company-skill 4.6.8 → 4.6.10

package/COMPANY.md.template

@@ -1,7 +1,11 @@
 # My Company
 
 <!--
-  INSTRUCTIONS:
+  OPTIONAL hint pool. /company runs fine with NO COMPANY.md and derives the team
+  from your goal. The active roster is goal-derived, not staffed from this file.
+  Use this only to bias role names, pin a model to a role, or seed the dashboard pool.
+
+  INSTRUCTIONS (optional):
   1. Rename this file to COMPANY.md
   2. Fill in your departments and roles
   3. Add/remove departments as needed

package/MODEL_POLICY.template

@@ -18,6 +18,13 @@
 #               every inheriting role uses (lead, reviewer, critic inherit by
 #               omission, so the session choice propagates automatically).
 #
+#   CHEAP       Every Agent call passes haiku and MODEL: tags are ignored, so
+#               strong, mid and cheap all resolve to the cheap family. The whole
+#               run lands on the cheapest tier. Because the session family is
+#               effectively the cheap tier, the orchestrator opens its briefing
+#               and chat reply with the weak-verify-layer warning. Use it only
+#               for bulk low-stakes work, and flip back to TIERED when done.
+#
 # A missing or unparseable file means TIERED. Never write a versioned model
 # name here, only the policy word. The launch-time alternative is the env
 # var CLAUDE_CODE_SUBAGENT_MODEL, which forces every sub-agent to a named

package/README.md

@@ -24,9 +24,9 @@ Reach for it when "looks done" is not good enough and you want the loop to finis
 Compared to a single agent or a plain prompt loop, the difference is the gate. A single agent stops when it decides it is finished. A company of agents keeps running, re-checking its own claims each cycle, until the evidence is there. It does not invent work outside the goal, and it tells you plainly when it is blocked.
 
 <p align="center">
-  <img src="assets/dashboard.png" alt="Company dashboard showing org tree, context gauge, active agents, and criteria" width="900">
+  <img src="assets/dashboard.png" alt="Company dashboard showing a tokens box and a separate cost box with a model-policy toggle, a horizontal cycles-and-memory row, context gauge, active agents, the delegation tree, and criteria" width="900">
   <br>
-  <em>Live dashboard: org tree, context gauge, agent table, and criteria checklist - auto-starts with every /company run.</em>
+  <em>Live dashboard: a tokens box and a separate cost box (cache savings, hit rate and cycles live with the dollars), a horizontal cycles-and-memory row, context gauge, agent table, delegation tree, and criteria checklist - auto-starts with every /company run.</em>
 </p>
 
 ```bash
@@ -72,21 +72,23 @@ The dashboard starts automatically when you run `/company` and prints its URL in
 http://127.0.0.1:7421   <- your session's link, printed at startup and in the status bar
 ```
 
-A per-session identity header sits at the top: the project, the session id, the active model, and an "All projects" link to the cross-project roll-up.
+A per-session identity header sits at the top: the project, the session id, the active model, and an "All projects" link to the cross-project roll-up. The project name is read from your `.company` directory, so two companies launched from the same folder stay labelled apart.
 
-What you see, panel by panel:
+Every block is a card with the same tile look, so cost, cycles, agents, and criteria all read the same way. What you see, panel by panel:
+
+**Cost and usage** - two stacked bands so dollars never interleave with token counts. The Tokens band shows the volumes (input, output, cache-write, this session) as plain counts. The Cost band shows every dollar figure together (today, this session, and "Saved by cheaper models vs all-opus"), with the list-price "not billed" note attached only to the dollars. The dollars come from ccusage at public list prices and are notional on a subscription plan, which the card says plainly. A model-policy toggle sits on the savings tile, reusing the same Apple-style pill as the auto-restart control: off is adaptive (cheaper models run sub-tasks for more savings), on forces the best model everywhere. It writes `.company/MODEL_POLICY` (`TIERED` or `FORCE_BEST`), the file the orchestrator reads at the start of each cycle, so the change applies next cycle.
 
 **Context fill** - the live fill percentage, computed with the same formula the context-guard uses. When the session hits the restart threshold (default 50%), the gauge marks the gate before it fires. Next to it sits an Apple-style auto-restart pill, locked on - the restart block is always enforced and the toggle cannot turn it off.
 
-**Delegation tree** - SVG tree of orchestrator, department leads, and workers, with org-chart context filled from COMPANY.md. Click any node to expand its current task and status. Zoom only with the pill-shaped +/- buttons, or use the expand button to blow the tree up to fill the screen and the contract button to bring it back. Drag to pan. A refresh resets the tree to its default view. Zero external JS libraries.
+**Delegation tree** - SVG tree of orchestrator, department leads, and workers, showing only the agents running right now. COMPANY.md is the source pool and the activated roster decides which departments are eligible, but a role node paints only when a currently-active agent maps to it, and a department appears only when at least one of its roles is live, so a finished or stale agent leaves no node behind. The orchestrator (CEO) root always shows. Long role names wrap inside their node instead of spilling out. Click any node to expand its current task and status. Zoom only with the pill-shaped +/- buttons, or use the expand button to blow the tree up to fill the screen and the contract button to bring it back. Drag to pan. A refresh resets the tree to its default view. Zero external JS libraries.
 
