Add organization governance controls

AgentCompany-New/tests/unit/domain-services.test.ts

@@ -23,7 +23,7 @@ describe("domain services", () => {
     const connection = createConnection();
 
     const rows = connection.db.prepare("select version from schema_migrations order by version asc").all() as Array<{ version: number }>;
-    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]);
+    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]);
     connection.close();
   });
 
@@ -45,6 +45,9 @@ describe("domain services", () => {
     expect(state.providers.length).toBeGreaterThanOrEqual(6);
     expect(state.employeeIdentities).toHaveLength(1);
     expect(state.roleGrants.map((grant) => grant.roleKey).sort()).toEqual(["approval_decider", "hiring_manager", "org_admin"]);
+    expect(state.orgDepartments.map((department) => department.name)).toContain("Engineering");
+    expect(state.hiringPolicies.some((policy) => policy.departmentName === "Engineering")).toBe(true);
+    expect(state.approvalRoutingRules[0]).toMatchObject({ kind: "*", minimumRisk: "low", routeToType: "employee" });
     expect(state.chatSpaces.map((space) => space.name)).toContain("board");
     expect(state.policyRules[0]?.action).toBe("task_create");
     expect(state.auditEvents[0]?.action).toBe("created");
@@ -82,6 +85,7 @@ describe("domain services", () => {
     const state = snapshot.load();
     expect(state.tasks).toHaveLength(1);
     expect(state.approvals).toHaveLength(1);
+    expect(state.approvalAssignments).toHaveLength(1);
     expect(state.approvals[0]?.state).toBe("pending");
     connection.close();
   });

AgentCompany-New/tests/unit/migration-service.test.ts

@@ -92,6 +92,8 @@ describe("migration service", () => {
     const snapshot = new SnapshotService(connection.db);
     const legacyPath = createLegacyDatabase(`
       create table organizations(id text primary key);
+      create table org_departments(id text primary key, org_id text, lead_agent_id text);
+      create table hiring_policies(id text primary key, org_id text);
       create table employees(id text primary key, org_id text);
       create table employee_identities(id text primary key, org_id text, employee_id text);
       create table service_identities(id text primary key, org_id text, agent_id text);
@@ -104,6 +106,8 @@ describe("migration service", () => {
       create table projects(id text primary key, org_id text, goal_id text, lead_agent_id text);
       create table task_runs(id text primary key, org_id text, task_id text, agent_id text, provider_id text);
       create table approvals(id text primary key, org_id text, decided_by_employee_id text);
+      create table approval_routing_rules(id text primary key, org_id text);
+      create table approval_assignments(id text primary key, org_id text, approval_id text, routing_rule_id text);
       create table chat_spaces(id text primary key, org_id text);
       create table chat_messages(id text primary key, org_id text, space_id text, thread_id text);
       create table chat_threads(id text primary key, org_id text, space_id text, root_message_id text);
@@ -147,6 +151,8 @@ describe("migration service", () => {
       insert into file_objects(id, org_id, space_id) values ('file-1', 'org-1', 'space-1');
       insert into workspaces(id, org_id, project_id) values ('wsp-1', 'org-1', 'prj-1');
       insert into agents(id, org_id, model_provider_id, manager_agent_id, workspace_id) values ('agent-1', 'org-1', 'prov-1', null, 'wsp-1');
+      insert into org_departments(id, org_id, lead_agent_id) values ('dep-1', 'org-1', 'agent-1');
+      insert into hiring_policies(id, org_id) values ('hpl-1', 'org-1');
       insert into service_identities(id, org_id, agent_id) values ('sid-1', 'org-1', 'agent-1');
       insert into role_grants(id, org_id, granted_by_employee_id) values ('role-1', 'org-1', 'emp-1');
       insert into access_decisions(id, org_id) values ('access-1', 'org-1');
@@ -155,6 +161,8 @@ describe("migration service", () => {
       insert into tasks(id, org_id, assignee_agent_id, project_id, goal_id, workspace_id) values ('task-1', 'org-1', 'agent-1', 'prj-1', 'goal-1', 'wsp-1');
       insert into task_runs(id, org_id, task_id, agent_id, provider_id) values ('run-1', 'org-1', 'task-1', 'agent-1', 'prov-1');
       insert into approvals(id, org_id, decided_by_employee_id) values ('approval-1', 'org-1', 'emp-1');
+      insert into approval_routing_rules(id, org_id) values ('route-1', 'org-1');
+      insert into approval_assignments(id, org_id, approval_id, routing_rule_id) values ('assign-1', 'org-1', 'approval-1', 'route-1');
       insert into chat_threads(id, org_id, space_id, root_message_id) values ('thread-1', 'org-1', 'space-1', null);
       insert into chat_messages(id, org_id, space_id, thread_id) values ('msg-1', 'org-1', 'space-1', 'thread-1');
       insert into chat_memberships(space_id, principal_type, principal_id) values ('space-1', 'employee', 'emp-1');
@@ -197,6 +205,8 @@ describe("migration service", () => {
     expect(body.failures).toEqual([]);
     expect(body.tableCounts.credentials).toBe(1);
     expect(body.tableCounts.employee_identities).toBe(1);
+    expect(body.tableCounts.org_departments).toBe(1);
+    expect(body.tableCounts.hiring_policies).toBe(1);
     expect(body.tableCounts.role_grants).toBe(1);
     expect(body.tableCounts.skill_artifacts).toBe(1);
     expect(body.tableCounts.chat_read_state).toBe(1);
@@ -210,6 +220,7 @@ describe("migration service", () => {
     expect(body.idMaps.skill_runtime_snapshots).toEqual(["snapshot-1"]);
     expect(body.idMaps.service_identities).toEqual(["sid-1"]);
     expect(body.idMaps.access_decisions).toEqual(["access-1"]);
+    expect(body.idMaps.approval_assignments).toEqual(["assign-1"]);
     expect(body.idMaps.board_interventions).toEqual(["bdi-1"]);
     expect(body.idMaps.retention_freezes).toEqual(["freeze-1"]);
     expect(body.idMaps.provider_usage_windows).toEqual(["usage-1"]);

