calls. Anything else is none of this guard's business.
+if (!input || input.tool_name !== 'Bash') allowSilently();
+
+const command = input.tool_input && typeof input.tool_input.command === 'string'
+  ? input.tool_input.command : '';
+if (!command) allowSilently();
+
+// 3. Match publish commands: git push, gh pr create, gh pr ready. Word-boundary-ish
+//    matching so "git pushd" or a path containing "git push" in a comment is unlikely
+//    to false-match while real pushes are caught. Fail-open bias: when in doubt, allow.
+const isPush = /\bgit\s+push\b/.test(command) ||
+  /\bgh\s+pr\s+create\b/.test(command) ||
+  /\bgh\s+pr\s+ready\b/.test(command);
+if (!isPush) allowSilently();
+
+// 4. Resolve the worktree to scan. Prefer the cwd the harness reports; else this
+//    process cwd. A bad value just scans the wrong-but-harmless dir (fail open).
+const worktree = (input.cwd && typeof input.cwd === 'string') ? input.cwd : process.cwd();
+
+// 5. Locate secret-scan.js. In the repo it sits at ../scripts/ relative to this hook;
+//    once installed the hook lives in ~/.claude/hooks/ and the scanner in
+//    ~/.claude/skills/company/scripts/. Try both; if neither exists, fail OPEN.
+function findScanner() {
+  const candidates = [
+    path.join(__dirname, '..', 'scripts', 'secret-scan.js'),
+    path.join(process.env.HOME || '', '.claude', 'skills', 'company', 'scripts', 'secret-scan.js')
+  ];
+  for (const c of candidates) {
+    try { if (fs.existsSync(c)) return c; } catch (e) {}
+  }
+  return null;
+}
+const scanner = findScanner();
+if (!scanner) allow('company-prepush-guard: secret-scan.js not found, failing open');
+
+// 6. Run the scanner. Exit 1 = confirmed secret => DENY (fail closed). Exit 0 = clean
+//    or SCANNER-MISSING => allow. Any other exit (scanner crash) => allow (fail open).
+let r;
+try {
+  r = spawnSync(process.execPath, [scanner, '--worktree', worktree], { encoding: 'utf8' });
+} catch (e) {
+  allow('company-prepush-guard: scanner failed to spawn, failing open');
+}
+
+if (r && r.status === 1) {
+  const detail = ((r.stderr || '') + (r.stdout || '')).trim().split('\n').slice(0, 4).join(' ');
+  deny('company-prepush-guard BLOCKED-SECRET: secret-scan.js flagged a secret in this worktree. ' +
+    'Do not push. ' + detail);
+}
+
+// Clean, SCANNER-MISSING, or any non-1 exit: allow.
+allow('company-prepush-guard: secret scan passed (exit ' + (r ? r.status : 'n/a') + ')');

package/hooks/context-guard.js

@@ -48,7 +48,7 @@ function parseThreshold() {
   return v > 1 ? v / 100 : v;
 }
 
-// Hard ceiling: the toggle CANNOT suppress a block at or above this level.
+// Hard ceiling: a higher informational level that changes the block wording only.
 // Default 0.80. Overridable via COMPANY_CONTEXT_HARD_CEILING (fraction or percent).
 // If the parsed value is below the soft threshold, it is clamped up to the threshold.
 function parseHardCeiling(threshold) {
@@ -103,6 +103,7 @@ function resolveCompanyDir() {
 const companyDir = resolveCompanyDir();
 const ownerPath = path.join(companyDir, 'OWNER');
 const cancelPath = path.join(companyDir, 'CANCEL');
+const handoffPath = path.join(companyDir, 'HANDOFF');
 
 // Respect CANCEL: a cancelled run must not be force-restarted.
 try {
@@ -111,6 +112,15 @@ try {
   process.exit(0);
 }
 
+// A handed-off session is never re-demanded a restart (symmetric with stop-guard).
+try {
+  if (sessionId) {
+    const handed = fs.readFileSync(handoffPath, 'utf8')
+      .split('\n').map(function (l) { return l.trim(); }).filter(Boolean);
+    if (handed.indexOf(sessionId) !== -1) process.exit(0);
+  }
+} catch (e) {}
+
 // Check session ownership before doing any work.
 // Null sessionId with a clean OWNER list = unidentifiable session, fail-open (allow).
 // Null sessionId with no OWNER / garbled OWNER = legacy gate-all mode, fall through.
@@ -159,52 +169,74 @@ try {
 // No usage found: fail-open.
 if (!lastUsage) process.exit(0);
 
