Status: DRAFT v2 (post rate-and-improve, 2026-07-06). Anthony has answered D1. Build starts when he approves the remaining decisions below or stays silent past the stated defaults. Written: 2026-07-04, revised 2026-07-06 by Claude (sessions with Anthony). Audience: a cold build agent with no prior context. This file is self-contained; companion files are summarized inline and cited by path for verification, not required reading before this one.
| # | Decision | Recommendation (= default if Anthony is silent) | Status |
|---|---|---|---|
| D1 | Two-surface split: Toby-Director is Anthony-only with full access; employee-Toby stays fenced | Yes | ANSWERED YES, Anthony, 2026-07-06 |
| D2 | Write authority | Propose-only v1. If later granted, Toby-Director may write ONLY to Anthony-visible surfaces (DM, Corporate-Anthony board); never the shared HR Team board | OPEN |
| D3 | Jurisdictions for employment-law compartment | CA, NV, WA, PH | OPEN |
| D4 | Legal-review scope | HR documents only for v1; vendor/commercial contracts later | OPEN |
| D5 | Surface | Headless script + Jarvis only; no new Slack channel | OPEN |
| D6 | Decision-log backfill sources | Mine vault + Basecamp + transcripts, Anthony reviews each entry | OPEN |
| D7 | Review cadence | "Toby Director" section in the Friday weekly-coo-review, graded by Anthony | OPEN |
| D8 | Naming | One identity, two modes, all "Toby" | OPEN |
| D9 | Legal-field inventory (section 12) | Build against the table as written; fields are added or killed by editing this PRD, not by a kickoff conversation | OPEN |
Expand Toby from an employee-facing HR Q&A bot into an AI Director of HR for Emazing Group (US + Philippines), so Anthony can delegate director-level HR work to Toby instead of doing it himself. Both Anthony and Jarvis (the COO agent) can hand Toby a task and get back a finished answer or a proposed action. The expansion adds a Director layer on top of the existing (untouched) employee-answering engine:
data/chief-kb/compartments/04-employee-relations/decisions-log.md), which exists but has ZERO entries today (verified 2026-07-04: file contains only the template). Backfilling it is Phase 1.The delegation contract (Anthony's words, 2026-07-06): on sensitive matters Toby does 80-90% of the work (pulls data, drafts paperwork, lays out options) and Anthony gives final approval. Toby never self-approves a sensitive call. Section 9's Category-RED table is the enforcement of this sentence.
Design lineage (context, not gospel): a four-layer architecture (knowledge / procedures / routing / judgment) was designed 2026-06-14 in HANDOFF-hr-chief-2026-06-14.md and is summarized in section 2 so this doc stands alone. That design rejected standing per-field agents (memory drift, echo-chamber agreement, unauditable); this PRD keeps that call. "Sub-agents per legal field" here means stateless prompt files + per-field KB compartments, convened on demand and discarded.
Goal alignment (~/second-brain/context/goals/priorities.md): June priority #9 (HR Manager Bot: 90% of HR questions by end of July), Q2 OKR #4 (Improve HR), annual goals "Department manager agents," "HR chatbot satisfaction 90%," "Save 20 hrs/wk with AI in HR."
The June 14 design in ten lines (source: ~/cron-launchers/hr-bot/HANDOFF-hr-chief-2026-06-14.md): one canonical KB compartmentalized by HR sub-domain, no agent holds a private copy. Procedures (skills) define how to DO a task. A routing front door classifies each ask and pulls ALL relevant compartments, not just the obvious one. Judgment: routine asks get a single fast pass; high-stakes or cross-field asks convene an on-demand panel of lenses (legal, payroll, employee-relations) that reconcile into one recommendation and disappear. Two surfaces on one KB: employee-Toby reads SHARED compartments only; the Director reads everything. GREEN = answer, YELLOW = recommend + flag, RED = stop and route to Anthony. The clone mechanism is the decision log: every Anthony ruling recorded with its weighting so the judgment layer learns to rule like him. Escalation recommendations cite which compartment each fact came from. Live people data comes from Paycor, never duplicated into files. Filing rule: every new input gets one home, a date, and a note of what it supersedes.