AgentCompany-New/tests/unit/org-governance-service.test.ts

@@ -0,0 +1,108 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { DatabaseConnection } from "../../src/main/database/connection";
+import { ApprovalService } from "../../src/main/services/approval-service";
+import { OrganizationService } from "../../src/main/services/organization-service";
+import { SnapshotService } from "../../src/main/services/snapshot-service";
+import { RISK_LEVEL } from "../../src/shared/domain";
+
+function createConnection(): DatabaseConnection {
+  return new DatabaseConnection(join(tmpdir(), `agentcompany-new-governance-${randomUUID()}.db`));
+}
+
+function createOrganization(organization: OrganizationService): string {
+  return organization.createOrganization({
+    organizationName: "Acme Operations",
+    employeeName: "Dana Lee",
+    mission: "Coordinate agents with auditable approvals.",
+    goal: "Ship a verified control plane.",
+  });
+}
+
+describe("org governance service", () => {
+  test("enforces department hiring budget policy before creating agents", () => {
+    const connection = createConnection();
+    const organization = new OrganizationService(connection.db);
+    let orgId = "";
+
+    connection.transaction(() => {
+      orgId = createOrganization(organization);
+      connection.db.prepare(`
+        update hiring_policies
+        set monthly_budget_limit_cents = ?
+        where org_id = ? and department_name = ?
+      `).run(10000, orgId, "Engineering");
+    });
+
+    expect(() => connection.transaction(() => organization.createAgent({
+      orgId,
+      name: "Ada",
+      role: "Reviewer",
+      department: "Engineering",
+      modelProviderId: null,
+      modelId: null,
+      budgetCents: 10001,
+      managerAgentId: null,
+    }))).toThrow("Department monthly budget limit has been reached.");
+    expect(connection.db.prepare("select count(*) as count from agents where org_id = ?").get(orgId)).toEqual({ count: 0 });
+    connection.close();
+  });
+
+  test("routes created approvals to the configured review assignee", () => {
+    const connection = createConnection();
+    const organization = new OrganizationService(connection.db);
+    const approvals = new ApprovalService(connection.db);
+    const snapshot = new SnapshotService(connection.db);
+    let orgId = "";
+    let approvalId = "";
+
+    connection.transaction(() => {
+      orgId = createOrganization(organization);
+      approvalId = approvals.create({
+        orgId,
+        kind: "release",
+        title: "Release approval",
+        details: "Approve release train.",
+        risk: RISK_LEVEL.MEDIUM,
+        requestedByType: "system",
+        requestedById: null,
+      });
+    });
+
+    const state = snapshot.load();
+    expect(state.approvalAssignments).toHaveLength(1);
+    expect(state.approvalAssignments[0]).toMatchObject({ approvalId, assigneeType: "employee" });
+    expect(state.auditEvents.some((event) => event.entityType === "approval" && event.action === "routed")).toBe(true);
+    connection.close();
+  });
+
+  test("routes high budget hires to the configured review assignee", () => {
+    const connection = createConnection();
+    const organization = new OrganizationService(connection.db);
+    const snapshot = new SnapshotService(connection.db);
+    let orgId = "";
+
+    connection.transaction(() => {
+      orgId = createOrganization(organization);
+      organization.createAgent({
+        orgId,
+        name: "Ada",
+        role: "Reviewer",
+        department: "Engineering",
+        modelProviderId: null,
+        modelId: null,
+        budgetCents: 600000,
+        managerAgentId: null,
+      });
+    });
+
+    const state = snapshot.load();
+    const approval = state.approvals.find((item) => item.kind === "agent_hire");
+    expect(approval).toMatchObject({ orgId, title: "Review hire: Ada", risk: RISK_LEVEL.MEDIUM });
+    expect(state.approvalAssignments).toHaveLength(1);
+    expect(state.approvalAssignments[0]).toMatchObject({ approvalId: approval?.id, assigneeType: "employee" });
+    connection.close();
+  });
+});