~ / rigs / Canhada-Labs / ceo-orchestration

Canhada-Labs/ceo-orchestration

Governance & auditability layer for Claude Code: run a structured team of specialist agents under a CEO protocol — plan→debate→execute gating, tamper-evident audit log, cross-LLM pair-rail.

↗ GitHub ★ 2 MIT updated today project Claude Code Codex Claude plugin

share on X

ARCHETYPE

Fort Knox

Deny lists, pre-tool hooks, sandboxing. Nothing touches prod without a signature.

CONTEXT TAX · EVERY TURN

~14.1k tokens

Heavy · median rig: 2.3k · breakdown

GUARDRAILS

4/5

Blocks destructive commands · Protects secrets · Pre-tool screening hook · No YOLO mode · details

Copy this rig

# review before running: this installs third-party code
$ npx degit Canhada-Labs/ceo-orchestration/.claude ./rig-ceo-orchestration  # inspect, then merge into .claude/

MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.

$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/academic-humanities/skills/anthropologist .claude/skills/anthropologist
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/academic-humanities/skills/geographer .claude/skills/geographer
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/academic-humanities/skills/historian .claude/skills/historian
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/academic-humanities/skills/narratologist .claude/skills/narratologist
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/academic-humanities/skills/psychologist .claude/skills/psychologist
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/business-support/skills/analytics-reporter .claude/skills/analytics-reporter
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/business-support/skills/executive-summary .claude/skills/executive-summary
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/business-support/skills/finance-tracker .claude/skills/finance-tracker
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/business-support/skills/support-responder .claude/skills/support-responder
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/civil-engineering/skills/civil-engineer .claude/skills/civil-engineer
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/community/skills/advanced-evaluation .claude/skills/advanced-evaluation
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/community/skills/agent-evaluation .claude/skills/agent-evaluation
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/community/skills/agentic-actions-auditor .claude/skills/agentic-actions-auditor
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/cpp/skills/cpp-build-systems .claude/skills/cpp-build-systems
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/cpp/skills/cpp-coding-standards .claude/skills/cpp-coding-standards
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/cpp/skills/cpp-testing .claude/skills/cpp-testing
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/data-ml/skills/ml-evaluation-patterns .claude/skills/ml-evaluation-patterns
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/data-ml/skills/ml-serving-patterns .claude/skills/ml-serving-patterns
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/data-ml/skills/pytorch-patterns .claude/skills/pytorch-patterns
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/devrel/skills/developer-advocate .claude/skills/developer-advocate
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/devrel/skills/frontend-slides .claude/skills/frontend-slides
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/devrel/skills/ui-demo .claude/skills/ui-demo
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/edtech/skills/assessment-integrity .claude/skills/assessment-integrity
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/edtech/skills/learning-analytics .claude/skills/learning-analytics
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/edtech/skills/student-data-privacy .claude/skills/student-data-privacy
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/edtech/skills/study-abroad-advisory .claude/skills/study-abroad-advisory
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/embedded/skills/embedded-firmware .claude/skills/embedded-firmware
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/finance-accounting/skills/bookkeeper-controller .claude/skills/bookkeeper-controller
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/finance-accounting/skills/financial-analyst .claude/skills/financial-analyst
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/finance-accounting/skills/fpa-analyst .claude/skills/fpa-analyst
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/finance-accounting/skills/tax-strategist .claude/skills/tax-strategist
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/fintech/skills/blockchain-security-audit .claude/skills/blockchain-security-audit
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/fintech/skills/equity-research .claude/skills/equity-research
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/fintech/skills/exchange-api-integration .claude/skills/exchange-api-integration
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/fintech/skills/exchange-onboarding-playbook .claude/skills/exchange-onboarding-playbook
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/fintech/skills/financial-correctness-and-math .claude/skills/financial-correctness-and-math
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/fintech/skills/financial-display .claude/skills/financial-display
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/fintech/skills/frontend-data-layer .claude/skills/frontend-data-layer
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/fintech/skills/frontend-patterns .claude/skills/frontend-patterns
$ npx degit Canhada-Labs/ceo-orchestration/.claude/skills/domains/fintech/skills/prediction-markets .claude/skills/prediction-markets

