Company Console guide

The Company Console is the browser workspace for operators. It reads and acts on Company OS through the Company OS API; it does not keep its own copy of company state. Use it to describe work, follow tasks, decide approvals, inspect receipts, manage agents and connectors, and check system health.

Status. The Console is the internal and operator web UI. The customer desktop shell is the Company OS desktop app. In supported-capabilities.json (as of 2026-09-16) the release gate is blocked and the strategy is an invite-only private preview. A route that exists in the Console is not thereby release-supported. See Canonical product path and Start here.

Open the Console

From a source checkout, run one command from the repository root:

./company-os

It starts or reuses the local services, opens the Workspace start page, and prints one URL. With default settings:

Surface	URL
Company Console (Workspace)	http://127.0.0.1:3050/workspace/start
Company OS API	http://127.0.0.1:3847
API health	http://127.0.0.1:3847/api/company/health
AgentChat runtime health	http://127.0.0.1:3050/api/agent-chat-runtime

Change the ports with HSM_COMPANY_CONSOLE_PORT (Console) and HSM_CONSOLE_PORT (API).

Command	Effect
./company-os status	Prints the Workspace URL when API, AgentChat, and Workspace are healthy.
./company-os up --no-open	Starts or reuses the stack without opening the browser.
./company-os down	Stops the services this checkout started.

The launcher needs local Rust, Node/npm, reachable Postgres, and model access for provider-backed turns. Full startup and troubleshooting steps are in Workspace and chat launch. The routes / and /workspace both redirect to /workspace/start.

Sign in

When the Console cannot load the company list because the request is unauthorized, it sends you to /operator-login, remembering the page you came from.

1. Open the Operator sign-in page (/operator-login).
2. Choose Continue on this device. This signs you in without a key when the device is running Company OS locally.
3. If that is unavailable, choose Use an operator key instead, enter the Operator key, and select Open Company OS. The key is kept in an HttpOnly session cookie and is not exposed to workspace scripts.
4. After the operator session, the page establishes a human session for the device. If that fails it shows: "This device could not be signed in. Ask your administrator to authorize it."

After sign-in you return to the page you came from if it is under /workspace/ or is a CLI authorization page (/cli/authorize, /cli/device). Otherwise you land on /workspace/start.

Company access. The company selector is in the page header. To join another company, open Join another company and either enter a Company ID or address (sends an access request) or an Invitation link or code. Owners and admins see Pending access requests there.

Layout

• Sidebar. Seven primary entries: Chat, Work, Beads, Proof, Agents, Connectors, Operate. Below them, All workspace areas expands the full directory of every other surface, grouped by job. The footer links to System (system health) and Legacy console (/classic).
• Tab strips. Work and Proof each show sibling views as tabs under the header.
• Search. Press Cmd+K (or Ctrl+K) or use the search button to search the company; the Search page lists what it covers.
• Right rail. A resizable rail that appears when you select a task or an agent and can be hidden from the header.
• Overview. The brand link at the top of the sidebar opens the dashboard.

Pages that need a company say "Select a company in the header" until one is selected.

Main areas

Chat (/workspace/start)

The front door. Tell the company what needs to happen; the conversation drives the work and the result stays open beside it.

• The left pane is the chat. Starter prompts: "Plan this week's highest-impact work", "Review blocked tasks and propose next actions", "Research competitors and draft a launch memo". If you are unsure where to start, answer the three questions in the result pane and the page prepares one concrete workflow. Nothing runs until you choose Use this workflow or Run first step.
• The chat settings menu (the three-dots button) holds Run controls: create a company when none is active, Create a new governed proof workspace, a Model and execution choice (Cloud or Local), and the Employee leading this work.
• The result pane has three tabs: Result, Evidence, and Task. Evidence ("Run proof and verification") shows setup readiness (company API, model execution, worker execution, core MCP client, desktop bridge) separately from the outcome evidence for your request. Task shows the dispatched task, with Open task and Review approvals links.
• Header shortcuts open Run receipts and Approvals.
• If the run needs authority, the page offers Connect owner or admin, Create governed workspace and retry, or Sign in as operator.

Work (/workspace/issues)

One task ledger. Tabs: All tasks, Your tasks, Approvals, Beads.