Verified as-is (2026-07-04 disk and Basecamp checks):
- Employee Toby is LIVE: launchd Slack bot on the shared orchestrator engine (~/jarvis-agent/slack_orchestrator.py), runtime at ~/toby-agent/ (agents/toby/system_prompt.md, plists com.claude.toby-agent, com.claude.toby-watchdog), brain/KB at ~/cron-launchers/hr-bot/. Interaction volume: see ~/cron-launchers/hr-bot/data/logs/interactions.jsonl (18+ entries as of the 2026-07-02 sweep; recount at Phase 0). Naming history: Amy, then Harper, then Toby (same bot; older docs say Harper).
- Constitution: ~/cron-launchers/hr-bot/CLAUDE.md. Its fence in one line: HR-only scope, one-person-only privacy (the asker's own data, never anyone else's), never fabricate pay/benefits/legal facts, sensitive topics always escalate to Anthony via a *HR note:* line, propose-never-confirm Paycor actions, no em-dashes. Director mode inherits all of it except one-person-only, which section 9 replaces with a director-scope rule.
- KB taxonomy locked (data/kb/compartments/_TAXONOMY.md): 8 compartments, SHARED vs CHIEF-ONLY. SHARED (01 payroll how-to, 02 handbook, 03 benefits/leave, 06 hiring/onboarding) in data/kb/; CHIEF-ONLY (04 employee relations + decision log, 05 employment law, 07 offboarding/terminations, 08 people data) as skeletons in data/chief-kb/. Employee-Toby's allow-list physically cannot read data/chief-kb/ (enforced in ~/toby-agent/config.yaml workspace paths, verify at Phase 0).
- The decision log is empty (template only, verified 2026-07-04) despite qualifying rulings existing. Sources for backfill: ~/second-brain/themes/margie-fraud-investigation.md, ~/second-brain/themes/margie-counsel-selection.md (the ~40-contractor classification exposure and the "at 40, we're late" quote live here), termination meeting notes in ~/second-brain/meetings/.
- Tools: tools/hr_connectors.py (Paycor pulls, read-only), build_identity_map.py + daily 5 AM refresh cron, build_playbooks.py.
- No Jarvis-to-Toby routing exists today. The /coo skill routes only inside the Claude Code CLI, not inside the Slack orchestrator engine.
- Existing HR skills to reuse, not rebuild (~/Documents/Claude/skills/): paycor-ops, payroll-qc, payroll-timecard-prep, ph-payslips, terminate, quarterly-review-response, chief-people-officer.
- People-name disambiguation (Anthony, 2026-07-06): Christine Lim and Christine Adler are two different people. A vault note from the 2026-06-16 workers-comp call may conflate them; Phase 0 corrects the vault note before any KB seeding cites it.
~/cron-launchers/scripts/; always edit templates in ~/.claude/skills/cron-scheduler/references/templates/.claude -p must set -a; source ~/.claude-cron.env; set +a or MCP children get no credentials./usr/local/bin/python3 (3.13) for anything touching Google libs; /usr/bin/python3 (3.9) degrades silently.model: "sonnet" (judgment) or "haiku" (fetch/format). Never default.Anthony does all director-level HR work himself: terminations and their paperwork, employment-law questions across CA/NV/WA/PH, the Margie fraud case and PH contractor-classification exposure, E-Verify rollout, workers comp incidents, benefits/insurance escalations, wage recoupments, state employment-tax matters, and every sensitive escalation employee-Toby routes up. Anne owns HR vendors 80/20, but judgment calls all land on Anthony. Employee-Toby covers exactly one lane (employee Q&A). Everything above it has no AI owner, and the design to fix it has been stalled since 2026-06-14 on D1, which is now answered.