$ curl -fsSL --create-dirs -o .claude/agents/_dispatch.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/_dispatch.md
$ curl -fsSL --create-dirs -o .claude/agents/_probe_architect.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/_probe_architect.md
$ curl -fsSL --create-dirs -o .claude/agents/_probe_canonical_edit.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/_probe_canonical_edit.md
$ curl -fsSL --create-dirs -o .claude/agents/_probe_missing_skill.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/_probe_missing_skill.md
$ curl -fsSL --create-dirs -o .claude/agents/code-reviewer.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/code-reviewer.md
$ curl -fsSL --create-dirs -o .claude/agents/devops.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/devops.md
$ curl -fsSL --create-dirs -o .claude/agents/identity-trust-architect.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/identity-trust-architect.md
$ curl -fsSL --create-dirs -o .claude/agents/incident-commander.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/incident-commander.md
$ curl -fsSL --create-dirs -o .claude/agents/llm-finops-architect.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/llm-finops-architect.md
$ curl -fsSL --create-dirs -o .claude/agents/performance-engineer.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/performance-engineer.md
$ curl -fsSL --create-dirs -o .claude/agents/qa-architect.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/qa-architect.md
$ curl -fsSL --create-dirs -o .claude/agents/security-engineer.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/security-engineer.md
$ curl -fsSL --create-dirs -o .claude/agents/threat-detection-engineer.md https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/main/.claude/agents/threat-detection-engineer.md

Merge into .claude/settings.json (project) or ~/.claude/settings.json (user). Hook commands reference scripts in the source repo — copy those too.

{
  "permissions": {
    "deny": [
      "Bash(git push --force*)",
      "Edit(PROTOCOL.md)",
      "Edit(.claude/settings.json)",
      "Edit(SPEC/**)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)",
      "Read(~/.npmrc)",
      "Read(~/.config/gcloud/**)",
      "Read(~/.kube/config)",
      "Read(~/.docker/config.json)",
      "Read(~/.git-credentials)",
      "Read(~/.netrc)",
      "Read(~/.pypirc)",
      "Read(**/.env)",
      "Read(**/.env.local)",
      "Read(**/.env.*.local)",
      "Read(**/.env.development)",
      "Read(**/.env.dev)",
      "Read(**/.env.production)",
      "Read(**/.env.prod)",
      "Read(**/.env.staging)",
      "Read(**/.env.test)",
      "Read(**/.env.ci)",
      "Bash(curl * | bash)",
      "Edit(.claude/settings.local.json)",
      "Edit(.claude/state/night-mode.json)",
      "Edit(.claude/scripts/night-mode.py)",
      "Bash(git push --force*)",
      "Edit(PROTOCOL.md)",
      "Edit(.claude/settings.json)",
      "Edit(SPEC/**)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)",
      "Read(~/.npmrc)",
      "Read(~/.config/gcloud/**)",
      "Read(~/.kube/config)",
      "Read(~/.docker/config.json)",
      "Read(~/.git-credentials)",
      "Read(~/.netrc)",
      "Read(~/.pypirc)",
      "Read(**/.env)",
      "Read(**/.env.local)",
      "Read(**/.env.*.local)",
      "Read(**/.env.development)",
      "Read(**/.env.dev)",
      "Read(**/.env.production)",
      "Read(**/.env.prod)",
      "Read(**/.env.staging)",
      "Read(**/.env.test)",
      "Read(**/.env.ci)",
      "Bash(curl * | bash)",
      "Edit(.claude/settings.local.json)",
      "Edit(.claude/state/night-mode.json)",
      "Edit(.claude/scripts/night-mode.py)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Agent",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_agent_spawn.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_budget.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_agent_spawn.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_budget.py"
          }
        ]
      },
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_bash_safety.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_adversary.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_scratchpad_access.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_cost_envelope.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_ledger_checkpoint.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_bash_safety.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_adversary.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_scratchpad_access.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_cost_envelope.py"
          }
        ]
      },
      {
        "matcher": "Edit|Write|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_plan_edit.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_protocol_semver_cascade.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_skill_patch_sentinel.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_tier_policy.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_pair_rail.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_config_protection.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_plan_edit.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_protocol_semver_cascade.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_skill_patch_sentinel.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_tier_policy.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_pair_rail.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_config_protection.py"
          }
        ]
      },
      {
        "matcher": "Edit|Write|MultiEdit|mcp__.*",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_canonical_edit.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_arbitration_kernel.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_canonical_edit.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_arbitration_kernel.py"
          }
        ]
      },
      {
        "matcher": "Read",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_read_injection.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_read_injection.py"
          }
        ]
      },
      {
        "matcher": "mcp__codex__codex|mcp__codex__codex-reply",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_codex_filewrite.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_codex_filewrite.py"
          }
        ]
      },
      {
        "matcher": "Agent|Bash|Edit|Write|MultiEdit|Read|Glob|Grep|WebFetch|WebSearch|NotebookEdit|TodoWrite|Task|mcp__.*",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_anti_ceo_overhead.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_anti_ceo_overhead.py"
          }
        ]
      },
      {
        "matcher": "Bash|Edit|Write|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_worktree_writer.py"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_worktree_writer.py"
          }
        ]
      },
      {
        "matcher": "Workflow",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh\" check_workflow_launch.py"
          }
        ]
      }
    ]
  }
}

