> **DRAFT (16 Oct, Ouria Intensive Day 2).** Parts A, B and F were dry-run on a made-up brain on a laptop. Parts C, D and E (Supabase, Railway, a team member's agent) have not been run on a real account yet. Remove this line only after one full run on a demo box. > **For you, the member:** you never need to read this file. Drag it onto your brain folder, then tell Hermes: Read company-brain-setup.md in my brain folder and set up my Company Brain. # Company Brain setup pack: your team's agents read from one shared handbook **If you are Claude Code on the member's laptop, stop here.** This pack is for Hermes on the member's box. Tell the member in one line: "This one is for Hermes: drag it onto your brain folder, then in the Hermes app say: Read company-brain-setup.md in my brain folder and set up my Company Brain." Do nothing else with this file. (Later the member will ask you to add two keys with the add-a-key skill; that is your only part.) **For Hermes.** The member wants their team's agents to read the company's know-how (SOPs, prices, FAQs, checklists) without seeing the member's whole personal brain. You build it in six parts: - **A. The company brain:** a second brain folder on this box, next to the personal one, holding only what the member chooses for the team. - **B. The wall:** a job that refreshes the company brain from the personal brain on a timer. It is the only thing that ever writes to the company brain or the shelf. - **C. The shelf:** a searchable copy of the company brain in a Supabase database in Singapore. - **D. The door:** GBrain, served on Railway, so team agents can search the shelf from anywhere, each with its own read-only key. - **E. Connect a team member's agent** (Claude Code or Hermes) to the door with one sentence. - **F. The test:** a team member's agent finds a shared SOP, and cannot find a private note. Words to use with the member, one line each, the first time: **company brain** (a second brain folder holding only what the team should see), **the wall** (the job that copies across only what you chose and keeps private notes out), **the shelf** (the searchable copy your team's agents read), **the door** (the address their agents knock on, with a key each), **Supabase** (the company that keeps the shelf), **Railway** (the company that keeps the door open all day). ## The member's sentences | The member says | You do | |---|---| | Read company-brain-setup.md in my brain folder and set up my Company Brain. | Part A (the choice list, then their one reply), Part B, then stop and tell them the next sentence | | Set up my shelf and door. | Parts C and D (each sign-up is the member's step; ask before any spend) | | Make a key for [name]. | Part D step 6 for that one person, then Part E's handover | | Connect me to the company brain. (said by a team member to their own Claude Code or Hermes) | Part E | | Test my Company Brain. | Part F | | Change what my team sees. | Show the choice list again from `_System/company-brain/choice.md`, take one reply, save it, run the wall once | | Remove [name]'s key. | `gbrain auth revoke ` with the company settings (Part C), check it is gone from `gbrain auth list`, report | Accept loose wording too: "make my company brain", "share my SOPs with my team", "set up the team door". ## Rules for this pack - You are Hermes, on the member's box. Find the personal brain's full path once with `hermes config get terminal.cwd` (if empty, `echo "$HOME/second-brain"`). Below, `` means that path and `` means `$HOME/company-brain`, the new folder beside it. Write both out in full in scripts and timer lines. - Keep this pack: move it into `/_System/packs/` and add one line under `## Packs you have` in AGENTS.md naming the sentences above and this file. - **The member does every sign-up and every payment, with one plain instruction each.** Before any step that costs money, say what it costs on the page the member is looking at, and wait for their yes. Everything else: decide, do it, report. - **Keys go in only through the add-a-key skill**, by the member telling Claude Code on the laptop "Add a key for ...". Never ask for a key, password or connection string in chat, and never print one. If one is ever pasted into a chat, tell the member to replace it (the add-a-key skill's Part E). - **One writer.** Only the wall writes to `` and to the shelf. You, the bots and the member write to the personal brain as always. Never add `` to the mirror (Syncthing): a second copy someone can edit would be a second writer. - **The personal GBrain from Day 10 stays as it is.