Company OS as Task OS: System Map
This is the compact map for understanding Company OS as one local-first Task OS: a ledger for work, a console for operators, and an execution spine for agents. It separates what is live from what is partial, lab-only, or still a gap.
Status labels:
| Status | Meaning |
|---|---|
| Live | Product path exists and should be treated as supported in this repo. |
| Partial | Core pieces exist, but the surface is not complete or polished end to end. |
| Lab | Useful advanced lane, not the beginner product path. |
| Gap | Named missing feature or parity item. |
Beginner Product Spine
| Area | Status | What exists |
|---|---|---|
| One-command local startup | Live | Repo path: ./company-os. It starts or reuses the local Company Console path, hsm_console, Postgres when needed, and the worker/chat route, then prints one ready URL. scripts/company-os-up.sh is the internal supervisor. Public installer shape is `curl -fsSL .../install.sh |
| First-run onboarding | Partial | Create company, choose model lane (OpenRouter, Ollama, or UI-only), run proof demo, show success checklist, and explain the trust summary. Some first-run/browser-harness work is still dirty in this worktree and should be verified before release. |
| Canonical runtime path | Live | src/bin/hsm_console.rs, src/company_os/, migrations/, web/company-console/, and ./company-os (which delegates internally to the supervisor). See docs/company-os/CANONICAL_PRODUCT_PATH.md. |
| What this is | Live | A local-first operating system for delegated tasks: company ledger, operator console, task worker execution, memory, governance, evidence, and promotion loops. |
| What this is not | Live | Not a hosted SaaS by itself. Not "agents run your whole company unsupervised." Not full Paperclip parity yet. |
Ledger And World Model
| Area | Status | What exists |
|---|---|---|
| Company ledger | Live | Companies, tasks, goals, agents/personas, agent runs, governance events, spend events, memory entries, artifacts, connector accounts/sessions/triggers, promotion state. |
| World model | Live | Postgres is the canonical graph and integration ledger. External intelligence can sync into it, but Company OS remains the source of truth. |
| Ops overview as recovery context | Live | Unified company state endpoint for task/goal/agent/spend counts, recent governance, heartbeats, tickets, org model, task trail audit, and failure/repair visibility. |
Task llm-context rehydration | Live | Agents should recover context through ops overview and task context rather than fragile session-only state. |
Operator Console
| Area | Status | What exists |
|---|---|---|
| Core routes | Live | Start, Dashboard, Tasks, Inbox/approvals, Agents, Results/quality, Hire, Models, Costs, My work, Trust trail, Automations, Guardrails, Workflows, Council, Playbooks, Packs/marketplace, Connectors, Activity/intelligence, Map/graph, System health, Settings. |
| Lab routes | Lab | Snapshots, GEPA, promotions, dynamic plans, trace router, and advanced harness lanes belong behind lab/product-boundary language. |
| Beginner copy guard | Partial | Beginner routes should avoid leaking lab/runtime names. Use browser smoke and red-squigglies when onboarding or public-front-door docs change. |
Agent Chat And Native Worker
| Area | Status | What exists |
|---|---|---|
| Agent-chat | Live | Operator conversation surface routes substantive work into Company OS task/worker execution, streams progress, and uses company/task/persona context. |
| Worker-first execution | Live | Real work should go through task/worker paths, not a disconnected chatbot-only answer. |
| Native ReAct worker | Live | Default execution loop uses Company OS tools, creates run records, emits evidence, captures terminal outcome, produces artifact-shaped outputs, and feeds grading/promotion gates. |
| Work modes | Live | Runs can be shaped as research_brief, repo_diagnosis, decision_memo, document_extract, task_plan, or direct_answer. |
Memory, Retrieval, And Skills
| Area | Status | What exists |
|---|---|---|
| Company memory | Live | Shared company memory, scoped memory writes, memory search, and evidence-bearing retrieval artifacts. |
| Workspace/document retrieval | Live | Workspace/catalog APIs, document/context artifacts, ColGREP-style code retrieval, and ops overview recovery. |