+// Token-sum fill must match the dashboard gauge + statusline EXACTLY:
+// input + cache_read + cache_creation + output. Omitting output_tokens made the
+// guard compute a LOWER % than the number the user sees, so a session displayed at
+// >= threshold could sit just under the guard and never fire (criterion 38).
 const used =
   (lastUsage.input_tokens || 0) +
   (lastUsage.cache_read_input_tokens || 0) +
-  (lastUsage.cache_creation_input_tokens || 0);
+  (lastUsage.cache_creation_input_tokens || 0) +
+  (lastUsage.output_tokens || 0);
 
 const contextWindow = detectWindow(lastModelId);
 const threshold = parseThreshold();
 const hardCeiling = parseHardCeiling(threshold);
-const fill = used / contextWindow;
+
+// Prefer Claude's native context_window.used_percentage from the Stop-hook stdin when
+// present (mirrors statusline.js resolveContextPct: native first, then token-sum). This
+// is the authoritative number the user sees. Native may be ABSENT on Stop hooks, so it
+// is used only when it is a finite number; otherwise fall back to the token-sum fill.
+const nativePct = stdinData.context_window && stdinData.context_window.used_percentage;
+const fill = (typeof nativePct === 'number' && isFinite(nativePct))
+  ? nativePct / 100
+  : used / contextWindow;
 
 if (fill < threshold) process.exit(0);
 
-// Per-session toggle: read .company/context-guard-config.json for this session.
-// Shape: { "sessions": { "<id>": { "enforceRestart": true|false } } }
-// Default (no file, no entry, parse error) = enforceRestart: true (safe default).
-// If enforceRestart === false for this session, and fill is BELOW the hard ceiling,
-// the toggle suppresses the soft-threshold block. At or above the hard ceiling the
-// toggle has no effect and we fall through to block unconditionally.
-if (sessionId && fill < hardCeiling) {
-  const cfgPath = path.join(companyDir, 'context-guard-config.json');
+// Per-session SOFT toggle (founder decision): the dashboard pill can turn OFF the early
+// 50% soft restart for THIS session only. Pref lives in <companyDir>/restart-pref.json as
+// { sessions: { "<sid>": { soft: false } } }; default (absent/true/garbled) = ON.
+// The toggle suppresses ONLY the band between the soft threshold and the hard ceiling.
+// The 80% hard ceiling (parseHardCeiling) stays ALWAYS active even when soft is off, so a
+// runaway session still hard-blocks. Below the hard ceiling, soft:false allows the stop.
+function softRestartOff(dir, sid) {
+  if (!sid) return false; // unidentifiable session never reads a per-session pref
   try {
-    const cfgRaw = fs.readFileSync(cfgPath, 'utf8');
-    const cfg = JSON.parse(cfgRaw);
-    if (cfg && typeof cfg === 'object' &&
-        cfg.sessions && typeof cfg.sessions === 'object' &&
-        cfg.sessions[sessionId] && typeof cfg.sessions[sessionId] === 'object' &&
-        cfg.sessions[sessionId].enforceRestart === false) {
-      // Toggle is OFF and below the hard ceiling: allow through without blocking
-      process.exit(0);
-    }
-    // Any other value (true, missing, or unknown) falls through to block
+    const raw = fs.readFileSync(path.join(dir, 'restart-pref.json'), 'utf8');
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object' || !parsed.sessions) return false;
+    const entry = parsed.sessions[sid];
+    return !!(entry && entry.soft === false);
   } catch (e) {
-    // File missing or parse error: treat as enforceRestart=true (safe default)
+    return false; // missing or garbled pref = ON (fail toward the restart)
   }
 }
+if (fill < hardCeiling && softRestartOff(companyDir, sessionId)) process.exit(0);
+
+// At or above the hard ceiling the restart block is UNCONDITIONAL: the per-session soft
+// toggle above can never reach here. Between soft and hard, an ON session falls through and
+// blocks as before. The hard ceiling only changes the wording of the block, not whether it fires.
 