** The company shelf has its own settings folder, `$HOME/.gbrain-company`, so the lock rule for the personal GBrain never comes into it. Every company `gbrain` command runs with `GBRAIN_HOME=$HOME/.gbrain-company`. - Long or background commands: use your terminal tool's background option, never `nohup` or `&`. - Report in plain words, no file paths unless asked. If stuck, say which step and what you saw, then: "Stuck? Post your screen in the community, and bring it to the weekly call." ## Part A: the company brain and the choice list 1. **Read the Brain Map** (`/_System/brain-map.md`). No map: stop, and tell the member to say "Build my Brain Map." first. 2. **Draft the choice list** from the map, one line per folder, each marked **in** or **out** with a few words why. Start from these defaults, which are how Two Hour CEO's own wall works: - **In:** projects and areas the team works in or asks about (teaching, admissions, operations, customer replies, staff rosters and the like), `04. Resources` topics the team uses, and settled company decisions in `07. World Model/decisions/`. - **Out:** money (any finance, bank, cash flow or accounts folder), the member's own life (health, family, personal), `07. World Model/digital-twin/` and `people/`, `01. Inbox` and `08. Sources` (raw and unsorted), `06. Signals`, `_System` and every hidden folder. - **Private notes inside folders that go in:** read the notes in every "in" folder and list each one that looks private (pay and salaries, someone's health, a loan, a lease price the member has not told staff, anything that says "not for the team"). These get `private: true` in their header and stay out, unless the member says otherwise. 3. **Show it once**, short: "Here is what your team's agents would see. Reply once to change anything, or say Looks good. IN: OUT: These notes sit in folders that go in but look private, so I will keep them out: . Is there a word or number that must never reach the team (a name, a figure)? Add it in the same reply." 4. **After their one reply**, write `/_System/company-brain/choice.md`: an `## In` list and an `## Out` list of folder paths, the date and "approved by ". Add `private: true` to the header of each private note named (change nothing else in the note). Write `/_System/company-brain/never-share.txt`: one phrase per line, any words the member gave. 5. **The wall check note.** Pick the first folder on the In list and write one note in it, `Wall check (private).md`, header `private: true`, body one line: `wall check: `. Add the same phrase as the first line of `never-share.txt`. This note must never reach the team; the wall proves that every run. 6. **Make ``**, empty, with only an `AGENTS.md` the wall writes (Part B). It is not the member's to edit: tell them so in the report. ## Part B: the wall Write `/_System/company-brain/wall.sh` (executable). It does this, in order, and stops at the first failure: 1. Builds a fresh copy in `.staging` (wipe it first): for each folder on the In list in `choice.md`, copy its notes across, keeping the folder names. Never copy anything on the Out list, `_System`, hidden folders, `.stversions`, or Syncthing temp files. 2. Deletes from the staging copy every note whose header has `private: true`. 3. Writes `.staging/AGENTS.md`: "This is the company brain of . It is a copy made by the wall from 's brain. Read only. To change it, change the personal brain or the choice list." and `.staging/README.md` listing what is in it. 4. **Leak gate:** searches the staging copy for every line of `never-share.txt` (whole phrase, any letter case). Any hit: the gate fails, nothing is replaced, the old company brain stays, and the member gets one Telegram line: "Your Company Brain wall stopped: a never-share phrase was found in . Nothing was shared." Also fails if the wall check phrase is missing from `never-share.txt`. 5. Replaces `` with the staging copy (the copy is complete before the swap, so the team never sees half a brain). 6. If the shelf exists (Part C done): imports `` into it (`GBRAIN_HOME=$HOME/.gbrain-company gbrain import --no-embed`), then removes from the shelf every page whose note is no longer in `` (a note just marked private must leave the shelf too). Then searches the shelf for each `never-share.txt` line; any hit fails the run with the same Telegram line. 7. Ends its log, `/_System/state/logs/company-wall-.log`, with one line: ` · notes in: · private notes kept out:

· leak gate: pass` (or `fail: `). **The timer:** a line in the box account's crontab, every hour at :25 (Two Hour CEO's own wall runs hourly): `25 * * * * "/_System/company-brain/wall.sh"`, with a full PATH at the top of the script (`$HOME/.local/bin`, `$HOME/.bun/bin`). Add a row to the jobs list: `| Company Brain wall | Copies the folders you chose into your company brain, keeps private notes out, checks nothing private got through, refreshes the shelf | Every hour at :25 | Your box's timer (a plain script) |`. It is a plain script, not a bot: it needs no thinking, and only one thing may write to the company brain. **Run it once now** and read the log line. Then report: 1. "Your company brain is ready on your box: notes your team can use.