| Skills | Live | Repo skills load through HSM_SKILL_EXTERNAL_DIRS; Company OS startup prepends ./skills when needed. Skill catalog/list/read patterns support progressive disclosure. |
| Trace-to-skill promotion | Partial | Promotion path exists and is gated by verifier/human approval. Treat it as governed automation, not automatic skill mutation. |
Tasks, Goals, Governance, And Spend
| Area | Status | What exists |
|---|---|---|
| Task operations | Live | Create/update tasks, assign ownership/DRI, checkout/release, state changes, handoffs, SLA/priority/context updates, and follow-up task flows. |
| Goal APIs | Live | Goals exist as first-class planning/ledger objects and can sync with intelligence-layer state. |
| Governance | Live | Human-required gates, approval/inbox surfaces, governance event log, verifier concepts, escalation/repair visibility, and budget enforcement on checkout. |
| Protected assignment | Live | Assignment is a distinct company_os:assignments authority: authenticated owners/admins may assign directly; delegated actors need this grant in addition to company_os:tasks, and org-chart checks refuse upward or sideways assignment. |
| Spend | Live | Spend ledger, spend grouped by kind and agent reference, console cost surface, and budget usage where agent refs match role config. |
Connectors, Triggers, And Automations
| Area | Status | What exists |
|---|---|---|
| Connectors | Live | Connector catalog, accounts, sessions, trigger subscriptions, account-aware discovery, OpenAPI/MCP tool-source ingestion, executor bridge status/sync, and BaseLayer browser connector template. |
| OAuth/productized auth | Partial | Foundations exist, but fully polished OAuth flows for every connector are not complete. |
| Triggers | Partial | poll, schedule, webhook, and manual delivery exist. Current mature action type is mainly create_task; broader action types remain future work. |
| Notifications | Gap | Slack/Discord-style notification wiring is not yet fully productized. |
Files, Artifacts, Trust, And Review
| Area | Status | What exists |
|---|---|---|
| Workspace files | Live | Workspace file/catalog APIs, blob/artifact store, document/context artifacts, evidence artifacts, and snapshot artifacts. |
| Trust trail | Live | Run execution events, agent run records, trace store, and trace router lab lane. |
| Diff review | Live | Broker-authoritative task/run review artifacts render in a dedicated workspace surface with unified and split views, governed annotations, model/contract/browser coverage, and a bundle budget. |
| Managed worktree reseed | Gap | Workspace roots and task context exist, but Paperclip-style managed worktree reseeding with conflict preview and recovery UX is not first-class. |
Evaluation, Promotion, And Lab Lanes
| Area | Status | What exists |
|---|---|---|
| Evaluation and promotion | Live | Cheap artifact grading, promotion gates, eval packs, meta-harness smoke, runtime policy deltas, and promote/rollback decisions. |
| Snapshots | Live | Native workflow snapshot capture/list/get plus snapshot service hash/version metadata for replay/eval/GEPA use cases. Browser snapshot shim is optional/provider-backed. |
| Dynamic workflows | Lab | Bounded workflow-plan artifacts for classify/act, fan-out/synthesize, adversarial verification, generate/filter, tournament, loop-until-done, triage quarantine, and lightweight eval patterns. |
| Advanced lanes | Lab | GEPA optimizer boundary, Claude/Ax harness, RLM REPL executor, smol_code eval path, Harbor verifier, SGLang/Nemotron model lane, OpenCode escalation, GraphJin/graphify/codegraph intelligence prefixes, and BaseLayer provider-backed browser hosting. |
SDK, Contracts, MCP, And Red Squigglies
| Area | Status | What exists |
|---|---|---|
| SDK/contracts | Live | OpenAPI, Python/TypeScript SDK surface, typed run events, markdown agent definitions, action event schema, and runtime policy delta contracts. |
| Dedicated Company OS MCP server | Live first slice | services/company-os-mcp-server/ exposes Company OS API tools over stdio MCP, including approval-sensitive calls with explicit confirmation. See docs/company-os/COMPANY_OS_MCP_SERVER.md. |
