company-brainify

Extract a sanitized shared team/company brain from a personal brain. Strips internal ratings, compensation, performance assessments, retention and political dynamics from pages, takes, and facts across the full scan scope (people, companies, meetings, dailies, cross-references — not just people/), verifies with grep + retrieval passes, and purges sensitive git history behind the data-loss-gate confirmation card. Also runs as a report-only re-audit on an existing shared brain.

Jump to install

Repository: garrytan/gbrain
Last source activity: September 2, 2026 at 00:48
Detected SKILL.md language: English
Stars: 29,706
Forks: 4,432

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	company-brainify
version	1.0.0
description	Extract a sanitized shared team/company brain from a personal brain. Strips internal ratings, compensation, performance assessments, retention and political dynamics from pages, takes, and facts across the full scan scope (people, companies, meetings, dailies, cross-references — not just people/), verifies with grep + retrieval passes, and purges sensitive git history behind the data-loss-gate confirmation card. Also runs as a report-only re-audit on an existing shared brain.
triggers	["company brain","team brain","brainify","sanitize the brain","share my brain with the team","strip sensitive data from the brain","scrub employee data","audit the shared brain","make the brain safe to share"]
mutating	true
writes_pages	true
writes_to	["people/","companies/","meetings/","daily/","projects/","analysis/"]
upstream	company-brainify@fc834ee
brain_first	true

company-brainify — Personal → Team-Brain Sanitization

Convention: see conventions/brain-first.md — discovery runs through the brain's own retrieval, not filesystem guesswork. The grep pipelines below TRIAGE; gbrain query finds what keyword patterns miss.

Convention: see conventions/test-before-bulk.md — sanitize 3-5 files, read the output yourself, then ramp. A bad bulk sanitization pass is worse than none: it looks done and isn't.

Convention: see conventions/regex-discipline.md — "is this sensitive?" is a judgment call, so the model decides per file. The grep patterns are earned triage/verification tools, never the judge.

Convention: see _brain-filing-rules.md — edits stay in the page's existing directory; the deletion log files date-keyed under daily/.

The Problem

Personal brains accumulate everything — company knowledge, meeting notes, internal assessments, compensation details, management strategy, candid opinions about the people you work with. When you stand up a shared team brain from that personal brain (see docs/architecture/brains-and-sources.md for the team-mount topology), all of that has to go. The knowledge is valuable; the sensitive metadata is a liability.

Clean working-tree files alone are NOT enough: git history still carries every pre-sanitization version, and gbrain takes/facts carry evaluative claims outside the page prose. This skill handles all three surfaces — pages, takes/facts, and history.

When to Use

Standing up a shared company brain from a founder/exec's personal brain
Auditing an existing shared brain for sensitive content that shouldn't be there
Onboarding new team members to a brain repo that must be verified clean first
Periodic hygiene pass on a shared brain that re-accumulates sensitive data

What Gets Removed

Always strip (non-negotiable)

Category	Examples
Internal scores/ratings	`score:`, `rating:`, `skill:`, or any vertical-specific frontmatter field; any numeric rating of a person

*_score:

Category	Examples
Professional identity	Name, role, title, work email, LinkedIn
What they're building	Current projects, product work, technical contributions
Career arc	Prior companies, education, professional background (public info)
Professional beliefs	Their views on technology, strategy, product philosophy
Timeline of work	Meeting attendance, project milestones, launches (factual, not evaluative)
Skills/expertise	Technical capabilities, domain knowledge

BRAIN="$(gbrain config get sync.repo_path)"
cd "$BRAIN"

Retrieval discovery — hybrid search catches judgment-shaped content that no keyword pattern will:
```
gbrain query "compensation, equity, or salary discussions about team members" --limit 50
gbrain query "performance concerns, underperformance, or who is struggling" --limit 50
gbrain query "considering leaving, retention conversations, departure rumors" --limit 50
gbrain takes search "performance" --limit 50
gbrain recall --grep "salary"
```
Resolve every returned slug to its repo-relative file path and write the paths into /tmp/brainify-scope.txt (one per line). This file is the scope list; the structural pass below APPENDS to it — nothing later in the procedure may truncate it, or the retrieval-discovered pages silently drop out of scope.