| # | Goal | Measurable check |
|---|---|---|
| G1 | Anthony delegates director-level HR tasks to Toby | 10 real delegated tasks completed in the first 30 days, logged in director-interactions.jsonl, each graded pass by Anthony in the Friday review |
| G2 | Every section-12 legal field has a current KB file and working lens | 100% of fields answer their section-8 test question citing their own compartment file |
| G3 | The judgment layer rules like Anthony | 10+ backfilled decision-log entries Anthony has marked reviewed; on 3 held-out precedent questions, Toby's answer cites the correct entry and matches Anthony's actual ruling |
| G4 | Jarvis delegates one-way | Leak test passes: grep of Toby's logged prompts shows zero non-HR context; grep of Jarvis relay output shows zero CHIEF-ONLY strings (test corpus defined in Phase 4) |
| G5 | Employee-Toby unharmed | config.yaml allow-list diff is empty; employee test DM answers normally after every phase |
__PROPOSAL__ lines, logged, human-executed. Anthony ──── Slack / CLI / Jarvis (one-way in)
│
TOBY DIRECTOR MODE
(charter: director/DIRECTOR.md, front-door router)
│
router finds ALL relevant fields, then checks
the Category-RED table (section 9) FIRST:
RED category → do the 80-90% (data, drafts, options),
then STOP; Anthony decides
GREEN (routine) → single fast pass, one lens
YELLOW → recommend + flag
│
┌────────┬─────────┬──────────┼──────────┬──────────┬─────────┐
EMPLOYMENT TERMINATIONS WAGE & LEAVE & IMMIGRATION WORKERS ...per
LAW (by & OFFBOARD HOUR / BENEFITS & WORK AUTH COMP section 12
jurisdiction) PAYROLL COMPLIANCE (E-Verify)
└────────┴─────────┴──────────┼──────────┴──────────┴─────────┘
│
data/chief-kb/compartments/* (CHIEF-ONLY, per-field files)
data/kb/compartments/* (SHARED, unchanged)
decisions-log.md (precedent; the clone mechanism)
live Paycor via hr_connectors.py (never duplicated)
director/agents/, executed as Agent-tool spawns (sonnet) or headless claude -p. Stateless; the KB is the memory.director/DIRECTOR.md: who Toby-Director serves (Anthony, Jarvis; NOT employees), what he owns (section 12 fields), authority defaults (propose, log, escalate per the Category-RED table), routing table (ask type to lens + compartments).director/prompt-director.txt: operating manual. Inherits the CLAUDE.md HR fence by reference, replacing one-person-only with: may discuss any employee's data with Anthony only; output going anywhere other than Anthony's DM/CLI/Jarvis-relay must contain zero CHIEF-ONLY content.director/toby-director.sh: headless entry (sources ~/.claude-cron.env, cwd this dir). Every interaction appends to data/logs/director-interactions.jsonl.reviewed: true).reviewed: false, subject to the same guardrail.data/chief-kb/compartments/ (05 gets per-jurisdiction files per D3). Template: scope, our exposure/current state, key rules, our precedents (links to reviewed decision-log entries only), the field's RED rows from section 9, sources.director/agents/, each declaring its KB manifest and embedding its RED rows.anthropics/knowledge-work-plugins repo (legal plugin). Phase 0 verifies this repo: clone it read-only, confirm the legal plugin and framework exist as described; if the repo has moved or changed, vendor the pattern into director/legal-review-framework.md from the June handoff's notes instead. The build never hard-depends on the live repo.~/.claude/skills/coo/), add a routing rule: HR-domain asks invoke director/toby-director.sh "<question>" and relay stdout. Jarvis passes ONLY the question text, never conversation context. Toby's reply is self-contained; if the ask is outside HR, the fence refuses in one line and Jarvis handles it itself. (Identical contract to the planned Pam delegation: question text in, self-contained answer out, zero shared context. Build the plumbing once if both projects proceed.)Rule for the builder: every gate below is a pass/fail check with observable output. "Anthony grades it" appears only where his judgment IS the product (G3), and there it is scored against his actual recorded rulings.
| Phase | Scope | Pass/fail gate |
|---|---|---|
| 0 | Read this PRD. Verify env + baselines | ALL of: recount interactions.jsonl; launchctl list \| grep toby shows agent + watchdog; employee test DM answers normally; config.yaml allow-list snapshot saved for later diffs; clone + verify knowledge-work-plugins repo (or vendor the framework); correct the Christine Lim / Christine Adler conflation in the vault note and record the fix |
| 1 | C2 decision-log backfill | 10+ entries with reviewed: true; active-matter entries are pointer-only (grep the log for "Margie" returns only pointer lines); Toby answers 3 held-out precedent questions citing the correct entry, matching Anthony's actual ruling |
| 2 | C1 charter + entry + logging | toby-director.sh "test" returns a director answer; a CS question returns a one-line refusal; both appear in director-interactions.jsonl; a RED-category test ask ("draft termination for X") produces work product + a stop line, never a decision |
| 3 | C3 field KBs + lenses (top 5 first: employment law CA/NV/WA/PH, terminations, wage & hour, leave/benefits compliance, work auth) | Each lens answers its test question citing its own compartment file path; each RED-category test triggers the stop; zero answers cite an unreviewed decision-log entry |
| 4 | C4 Jarvis routing | Leak test corpus (10 mixed asks): Toby's logged prompts contain zero non-HR strings; Jarvis relay output contains zero CHIEF-ONLY marker strings (each chief-kb file gets a canary marker in frontmatter for this grep) |
| 5 | Remaining fields + C5 skill invocation | Same per-field gates as Phase 3, full section-12 coverage |
Each phase ships independently and is useful at every stop point.
