Add company constitution

.env.example

@@ -1,92 +1,12 @@
-# FOUNDER OS — copy to .env.local and fill in. .env.local is gitignored.
-
-# ── Email (up to 4 IMAP inboxes) ─────────────────────────────────────────
-# Gmail: use an App Password (Google Account → Security → 2FA → App passwords)
-INBOX_1_HOST=imap.gmail.com
-INBOX_1_USER=
-INBOX_1_PASS=
-INBOX_1_NAME=
-# INBOX_1_PORT=993            # optional, defaults to 993
-INBOX_2_HOST=
-INBOX_2_USER=
-INBOX_2_PASS=
-INBOX_3_HOST=
-INBOX_3_USER=
-INBOX_3_PASS=
-INBOX_4_HOST=
-INBOX_4_USER=
-INBOX_4_PASS=
-
-# ── Slack ────────────────────────────────────────────────────────────────
-# Bot token (xoxb-…) with scopes: channels:read, channels:history, users:read
-SLACK_BOT_TOKEN=
-
-# ── Payment processors ───────────────────────────────────────────────────
-STRIPE_SECRET_KEY=            # full client implemented (balance + charges)
-PAYPAL_CLIENT_ID=             # registered; client lands when keys do
-PAYPAL_CLIENT_SECRET=
-SQUARE_ACCESS_TOKEN=
-WHOP_API_KEY=
-
-# ── Notion ───────────────────────────────────────────────────────────────
-# Internal integration secret; share target pages with the integration
-NOTION_API_KEY=
-
-# ── Launchpad Cohort ───────────────────────────────────────────────────
-WEBINARJAM_API_KEY=          # account-wide key; pulls webinar registrants/attendees
-TRAKYO_API_KEY=              # revenue attribution; status-only until Trakyo ships an API
-GHL_API_KEY=                 # GoHighLevel Private Integration token (Settings → Private Integrations, read scopes)
-GHL_LOCATION_ID=             # the LC sub-account location id (visible in the GHL URL: /v2/location/<id>/…)
-
-# ── G-Brain ──────────────────────────────────────────────────────────────
-# Defaults work: gbrain CLI on PATH, store at knowledge/brain-store
-# BRAIN_PROVIDER=gbrain       # set to "stub" to disable
-# GBRAIN_BIN=                 # override CLI path
-# GBRAIN_STORE=               # override brain-store path
-# GBRAIN_DISABLE_DIRECT_POOL=1
-
-# ── LLM (agent & Conductor chat via Vercel AI Gateway) ───────────────────
-# Without a key, agent chat reports "not configured" (no fake "connected").
-AI_GATEWAY_API_KEY=           # Vercel AI Gateway key; enables agent chat
-# LLM_PROVIDER=gateway        # set to "stub" for deterministic offline tests
-# LLM_MODEL=anthropic/claude-sonnet-4-6   # "provider/model" routed via gateway
-
-# ── Beehiiv (email list) ─────────────────────────────────────────────────
-# Without both, the Social email-list card stays seeded dummy (no fake number).
-BEEHIIV_API_KEY=             # Beehiiv API key
-BEEHIIV_PUBLICATION_ID=      # publication id (pub_...)
-
-# ── ManyChat (Instagram DM automation) ───────────────────────────────────
-# Lights up the ManyChat connector on /integrations. ManyChat → Settings → API.
-# The API cannot list DMs — the live /social DM inbox is fed by the webhook
-# below, not by this key.
-MANYCHAT_API_KEY=            # ManyChat API key
-# Optional shared secret: if set, /api/webhooks/manychat requires header
-# `x-manychat-secret` to match (put the same value in the ManyChat External
-# Request headers). Leave blank to accept unauthenticated posts (dev only).
-MANYCHAT_WEBHOOK_SECRET=
-
-# ── Payments processors (Finances) ───────────────────────────────────────
-# Stripe is fully wired; the rest are honest "not configured" until keyed.
-# STRIPE_SECRET_KEY=         # sk_live_… / sk_test_… (already above if set)
-PAYPAL_CLIENT_ID=
-PAYPAL_CLIENT_SECRET=
-FANBASIS_VANTAGE_KEY=       # FanBasis · Vantage
-FANBASIS_LC_KEY=             # FanBasis · Launchpad Cohort
-WISE_1_TOKEN=                # Wise account 1 (income + outgoing transfers)
-WISE_2_TOKEN=                # Wise account 2
-
-# ── Email send (SMTP, optional per inbox) ────────────────────────────────
-# Comms email replies send for real via SMTP using each inbox's user/pass.
-# Defaults: host = INBOX_n_HOST with imap.→smtp., port 465. Override per slot:
-# INBOX_1_SMTP_HOST=smtp.gmail.com
-# INBOX_1_SMTP_PORT=465
-
-# ── Comms lane routing (optional) ────────────────────────────────────────
-# Extra keywords that force a message into the /comms Work lane, comma-separated,
-# matched against its inbox / sender / subject. Add your brands + key clients.
-# Generic work signals (invoice, contract, proposal, …) are built in.
-# COMMS_WORK_KEYWORDS=Acme,Northwind,Jane Client
-
-# ── App ──────────────────────────────────────────────────────────────────
-# FOUNDER_OS_DB=              # override SQLite path
+# Real provider integration (V2J.1)
+# Copy only the variable NAMES you need into .env.local.
+# NEVER commit real values.
+
+ANTHROPIC_API_KEY=
+ANTHROPIC_MODEL=claude-sonnet-5
+TAVILY_API_KEY=
+ALPHA_VANTAGE_API_KEY=
+
+# Existing optional runtime paths/secrets can remain in your local environment.
+# STARTUP_CONTROL_PLANE_DB=
+# STARTUP_RUNTIME_IDENTITY_SECRET=