Skills (116)

anthropologist geographer historian narratologist psychologist analytics-reporter executive-summary finance-tracker support-responder civil-engineer advanced-evaluation agent-evaluation agentic-actions-auditor cpp-build-systems cpp-coding-standards cpp-testing ml-evaluation-patterns ml-serving-patterns pytorch-patterns developer-advocate frontend-slides ui-demo assessment-integrity learning-analytics student-data-privacy study-abroad-advisory embedded-firmware bookkeeper-controller financial-analyst fpa-analyst tax-strategist blockchain-security-audit equity-research exchange-api-integration exchange-onboarding-playbook financial-correctness-and-math financial-display Fintech Frontend Data Layer & Real-Time fintech-frontend-patterns prediction-markets real-time-market-systems solidity-smart-contracts trading-execution golang-patterns golang-services golang-testing accessibility-section-508 digital-presales foia-and-records public-procurement healthcare-customer-service marketing-compliance guest-services hr-onboarding recruitment-specialist cultural-intelligence french-consulting korean-business language-translator identity-graph-operator java-coding-standards jvm-testing springboot-patterns client-intake document-review legal-billing agentic-search-optimizer ai-citation-strategist app-store-optimizer book-co-author carousel-growth-engine content-creator growth-hacker instagram-curator linkedin-content-creator podcast-strategist reddit-community-builder seo-specialist social-media-strategist tiktok-strategist twitter-engager video-optimization-specialist mobile-app-builder auditor creative-strategist paid-social-strategist ppc-strategist programmatic-buyer search-query-analyst tracking-specialist experiment-tracker project-shepherd studio-operations studio-producer buyer-seller-agent loan-officer-assistant customer-returns cms-developer filament-specialist prisma-patterns salesforce-architect account-strategist deal-strategist discovery-coach outbound-strategist pipeline-analyst proposal-strategist sales-coach sales-engineer sales-outreach supply-chain-strategist kill-switches latency-budgets order-routing corporate-training-designer voice-ai-integration

Subagents (13)