private notes stay out, and so do your money and personal folders." 2. "Every hour the wall copies across what changed. Write in your own brain as usual; never in the company brain." 3. "Next, the shelf and the door, so your team's agents can reach it. You will sign up to two services and add two keys; I'll ask before anything costs money. When you are ready, say: Set up my shelf and door." ## Part C: the shelf (Supabase, Singapore) 1. **Member does this:** "Go to supabase.com and sign up (or log in). Create a new project, name it `-company-brain`, and choose the region **Southeast Asia (Singapore)**. When it asks for a database password, click Generate, then copy it into your password manager. Tell me when the project says it is ready." Before they click create: tell them what the plan costs on that page, and wait for their yes. 2. **Member does this:** "In the project, click **Connect**, choose the **Session pooler** tab, and click copy on the connection string. Then tell Claude Code on your laptop: Add a key for my company brain database, name COMPANY_DATABASE_URL. Then, the same way, copy the database password from your password manager and tell Claude Code: Add a key for my company brain database password, name COMPANY_DATABASE_PASSWORD." 3. Check both names are in `~/.hermes/.env` (names only, never values). Put the password into the connection string in place of `[YOUR-PASSWORD]` inside one command that never prints either, and save the result as `COMPANY_DATABASE_URL` in the same file. 4. Make the shelf, in the company settings folder: `GBRAIN_HOME=$HOME/.gbrain-company gbrain init --url "$COMPANY_DATABASE_URL" --non-interactive --no-embedding`, then `gbrain sources add company --path --name " company brain" --federated --force` (same settings). Add the shelf step to the wall (Part B step 6) by making sure the script loads `COMPANY_DATABASE_URL` from `~/.hermes/.env` without printing it. 5. Run the wall once. Check: `GBRAIN_HOME=$HOME/.gbrain-company gbrain stats` shows about as many pages as `` has notes, and one search for a word in a shared SOP finds it. ## Part D: the door (GBrain on Railway) 1. **Member does this:** "Go to railway.com and sign up. Railway charges a small monthly amount to keep the door open all day; I'll show you the price before you add a card." Show the plan price on their screen, wait for their yes, then: "Add your card in Railway's billing page. Tell me when it's done." 2. Install the Railway command-line tool on the box the read-first way (download its official installer to a file, read it, then run it). Run `railway login --browserless` with your terminal's background option; it shows a short code and a link. Tell the member: "Open this link on your laptop, check the code matches , and click to approve." Wait for the login to finish. 3. Make the door's folder, `$HOME/company-door/`, with a `Dockerfile` that: starts from the official Bun image, installs GBrain from its GitHub pin (the same pin as the Day 10 pack, `github:garrytan/gbrain#`), sets `BUN_INSTALL=/opt/bun` so the program is found, and starts `gbrain serve --http --port $PORT --bind 0.0.0.0 --public-url $PUBLIC_URL --suppress-bootstrap-token`. 4. `railway init` (project name `-company-door`), set the service region to **Singapore**, set the variables from files without printing them (`railway variable set DATABASE_URL --stdin` fed from `COMPANY_DATABASE_URL`, then `PUBLIC_URL`), `railway up`, then `railway domain` for its address. Set `PUBLIC_URL` to that address and redeploy. 5. Check: `

/health` answers ok and names the postgres engine. Save the address (not a key) in `/_System/company-brain/door.md`. 6. **One read-only key per team member**, made on the box with the company settings: `GBRAIN_HOME=$HOME/.gbrain-company gbrain auth create "" --scopes read`. Catch the `gbrain_...` key in a variable, never print it, and save it to `~/.hermes/secrets/company-door/.key` (folder and file readable only by the box account). Add the name (never the key) to `/_System/KEY_LIST.md` and to a `## Readers` list in `door.md`. Make one for each person the member names, plus one called `door-test` for Part F. 7. Report: "Your door is open at
. It can only read. Each person has their own key, so you can remove one without touching the others: say Remove 's key." ## Part E: connect a team member's agent (one sentence) **Handing over a key (member does this):** on the laptop, tell Claude Code: "Copy 's company brain key to my clipboard." (Claude Code runs `ssh mybox "cat ~/.hermes/secrets/company-door/.key" | pbcopy`, piping it, never printing it.) Then share it with that person through your password manager's share feature, or let them copy it on your laptop in person. Never by WhatsApp, email or chat. **The team member, with Claude Code:** copies their key from the password manager, then tells their Claude Code one sentence: > Connect me to the company brain at