Structural discovery — people files that belong to the company, plus keyword hits across the wider scan scope:

grep -rli 'company: *"acme-example"' people/ --include="*.md" | sort >> /tmp/brainify-scope.txt
grep -rli -E 'salary|equity|carry|retention|underperform|performance review|hard conversation' \
  meetings/ daily/ companies/ projects/ analysis/ --include="*.md" 2>/dev/null >> /tmp/brainify-scope.txt
sort -u -o /tmp/brainify-scope.txt /tmp/brainify-scope.txt

Cross-reference against the company's public people page (website, LinkedIn) to catch files using different frontmatter conventions.
Count: wc -l /tmp/brainify-scope.txt

while read -r f; do
  hits=$(grep -c -i -E 'carry|salary|equity|comp change|departure|considering leaving|retention|underperform|picking up slack|performance review|management risk|hard conversation|nervou|score: *[0-9]|firing|fired|pip|probation|weakness' "$f" 2>/dev/null || true)
  [ "${hits:-0}" -gt 0 ] && echo "$hits $f"
done < /tmp/brainify-scope.txt | sort -rn > /tmp/brainify-triage.txt

Standing up a NEW team brain (default, preferred): sanitize a STAGING COPY of the scanned directories, never the personal brain in place. The founder's personal brain is SUPPOSED to keep comp, performance, and candid notes — stripping them from the personal working tree destroys valuable private data. Copy the Phase-1 scope into a durable staging dir and edit THAT; Phase 5 Step 0 exports from the staging copy. Blast radius: none on the personal brain.
```
# Durable staging dir (NOT /tmp — same reasoning as the mirror backup).
STAGING="$HOME/.gbrain/backups/brainify-staging-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$STAGING" && chmod 700 "$STAGING"
for d in people meetings daily companies projects analysis; do
  [ -d "$d" ] && rsync -a "$d/" "$STAGING/$d/"
done
cd "$STAGING"   # all edits below happen here, not in sync.repo_path
```
Re-auditing an EXISTING shared brain: the shared brain IS the target, so edits are in place on the SHARED repo (cd into the shared repo, never the personal sync.repo_path). Fact-row removal + re-sync applies to the shared source's DB.

⚠️ DATA DELETION — Confirmation Required

What: strip sensitive content, remove takes, and delete fact rows across
      [N files] in [STAGING COPY at <path>  |  the SHARED brain in place]
Count: [N files edited; T takes removed; F fact rows removed]
Location: [staging path OR shared repo path] — NOT the personal sync.repo_path
          on the staging path

Why: preparing a sanitized tree for team access

Recoverable?
- [x] Personal brain untouched (staging-copy path) — re-copy to redo
- [ ] In-place shared-brain path: edits overwrite the live tree; git history is
      the recovery line until Phase 5 purges it

Proceed? (yes/no)

# Rating fields remaining in frontmatter
grep -rn -E '^[a-z_]*(score|rating|skill)[a-z_]*: *[0-9]' people/ --include="*.md"

# Phone numbers
grep -rn -E '\+1[0-9]{10}|\([0-9]{3}\) [0-9]{3}-[0-9]{4}' people/ --include="*.md"

# Comp keywords (full scan scope, not just people/)
grep -rin -E 'carry|comp change|equity|salary' people/ meetings/ daily/ companies/ projects/ analysis/ --include="*.md" 2>/dev/null

# Management/performance
grep -rin -E 'considering leaving|departure rumor|underperform|picking up slack|hard conversation' people/ meetings/ daily/ companies/ projects/ analysis/ --include="*.md" 2>/dev/null

gbrain query "what is alice-example's compensation" --limit 10
gbrain query "who is underperforming or at risk of leaving" --limit 10
gbrain takes search "weakness" --limit 20

# The sanitized staging tree IS the export.
cd "$STAGING"

# Re-run the Phase 4 verification greps + retrieval checks INSIDE $STAGING —
# the staging tree is what ships, and it is the tree that must certify clean.
# ... Phase 4 greps against $STAGING ...

git init -b main
git add -A && git commit -m "Initial import — sanitized team brain"
git remote add origin <TEAM_REPO_URL>
git push -u origin main