• All tasks lists tasks with filters All, Active, Needs you, Blocked, Done. New task opens a form. Board switches to a kanban view; List view switches back. A Related work panel appears when tasks share a project or workspace attachment; these links do not create dependencies.
• Your tasks (/workspace/my-work, page title "My Work") has four sections: In Review, Assigned to Me, Recently Touched (last 24 hours), and Failed Runs.
• Approvals (/workspace/approvals, page title "Inbox") is for human decisions only. It shows counts for total, tasks, email drafts, and failures, then Tasks awaiting approval (Approve or Approve done, Reject, Open), Runs needing your attention, Email drafts to review (Approve draft, Reject), and Recent errors. Approving an email draft does not send it; delivery is a separate, receipt-backed action. A Human signing panel covers passkey enrollment and approval.

Beads (/workspace/beads)

The task graph and ready work, titled "Company OS Beads". It shows ready ledger rows, triage lists (top picks, quick wins, blockers to clear), graph and analytics views, and a Robot JSON export link. It is also the fourth Work tab.

Proof (/workspace/quality)

Evidence about what happened. Tabs: Quality, Diagnostics, Calibration, Lessons, Run receipts, Trace explorer, Papercuts.

• Quality: select agents, run quality checks, and use trace-backed evidence to decide what can be promoted (quality packs, agent KPIs, run stories, promotion gates).
• Diagnostics (/workspace/diagnostics): the diagnostic inbox of analyzer findings with proof. Each finding links to its source revision, run receipt, responsible task, and raw analyzer output when present. Lifecycle state changes only when a producer submits a complete snapshot.
• Calibration (/workspace/quality/decision-calibration): decision calibration.
• Lessons (/workspace/learn, page title "Recurring overrides"): decisions that people repeatedly changed, listed for review.
• Run receipts (/workspace/runs, page title "Verified runs"): recent agent runs with status, missing evidence, final summary, and approval state. Opening a run (/workspace/companies/<company>/runs/<run>) shows live attach, run surfaces, and the verified timeline: node state, evidence, spend, approvals, snapshots, rewind points, forks, and legal actions.
• Trace explorer (/workspace/trace): live agent runs as span trees, and fleet-level failure patterns.
• Papercuts (/workspace/papercuts): the inbox of recurring friction. Filter aggregates, inspect provenance, then resolve or promote open evidence to a task.

Agents (/workspace/agents)

The team roster: who is active, what they know, and where to open their workspace. Filter by All, Active, Paused. An agent page (/workspace/agents/<id>) has tabs Workspace, Memory, Skills, Overview, Chat, Runs, and Computer.

Connectors (/workspace/credentials)

API secrets, linked accounts, triggers, and discovery in one place. Tabs: API secrets, Accounts & automations, Executor catalog, Discovery, Plugin config. Provider keys and connection tests are also on Models (/workspace/models). For desktop account sign-in see Desktop connector sign-in.

Operate (/workspace/operate)

The control-plane directory, titled "Operate the company". It links to Governance, System health, and Proof, then lists every other surface in seven groups (the same groups appear under All workspace areas). Review and proof holds only Lessons (/workspace/learn).

Work views

Label	Route	Purpose
Overview	/workspace/dashboard	Work graph by status and priority, Needs attention, API health, shortcuts.
Recovery	/workspace/recovery	Track approved retry and replanning actions; proposals are reviewed through task approval first.
Outcome Radar	/workspace/radar	Ranked, evidence-backed proposed next moves. Proposal-only, no external action.
Scenario rehearsal	/workspace/scenarios	Forecasts and decision rehearsal (page title "Scenario Lab").
Voice intake	/workspace/voice	Capture spoken intent, review the cleaned command, choose one action, persist the evidence. Voice is input, not authority.
Diff review	/workspace/review	Inspect publication evidence and add annotations. Approval stays in Approvals.
Beads	/workspace/beads	See above.
Search	/workspace/search	Search tasks, agents, projects, goals, memory, run activity, connectors, routes, and recent searches.
Files	/workspace/files	Inspect files, parse documents, and prepare evidence before an agent uses data. Upload is supported.
Website studio	/workspace/web-clone	Source-first website workflow.
Presentation studio	/workspace/openvid	Record, edit, and import presentation video.

Automation

Label	Route	Purpose
Daemons	/workspace/daemons	Versioned DAEMON.md automation packages.
Daemon flows	/workspace/workflows	Multi-step work (page title "Workflows"): Explore gathers facts, Plan defines the approach, completed plans move to Build. Detail pages: /workspace/workflows/<id>.
Daemon runs	/workspace/routines	Runs, env, and coalescing.
One-click tasks	/workspace/automations	Reports, triage, quality scans.
Admission	/workspace/mission-control	"What can start now?": readiness, capacity, budgets, runs, and receipts.
SOPs	/workspace/playbooks	Author procedures and implement them as tasks.
Context canvas	/workspace/context-canvas	Branch from documents, receipts, and tasks.

