| name | upgrade-to-company |
| description | Convert a personal ARC second brain into a shared company brain. A deliberate, reviewed ritual that crosses a trust boundary — default-deny, founder-approved, never a one-click switch. Trigger on "make this a company brain", "share this with my team", "upgrade to company", "set up the team version", or "/upgrade-to-company". |
| metadata | {"short-description":"Personal → company brain, with a fail-closed privacy gate"} |
upgrade-to-company
Turn this personal ARC workspace into a company (shared) second brain: one
git-backed source of truth the team clones, plus a local-only private/ tier that
never leaves the founder's machine.
This is a trust-boundary crossing, not a storage move. A personal brain holds
candid content (comp, equity, health, opinions about named people, career thoughts)
that is safe for one reader and a leak the moment the company can read it. The
boundary is therefore structural and fail-closed.
Hard rules
- Default-deny. Nothing becomes company-visible until the founder approves it in
the manifest. When unsure, an item stays private.
- Never push to a public remote.
gh repo view --json visibility; abort if PUBLIC.
- Structure is the boundary — the
private/ folder + .gitignore, not frontmatter.
- You propose, the founder decides. The classification is a draft for review.
Flow
- Preconditions —
/setup has run. Decide where the shared brain lives: a fresh
private repo under a GitHub Organization (best — each teammate joins with
their own account), or a private repo with the other person added as a collaborator
(fine for two). NEVER a shared GitHub login, and never a teammate's existing personal
repo. Verify the remote is private (gh repo view --json visibility).
- Create the private tier if absent:
uv run python scripts/scaffold_private.py
(idempotent). Confirm .gitignore excludes private/.
- Classify every
wiki/ article and context/ file as shared / private /
ambiguous, reusing the ai-leverage-brief taxonomy and business-snapshot
keep-personal labels. Private-by-default: personal finance / comp / equity, health,
family, candid opinions about named people, credentials, legal, career or exit.
Write private/upgrade-manifest-{date}.md (path | visibility | reason | excerpt);
ambiguous defaults to private.
- Human review — founder approves per row. Move (not copy) private items into
private/, preserving wikilinks. Run lint and fix any shared→private link leak.
- Company scaffolding — set
- Mode: company in context/workspace.md (flips
compile to write new captures into private/wiki/ by default; see
scripts/config.py:get_mode). Add team-roster.md, roles.md, access-tiers.md,
ways-of-working.md. Reframe context/overview.md for a team audience.
- Shared remote — point
origin at the org/private repo; push only the shareable
tree (except private/ and gitignored paths). Teammate onboarding, each with THEIR
OWN account: founder adds them as org member/collaborator → they gh auth login as
themselves → git clone → run setup.sh (creates their own local private/) → read
SHARING.md → work on arc/<their-slug> and /sync. No shared credentials.
- Govern — write/refresh
SHARING.md; summarize what is shared vs private and how
to promote/sync; note that deeper rollout is a separate engagement.
Out of scope
Multi-user RBAC, encryption at rest, multi-remote selective sync, server-enforced
access — those belong to a hosted product, not this starter kit.
Trigger examples
- "make this a company brain"
- "share this brain with my team"
- "upgrade to company"
- "/upgrade-to-company"