PERSONAL="$(gbrain config get sync.repo_path)"
mkdir -p "$HOME/.gbrain/backups" && chmod 700 "$HOME/.gbrain/backups"
WORK="$HOME/.gbrain/backups/brainify-purge-$(date +%Y%m%d-%H%M%S)"
git clone <SHARED_REPO_URL> "$WORK/shared"
cd "$WORK/shared"
[ "$(git rev-parse --show-toplevel)" != "$PERSONAL" ] \
  || { echo "target IS sync.repo_path (personal brain) — ABORT"; exit 1; }

# Apply the sanitized tree, then COMMIT it BEFORE the mirror clone. A mirror
# captures COMMITTED state only; if the clean tree lives only in volatile
# staging during the rewrite window, a crash loses the sanitization work.
# Committing makes the clean state durable and recoverable.
for d in people meetings daily companies projects analysis; do
  [ -d "$STAGING/$d" ] && rsync -a "$STAGING/$d/" "./$d/"   # or sanitize in place here
done
git add -A && git commit -m "Sanitize: strip sensitive content before history purge"

# Mirror-clone backup = the recoverability line on the card. Capture the path
# in a variable NOW and reuse it verbatim at purge time — a run crossing
# midnight must NOT recompute $(date) and false-abort on a mismatched name.
BACKUP_PATH="$HOME/.gbrain/backups/shared-brain-history-backup-$(date +%Y%m%d-%H%M%S).git"
git clone --mirror "$WORK/shared" "$BACKUP_PATH"
git -C "$BACKUP_PATH" log -1 >/dev/null || { echo "backup unreadable — ABORT"; exit 1; }

⚠️ DATA DELETION — Confirmation Required

What: rewrite git history to remove all prior versions of [purged paths]
      from the SHARED repo, then force-push to [remote/branch]
Count: [N commits rewritten; M files with history purged]
Size: [repo size before → expected after]
Location: [SHARED repo work dir; remote URL; branch]
Target check: this is the SHARED repo, verified ≠ personal sync.repo_path
      ($PERSONAL) — the personal brain's history is never rewritten

Why: prior commits contain pre-sanitization versions of pages that were
     just cleaned — team access to the repo means team access to history

Recoverable?
- [x] Mirror-clone backup at $BACKUP_PATH
      (verified: exists, `git -C "$BACKUP_PATH" log` works)
- [ ] NOT recoverable from the rewritten remote — old SHAs become unreachable

What we'd lose:
- all pre-sanitization history for the purged paths (edit trail, blame,
  old versions)
- every existing clone breaks — all collaborators must re-clone

Alternative to deletion:
- fresh-history export to a NEW team repo (Step 0) — personal repo untouched

Proceed? (yes/no)

cd "$WORK/shared"
[ "$(git rev-parse --show-toplevel)" != "$PERSONAL" ] \
  || { echo "target IS sync.repo_path — ABORT, do not filter-repo"; exit 1; }

# The purge list derives from the COMPLETE set of sanitized paths — the same
# directories Phases 1-4 scanned. A filter list narrower than the scan
# (people/ + meetings/ only) leaves pre-sanitization history alive for every
# other scanned directory. The restore carrier below MUST match this same
# list — backed-up set, filtered set, and re-added set are identical.
PURGE_DIRS="people meetings daily companies projects analysis"

# Back up the clean working tree of every purged path to a DURABLE carrier
# (under $WORK in ~/.gbrain/backups — never /tmp, which can vanish mid-rewrite).
CLEAN="$WORK/clean"
mkdir -p "$CLEAN"
for d in $PURGE_DIRS; do
  [ -d "$d" ] || continue
  mkdir -p "$CLEAN/$d" && cp -r "$d/." "$CLEAN/$d/"
done

# Rewrite history: one --path per purged directory, derived from $PURGE_DIRS
rm -rf .git/filter-repo
git filter-repo --invert-paths $(for d in $PURGE_DIRS; do printf -- '--path %s/ ' "$d"; done) --force