-**Cycles and memory** - a savings card that shows human cycle and memory counts plus the dollars saved by model tiering and prompt caching, each marked approximate.
+**Cycles and memory** - a savings card that shows cycle and memory counts plus the cache-read volume and the dollars saved by prompt caching, marked approximate. The model-tiering saving lives in the Cost band above, next to the policy toggle.
 
 **Active agents** - centered live table of every agent the orchestrator has spawned this session, with model, status, and token count.
 
 **Criteria** - compact progress view with a click-to-expand toggle for the full pass/fail list and reproduced evidence.
 
-**All projects** - the "All projects" link near the session header opens `/all`, a cross-project roll-up. It reads `~/.claude/company-dashboards.json`, a small index every dashboard writes itself into, and shows aggregate cost, tokens, and cache reuse grouped by project. It lists only dashboards seen in the last 5 minutes, costs come from ccusage and are notional on a subscription plan, and a session whose usage row is missing shows `?` rather than zero. Each row links back to that session's own dashboard.
+**All projects** - the "All projects" link near the session header opens `/all`, a cross-project roll-up. It reads `~/.claude/company-dashboards.json`, a small index every dashboard writes itself into, and shows aggregate cost, tokens, and cache reuse grouped by project. It lists only dashboards seen in the last 5 minutes, costs come from ccusage and are notional on a subscription plan, and a session whose usage row is missing shows `?` rather than zero. Each row links back to that session's own dashboard. A dashboard whose owning session has ended drops itself from the index, so `/all` never lists a stale one.
 
 The dashboard binds 127.0.0.1 only, reads local files, and sends nothing anywhere. Override the port with `COMPANY_DASHBOARD_PORT`.
 
