tycono 0.1.59 → 0.1.60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tycono",
-  "version": "0.1.59",
+  "version": "0.1.60",
   "description": "Build an AI company. Watch them work.",
   "type": "module",
   "bin": {

package/src/api/src/engine/context-assembler.ts

@@ -112,6 +112,17 @@ export function assembleContext(
   // Dispatch 도구 안내 (하위 Role이 있는 경우)
   if (subordinates.length > 0) {
     sections.push(buildDispatchSection(orgTree, roleId, subordinates, options?.teamStatus));
+  } else if (node.level === 'c-level') {
+    // C-level with no subordinates — clarify authority boundaries
+    sections.push(`# Team Structure
+
+⚠️ **You have no direct reports.** You are an individual contributor at the C-level.
+
+- You CANNOT dispatch tasks to other roles (no subordinates)
+- You CAN consult other roles for information (see Consult section below)
+- You MUST do the work yourself — research, analyze, write, decide
+- If implementation requires another role (e.g., engineering work), recommend it to CEO
+- Make decisions within your authority autonomously — do NOT ask CEO for decisions you can make yourself`);
   }
 
   // Consult 도구 안내 (상담 가능한 Role이 있는 경우)

package/src/api/src/services/job-manager.ts

@@ -1,6 +1,7 @@
 import { COMPANY_ROOT } from './file-reader.js';
 import { ActivityStream, type ActivityEvent } from './activity-stream.js';
 import { buildOrgTree } from '../engine/org-tree.js';
+import { validateDispatch, validateConsult } from '../engine/authority-validator.js';
 import { createRunner } from '../engine/runners/index.js';
 import type { ExecutionRunner } from '../engine/runners/types.js';
 import { setActivity, updateActivity, completeActivity } from './activity-tracker.js';
@@ -117,11 +118,30 @@ class JobManager {
     return () => { this.jobCreatedListeners.delete(listener); };
   }
 
-  /** Start a new execution job. Returns the Job immediately (fire-and-forget). */
+  /** Start a new execution job. Returns the Job immediately (fire-and-forget).
+   *  Throws if sourceRole lacks authority to dispatch/consult the target role. */
   startJob(params: StartJobParams): Job {
     const jobId = `job-${Date.now()}-${this.nextId++}`;
     const orgTree = buildOrgTree(COMPANY_ROOT);
 
+    // Authority gate: validate dispatch/consult authority at job creation
+    if (params.sourceRole && params.sourceRole !== 'ceo') {
+      if (params.type === 'consult') {
+        const auth = validateConsult(orgTree, params.sourceRole, params.roleId);
+        if (!auth.allowed) {
+          console.warn(`[JobManager] Authority denied: ${params.sourceRole} → ${params.roleId} (consult): ${auth.reason}`);
+          throw new Error(`Authority denied: ${auth.reason}`);
+        }
+      } else if (params.type === 'assign' && params.parentJobId) {
+        // Only validate dispatch authority for child jobs (not CEO waves)
+        const auth = validateDispatch(orgTree, params.sourceRole, params.roleId);
+        if (!auth.allowed) {
+          console.warn(`[JobManager] Authority denied: ${params.sourceRole} → ${params.roleId} (dispatch): ${auth.reason}`);
+          throw new Error(`Authority denied: ${auth.reason}`);
+        }
+      }
+    }
+
     const stream = new ActivityStream(jobId, params.roleId, params.parentJobId);
 
     const job: Job = {