# Active Company Session

Company OS selects a tenant independently from the model provider and the
working directory. A repository path may help an operator find a company, but
it never grants access.

## Interface

The local active-company module has one small interface:

1. A verified Console principal session persists a private tenant binding at
   `<auth-home>/company-os-tenants/<company-id>.env`.
2. The non-secret current selection is written to
   `<auth-home>/company-os-active-company.env` using schema
   `hsm.company_os.active_company.v1`.
3. Desktop admission validates that tenant binding through the canonical
   `principal-session` route before creating a run.
4. The resulting immutable run grant carries `company_id`, principal, scopes,
   provider, selected model, and run ID to the provider broker.
5. Brokered MCP calls and run receipts must match that grant's company. A later
   operator selection cannot rebind an admitted run.

`<auth-home>` is `HSM_COMPANY_OS_AUTH_HOME` when configured and otherwise the
current user's `~/.hsmii` directory. Files containing principal credentials are
regular, non-symlink, mode-0600 files. The active pointer contains no
credential.

## Operator behavior

- The Console does not select the first catalog company.
- Selecting another company activates it only when this PC already has a
  stored principal binding and the server verifies that binding for the exact
  company.
- A company created through the Company Passport is registered automatically.
- If authority is absent or expired, the selection remains unchanged and the
  Console displays `Not authorized`.
- Governed desktop model rows display `Working in: <company>` after validation.
  If validation fails, the rows are not selectable even when provider login and
  subscription quota are otherwise ready.

## Harness behavior

OpenRouter is a model backend, not a tenant authority. OMP, Pi, Codex, Claude
Code, and OpenRouter all receive the same server-owned run grant. Direct Codex
and Claude MCP configurations that launch `scripts/company-os-mcp-server.sh`
resolve the same active binding. Provider credentials never enter the tenant
binding files, and Company OS principal credentials never enter ACP frames.

## Fail-closed invariants

- Active pointer company must equal tenant credential company.
- Principal-session company must equal selected company.
- Run grant, broker environment, MCP sidecar, and receipt company must match.
- Missing, malformed, permissive, or symlinked binding files are rejected.
- Working-directory and company-catalog matches are context hints only.