# Restore clean files and re-commit as a single new commit — same $PURGE_DIRS
for d in $PURGE_DIRS; do
  [ -d "$CLEAN/$d" ] || continue
  mkdir -p "$d" && cp -r "$CLEAN/$d/." "$d/"
done
git remote add origin <SHARED_REPO_URL>   # filter-repo removes remotes
for d in $PURGE_DIRS; do [ -d "$d" ] && git add "$d/"; done
git commit -m "Re-add sanitized directories"

# VERIFY RESTORE COMPLETENESS before the irreversible push — a partial restore
# would ship a smaller tree than was sanitized. Compare file counts (and, for
# extra safety, checksums) between the carrier and the restored tree.
before=$(find "$CLEAN" -type f | wc -l | tr -d ' ')
after=$(for d in $PURGE_DIRS; do [ -d "$d" ] && find "$d" -type f; done | wc -l | tr -d ' ')
[ "$before" = "$after" ] \
  || { echo "restore incomplete ($before → $after files) — ABORT, do not force-push"; exit 1; }
# Optional stronger check: diff -r "$CLEAN/<d>" "<d>" for each purged dir.

# RE-VERIFY the backup immediately before the irreversible step — card-time
# verification is not enough; time has passed and the rewrite could have gone
# sideways. Reuse $BACKUP_PATH (do NOT recompute $(date)); abort if unreadable.
git -C "$BACKUP_PATH" log -1 >/dev/null \
  || { echo "backup missing/unreadable — ABORT, do not force-push"; exit 1; }

git push --force origin main

Both destructive steps fire the data-loss-gate confirmation card and wait for an explicit typed "yes"/"do it" BEFORE running: Phase 3 (bulk strip + take/ fact removal) and Phase 5 (history purge + force-push). This is a routing convention the agent must follow — nothing in the runtime mechanically blocks a skipped gate, which is why skipping it is the cardinal violation of this skill.
Phase 3 defaults to sanitizing a STAGING COPY of the scanned scope, leaving the personal brain's working tree untouched; in-place edits are reserved for re-auditing an existing shared brain.
The Phase 5 history purge (Steps 3+) runs only on the SHARED repo cloned to a work dir — never sync.repo_path — after (a) a mirror-clone backup exists and is verified, and (b) a restore-completeness check passes before the force-push. The personal brain's history is never rewritten.
The deletion log is written to the PERSONAL brain (daily/) or a local ops log, never into the shared repo.
The scan covers the full scope (people, meetings, dailies, companies, projects, analysis, takes, facts, back-links), never people/ alone.
Nothing unscanned ships: the fresh-export path includes ONLY directories covered by the sanitization scan; everything else is excluded by default, and the Phase 4 verification greps run against the exported tree before the first push.
Sensitive fact rows are deleted from the page's Facts fence, re-synced, and the facts index reconciled (extract-facts sweep) with the removal verified via gbrain recall --grep, never merely expired — gbrain forget retains the row (struck through, served via --include-expired) and can never certify clean.
The history-purge filter list and its restore manifest both derive from the COMPLETE set of sanitized paths, never a subset.
Every strip decision is a per-file model judgment grounded in a full read; grep output is triage and verification only.
A verification pass (Phase 4 greps + retrieval checks) runs before any commit is pushed to the shared repo.
Confirmed purges are logged to daily/notes/YYYY-MM-DD.md under ## Data Deletions with the backup path as the recovery line.
A brainified brain is stamped brain.audience=shared at handoff and never receives the ambient-writeback enablement nudge — that consent ask is reserved for personal brains.
Routing matches the canonical triggers in the frontmatter.
Output written under the directories listed in writes_to: (edits in place, plus the daily/ deletion log).
Privacy contract preserved: no real names, no fork-specific filesystem path literals, no upstream-fork references.

## Brainify Report — YYYY-MM-DD

- Scope: [N files scanned across people/, meetings/, daily/, ...]
- Flagged: [M files with hits] (triage list attached)
- Edited: [K files sanitized; T takes removed; F fact rows removed + re-synced + facts index reconciled]
- Verification: [grep residuals: 0 confirmed-sensitive; retrieval checks: clean]
- History: [not purged | fresh-export | purged after confirmed gate — backup at <path>]
- Next re-audit: [date / cron slot]