review_deliverables was written at onboarding and shown in Settings but
nothing ever consumed it - Co-Founder mode silently behaved like AI CEO
mode for output. Now every write_deliverable and create_document in a
review_deliverables org files a pending deliverable_review approval tied to
the file or document, and the tool tells the agent their work is queued for
board review; AI CEO mode keeps shipping without review, which is that
mode's contract. Kickoff and worker briefings also catch up with the
conversation model: managers brief each report in a direct message with one
company-wide post in #general, and workers raise blockers with their
manager over DM instead of flooding department channels. Three
execution-mode contract tests pin deliverable review, no-review autonomy,
and the hire-approval split.
Connections belong to the company - one Composio connected account per
toolkit, mirrored locally in connector_accounts - and access belongs to
individuals: a new agent_connector_grants table records which agent may use
which toolkit. Agent runs now load composio tools from the intersection of
active connections and that agent's grants, and tool execution re-checks the
grant server-side so an ungranted agent cannot call a connector tool it
heard about. Any agent can list_connectors to see what the company has
connected and who holds access; grant_connector/revoke_connector are
CEO-only. The Composio client speaks the v3 contract (user_id,
connected_account_id, toolkit catalog with cursor paging, managed auth
config creation, connect-link initiation). Covered by four grants contract
tests.
Agents could only post to named public channels - the messaging tool even
excluded direct spaces - so assignments, reports, and questions all crowded
into general. Now ChatService.ensureDirectSpace finds or creates the private
two-member conversation for any agent/employee pair; send_message takes
to="Name" for 1:1 traffic (exactly one of to/channel), read_messages reads a
conversation by teammate name, and task assignments land in the manager's DM
with the assignee. In a direct conversation the counterpart agent wakes on
every message without needing an @mention - same social contract as any
messenger - still bounded by the autonomous-turn budget, and wake task
briefings tell agents to reply with to= in kind. Covered by six new
direct-message contract tests; the assignment-thread test now encodes the
DM routing contract.
Busy agents emitted a snapshot-changed broadcast per tool turn; every event
made the renderer reload the full snapshot while the main process re-read
whole audit tables synchronously, and ChatTimeline re-rendered every message
with per-row linear scans - quadratic work per keystroke of agent activity
until clicks stopped responding. Root fixes at each layer: all broadcasts
funnel through one 200ms-coalesced notifier (unit-tested), the renderer
reloads at most every 800ms with a trailing load, audit/access snapshot
reads use SQL limits instead of full-table scans, and the timeline renders
the latest 150 messages via O(n) lookup maps with a real show-earlier
control. cred.txt is now gitignored so the Composio key cannot leak.
Idle agents now live a little: after settling in they occasionally walk the
lane graph to the coffee machine, snack counter, or a restroom stall, dwell
there, and stroll back - carrying their coffee or snack to the desk for a
while. Working agents never leave, and an agent woken to work mid-break
abandons the trip and heads straight home. Randomness is injected so the
whole loop - trip, dwell, carry-back, interruption - is deterministic under
unit test, and a settle period keeps the floor calm right after it loads.
Canvas clicks hit-test against the exact positions the renderer draws -
frontmost person wins - and select the agent: a floating card in the app's
design language shows their name, title, department, level, live status, and
current task, with a selection ring under their feet. Escape, the close
button, or clicking empty floor dismisses it; hovering a person shows a
pointer cursor. The floor now seats only lifecycle-active agents, matching
how the backend wakes and assigns work. Covered by a hit-test unit test and
a dedicated office e2e that clicks the CEO through the real floor-plan math.
Office windows now render a living sky: night with stars, a moon, and lit
city windows; a warm sunrise; blue daylight with the sun arcing across; and
an orange sunset - all interpolated smoothly along a palette timeline driven
by the actual clock, over a per-window deterministic skyline. Phase mapping,
sun/moon handover, star intensity, and palette blending are unit-tested.