@@ -193,6 +195,35 @@ State lives in `./.company/` (relocate with `COMPANY_DIR`):
 ```
 
 
+## State is per-project, code is global
+
+Run state is per-project. Every `.company/` lives inside the project it belongs to
+(or wherever `COMPANY_DIR` points), so two projects never share or leak state.
+
+The skill code is global on purpose. One install lives under `~/.claude/skills/company`
+and serves every project. There are no per-project copies, which avoids version drift
+across projects, a separate update path per project, and duplicated disk. Isolation
+comes from per-project state, not per-project code.
+
+Per-session resources are keyed on the session id. The dashboard port and the
+statusline render cache derive from `$CLAUDE_CODE_SESSION_ID`, so concurrent sessions
+do not collide and dead sessions release their slot.
+
+Stop-guard anchors live outside the project, under `~/.claude/company-guard-state/`,
+keyed by `sha256(realpath(COMPANY_DIR))`. They sit outside the project so an in-run
+actor cannot forge them. The key set grows by one for every distinct `.company` path
+ever used and is never pruned by the default reset. Reclaim old ones by age with:
+
+```bash
+node ~/.claude/skills/company/scripts/reset-company-guard.js --gc --dry-run
+node ~/.claude/skills/company/scripts/reset-company-guard.js --gc --max-age-days 30
+```
+
+`--gc` is opt-in and never auto-run. It removes only anchors older than the cutoff
+(default 30 days), `--dry-run` lists what would go without removing anything, and it
+only ever touches dirs under `~/.claude/company-guard-state/`.
+
+
 ## Examples
 
 [`startup.md`](examples/startup.md), [`research-lab.md`](examples/research-lab.md), [`dev-team.md`](examples/dev-team.md).

package/agents/company-critic.md

@@ -25,6 +25,7 @@ Probe checklist, applied to every passing criterion and every merged-or-mergeabl
 9. ROI probe: did the worker take the highest-ROI approach to the task, or just the minimum that clears the bar? A trivially better approach within the same scope is a soft flag. This is NOT a license to demand out-of-scope work - it is the inverse of probe 6 (simplicity) and checks whether the best result within scope was delivered.
 10. Anti-vacuous test (SKILL.md ANTI-VACUOUS TEST): does the new test FAIL against the pre-change code? If the test passes unconditionally (before and after the fix), it is vacuous - REJECT.
 11. Feature reachability (SKILL.md FEATURE REACHABILITY): for any feature that gates on a field or condition, is there an authoring or runtime path that sets that field? Probe by reading the skill/agent authoring instructions - if no instruction tells the orchestrator to write the gating field, the feature is dead - REJECT.
+12. Parallelization (SKILL.md CONCURRENCY FLOOR): read the cycle review's REALIZED-WIDTH against the briefing's PARALLEL-WIDTH. If independent contracts existed (DEPENDS-ON: none) but the realized width fell materially below that independent-contract count, or independent agents took a blocking join with no named downstream consumer, flag UNDER-PARALLELIZED with the count gap. This is a SOFT flag, not a hard REJECT: correct work shipped serially is slower than the plan declared, not wrong, and a hard block would punish a harness-cap-limited run. Record it in the review so the next cycle's effort scaling corrects it.
 
 Audit each probe claim against a tool result from THIS session. Never accept a passing verdict you did not personally re-derive this run.
 

package/agents/company-digest.md

@@ -18,6 +18,8 @@ Your prompt names the finished cycle's findings files, its review file (`.compan
 5. The review's feedback for the next cycle.
 6. Append this cycle's FAILED -> USE INSTEAD and INEFFICIENT -> FASTER lessons to `.company/playbook.md` now. Dedup gate: grep the playbook for the lesson's key tokens first. On a hit, update the existing line (append "seen again {date}") instead of appending a near-duplicate.
 7. Cost line: run `npx ccusage@latest session --id "$CLAUDE_CODE_SESSION_ID" --json` (if it fails for any reason, write `COST: unavailable` and continue), write `.company/cycles/cycle-{N}-cost.json` (totalCost, totalTokens), and put a one-line `COST:` delta in the briefing. Never paste the raw JSON anywhere.
+8. PARALLEL-DEBT: compare the review's REALIZED-WIDTH against the briefing's planned PARALLEL-WIDTH. When realized fell below planned for 2 consecutive cycles with no harness-cap reason, write `PARALLEL-DEBT: {gap}` into the next briefing so the next THINK must explain or fix it.
+9. PLAYBOOK-HITS: count the `PLAYBOOK-CITED` tags in the cycle review and write `PLAYBOOK-HITS: {n}` into the next briefing. After two goals with zero hits, add a line that the playbook is not influencing planning.
 
 Never drop a SOURCE line when compressing an importance 4-5 finding, and never write a pointer whose anchor does not appear in the file it points to. A compressed claim without its source is unverifiable and worse than dropping the claim. Never editorialize and never add new claims.
 

package/agents/company-lead.md

@@ -30,8 +30,10 @@ Rules that bind you:
 - No command, no task. If you cannot write a VERIFY-WITH command (or an equally concrete check, like a named URL to screenshot), the task is not ready and you must not emit it.
 - ROI is required on every contract. It is your value rationale: why this task over an alternative. State it in one line. After writing all contracts, rank them by ROI and call out that ranking in your reply so the orchestrator sequences waves highest-value-first.