| Always-RED category | Toby prepares | Anthony decides |
|---|---|---|
| Terminations and discipline | Paperwork, Paycor data, precedent, risk notes | Whether and when |
| Wage disputes, recoupments, garnishments | Numbers, law summary, options | The resolution |
| Leave denials and accommodations (FMLA/ADA-class) | Eligibility analysis, precedent | Approve/deny |
| Harassment/complaint investigations | Intake summary, process checklist | Everything past intake |
| Active legal matters (Margie-class) | Nothing new without instruction | Everything, with counsel |
| Anything crossing into medical, disability, or protected-class facts | Data assembly only | All judgment |
New categories are added to this table by editing this PRD; a lens may escalate anything else to RED, but may never downgrade a row here.
~/toby-director/ or a director profile in ~/toby-agent/config.yaml) whose file allow-list grants data/kb/** + data/chief-kb/** and nothing else, exactly as employee-Toby's allow-list physically blocks chief-kb. The privacy rule is thereby enforced by the same mechanism in both directions; the prompt text is a second layer, not the only layer. Phase 2 verifies by attempting an out-of-scope file read (must fail).chief-kb file carries a unique marker string in frontmatter; the Phase 4 leak test and a weekly cron grep all outbound surfaces (Slack export, Jarvis relay logs, Basecamp posts) for any marker.__PROPOSAL__ {json} lines, stripped, logged, human-executed.model: "sonnet" judgment, "haiku" fetch/format. Never unset.Moved to section 0, page 1. D1 is answered yes; D2-D9 carry defaults that apply if Anthony does not override at approval.
~/cron-launchers/cst-bot/PRD-pam-director-of-cs.md) shares the Jarvis-delegation pattern; build that plumbing once.| Field | Evidence (source) | Priority |
|---|---|---|
| Contractor classification (PH) | ~/second-brain/themes/margie-counsel-selection.md: ~40 PH contractors, misclassification flagged "at 40, we're late" |
HIGH |
| Employment law by jurisdiction (CA, NV, WA, PH per D3) | WA employment-tax card (Basecamp HR Team 22974666); PH counsel files above; NV+PH in the June handoff | HIGH |
| Terminations & offboarding | Basecamp cards "Bonnie and Lynn Termination", "Chas termination", "Semi-Automate the Termination Process"; terminate skill |
HIGH |
| Wage & hour / payroll compliance | Basecamp card "Keep track of Erika V's payback"; garnishments in employee-Toby's escalation list | HIGH |
| Leave & accommodation (FMLA/PTO/LOA) | Basecamp cards "Christine Holliday's Time Accrual Adjustment", "PTO tracking system"; compartment 03 | MED |
| Immigration / work authorization | Basecamp card "E-Verify - Test on Next US Hire" (42 comments, active) | MED |
| Workers comp | 2026-06-16 call re injured employee (~/second-brain/meetings/). Christine Lim and Christine Adler are DIFFERENT people (Anthony, 2026-07-06); Phase 0 fixes the vault conflation |
MED |
| Benefits & insurance compliance | Basecamp cards "Call Kaiser for a refund", "Jose Palacios health insurance update"; BENEFITS-US/PH playbooks | MED |
| Employee relations / investigations | Compartment 04; harassment class in employee-Toby's always-escalate list | MED |
| State employment tax / unemployment | Basecamp card "Washington State Employment Tax Refund" | LOW |
Known coverage limit: Basecamp Done-archive columns (500+ cards each) were not scanned; fields surfacing later are added via D9's edit-this-PRD rule.
~/cron-launchers/hr-bot/HANDOFF-hr-chief-2026-06-14.md (original design; summarized in section 2; this PRD supersedes it where they conflict)~/cron-launchers/hr-bot/CLAUDE.md (the fence) + data/kb/compartments/_TAXONOMY.md (compartment map)~/cron-launchers/cst-bot/PRD-pam-director-of-cs.md (sibling build; shared Jarvis plumbing)~/jarvis-agent/workspaces/jarvis/memory/hr-chief-architecture.md (design memory)~/second-brain/themes/margie-fraud-investigation.md, margie-counsel-selection.md~/second-brain/context/goals/priorities.mdanthropics/knowledge-work-plugins