[MrJoy]

Why

A person who works for several organizations needs each to be its own Company: its own root key, facts, authorities and certificates. The launcher config admits one [company]. Merging organizations into one Company sends org A's rulings into org B's coding sessions. Swapping XDG_CONFIG_HOME per invocation doesn't work either, because the installed hooks run kinbase hooks dispatch <host> <event> with no arguments.

What

This PR adds a named form, [companies.<name>], which can't be combined with [company]. The single form is unchanged byte for byte, and the existing suite passes untouched.

[companies.wander]
url = "http://127.0.0.1:8421"
facts_token_file = "…/wander/facts.token"
root_public_key_file = "…/wander/company-root.pub"
cache_root = "…/wander/cache"
discovery_hints = ["github.com/wandercom/*"]

[companies.acme]
url = "http://127.0.0.1:8422"
…
discovery_hints = ["github.com/acme-corp/*", "gitlab.acme.example/platform/**"]

The launcher picks at most one Company per invocation, from the repository the invocation acts on: --repo, the hook envelope cwd, or else the process cwd. From that Company it builds today's single-Company config, so build_trust, the caches, the projector and the hooks still see exactly one Company. The ratified "one externally configured Company root" therefore holds per repository and per invocation.

Selection only narrows. It looks at three kinds of evidence, from configured Companies only:

• holds: the Company's cache keeps a certificate for the worktree UUID, and it verifies against that Company's root;
• hint match: the Company's discovery_hints match the repository's normalized origin;
• pin claim: the Company's cache already pins that origin.

The outcome:

• One Company in the union is selected.
• None means Codebase-only mode.
• Two or more, or any evidence that can't be read, is a refusal: CONFIG_INVARIANT with detail.reason.

No kind of evidence outranks another. The UUID comes from worktree bytes and a certificate binds no origin, so a copied or forked .kin/ must not carry one organization's certificate into another organization's repository.

Also in this PR

• Session candidates are bound to where they were minted. Under the named form, a Company candidate is company:<company_id> and records its repository_uuid. A checkpoint delivers it only from that repository with that Company selected; otherwise the candidate is held. Before this, candidates recorded only company:root and were admitted against the process cwd. A session that stopped in another organization's repository then delivered to that organization's Company. The probe for this fails when the guard is removed.
• Hooks never block. When selection is refused or finds nothing, SessionStart gets a constant notice in the model context. On Claude it also gets a constant systemMessage that the person sees. Hook output never contains another Company's name, URL, cache path or company_id; a canary probe checks this.
• Conversion from [company] is safe. If the per-Company default key would be minted next to the single form's existing key, the command refuses instead. To use one maintainer key for several Companies, set [identity] share_maintainer_key = true.
• Revocation watermarks are keyed by company_id under the named form. A converted config carries its unqualified value over to one Company only.
• Unselected repositories get their own local Company store, per repository, instead of one shared fallback.
• project --evidence-repo refuses an evidence repository that resolves to a different Company.
• status and doctor --repo show company_selection: the configured Companies, the evidence, the outcome and a remediation. This is terminal output only.
• repo issue --company <name> takes a Company name under the named form. It refuses certified-elsewhere when another configured Company claims the repository, and the remediation gives the new-identity procedure: delete .kin/kinbase.toml, then run repo issue and repo init.

Spec

The error taxonomy is unchanged. spec/amendment-004-multiple-companies.md is a candidate that states the rule, adds the named form to cli.md, and lists the limitations and follow-ups:

• certified-elsewhere is client-side only; server-side mint-only issuance is a follow-up.
• Personal-store keys outlive a cache purge; company forget is a follow-up.
• Cross-Company moves that keep signed history are a follow-up.

The amendment carries no authority until ratified. The code is meant to stand on today's ratified text.

How it was designed

1. The problem was put through a constrain interview (wandercom/constrain). The challenge phase settled what counts as "holding" a certificate and withdrew a proposed diagnostics ledger.

2. The resulting design was reviewed by the seven Advocate personas: Red Team, Adversarial, Sage, User, SME, Good Friend and Pat Helland. They found two defects in the first draft, and both are fixed here:

   • Cross-Company candidate delivery. Red Team, Adversarial and Helland each found it independently.
   • Worktree UUID outranking the origin. Red Team, Adversarial, SME and Helland flagged it.

   They also prompted the key-migration guard, the refusal on unreadable evidence, the per-repository fallback store, the watermark carry-over and the human-visible notice.

Tests

crates/kinbase/tests/multiple_companies.rs runs two real company serve processes against an isolated HOME, XDG directories and Personal root:

• each repository is served by its own Company, including from the hook envelope cwd;
• a fork carrying another Company's UUID is refused, hooks exit 0 with no Company names or URLs, and the new-identity procedure recovers;
• two Companies holding one UUID, forced by posting to the second server directly, is refused;
• unreadable evidence refuses instead of falling through;
• a repository no Company claims runs Codebase-only and the hook says so;
• converting a config refuses until the legacy key is named;
• sharing a maintainer key must be stated;
• malformed named configs are refused;
• a Company candidate minted in A's repository never reaches B's store.