 - Contracts must be self-contained. Paste the needed playbook lines and paths in. A worker never sees this conversation or the skill text.
-- List the surfaces (files, pages, endpoints) each task touches so the orchestrator can dedup. Two of your own tasks must not touch the same surface.
+- List the surfaces (files, pages, endpoints) each task touches so the orchestrator can dedup. Two of your own tasks must not touch the same surface. Define surfaces at the finest safe granularity (a file, an endpoint, a page), never a whole directory or repo. Coarse surfaces collapse independent work into one serialized worker and narrow the wave.
+- DEPENDS-ON only for a genuine output-to-input need. If task B does not consume task A's produced artifact, B's DEPENDS-ON is `none`. Over-declaring dependencies serializes waves that could run in parallel. Default DEPENDS-ON to none and justify any edge you add in one line.
 - If you see a skill gap on your team, add a line `HIRE: {role}, {why}`.
+- If a pasted playbook lesson shaped a contract's plan, tag that contract `PLAYBOOK-CITED: {lesson anchor}` so the digest can count playbook usage (PLAYBOOK-HITS) and surface a playbook that has stopped influencing planning.
 - If a needed check or fact is missing, you may use Read, Grep, Bash, or WebFetch to inspect state before writing contracts. Verify external facts before baking them into a contract. Never write a contract around a guess.
 - **Tool-use heuristics.** Grep/Bash for local state, WebFetch for a known URL, WebSearch when you
   do not know the URL. Make independent lookups in parallel. Read only the slice you need.

package/agents/company-reviewer.md

@@ -22,7 +22,19 @@ Additional duties:
 - **Stall counter.** When you keep a criterion failing, increment (or create) an `attempts` field on its criteria.json entry. At 2+ state in your verdict that the approach is stalled and the next cycle must re-plan, not re-try. Writing `attempts` is required: the stall detector and the high-stakes 3-lens gate both read it from criteria.json.
 - **Anti-vacuous test check (SKILL.md ANTI-VACUOUS TEST).** For every new test introduced this cycle, confirm it FAILS against the pre-change code. A test that passes before the fix is vacuous and must be rejected.
 - **Feature reachability check (SKILL.md FEATURE REACHABILITY).** For every new feature that gates on a field in criteria.json (e.g. `stakes: "high"`), confirm the authoring path that sets that field exists in the skill or agent instructions. A gate that is never set is a dead feature; reject it until the wiring is present.
-- **Respawn reflection.** For any task that will be respawned, write a 3-line block into your verdict for the orchestrator to paste into the fresh contract: WHAT-WAS-TRIED / WHY-IT-FAILED (cited to the findings file) / DO-DIFFERENTLY. The failed worker's self-report is not a source.
+- **Respawn diagnosis.** For any task that will be respawned, author a structured FAILURE-DIAGNOSIS block into your verdict for the orchestrator to paste into the fresh contract. You author it by reading the shaped FINDINGS file (and re-running the cited command), NEVER the raw transcript and never the failed worker's self-report. The block:
+
+  ```
+  FAILURE-DIAGNOSIS (task {id}, attempt {n})
+  ROOT-CAUSE-CLASS: one of [wrong-approach, missing-context, environment/tooling, spec-ambiguity, flaky/transient, scope-too-large, vacuous-or-misdirected-test]
+  ROOT-CAUSE: {one line}
+  EVIDENCE: {a findings-file:line you read, or a command you re-ran + its output, verbatim}
+  WHAT-TO-CHANGE: {concrete, contract-shaped: the next contract's TASK/INPUTS/surfaces}
+  KEEP: {what worked and must not be thrown away}
+  CONFIDENCE: high|low
+  ```
+
+  EVIDENCE must cite a real findings line or a re-run command and its output, never your memory of the failure. A diagnosis with an empty ROOT-CAUSE, EVIDENCE, or WHAT-TO-CHANGE, or a ROOT-CAUSE-CLASS outside the enum, is not actionable (the anti "try-harder" guard) and the orchestrator falls back to the plain 3-line reflection (WHAT-WAS-TRIED / WHY-IT-FAILED cited to the findings file / DO-DIFFERENTLY). When CONFIDENCE is low, say so in the block so the next THINK varies the decomposition rather than trusting one read.
 
 Audit each verdict against a tool result from THIS session. Only mark a criterion MET when you can cite the command you ran and its output from this run.
 

package/agents/company-worker.md

@@ -15,11 +15,12 @@ Execution rules, all binding:
 - **Scope.** Do ONLY the assigned task. Respect OUT-OF-SCOPE literally. Adjacent problems get one line in your findings (`ALSO-FOUND: ...`) and nothing else. Never fix unbidden. For genuinely high-leverage opportunities spotted during the work, add: `PROPOSE: {opportunity} - ROI: {why high value}`. The orchestrator triages it at the next THINK. Surface it, do not execute it.
 - **Maximize within scope.** Within the assigned task, deliver the best-achievable result, not the literal minimum that clears DONE-WHEN. If a higher-ROI approach to the SAME task exists (same surfaces, same scope), take it. Example: if the contract says "fix the bug", also add a regression test if one is trivially missing - that is best-achievable on the same surface, not scope creep.
 - **Skill first.** If the contract assigns a skill, invoke it via the Skill tool before anything else. If it is not installed, fall back to raw tools and note `SKILL-MISSING` in your findings. Never loop retrying a skill that does not exist.