The signed-in employee now appears automatically at the office entrance in a
blazer with an accent name chip, and moves with WASD or arrow keys: per-axis
wall sliding against the floor-plan colliders, normalized diagonal speed,
facing-aware walk animation, and a camera that follows and clamps to the
world so large teams scroll into view instead of being cut off. Key input
ignores typing targets and releases on window blur. Movement, collision,
spawn stability, and camera clamping are unit-tested.
Replace the single cloned character with identity-derived sprites: skin
tone, hair style and color, outfit (tee/hoodie/blazer), shirt palette, and
glasses all hash off the agent id, drawn with facing-aware variants, a walk
cycle, and carried-item support for later behaviors. The CEO always wears
the blazer. Appearance determinism and population variety are unit-tested.
Replace the viewport-derived desk grid with a fixed-world office: a north
band of rooms (CEO office, meeting room, snack bar, restroom) with door
signage opening onto a corridor, and an open desk field that grows by rows
so any head-count fits the world instead of being cut off. Geometry lives in
a pure floor-plan module that also builds an axis-aligned lane graph with
BFS routing, unit-tested for reachability and collision invariants. A camera
transform centers or clamps the view, the first c_suite agent takes the CEO
office, name labels render the full name, and the mock TODO-board text is
gone. Office screenshots join the visual-review capture set.
Tests verify: canonical handle generation for multi-word names, mention
resolution via canonical handles, read_messages from channel, and
read_messages inbox (agent @mentions across channels).
MentionTextarea inserted raw agent names (e.g. @Sarah Chen) but the
backend regex captured only the first word (@Sarah), causing mention
resolution to fail silently. Moved canonicalMentionHandle to shared/
so the renderer can produce space-free handles that the backend resolves
correctly.
writeDeliverable guards against path traversal, but recordWorkspaceFile
resolved and readFileSync'd its path with no containment check — safe
only because today's lone caller hands it the already-sanitized result.
Any future caller passing a raw agent path (../../.ssh/id_rsa) could read
an arbitrary file into the org's file store.
Extract the resolve+reject-".."/absolute guard into one workspace-path
helper and route both the writer and the reader through it, so the
defense lives on the function rather than the caller.
send_message answered the agent with "Posted to #x (message_id=...,
thread_id=...)" — a transaction receipt that gives no sense anyone is
there. An agent posting into that void has no reason to converse.
Now it answers with presence: who was addressed and can reply, who else
is in the channel, and the thread_id to stay in the conversation. The
message_id noise is gone. The tool's own description now frames it as
talking to teammates rather than posting a coordination status.
The manual runTask path enforces assertExecutionApproval, but the
autonomous heartbeat path (enqueueHeartbeatRuns -> enqueueRun -> the
queue worker) did not, so a high-risk or filesystem task whose approval
was still pending — the normal state in ai_cofounder mode, or after an
operator declines — was executed unsupervised.
Apply the same gate in enqueueRun. Pending/declined approvals leave the
task unqueued (the heartbeat's existing try/catch skips it) and it is
picked up on the next tick once approved. ai_ceo mode auto-approves at
task creation, so autonomous companies are unaffected.
An @mention by an agent wakes the mentioned teammate by creating a task
run, and the woken agent's reply can mention back, an unbounded A->B->A
loop whose only backstop was the per-provider monthly request cap (which,
once tripped, fails every agent on that provider). Before enriching agent
conversation this had to be made safe.
Cap the agent-authored messages a thread may accumulate since its last
human/board message; past the cap, agent-triggered wakes pause until a
person re-engages. A human message always wakes mentions and resets the
budget. Counted from chat_messages, so no schema change.
Root cause of the GPT-account "empty turn: no text and no tool calls"
failures, found by replaying the real stored response: the CEO actually
called hire_agent five times, but the ChatGPT/Codex backend delivers each
output item in a response.output_item.done event and then sends a
response.completed whose response.output is []. accumulateResponsesStream
read only the completion event, so every tool call was discarded and the
turn parsed as empty — the run failed and the company never staffed.
