Active Company Session

Company OS selects a tenant independently from the model provider and the working directory. A repository path may help an operator find a company, but it never grants access.

Interface

The local active-company module has one small interface:

1. A verified Console principal session persists a private tenant binding at <auth-home>/company-os-tenants/<company-id>.env.
2. The non-secret current selection is written to <auth-home>/company-os-active-company.env using schema hsm.company_os.active_company.v1.
3. Desktop admission validates that tenant binding through the canonical principal-session route before creating a run.
4. The resulting immutable run grant carries company_id, principal, scopes, provider, selected model, and run ID to the provider broker.
5. Brokered MCP calls and run receipts must match that grant's company. A later operator selection cannot rebind an admitted run.

<auth-home> is HSM_COMPANY_OS_AUTH_HOME when configured and otherwise the current user's ~/.hsmii directory. Files containing principal credentials are regular, non-symlink, mode-0600 files. The active pointer contains no credential.

Operator behavior

• The Console does not select the first catalog company.
• Selecting another company activates it only when this PC already has a stored principal binding and the server verifies that binding for the exact company.
• A company created through the Company Passport is registered automatically.
• If authority is absent or expired, the selection remains unchanged and the Console displays Not authorized.
• Governed desktop model rows display Working in: <company> after validation. If validation fails, the rows are not selectable even when provider login and subscription quota are otherwise ready.

Harness behavior

OpenRouter is a model backend, not a tenant authority. OMP, Pi, Codex, Claude Code, and OpenRouter all receive the same server-owned run grant. Direct Codex and Claude MCP configurations that launch scripts/company-os-mcp-server.sh resolve the same active binding. Provider credentials never enter the tenant binding files, and Company OS principal credentials never enter ACP frames.

Fail-closed invariants

• Active pointer company must equal tenant credential company.
• Principal-session company must equal selected company.
• Run grant, broker environment, MCP sidecar, and receipt company must match.
• Missing, malformed, permissive, or symlinked binding files are rejected.
• Working-directory and company-catalog matches are context hints only.