-- **Git isolation.** If the task touches a repo: work in your own worktree on your own branch (`git worktree add ../wt-{task-id} -b company/{task-id}`), commit there, push the branch, open a DRAFT PR. NEVER commit to a shared checkout, NEVER push to main, NEVER merge anything. Merging happens after review, by the orchestrator, not by you. Every draft PR body ends with a `Proof of work` block: the VERIFY-WITH command + its pasted output, the CI link, and the diff stat. Evidence stays verbatim inside the block, no humanizing.
+- **Git isolation.** If the task touches a repo: work in your own worktree on your own branch (`git worktree add "${COMPANY_DIR:-$HOME/.company}/worktrees/{repo-name}/{task-id}" -b company/{task-id}`, the grouped worktree home, never a cryptic `../wt-*` sibling that clutters the repo list), commit there, push the branch, open a DRAFT PR. NEVER commit to a shared checkout, NEVER push to main, NEVER merge anything. Merging happens after review, by the orchestrator, not by you. Every draft PR body ends with a `Proof of work` block: the VERIFY-WITH command + its pasted output, the CI link, and the diff stat. Evidence stays verbatim inside the block, no humanizing.
 - **Run your check.** Before reporting done, run the contract's VERIFY-WITH command and paste its real output in your findings. If the output does not prove DONE-WHEN, you are not done.
 - **EXTERNAL FACT RULE (highest priority).** Before writing ANY public-facing output (GitHub comments, PR descriptions, emails, posts) that states a specific fact about an external project (versions, APIs, features, architecture), verify it first with WebFetch or `gh api` against their actual docs, source, or README. If you cannot verify, write "not sure" instead of guessing. Never cite external numbers from memory. ONE STRIKE: if corrected, post a one-line factual correction and stop. Never argue and never guess a second time.
 - **Blocked is a result.** If the task is impossible or blocked, report `BLOCKED: reason + what would unblock it`. Never return nothing and never expand scope to compensate.
 - **Ask, don't guess.** If the contract is executable but ambiguous on a point that changes the output, do not guess: report `BLOCKED: NEEDS-SPEC: {one concrete question}` with `STATUS: blocked` and stop. One question, not a list.
+- **Pre-act checkpoint.** If your criterion is stakes: high AND the action is irreversible (the VERIFY-WITH has side effects, or you are about to publish, deploy, or delete), emit `CHECKPOINT: about to {action} on {target}; PLAN: {1 line}; ROLLBACK: {1 line or NONE}; CONFIRM?` and STOP before the irreversible step. The orchestrator confirms or returns a corrected plan, same as NEEDS-SPEC. Do not fire a one-way door before the confirm.
 - **Long waits.** For CI, builds, or deploys, start a background watcher and read its output. Never blind-sleep and never assume success. A watcher must fail loud: distinguish "the status command errored" from "nothing pending", or an outage reads as success.
 - **You cannot spawn agents.** You are a leaf: the platform gives sub-agents no agent-spawning tool. If your contract seems to need a sub-agent (a debate, a parallel sweep), report `BLOCKED: needs orchestrator fan-out` instead of improvising.
 - **Deferred tools.** If a tool you need is not directly callable, try loading it via ToolSearch first (`select:<name>` or keywords). Only after ToolSearch returns nothing do you report the gap.

package/bin/install.js

@@ -19,17 +19,26 @@ function copyFile(src, dest) {
 copyFile(path.join(srcDir, 'skill', 'SKILL.md'), path.join(skillDir, 'SKILL.md'));
 
 // Scripts are runtime dependencies referenced from SKILL.md. check.sh, lint-*,
-// check-doc-commands.js, check-version.js, and test files stay in the repo only.
+// check-doc-commands.js, check-version.js, check-regression.js, and test files
+// stay in the repo only.
 const INSTALL_SCRIPTS = [
   'codegraph.js',
   'check-contracts.js',
   'check-findings.js',
+  'check-criteria.js',
+  'diagnosis-block.js',
+  'check-playbook.js',
   'restart-debate.js',
   'dashboard.js',
   'secret-scan.js',
   'reset-company-guard.js',
   'cleanup.js',
   'statusline.js',
+  'workspace-guard.js',
+  'migrate-state.js',
+  'check-isolation.js',
+  'check-roster.js',
+  'clean-stale-dashboards.js',
 ];
 const scriptsDestDir = path.join(skillDir, 'scripts');
 for (const script of INSTALL_SCRIPTS) {
@@ -51,7 +60,12 @@ const hookFiles = {
   'stop-guard.js': 'company-stop-guard.js',
   'context-guard.js': 'company-context-guard.js',
   'precompact.js': 'company-precompact.js',
-  'session-restore.js': 'company-session-restore.js'
+  'session-restore.js': 'company-session-restore.js',
+  'intake-log.js': 'company-intake-log.js',
+  'company-prepush-guard.js': 'company-prepush-guard.js',
+  'orchestrator-guard.js': 'company-orchestrator-guard.js',
+  'post-merge-cleanup.js': 'company-post-merge-cleanup.js',
+  'owner-bootstrap.js': 'company-owner-bootstrap.js'
 };
 
 for (const [src, dest] of Object.entries(hookFiles)) {
@@ -85,12 +99,41 @@ try {
   if (!settings.hooks.SessionStart.some(h => h.hooks?.some(hh => hh.command?.includes('company-session-restore')))) {
     settings.hooks.SessionStart.push({ matcher: 'compact', hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-session-restore.js')}"`, timeout: 10 }] });
   }
+  // SessionStart on a fresh start or resume: bootstrap OWNER so the owning session is