Collect items from output_item.done and fall back to them when the
completion carries no output of its own; keep using the completion output
when it is populated (non-Codex Responses backends). Verified against the
real captured stream (5 hires recovered) and unit-tested with the exact
event shape.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The GPT-account (Codex) path supports tool calls and worked before; my
forced tool_choice broke it and was the wrong fix. The real regression was
strict:null in the rebuild's tool definitions, which made the endpoint drop
the tool list so the model had nothing to call — a "Done" run that hired no
one. Forcing then turned that silent failure into a red one.
Restore the original "auto" loop (no forced tool_choice, no finish tool) and
keep only the one-line strict:null omission. Codex now receives valid tools
on the working "auto" choice, as in the version that worked.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The gpt-account (Codex) turn built its function tools with strict:null. The
Responses API expects strict to be a boolean or omitted; null is malformed,
so the endpoint dropped the whole tool list — leaving the model with nothing
to call. That is exactly the "model returned no tool calls" failure on the
GPT-account path. Omit strict when null; keep the boolean otherwise. Locked
with a test, alongside the Bedrock/Gemini forced-tool-choice encoding.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Forcing only the opening turn let a weak model take one token action and
stop, so a kickoff hired one agent (or none) and went quiet. Now every turn
is forced (tool_choice required) and the agent ends only by calling the new
`finish` tool — so it must keep hiring, delegating, and messaging until the
work is actually done. Finishing with zero actions, or returning no tool
call at all, fails the run loudly instead of faking success.
Prompts tell each agent it must call a tool every turn and finish only when
done. Tests drive weak-model stubs that act then finish, proving a full team
forms rather than a single gesture.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The whole premise is cheap models + skills + a team — so the control plane,
not the model, must guarantee action. Every adapter hardcoded
tool_choice:"auto", letting a weak model answer the kickoff with prose and
"succeed" having hired no one, delegated nothing, and said nothing.
Now the agent loop compels a tool call on the opening turn (tool_choice
plumbed through every backend: OpenAI/Responses/Chat, Anthropic, Codex,
Copilot, Azure, Custom, Gemini ANY mode, Bedrock any). If the forced turn
still yields no tool call, the run fails loudly instead of recording a
deceptive success — surfacing the problem (let it crash) rather than a
silent dead company. After it has acted, the model chooses freely.
Tested: a stub that rambles on "auto" but acts when forced now posts a
kickoff message; a prose-only first turn fails the run.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add CascadeMenu/CascadeRow: a menu whose rows reveal a side submenu on
hover with an open delay, a forgiving close delay, and a cursor→submenu
safe triangle — while the cursor sweeps toward an open submenu, hovers
over sibling rows are ignored, so a natural diagonal move never snaps the
target shut. The triangle geometry (pointInTriangle) is unit-tested.
Apply it to the org switcher: each organization reveals its actions
(switch / delete) on hover instead of a hidden hover-only "x", while the
destructive delete keeps its deliberate, non-hover-dismissible confirm.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The "Spaces" section badged each department with its agent count, so an
org with one CEO and zero files showed "Executive 1". Clicking it filtered
to that department's files and revealed nothing — the tree advertised a
folder that opened empty. collectDepartments now counts files per
department and omits departments with none, so every badge equals what the
section contains. Unit-tested for file-based counting and empty omission.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The rollback pack canonicalizes the source path via realpathSync.native
(correct: it resolves symlinks before comparing). On macOS tmpdir() is
/var → /private/var, so the test's raw legacyPath never matched. Compare
against the canonical path instead.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Engine-side writes - hires, delegated tasks, chat messages, run state -
only reached the renderer after a run finished: the queue worker sent
one snapshot-changed at the end, and nothing fired at claim time, so
the window sat frozen for the minutes a CEO run takes unless the user
reloaded by hand. The execution service now takes a notifyDataChanged
callback, the agent loop fires it after every tool-bearing iteration,
and the worker announces the claim itself, so the UI follows the
company working in real time.