 // Fill is at or above threshold. Check the de-loop state file before blocking.
-// De-loop state is SESSION-SCOPED: stored as JSON { "sessionId": "<id>", "tokens": <n> }.
+// De-loop state is SESSION-SCOPED JSON { "sessionId", "tokens", "releasedAtTokens"? }.
 // A state file from a different session (or a legacy bare-number file) is treated as
 // no prior fire for this session (lastFiredTokens = -1). This prevents a prior
 // session's high-water mark from suppressing a first-fire in a fresh session.
 // Within a session: first fire blocks + writes { sessionId, tokens }; subsequent stops
 // with grown tokens require the debate artifact; a token DROP re-arms unconditionally.
+// Once a debate is honored the release is STICKY: releasedAtTokens records the fill at
+// which the restart was released so re-stops at the same fill stay quiet (no re-demand
+// loop), mirroring how CANCEL is persistent.
 const stateFile = path.join(companyDir, '.context-guard-state');
 
+// Margin (5% of the context window) of new accumulation past the released high-water
+// before a fresh restart demand is legitimate again. Below this, the session is treated
+// as already released at this fill and the guard stays quiet.
+const RELEASE_MARGIN_TOKENS = Math.round(contextWindow * 0.05);
+
 let lastFiredTokens = -1;
+let releasedAtTokens = -1;
 try {
   const raw = fs.readFileSync(stateFile, 'utf8').trim();
   // Attempt JSON parse first (session-scoped format).
@@ -219,10 +251,30 @@ try {
       typeof parsed.tokens === 'number') {
     // State belongs to the current session: honor it.
     lastFiredTokens = parsed.tokens;
+    if (typeof parsed.releasedAtTokens === 'number') releasedAtTokens = parsed.releasedAtTokens;
   }
   // Null sessionId either side, legacy bare-number, or different session: treat as fresh.
 } catch (e) {}
 
+// Sticky release: a restart already honored at releasedAtTokens silences the guard for
+// re-stops at the same-or-similar fill. Only a meaningful rise past the margin re-arms.
+if (releasedAtTokens >= 0) {
+  if (used <= releasedAtTokens + RELEASE_MARGIN_TOKENS) process.exit(0);
+  // Fill rose meaningfully above the released high-water: genuine new accumulation.
+  // Re-arm by recording a fresh first-fire at this fill and block once.
+  try { fs.writeFileSync(stateFile, JSON.stringify({ sessionId: sessionId, tokens: used })); } catch (e) {}
+  const sessionTagRearm = sessionId ? ' [session ' + sessionId + ']' : '';
+  const pctRearm = Math.round(fill * 100);
+  console.log(JSON.stringify({
+    decision: 'block',
+    reason: '[COMPANY] Context at ' + pctRearm + '% (grew past the prior restart point). ' +
+      'Run /company restart NOW: quiesce in-flight agents, commit their work as draft PRs, ' +
+      'refresh STATUS/NEXT, run the restart debate gate, and emit the verified continuation prompt. ' +
+      'This is enforced, not advisory - do not continue new work.' + sessionTagRearm,
+  }));
+  process.exit(0);
+}
+
 if (lastFiredTokens >= 0) {
   // Fired once already this session. Re-arm unconditionally when tokens dropped below
   // the fire count (a genuine context reset happened). Otherwise gate on the debate artifact.
@@ -253,8 +305,13 @@ if (lastFiredTokens >= 0) {
   } catch (e) {}
 
   if (artifactFresh) {
-    // Debate recorded. Allow the stop and re-arm for the next cycle.
-    try { fs.writeFileSync(stateFile, JSON.stringify({ sessionId: sessionId, tokens: -1 })); } catch (e) {}
+    // Debate recorded. Allow the stop and record a STICKY release at this fill so the
+    // next stop at the same-or-similar fill does not re-demand the debate in a loop.
+    try {
+      fs.writeFileSync(stateFile, JSON.stringify({
+        sessionId: sessionId, tokens: used, releasedAtTokens: used,
+      }));
+    } catch (e) {}
     // Best-effort: remove the consumed artifact so a stale one cannot release
     // a future fire. Failure is ignored (artifact absence is also safe).
     try { fs.unlinkSync(artifactPath); } catch (e) {}
@@ -287,7 +344,7 @@ const sessionTag = sessionId ? ' [session ' + sessionId + ']' : '';
 const atHardCeiling = fill >= hardCeiling;
 const reason = atHardCeiling
   ? '[COMPANY] Context at ' + pct + '% (>= ' + ceilPct + '% HARD CEILING). ' +
-    'The per-session enforceRestart toggle CANNOT suppress this restart. ' +
+    'This restart is always enforced and cannot be suppressed per-session. ' +
     'Run /company restart NOW: quiesce in-flight agents, commit their work as draft PRs, ' +
     'refresh STATUS/NEXT, run the restart debate gate, and emit the verified continuation prompt.' +
     sessionTag