There are also unit tests for hint normalization and matching (* and **) and for whole-token scrubbing.

cargo test: 267 passed, 0 failed (main: 245). Two probes were also checked against mutants of the code they guard: the candidate-binding guard removed, and "held certificate wins" restored. Both probes fail against those mutants.

Review round 1 (5662d0d): every finding from Copilot and Adapt was reproduced by a probe that fails on 3ea19f2 before being fixed. The exception is the repo init unreadable-root ordering, which was fixed by reading. Details are in each thread.

Also on this branch, found while setting up three real organizations:

• 175259a: repositories with no origin URL were all answered with the first such repository's certificate. Fixed in both the client and the service, and covered by a probe.
• 3ea19f2: the "no Company" notice now appears only in a repository that carries .kin/kinbase.toml, rather than in every directory a host opens.

Not covered by an end-to-end probe: the watermark carry-over (it needs a revocation fixture, so it has a unit test of the attribution instead) and project --evidence-repo across Companies.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RoD6Wz3VRydW8LgHiWf3KL

[Copilot]

🟡 Changes recommended

Selection ordering, watermark concurrency, and evidence handling contain unresolved correctness issues.

5 open findings

• Normalize non-existent paths before overlap checks · New
• Make legacy watermark claiming atomic · New
• Show selection reports for refused status outcomes · New
• Set hook target before loading launcher · New
• Report unreadable evidence before ambiguity · New

What changed in this PR

Adds per-repository selection among multiple named Companies while preserving downstream single-Company behavior.

Changes:

• Adds named Company configuration and evidence-based selection.
• Binds candidates, stores, watermarks, and projections to the selected Company.
• Adds hook safeguards, diagnostics, and multi-Company integration tests.

File	Description
spec/​amendment-004-multiple-companies.md	Defines the candidate multi-Company contract.
crates/​kinbase/​tests/​multiple_companies.rs	Adds end-to-end multi-Company probes.
crates/​kinbase/​src/​store.rs	Separates unselected repository stores.
crates/​kinbase/​src/​session.rs	Binds Company candidates to Company and repository.
crates/​kinbase/​src/​selection.rs	Implements Company selection and diagnostics.
crates/​kinbase/​src/​repository.rs	Scopes watermarks and exposes selection status.
crates/​kinbase/​src/​lib.rs	Exports the selection module.
crates/​kinbase/​src/​launcher.rs	Applies selection when constructing launcher state.
crates/​kinbase/​src/​hooks.rs	Selects from hook cwd and scrubs output.
crates/​kinbase/​src/​corpus.rs	Recognizes named Company destinations.
crates/​kinbase/​src/​config.rs	Parses and validates named Companies.
crates/​kinbase/​src/​cli.rs	Selects command targets and checks projection evidence.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[adaptcom]

Confidence Score: 1/5

Summary

Adds repository-specific Company selection, but reproduced selection, redaction, checkpoint, and revocation defects make this unsafe to merge. Jeremy McEntire’s human review is required after fixes.

Important Files Changed

File	Overview
crates/kinbase/src/cli.rs	Repository-target routing and cross-Company projection checks.
crates/kinbase/src/config.rs	Named configuration, identity migration, and premature Company selection.
crates/kinbase/src/corpus.rs	Recognizes Company-qualified candidate destinations.
crates/kinbase/src/hooks.rs	Envelope routing and redaction introduce output and checkpoint regressions.
crates/kinbase/src/launcher.rs	Selected Company access, diagnostics, and redaction helpers.
crates/kinbase/src/lib.rs	Exports the Company selection module.
crates/kinbase/src/repository.rs	Revocation watermark migration misattributes ownership and races.
crates/kinbase/src/selection.rs	Combines repository claims but mistakes inaccessible caches for absent evidence.
crates/kinbase/src/session.rs	Binds Company candidates to repositories without aligning hook checkpoint paths.
crates/kinbase/src/store.rs	Isolates unselected Company fallback stores by repository.
crates/kinbase/tests/multiple_companies.rs	Misses reproduced permissions, redaction, hook-routing, and watermark boundary failures.
spec/amendment-004-multiple-companies.md	Candidate multi-Company contract includes unsafe first-claimant watermark migration.

↻ Re-run review · View in Adapt

[Copilot]

🟡 Changes recommended

Unbounded certificate loading, incomplete hook redaction, and Company-scope fallback issues remain.

