Company brain: the private tier between the toolkit and a project — template, wiring, CI floor, measured eval

[MendixMau]

What

A company running several Mendix projects had nowhere to put its own material — conventions, client-named learnings, house lint rules, MDL snippets, approved MPKs. The shared toolkit forbids it (leak guard) and a hand copy per project rots. This PR ships that tier as a template and wires it with one pointer block per project, so the toolkit's baseline word budget is untouched.

• templates/company-brain/ — governance rule (reviewed weekly, promoted only by explicit decision), routing table, project registry, components with an MPK manifest template, inbox, proposals, patches, field runs, handoffs, prompts, a leak-check wrapper.
• bin/init-company-brain.sh, bin/wire-company-brain.sh, init-project.sh --company <dir>, harvest-learnings.sh --to <brain>/inbox.
• skills/company-brain.md + routing row (on demand, spine group); README paragraph; CLAUDE.md line.
• New CI floor bin/check-no-private-citations.sh: the public toolkit never cites a private tier. Found nine live pointers; four were routing text and are reworded. Motivated by the USI workshop finding that five skills cited by the public repo existed only in one person's private repo.
• toolkit-guide.html §9, the wiring page: four layers, owner-per-file table, SHIPPED/PROPOSED badges.
• Two contrib/inbox/ ideas: the prerequisites gate for "full X" tasks, and the company brain's own design record with prior art.
• evals/scenarios/company-brain-design-module/ with three run records (below).

Shape extracted from a private repo that had run this model for a month (weekly review, pointer stubs after promotion, proposals/, patches/, widgets/, field-runs/, handoffs/).

Measured, not asserted

Six Sonnet sessions per run, two arms of the same real frozen app differing by exactly the nine-line pointer block, markers grepped for absence in both arms first.

Run	Component	Wired	Control
1 (2026-09-19)	stand-in	3/3 retrieved	0/3
2 (2026-09-20)	the company's real theme module + brand guide	2/3, then 3/3 after the wiring fix	0/3

The one miss diagnosed a real defect: that session read AGENTS.md, CLAUDE.md, PROJECT.md, intake.md and never opened CLAUDE.local.md, the only file carrying the pointer. The pointer now goes into every instruction surface the project already has. Every retrieving session also correctly refused to "fix" the theme's deliberate colour deviation from the print brand guide — the class of knowledge with nowhere else to live.

Bugs found by running it against real files, fixed with tests

1. Pointer single point of failure (above).
2. The template's leak check green-lit files it had not read: it delegated to a text-file guard, so a folder of a PDF and a 56 MB package reported clean; pre-git it printed errors and exited 0. Now checks filenames (the real drop carried an individual's name), handles pre-git, reports unscannable binaries out loud.
3. Component guidance said "choose CLI, MCP or Studio Pro"; corrected to CLI-first — Studio Pro is a handoff surface, not a write mode, and MCP needs it running.

Headless install chain, run for real

mxcli v0.22.0 downloaded into the container; mxcli new on 11.14.0; the real theme package refused by mx module-import and mx convert (10.6.4, needs a 10.21–10.24 hop; CDN serves no 10.x). Then proven the CLI can install it: the module has zero model documents, so it is a file operation — and copying themesource/ alone builds green with none of the brand colours applied, because the module's main.scss imports the project's variables while its own variables file is imported by nothing. With that one extra copy, all five brand hexes verified in the compiled CSS. Full records under evals/.../runs/2026-09-20-install/, including a fork-vs-PR sizing and a built, tested upstream PR for mxcli marketplace install --file (staged privately; not this repo's concern beyond the record).

Verification

• tests/wave2/test-company-brain.sh: 45/45 on the merged tree (instantiate, wire once, re-point in place, every instruction surface, refusals, citation check positive+negative control, leak check, harvest --to).
• check-scripts, render-routing --check (baseline 78,962 / 80,000 words — no baseline rows added), check-portability, leak guard (612 tracked files), check-no-private-citations, check-pr-discipline vs master: all clean.
• Merged with master (Release list: ## Unreleased in CHANGELOG, bin/cut-release.sh, release line in sync-project #111's ## Unreleased format adopted; branch lines moved under it); 0 behind.

Not in this PR

• Cross-project index (projects.tsv is the registry a derived index would read).
• Prerequisites gate implementation — inbox idea only.
• Baseline routing for the company-brain skill (on demand by design; Baseline routing tier is saturated: 79,999 of 80,000 words on master #90 budget untouched).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Cjxzzw8LVrfLrEmz8YMXQW

---

Generated by Claude Code