| Browser harness | Partial | Codex in-app browser contract and /workspace/start smoke expectations are documented; stable data-testid anchors should be kept for beginner-route verification. |
| Agent red-squigglies | Live | Warning hook catches drift such as package-manager mismatch, source changes without tests, generated-file edits, lab names leaking into beginner UI/docs, onboarding changes without browser smoke, and MCP overreach when a skill/script should come first. |
Paperclip Parity Backlog
| Item | Status |
|---|---|
Dedicated company-os-mcp-server | Live first slice; install/client polish may continue. |
| Unified company search | Live: one company-scoped endpoint and shared Console model cover tasks, agents, projects, goals, memory, runs, indexed workspace files/documents, activity, governed/task comments, connectors, routes, and Command-K handoff. Recent queries remain client-local convenience state rather than ledger records. |
| Diff viewer tied to task/run review | Live: broker-authoritative unified/split review with governed annotations. |
| Routine engine v1 | Partial product surface: portable routine/routine-run rows, immutable replay history, redacted run history, coalescing, checkpoints, and repair exist; portable routine env, full UI history, and broad action types remain. |
| HITL preference history | Live ledger slice: learned preference rows replay through complete immutable snapshots with drift, admin repair/checkpoints, provenance, and external stream heads. |
| Context-policy history | Live ledger slice: policy rows replay through complete immutable snapshots with nullable-field preservation, drift, admin repair/checkpoints, provenance, and external stream heads; policy admission/resolution remains governed by the existing writer path. |
| Shared-thread session history | Live ledger slice: session participants and state replay through complete immutable snapshots with immutable session identity, drift, admin repair/checkpoints, provenance, and external stream heads. |
| Channel-membership history | Live ledger slice: agent/human/service membership sets replay through immutable channel-scoped snapshots with drift, admin repair/checkpoints, provenance, and external stream heads; message bodies and principal authority remain separate boundaries. |
| Task operational history | Live ledger slice: priority, SLA/escalation, human-gate, status-reason, and context-note fields replay through immutable snapshots with drift, admin repair/checkpoints, provenance, and external stream heads; governed admission and human approval remain the decision authority. |
| Task context/lineage history | Live ledger slice: goal/project links, goal ancestry, promotion provenance, fork/parent/spawn lineage, display numbers, and step policy replay through immutable snapshots with drift, admin repair/checkpoints, provenance, schema registration, and external stream heads. |
| Connector account/OAuth history | Live ledger slice: safe account configuration and OAuth lifecycle fields replay through immutable snapshots with credential digests/presence evidence, escrow-preserving repair, checkpoints, provenance, schema registration, and external stream heads; secret bytes remain outside canonical history. |
| Routine-scoped secrets | Gap: connector credentials/redaction exist, but routine-scoped inheritance/revision history and agent < project < routine precedence do not. |
| Protected assignment permissions | Live: company_os:assignments is distinct from ordinary task mutation, and assignment targets remain bounded by the company org chart. |
| Worktree reseed/recovery UX | Gap. |
| Local cloud upstream sync | Gap: import/export and docs mirroring exist, but conflict-preview local-to-cloud activation does not. |
| Import/export UX polish | Partial: pack import/export and SDK/bundle concepts exist; nested picker, GitHub shorthand refs, merge history, and CLI polish remain. |
| Notification connectors | Gap. |
| Plugin/connector config UX | Partial: connector account redaction exists; mature reusable SecretBindingPicker remains a gap. |
Release Truth Checklist
Before calling this "done" for a release, verify:
bash
./company-os
bash scripts/company-os-sacred-loops.sh
bash scripts/agent-red-squigglies.shFor onboarding or public-front-door changes, also run the documented browser smoke for /workspace/start.