4 open findings

• Missing company_id falls back to shared legacy watermark · New
• Company service commands depend on launcher credentials · New
• Unbounded certificate read can exhaust memory · New
• Unreadable Company cache leaks company_id in hook response · New

5 resolved since last review

• Make legacy watermark claiming atomic
• Normalize non-existent paths before overlap checks
• Report unreadable evidence before ambiguity
• Set hook target before loading launcher
• Show selection reports for refused status outcomes

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Unresolved repository-isolation and fail-closed selection defects can mix facts across organizational boundaries.

2 open findings

• Include repository identity in fallback Company store namespaces · New
• Missing company_id falls back to shared legacy watermark

3 resolved since last review

• Unreadable Company cache leaks company_id in hook response
• Unbounded certificate read can exhaust memory
• Company service commands depend on launcher credentials

Previously missed (4)

In code that hasn't changed since last review

Validate Company names at the CLI boundary

crates/​kinbase/​src/​cli.rs:410

company is a raw command-line string here, while configured Company names are validated identifiers. An argument containing controls or bidi/noncharacter code points reaches selection and is interpolated into the company-unknown error instead of being refused as an invalid identifier. Apply the same Company-name validator at the CLI boundary before constructing Target::Named.

Propagate refused evidence repository selection

crates/​kinbase/​src/​cli.rs:467

A refused evidence-repository selection is collapsed to None here. When the primary repository is also unselected, an ambiguous or unreadable evidence repository therefore passes this equality check and its Codebase facts are mixed into the projection, bypassing the fail-closed selection rule. Propagate the evidence repository's refusal before comparing selected Companies.

Reserve context space for the required selection notice

crates/​kinbase/​src/​hooks.rs:683

The selection notice is appended after all repository unknowns, but bound_evidence keeps unknowns in order and drops everything after the item/byte ceiling. A repository with enough existing unknowns can therefore lose the required refusal/no-Company notice from the model context. Put this constant notice first (or reserve space for it) so bounding cannot omit it.

Route Git subprocesses through World::isolate

crates/​kinbase/​tests/​multiple_companies.rs:224

These Git subprocesses inherit the runner's live HOME and XDG configuration, so repository setup can read global Git config/templates instead of remaining inside the probe's temporary environment. Route the command through World::isolate just like the Kinbase subprocesses.

This issue also appears on line 829 of the same file.

🧠 Review effort: Balanced

[MrJoy]

The four "Previously missed" findings from Copilot's review of a79f878 have no threads, so they're answered here. Each one reproduced, and each fix is pushed (head f4b389e).

Validate Company names at the CLI boundary (cli.rs:410)

Reproduced: repo issue --company $'evil\e[2J‮' printed the raw argument in the company-unknown message (probe fails on a79f878). Fixed in ba7772f. A name that fails config::valid_company_name, the same check configured names pass, is now refused without being echoed. The check sits in selection::resolve and not in clap, because under the single form --company is the service URL. Probe: a_company_name_from_the_command_line_is_validated_before_it_is_echoed.

Propagate refused evidence repository selection (cli.rs:467)

Reproduced: from a repository no Company claims, project --evidence-repo <ambiguous fork> projected instead of refusing (probe fails on a79f878). Fixed in 1888cef. same_company_evidence returns the evidence repository's refusal before comparing selected Companies. Probe: a_refused_evidence_repository_is_refused_even_beside_an_unselected_one.

Reserve context space for the required selection notice (hooks.rs:683)

Reproduced: with 40 open unknowns, bound_evidence dropped the notice (unit test fails on a79f878). Fixed in 35aec6e. The notice now goes first among the unknowns. Test: hooks::tests::the_selection_notice_survives_the_projection_ceiling.

Route Git subprocesses through World::isolate (multiple_companies.rs:224, :829)

Fixed in f4b389e. Both git invocations now go through World::isolate. This is test hygiene, so there's no probe for it.

[blast-hardcheese]

Reproduced on e025856 with two local Company services and a repository whose origin matches Company A's hint. repo issue --company B returns issued, but installing that exact certificate with repo init exits 4 (company-ambiguous). This is one issuance/install failure mode: the command hands back a certificate that the normal next step rejects. Please make explicit issuance and installation agree about foreign hints, either by refusing issuance up front or by accepting the certificate under an intentional precedence rule.

[blast-hardcheese]

Reproduced separately on e025856 with two signed local Company services and 50 Personal observations. The old single-Company watermark for a key at revocation cursor 1001 is 42 and belongs to B. Both services have revoked that key at cursor 1001, but B's local signed snapshot is still the pre-revocation snapshot when A first reads it. A therefore migrates the legacy watermark to its own scoped key as 42. After B refreshes its signed snapshot, both Companies are recognized as revocation holders, but B's scoped watermark is created as 50 and A's incorrect 42 persists. Observations admitted before the original watermark can consequently be skipped when B evaluates the revocation. A cached snapshot that lacks a revocation cannot establish unique ownership of the legacy key; please make this carry-over conservative and ensure an early mistaken scoped write cannot remain authoritative.