.vscode/tasks.json

@@ -0,0 +1,27 @@
+{
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "Startup: Start Local Stack",
+      "type": "shell",
+      "command": "powershell",
+      "args": [
+        "-NoProfile",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-File",
+        "${workspaceFolder}\\scripts\\start-local-stack.ps1"
+      ],
+      "problemMatcher": [],
+      "group": {
+        "kind": "build",
+        "isDefault": true
+      },
+      "presentation": {
+        "reveal": "always",
+        "panel": "dedicated",
+        "clear": true
+      }
+    }
+  ]
+}

AGENTS.md

@@ -1,40 +1,45 @@
-# FOUNDER OS — agent rules
+# STARTUP — Agent Rules
 
-Full project docs live in **CLAUDE.md** (same directory) — read it first.
-This file exists so non-Claude agents (Codex, etc.) get the same house rules.
+Read `CLAUDE.md` and the canonical company specification before changing the system.
+
+Authoritative company files:
+
+- `company/company.yaml`
+- `company/organization.yaml`
+- `company/governance.yaml`
+- `policies/memory_policy.yaml`
 
 ## Non-negotiables
 
-- **Never commit or copy secrets.** Credentials live in `.env.local`
-  (gitignored) and Alex's canonical files; `lib/creds.ts` resolves them.
-  Never copy keys from `~/knowledge/.env.agents` into the repo.
-- **Never push to any remote or touch `main` without Alex's explicit yes.**
-  Commit locally on `founder-os`, small checkpoints, often.
-- **Don't kill the dev server on 4100 or 4101** — other sessions use them.
-  If your edit crashes the dev server's hot reload, fix it fast: a crash loop
-  corrupts `.next` and breaks every session's page chunks (kill the port,
-  `rm -rf .next`, restart).
-- `/org` markup is frozen — do not restructure it.
-- No em/en dashes in anything written for Alex.
-
-## How to work
-
-- TDD: failing test first (`tests/`, one file per module,
-  `FOUNDER_OS_DB=:memory:`), then implement. `npm test` and
-  `npm run typecheck` must be green before claiming done.
-- Everything reads through the repo layer: `lib/db.ts` repos + `lib/schemas.ts`
-  Zod validation + `lib/seed.ts` seeds. Never query SQLite from a page/route.
-- Theme via CSS vars on `data-theme` (five themes in `app/globals.css`);
-  Tailwind `os.*` tokens map to them. Keep `tailwind.config.ts` and
-  `globals.css` in sync.
-- Commands: `npm run dev` (port 4100) · `npm test` · `npm run typecheck` ·
-  `npm run seed` · `npm run brain:docs`.
-
-## Multi-agent etiquette
-
-Multiple agent sessions (Claude, Codex) work this repo concurrently:
-- `git log --oneline` to see where others are; commit small and often.
-- Coordinate by surface: don't edit a page/component another session has
-  uncommitted changes in (`git status` shows them).
-- The Playwright browser is shared across sessions — expect interference.
-- Leave handoff notes in `docs/` if you stop mid-feature.
+- Never commit secrets.
+- Never push to any remote without explicit human approval.
+- Never invent operational company history or production data.
+- Never give an AI agent unrestricted brokerage execution credentials.
+- Never bypass governance or approval state transitions.
+- Do not restore removed FounderOS functionality merely to satisfy an old test.
+
+## Engineering rules
+
+- Run `npm run typecheck`.
+- Run `npm test`.
+- Keep structured data validated with Zod.
+- Use repository abstractions for operational persistence.
+- Preserve useful generic infrastructure.
+- Remove application-specific FounderOS assumptions.
+- Treat empty Foundation Mode datasets as valid.
+
+## Architecture principle
+
+Agents propose actions.
+
+The deterministic Company Control Plane decides whether those actions are technically permitted.
+
+The human CEO retains final investment and execution authority.
+
+## Startup Brain
+
+Startup Brain is the company's institutional memory.
+
+Do not recreate or depend on the legacy FounderOS G-Brain.
+
+Raw market history belongs in market-data systems, not institutional memory.