+  // recorded mechanically. Fail-open, idempotent, only writes inside an active run.
+  if (!settings.hooks.SessionStart.some(h => h.hooks?.some(hh => hh.command?.includes('company-owner-bootstrap')))) {
+    settings.hooks.SessionStart.push({ matcher: 'startup|resume', hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-owner-bootstrap.js')}"`, timeout: 10 }] });
+  }
+
+  if (!settings.hooks.UserPromptSubmit) settings.hooks.UserPromptSubmit = [];
+  if (!settings.hooks.UserPromptSubmit.some(h => h.hooks?.some(hh => hh.command?.includes('company-intake-log')))) {
+    settings.hooks.UserPromptSubmit.push({ hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-intake-log.js')}"`, timeout: 10 }] });
+  }
+
+  // PreToolUse: mechanical secret-scan-before-push gate. Matcher 'Bash' so it only
+  // fires on shell commands; the hook itself filters to git push / gh pr create|ready.
+  if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
+  if (!settings.hooks.PreToolUse.some(h => h.hooks?.some(hh => hh.command?.includes('company-prepush-guard')))) {
+    settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-prepush-guard.js')}"`, timeout: 15 }] });
+  }
+
+  // PostToolUse: lean-orchestrator advisory guard. Warns (never blocks) when the owner
+  // session loads oversized content inline instead of delegating it to a worker.
+  if (!settings.hooks.PostToolUse) settings.hooks.PostToolUse = [];
+  if (!settings.hooks.PostToolUse.some(h => h.hooks?.some(hh => hh.command?.includes('company-orchestrator-guard')))) {
+    settings.hooks.PostToolUse.push({ hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-orchestrator-guard.js')}"`, timeout: 10 }] });
+  }
+  // PostToolUse: post-merge cleanup reminder. Fires after a Bash gh pr merge to nudge
+  // the orchestrator to prune the merged branch + worktree. Advisory, fail-open.
+  if (!settings.hooks.PostToolUse.some(h => h.hooks?.some(hh => hh.command?.includes('company-post-merge-cleanup')))) {
+    settings.hooks.PostToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: `node "${path.join(hooksDir, 'company-post-merge-cleanup.js')}"`, timeout: 10 }] });
+  }
 
   // Atomic write: a crash mid-write must not corrupt the user's settings.
   const tmpPath = settingsPath + '.tmp';
   fs.writeFileSync(tmpPath, JSON.stringify(settings, null, 2));
   fs.renameSync(tmpPath, settingsPath);
-  console.log('Hooks installed: Stop guard + Context guard + PreCompact + SessionStart restore');
+  console.log('Hooks installed: Stop guard + Context guard + PreCompact + SessionStart restore + intake log + PreToolUse prepush guard');
 } catch (e) {
   console.log('Could not register hooks. Add manually to settings.json.');
 }

package/hooks/company-prepush-guard.js

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+
+// PreToolUse hook: mechanical secret-scan-before-push gate. The SKILL.md rule to run
+// scripts/secret-scan.js before every push is prose-only, so a weak model that forgets
+// it can push secrets ungated. This hook enforces it in the harness, not the model: it
+// matches Bash commands that publish (git push, gh pr create, gh pr ready), runs the
+// secret scanner over the worktree, and DENIES the tool call on a confirmed secret.
+//
+// FAIL-OPEN-EXCEPT-SECRET: a bug in this guard must never brick all pushes, so every
+// error path (bad stdin, missing scanner, scanner crash) ALLOWS the command. The one
+// hard block is a scanner exit 1 (BLOCKED-SECRET): there it fails CLOSED and denies.
+//
+// Output contract (PreToolUse): exit 0 with
+//   { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny'|'allow', permissionDecisionReason } }
+// A bare exit 0 with no JSON also allows (normal permission flow), which is the
+// fail-open default when the command is not a push.
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+function allow(reason) {
+  // permissionDecision 'allow' lets the call proceed; emit a reason for auditability.
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'allow',
+      permissionDecisionReason: reason || 'company-prepush-guard: allowed'
+    }
+  }));
+  process.exit(0);
+}
+
+function allowSilently() {
+  // No JSON: normal permission flow decides. Used for non-push commands so this guard
+  // never inserts itself into unrelated tool calls.
+  process.exit(0);
+}
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason
+    }
+  }));
+  process.exit(0);
+}
+
+// 1. Parse stdin. Any failure => fail open (allow silently).
+let input;
+try {
+  input = JSON.parse(fs.readFileSync(0, 'utf8'));
+} catch (e) {
+  allowSilently();
+}
+
+// 2. Only gate Bash tool calls. Anything else is none of this guard's business.
+if (!input || input.tool_name !== 'Bash') allowSilently();
+
+const command = input.tool_input && typeof input.tool_input.command === 'string'
+  ? input.tool_input.command : '';
+if (!command) allowSilently();
+
+// 3. Match publish commands: git push, gh pr create, gh pr ready. Word-boundary-ish
+//    matching so "git pushd" or a path containing "git push" in a comment is unlikely
+//    to false-match while real pushes are caught. Fail-open bias: when in doubt, allow.
+const isPush = /\bgit\s+push\b/.test(command) ||
+  /\bgh\s+pr\s+create\b/.test(command) ||
+  /\bgh\s+pr\s+ready\b/.test(command);
+if (!isPush) allowSilently();
+
+// 4. Resolve the worktree to scan. Prefer the cwd the harness reports; else this
+//    process cwd. A bad value just scans the wrong-but-harmless dir (fail open).
+const worktree = (input.cwd && typeof input.cwd === 'string') ? input.cwd : process.cwd();