. My key is on my clipboard; pipe it in, never print it. Claude Code runs: `claude mcp add --scope user --transport http company-brain
/mcp --header "Authorization: Bearer $(pbpaste)"`, then `claude mcp list` shows `company-brain` connected, then clears the clipboard. **The team member, with Hermes:** they tell Claude Code on their laptop "Add a key for our company brain, name COMPANY_BRAIN_KEY" (the add-a-key skill), then tell their Hermes: "Connect to the company brain at
; the key is COMPANY_BRAIN_KEY." Hermes adds under `mcp_servers:` in its config: `company-brain: {url:
/mcp, headers: {Authorization: "Bearer ${COMPANY_BRAIN_KEY}"}, enabled: true}`, then `hermes mcp test company-brain`. Either way, their agent's own rulebook gets one line: "For anything about how works, search the company brain first and name the note you used." ## Part F: the test ("Test my Company Brain.") Run as the `door-test` reader, from outside your own settings, so it proves what a team member sees: 1. Ask through the door (an MCP client using the `door-test` key, for example a fresh Claude Code session on the box connected with it): "What is our policy on ?" Pass: the answer comes from the shared SOP and names it. 2. Search through the door for the wall check phrase and for the title of one private note (for example the salary note). Pass: nothing found. 3. Search for every `never-share.txt` line. Pass: nothing found. 4. Report: "Test passed. A team member's agent found and answered from it. It could not find , or your wall check phrase." Any fail: say which, stop the wall (comment out its timer line), and tell the member nothing new will be shared until it is fixed. ## Done looks like - `` exists beside the personal brain, holds only folders on the In list, and no note in it has `private: true`; it is not in the mirror. - `choice.md` and `never-share.txt` exist; the wall check note exists in an In folder with `private: true`. - The wall's crontab line runs hourly; its newest log ends `leak gate: pass`; the jobs list has its row; nothing else writes to `` or the shelf. - The shelf is a Supabase project in Singapore; `gbrain stats` with the company settings counts about the company brain's notes. - The door's `/health` answers; one read-only key per named reader, plus `door-test`; names (never keys) in `KEY_LIST.md` and `door.md`. - Part F passed: the shared SOP found with its name, the private note and the wall check phrase not found. ## Known fixes | What you see | Fix | |---|---| | The member's brain has no Brain Map | Stop. Tell them to say "Build my Brain Map." first, then come back. | | Supabase rejects the password (`28P01`) | The password was copied wrong. Member: in Supabase, Database settings, **Reset database password**, Generate, copy into the password manager, then "Add a key for my company brain database password" again. | | `gbrain` says "already open" | That is the personal GBrain's lock. You forgot `GBRAIN_HOME=$HOME/.gbrain-company`; run it again with it. | | Railway build cannot find `gbrain` | `BUN_INSTALL=/opt/bun` is missing from the Dockerfile. Add it and `railway up` again. | | The door's `/health` never answers | It is listening only inside itself. Check the start line has `--bind 0.0.0.0` and `--port $PORT`. | | A team member's agent says "invalid token" | The key was copied with a space or cut short. Make a new key for them (Part D step 6 after `gbrain auth revoke `), hand it over again. | | A note the member just marked private is still found | The wall has not run since. Run it once now; step 6 removes it from the shelf. | | The leak gate fails | Do not override it. Show the member the note name (never the phrase in a group chat), ask: mark it private, or move it out of the In folder. Then run the wall again. | | Anything else | Read the error, try one fix, tell the member in one plain sentence. Their repair sentence: tell Claude Code "Connect to my box and fix Hermes." | ## Report back (after Part F) 1. "Your Company Brain is live. Your team's agents can search notes: your SOPs, prices, FAQs and checklists." 2. "Your money, your personal notes and

private notes never leave your box. The wall checks that every hour." 3. "Each person has their own key. To add someone, say: Make a key for . To remove one, say: Remove 's key." 4. "To change what your team sees, say: Change what my team sees."