Access and governance

Label	Route	Purpose
Governance	/workspace/governance	Administrative authority, delegation expiry warnings, enforcement policy, principal tokens (shown once), and delegations.
System prompts	/workspace/prompts	Versioned prompt layers, review, and activation gates.
Grants	/workspace/permissions	Protected assignment permissions.
Connectors	/workspace/credentials	See above.
Financial agents	/financial-agents	Directory of financial APIs, MCP gateways, SDKs, and market data.
Extensions	/workspace/extensions	Stage signed packages and manage capability grants.
Models	/workspace/models	Provider keys (encrypted when HSM_COMPANY_CREDENTIALS_KEY is set) and connection tests.

Team: Together (/workspace/together, invite a partner, follow the work, and review together), Agents, Coordination (/workspace/coordination, durable agent channels), Hire (/workspace/hire), Squads (/workspace/squads), Council (/workspace/council), and Skills (/workspace/marketplace, install company packs and skills).

Data and memory: Business Data (/workspace/business-data), Sync (/workspace/sync), Map (/workspace/graph), Activity (/workspace/intelligence), News digest (/workspace/news), and Dialogue branches (/workspace/dialogue).

Spend and system

Label	Route	Purpose
Spend	/workspace/costs	Recorded month spend, by category, raw data; compare with agent budgets on Agents.
System health	/workspace/runtime	Local services, queues, recent errors, sandbox and mesh panels.
Notify	/workspace/notifications	Slack and Discord notifications.
Settings	/workspace/settings	Execution lane (keep on Auto), Lab Mode, code font preferences.

The remaining entries in this group are lab surfaces; see the next section.

Experimental and lab routes

These routes are not part of the supported path. No page marks most of them "experimental"; the basis is that they are outside the main navigation and outside the canonical product path and supported-capabilities.json. Treat them as development or lab surfaces.

Listed only in the Operate directory (no primary navigation):

• /workspace/pixels Agent Pixels: pixel operations map for agents and tasks.
• /workspace/openvid Presentation studio, and /workspace/web-clone Website studio.
• /workspace/rust-space Build and disk: Rust, Cargo, and workspace build storage.
• /workspace/dead-star Dead Star: preserved contributors and a local royalty ledger; settlement happens outside Company OS.
• /workspace/browser-lab Browser Agent Lab. This page labels itself "Lab only: no connector secrets, no company writes, no trust promotion."
• /workspace/fleet Fleet: opted-in installs reporting health telemetry.
• /workspace/architecture (Blueprint) and /workspace/~architecture (Architecture map).

Shown only with Lab Mode on (Settings, sidebar entries gated by feature flags; some need a connected runner or provider): /workspace/snapshots, /workspace/promotion, /workspace/gepa (needs optimizer configuration), /workspace/dynamic-plans. Lab output is candidate evidence until a verifier rerun and explicit human approval promote it.

Routable but not linked from the navigation: /workspace/quality/eval-pack, /workspace/quality/eval-runs, /workspace/quality/reflex, /workspace/quality/review, /eval-setup, /workspace/companies/new (Company Passport onboarding, linked from the legacy console), and /investor-demo/accept and /investor-demo/workspace (hosted sandbox for investors; see Investor demo mode).

Legacy: /classic, labelled Legacy console in the sidebar footer.

CLI authorization pages

/cli/authorize and /cli/device are the browser half of companyos login and companyos login --device. They are not part of the sidebar.

1. Run the login command in your terminal.
2. In the browser, sign in on this device if asked. For /cli/device, enter the code shown in the terminal (ABCD-EFGH form).
3. Choose the company. Only an owner or admin on a device authorized for that company can grant access; otherwise the page offers Request access.
4. Review the permissions and select Authorize CLI with this device. The fixed permission set is: Tasks, Memory, Customers, Connectors, Tools, Workspace files, Validation.

The grant is a separate CLI session for that company. Return to the terminal; it finishes signing in. End it with companyos logout. If the page says the link cannot be used, run the login command again for a fresh link. Commands and options are in the CLI reference; connecting agents is in Connect agents.