Interrupted runs now return to the queue instead of failing - an app
shutdown is not a model error and must not spend the task's bounded
retry budget. Startup work moves behind the single-instance lock so a
losing second instance can never run recovery against the live
instance's database. Background provider requests that died before
receiving an external response id now fail at boot (the background
worker can only resume accepted ones). Agent updates resolve the
department through the same canonical lookup as hires, replacing the
free-text write and its invented "General" default.
A reasoning-heavy model can burn the whole max_tokens budget on
thinking blocks; the parsed turn then has neither text nor tool calls
and the loop treated it as a successful completion, marking a run done
when nothing happened. Such a first turn now fails the run so the
failure is visible and the heartbeat retries; later empty-text turns
after real tool work still complete normally.
The CEO's first run hired five reports into departments "general" and
"engineering"; the hiring-policy lookup was exact-match against the
seeded names (Executive, Engineering, ...), so every hire failed and
the kickoff produced nothing. The tool schema now enumerates the
canonical departments, the policy lookup matches case-insensitively
and stores the canonical name on the agent, and an unknown department
error lists the valid choices so the model can self-correct.
The abort timer was cleared as soon as fetch resolved with headers, so
a server that stalled the response body hung the request forever - and
one hung run froze the autonomous queue behind the worker re-entrancy
guard. JSON requests now carry a header deadline plus a longer body
deadline on one abort controller, and event streams fail when no chunk
arrives within an idle window, cancelling the reader. Timeouts surface
as ProviderHttpError so the run records a clear failure and the
heartbeat retries.
A task_run still marked running at startup has no executor - the
single-instance app that owned it is gone - yet nothing failed it, the
queue worker only claims queued rows, and the heartbeat excludes tasks
with a running run, so one interrupted shutdown wedged the company
forever. Boot now fails orphaned running runs and their in-flight
foreground provider requests (auditably), which hands the task back to
the heartbeat for an automatic retry. Background provider requests are
untouched; the background worker resumes those by external id.
Adversarial review of the kickoff feature surfaced two gaps. First, the
kickoff task was inserted with raw SQL, so a workspace-bound kickoff
carried requires_filesystem without the execution approval every other
task receives - manual runs failed and review-mode orgs had no approval
trail. Kickoffs (in-app and onboarding) now go through createTask and
its policy gates. Second, a goal created before any agent existed
stayed inert forever; creating an agent now operationalizes every
active goal that has no task yet. Goal owners must be active agents:
an archived owner falls back to the top-level agent and the owner
dropdown only offers active agents.
A goal created from the Work page only wrote a goals row; nothing ever
read it, so the company never started working on it. Creating a goal now
produces an "Operationalize goal" kickoff task for the chosen owner (or
the top-level agent when unowned) and re-enables that agent's heartbeat,
so the autonomous queue worker starts the run - the same activation
contract the previous runtime had via goal_activated wakes and CEO
bootstrap. Onboarding shares the same kickoff module instead of its own
copy.
Migration 041 adds parent_task_id to tasks for subtask hierarchy.
TaskDetailDialog now has three tabs: Overview (description, assignee,
project, goal, workspace, runs with error messages), Subtasks (child
tasks with status), and Activity (audit events and approval history).
Inline edit overlay covers title, description, assignee, risk, priority,
and parent task. Task delete is available from the dialog footer.
Every catalog provider can now drive agent execution:
- Azure OpenAI -> Chat Completions at the deployment URL with api-key
- AWS Bedrock -> Converse API signed natively with SigV4 (node:crypto)
- Vertex AI -> Gemini generateContent with a service-account JWT (RS256)
exchanged for a cached access token
The credential resolver maps each cloud profile to the turn's needs; the router
covers all 16 providers. Pure encoders, the SigV4 signer and the GCP auth are
unit-tested; no AWS/GCP SDK dependency.
New 'Custom OpenAI-compatible' and 'Custom Anthropic-compatible' providers let
an agent run against any compatible endpoint by base URL + key: the turn posts
Chat Completions (/chat/completions) or Anthropic Messages (/v1/messages) at the
configured base URL. Backfilled into existing orgs by migration 037.
ZacharyZhang-NY