+
+// 5. Locate secret-scan.js. In the repo it sits at ../scripts/ relative to this hook;
+//    once installed the hook lives in ~/.claude/hooks/ and the scanner in
+//    ~/.claude/skills/company/scripts/. Try both; if neither exists, fail OPEN.
+function findScanner() {
+  const candidates = [
+    path.join(__dirname, '..', 'scripts', 'secret-scan.js'),
+    path.join(process.env.HOME || '', '.claude', 'skills', 'company', 'scripts', 'secret-scan.js')
+  ];
+  for (const c of candidates) {
+    try { if (fs.existsSync(c)) return c; } catch (e) {}
+  }
+  return null;
+}
+const scanner = findScanner();
+if (!scanner) allow('company-prepush-guard: secret-scan.js not found, failing open');
+
+// 6. Run the scanner. Exit 1 = confirmed secret => DENY (fail closed). Exit 0 = clean
+//    or SCANNER-MISSING => allow. Any other exit (scanner crash) => allow (fail open).
+let r;
+try {
+  r = spawnSync(process.execPath, [scanner, '--worktree', worktree], { encoding: 'utf8' });
+} catch (e) {
+  allow('company-prepush-guard: scanner failed to spawn, failing open');
+}
+
+if (r && r.status === 1) {
+  const detail = ((r.stderr || '') + (r.stdout || '')).trim().split('\n').slice(0, 4).join(' ');
+  deny('company-prepush-guard BLOCKED-SECRET: secret-scan.js flagged a secret in this worktree. ' +
+    'Do not push. ' + detail);
+}
+
+// Clean, SCANNER-MISSING, or any non-1 exit: allow.
+allow('company-prepush-guard: secret scan passed (exit ' + (r ? r.status : 'n/a') + ')');

package/hooks/context-guard.js

@@ -103,6 +103,7 @@ function resolveCompanyDir() {
 const companyDir = resolveCompanyDir();
 const ownerPath = path.join(companyDir, 'OWNER');
 const cancelPath = path.join(companyDir, 'CANCEL');
+const handoffPath = path.join(companyDir, 'HANDOFF');
 
 // Respect CANCEL: a cancelled run must not be force-restarted.
 try {
@@ -111,6 +112,15 @@ try {
   process.exit(0);
 }
 
+// A handed-off session is never re-demanded a restart (symmetric with stop-guard).
+try {
+  if (sessionId) {
+    const handed = fs.readFileSync(handoffPath, 'utf8')
+      .split('\n').map(function (l) { return l.trim(); }).filter(Boolean);
+    if (handed.indexOf(sessionId) !== -1) process.exit(0);
+  }
+} catch (e) {}
+
 // Check session ownership before doing any work.
 // Null sessionId with a clean OWNER list = unidentifiable session, fail-open (allow).
 // Null sessionId with no OWNER / garbled OWNER = legacy gate-all mode, fall through.
@@ -159,22 +169,54 @@ try {
 // No usage found: fail-open.
 if (!lastUsage) process.exit(0);
 
+// Token-sum fill must match the dashboard gauge + statusline EXACTLY:
+// input + cache_read + cache_creation + output. Omitting output_tokens made the
+// guard compute a LOWER % than the number the user sees, so a session displayed at
+// >= threshold could sit just under the guard and never fire (criterion 38).
 const used =
   (lastUsage.input_tokens || 0) +
   (lastUsage.cache_read_input_tokens || 0) +
-  (lastUsage.cache_creation_input_tokens || 0);
+  (lastUsage.cache_creation_input_tokens || 0) +
+  (lastUsage.output_tokens || 0);
 
 const contextWindow = detectWindow(lastModelId);
 const threshold = parseThreshold();
 const hardCeiling = parseHardCeiling(threshold);
-const fill = used / contextWindow;
+
+// Prefer Claude's native context_window.used_percentage from the Stop-hook stdin when
+// present (mirrors statusline.js resolveContextPct: native first, then token-sum). This
+// is the authoritative number the user sees. Native may be ABSENT on Stop hooks, so it
+// is used only when it is a finite number; otherwise fall back to the token-sum fill.
+const nativePct = stdinData.context_window && stdinData.context_window.used_percentage;
+const fill = (typeof nativePct === 'number' && isFinite(nativePct))
+  ? nativePct / 100
+  : used / contextWindow;
 
 if (fill < threshold) process.exit(0);
 
-// At or above the soft threshold the restart block is UNCONDITIONAL.
-// No per-session suppression exists: the enforceRestart toggle was removed because
-// a session at or above the threshold must always restart (founder-firm invariant).
-// The hard ceiling only changes the wording of the block, never whether it fires.
+// Per-session SOFT toggle (founder decision): the dashboard pill can turn OFF the early
+// 50% soft restart for THIS session only. Pref lives in <companyDir>/restart-pref.json as
+// { sessions: { "<sid>": { soft: false } } }; default (absent/true/garbled) = ON.
+// The toggle suppresses ONLY the band between the soft threshold and the hard ceiling.
+// The 80% hard ceiling (parseHardCeiling) stays ALWAYS active even when soft is off, so a
+// runaway session still hard-blocks. Below the hard ceiling, soft:false allows the stop.
+function softRestartOff(dir, sid) {
+  if (!sid) return false; // unidentifiable session never reads a per-session pref
+  try {
+    const raw = fs.readFileSync(path.join(dir, 'restart-pref.json'), 'utf8');
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object' || !parsed.sessions) return false;
+    const entry = parsed.sessions[sid];
+    return !!(entry && entry.soft === false);
+  } catch (e) {
+    return false; // missing or garbled pref = ON (fail toward the restart)
+  }
+}
+if (fill < hardCeiling && softRestartOff(companyDir, sessionId)) process.exit(0);
+
+// At or above the hard ceiling the restart block is UNCONDITIONAL: the per-session soft
+// toggle above can never reach here. Between soft and hard, an ON session falls through and
