AgentCompany/docs/proposals/C4-followup.md

Proposal C4-followup: close out the remaining taste debt from C4

Source: Roundtable 2026-04-20 session 6 cross-review (Jobs + Karpathy request_changes asks) Prerequisite: C4 landed (commits c91a233 through 0a35acf) Owner: TBD Estimated effort: 1-2 working days Blocking dependencies: none — safe to pick up any time

What this proposal closes out

C4 shipped the main meat — hire_agent + file_approval internal tools, the CEO initial-user-turn downgrade, the team-building SOP rewrite, and HTTP-hire deprecation. Cross-review surfaced four follow-up items that were out of scope for the C4 session but are small enough to land in a single follow-up pass. They are grouped here so a future session can execute them as one unit.

Item 1: tighten canRequestHire scope to match the C4 narrative

Problem (Karpathy review, specific ask #2): src/main/orchestration/internal-tool-selector.ts attaches hire_agent to any agent where canRequestHire returns true. In src/main/database/agent-permissions.ts:91-103, canRequestHire is true whenever the role or title matches vp|director|manager|lead|head|chief|cto|cmo|coo|cfo or the agent sits in the HR department. The C4 commit narrative claims "CEO-only injection" — the code does not match.

Fix: introduce a separate canFileCeoStrategy(agent) predicate (true only when reportsTo === null AND role is CEO-equivalent). Attach file_approval only when that predicate holds. Leave hire_agent attached on canRequestHire but update the C4 commit narrative and team-building.en.md to say so explicitly. A manager hiring an IC is a legitimate flow — the original "CEO-only" framing was narrower than reality.

Verification: a fixture showing a manager (non-CEO) invoking hire_agent during a team-expansion trigger would pin the broader scope as intentional.

Item 2: re-record non-ceo-dm-reply post-C4 for positive evidence

Problem (Karpathy review, specific ask #1): tests/eval/fixtures/non-ceo-dm-reply.jsonl was recorded at commit 302b8a0 before C4 part 3/5 (tool injection at 79edff5) landed. The fixture therefore cannot discriminate between "non-CEO correctly does not receive hire_agent in its tool schema" and "the tool was never offered because part 3/5 had not merged yet." manager-task-handoff was re-recorded post-C4 already (see c4-followup-manager-rerecord commit in this proposal's implementation). non-ceo-dm-reply still needs the same treatment.

Fix: re-record non-ceo-dm-reply with the current main tree. Confirm the assistant response still covers mark_read and /api/agent_message/send calls without referencing hire_agent (VP Product with two IC reports has management authority → canRequestHire is true → the tool is technically attached, but the trigger is a peer DM so the tool should not be invoked).

Verification: pnpm test:eval --run stays green with existing assertions.

Item 3: add a deprecation counter and Deprecation: header to legacy HTTP hire routes

Problem (Karpathy specific ask #3, Jobs specific ask #1): routes-agents.ts and routes-approvals.ts currently emit a single log.warn("[deprecated][C4] ...") line per call. That's enough for audit-by-grep, insufficient for asserting "usage has hit zero" before physical removal.

Fix:

1. Expose a counter via the existing telemetry module (if one exists; grep for metrics.increment in src/main/). Tick on every call.
2. Add RFC 8594 HTTP headers to the deprecated routes:
   • Deprecation: true
   • Sunset: Wed, 20 May 2026 00:00:00 GMT (or a date 30 days out from the follow-up commit)
   • Link: <docs/proposals/C4-followup.md>; rel="deprecation"
3. Document removal timeline: if the counter stays at zero for two weeks after this proposal lands, delete the route handlers physically.

Item 4: negative assertion kind for the eval harness

Problem (Karpathy specific ask #4): the current assertion-judge.ts supports positive substring assertions (message_contains_substring) but no negation. Asserting "the IC fixture does NOT contain hire_agent in its tool list" is not expressible, so tool-schema regressions on the IC path are only caught implicitly.

Fix: add a new assertion kind in tests/eval/assertion-judge.ts:

type Assertion =
  | ... // existing kinds
  | { kind: "message_does_not_contain_substring"; role: "user" | "assistant"; substring: string };

Wire it through assertion-judge.ts's evaluate switch. Update tests/eval/harness.self-test.ts (or wherever the harness self-tests live) to cover the new kind positively and negatively. Update C4-followup fixtures to use it where appropriate.

Non-goals

• This proposal does NOT expose goal creation as an internal tool — that is C5-scope (expose remaining CEO primitives as tools) and depends on goal-lifecycle design.
• This proposal does NOT delete the legacy HTTP routes — they stay until the counter from item 3 stays at zero for two weeks.
• This proposal does NOT add an LLM-as-judge tier — that is B5.1-scope and gated on fixture count N ≥ 10.

Completion criteria

This proposal closes when all four items land and:

• pnpm typecheck green
• pnpm test:eval --run green at ≥ 8/8
• canFileCeoStrategy predicate exists and is referenced by internal-tool-selector.ts
• non-ceo-dm-reply fixture's recordedAt is after c91a233
• Deprecation counter exists; counter value visible in telemetry; RFC 8594 headers on both legacy routes
• message_does_not_contain_substring assertion kind passes harness self-tests