+// blocks as before. The hard ceiling only changes the wording of the block, not whether it fires.
 
 // Fill is at or above threshold. Check the de-loop state file before blocking.
 // De-loop state is SESSION-SCOPED JSON { "sessionId", "tokens", "releasedAtTokens"? }.

package/hooks/intake-log.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+
+// UserPromptSubmit hook for /company runs: durably captures every operator request
+// into .company/intake-log.md so an ask can never be lost to model memory. This is
+// the mechanical complement to the criteria-gate (stop-guard): the stop-guard keeps
+// a run open until every captured ask is triaged, this hook makes sure the ask is
+// captured in the first place by a hook rather than by the model remembering.
+//
+// CONTRACT: ALWAYS exit 0, never print a decision, fail-OPEN on every error. A
+// UserPromptSubmit hook that blocked or crashed would wedge the operator's own
+// prompt; logging is best-effort and never gates input. The stop-guard does the
+// gating; this hook only records.
+//
+// Owner-scoping mirrors stop-guard.js: if OWNER is clean and non-empty and this
+// session is NOT listed, do not log (a foreign session sharing the dir must not
+// pollute this run's intake log). A garbled or missing OWNER falls through and logs
+// (fail-open: better a spurious line than a dropped ask).
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+// Resolve companyDir robustly: COMPANY_DIR env wins; else prefer the dir that holds
+// a clean OWNER (at least one valid session-id line); fall back to cwd/.company.
+// A blank/garbled OWNER does NOT qualify a dir as the active run (BLOCKER-1 fix).
+function hasCleanOwner(ownerPath) {
+  try {
+    const lines = fs.readFileSync(ownerPath, 'utf8')
+      .split('\n').map(function (l) { return l.trim(); }).filter(Boolean);
+    return lines.length > 0 &&
+      lines.every(function (l) { return /^[A-Za-z0-9][A-Za-z0-9._-]{7,}$/.test(l); });
+  } catch (e) { return false; }
+}
+function resolveCompanyDir() {
+  if (process.env.COMPANY_DIR) return process.env.COMPANY_DIR;
+  const home = process.env.HOME || '';
+  const cwdDir = path.join(process.cwd(), '.company');
+  const homeDir = path.join(home, '.company');
+  const cwdHasOwner = hasCleanOwner(path.join(cwdDir, 'OWNER'));
+  const homeHasOwner = home && hasCleanOwner(path.join(homeDir, 'OWNER'));
+  // cwd/.company wins when it has a clean OWNER (project-local run, or both have OWNER).
+  if (cwdHasOwner) return cwdDir;
+  if (homeHasOwner) return homeDir;
+  return cwdDir; // new-run default: preserves original single-project behavior
+}
+
+function main() {
+  const companyDir = resolveCompanyDir();
+  // No company dir: nothing to log against.
+  if (!companyDir || !fs.existsSync(companyDir)) return;
+
+  let input = null;
+  try {
+    input = JSON.parse(fs.readFileSync(0, 'utf8'));
+  } catch (e) { return; } // malformed stdin: fail-open, no line, no crash.
+  if (!input || typeof input !== 'object') return;
+
+  const sessionId = typeof input.session_id === 'string' ? input.session_id : '';
+  const prompt = input.prompt;
+  // Missing/empty/non-string prompt: nothing to capture.
+  if (typeof prompt !== 'string' || prompt.trim() === '') return;
+
+  // Owner-scope: clean+non-empty OWNER that does NOT list this session -> do not log.
+  // Garbled/missing OWNER -> fall through (log). Mirrors stop-guard's regex guard.
+  try {
+    const ownerPath = path.join(companyDir, 'OWNER');
+    const rawOwners = fs.readFileSync(ownerPath, 'utf8')
+      .split('\n').map(function (l) { return l.trim(); }).filter(Boolean);
+    const valid = rawOwners.filter(function (l) { return /^[A-Za-z0-9][A-Za-z0-9._-]{7,}$/.test(l); });
+    // Clean OWNER (every line valid, at least one line): scope strictly.
+    if (rawOwners.length > 0 && valid.length === rawOwners.length) {
+      if (valid.indexOf(sessionId) === -1) return; // foreign session, do not log.
+    }
+    // Garbled OWNER (some invalid line) or missing OWNER (read threw): fall through.
+  } catch (e) { /* no OWNER file: fall through and log */ }
+
+  // Stable id: first 8 hex of sha256(timestamp + sessionId + prompt).
+  const ts = new Date().toISOString();
+  const id8 = crypto.createHash('sha256')
+    .update(ts + sessionId + prompt).digest('hex').slice(0, 8);
+
+  // One-line the prompt: newlines -> space, pipe -> '/', collapse whitespace, truncate 500.
+  let oneLine = prompt.replace(/[\r\n]+/g, ' ').replace(/\|/g, '/').replace(/\s+/g, ' ').trim();
+  if (oneLine.length > 500) oneLine = oneLine.slice(0, 500);
+
+  const logPath = path.join(companyDir, 'intake-log.md');
+  const header =
+    '<!-- company intake log: append-only operator-request capture. Each line is one ' +
+    'UserPromptSubmit event. `- [ ]` = un-triaged, the THINK phase folds it into a ' +
+    'criterion and rewrites the marker: `- [x] captured: <criterion-id>`, ' +
+    '`- [~] declined: <reason>`, or `- [>] deferred: <target>`. The stop-guard blocks ' +
+    'a stop while any stale `- [ ]` line remains. Do not hand-edit the id or timestamp. -->\n';
+  const line = '- [ ] ' + ts + ' ' + id8 + ' | ' + sessionId + ' | ' + oneLine + '\n';
+
+  try {
+    if (!fs.existsSync(logPath)) {
+      fs.writeFileSync(logPath, header);
+    }
+    fs.appendFileSync(logPath, line);
+  } catch (e) { /* fail-open: a write error must never gate the operator's prompt */ }
+}
+
+try { main(); } catch (e) { /* fail-open on anything unexpected */ }
+process.exit(0);