_dispatch	—
_probe_architect	PLAN-020 Phase 0 item 5 governance probe — verifies that a native subagent dispatched with `CEO_ARCHITECT_ACTIVE=1` env var is blocked from acting as a parallel CEO architect. Architect role must rema
_probe_canonical_edit	PLAN-020 Phase 0 item 5 governance probe — verifies that a native subagent attempting to Edit/Write a canonical-guarded path WITHOUT a sentinel approved.md is blocked by `check_canonical_edit.py`. Exp
_probe_missing_skill	PLAN-020 Phase 0 item 5 governance probe — verifies that `check_agent_spawn.py` BLOCKS dispatch via the native subagent rail when the spawn prompt has no skill content (neither `## SKILL CONTENT` inli
code-reviewer model: claude-fable-5	Staff Code Reviewer with merge VETO authority. Loads code-review-checklist skill via reference (PLAN-020 ADR-051). Use for any change requiring quality gate (every PR, every commit). Identifies bugs,
devops model: claude-sonnet-4-6	DevOps & Platform Engineer specializing in CI/CD pipeline design, GitHub Actions hardening (SHA-pin, OIDC, fork-safe triggers), Docker optimization, deployment platform integration, health check engin
identity-trust-architect model: claude-fable-5	Principal Identity & Trust Architect with VETO authority over token lifecycle, authorization model, and service-to-service trust. Loads identity-and-trust-architecture skill via reference (PLAN-020 AD
incident-commander model: claude-fable-5	Principal Incident Commander with severity / scope / all-clear VETO authority. Loads incident-management skill via reference (PLAN-020 ADR-051). Use for: live incident triage, severity classification,
llm-finops-architect model: claude-sonnet-4-6	LLM FinOps Architect specializing in model-tier routing, cost-envelope governance, burn-rate monitoring, per-plan token budgets, parent-inheritance trap detection, and routing decision protocols. Load
performance-engineer model: claude-sonnet-4-6	Principal Performance Engineer specializing in latency analysis, GC tuning, memory profiling, hot path optimization, percentile-driven measurement, and subprocess startup cost analysis. Loads performa
qa-architect model: claude-sonnet-4-6	Principal QA Architect specializing in test strategy, edge cases, regression prevention, mutation testing, property-based testing, contract tests, fuzz harnesses, and CI flake elimination. Loads testi
security-engineer model: claude-fable-5	Principal Security Engineer with auth/crypto VETO authority. Loads security-and-auth skill via reference (PLAN-020 ADR-051). Use for: auth changes, token handling, encryption, threat modeling, input v
threat-detection-engineer model: claude-fable-5	Principal Threat Detection Engineer with VETO authority over detection-as-code coverage, false-positive-rate drift, and SOC alert quality. Loads security-and-auth skill via reference (PLAN-020 ADR-051

Hooks (60)

event	matcher	runs
PreToolUse	Agent	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_agent_spawn.py
PreToolUse	Bash	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_bash_safety.py
PreToolUse	Bash	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_adversary.py
PreToolUse	Edit\|Write\|MultiEdit	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_plan_edit.py
PreToolUse	Edit\|Write\|MultiEdit\|mcp__.*	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_canonical_edit.py
PreToolUse	Edit\|Write\|MultiEdit	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_protocol_semver_cascade.py
PreToolUse	Edit\|Write\|MultiEdit	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_skill_patch_sentinel.py
PreToolUse	Edit\|Write\|MultiEdit	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_tier_policy.py
PreToolUse	Edit\|Write\|MultiEdit\|mcp__.*	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_arbitration_kernel.py
PreToolUse	Bash	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_scratchpad_access.py
PreToolUse	Agent	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_budget.py
PreToolUse	Read	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_read_injection.py
PreToolUse	Edit\|Write\|MultiEdit	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_pair_rail.py
PreToolUse	mcp__codex__codex\|mcp__codex__codex-reply	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_codex_filewrite.py
PreToolUse	Agent\|Bash\|Edit\|Write\|MultiEdit\|Read\|Glob\|Grep\|WebFetch\|WebSearch\|NotebookEdit\|TodoWrite\|Task\|mcp__.*	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_anti_ceo_overhead.py
PreToolUse	Bash	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_cost_envelope.py
PreToolUse	Bash\|Edit\|Write\|MultiEdit	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_worktree_writer.py
PreToolUse	Edit\|Write\|MultiEdit	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_config_protection.py
PreToolUse	Bash	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_ledger_checkpoint.py
PreToolUse	Workflow	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_workflow_launch.py
PostToolUse	Agent	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" audit_log.py
PostToolUse	Agent	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_confidence_gate.py
PostToolUse	Agent	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_output_safety.py
PostToolUse	Agent	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_subagent_fabrication.py
PostToolUse	Agent	echo '{"decision":"allow","message":"POST-AGENT: Check git diff to verify file assignment compliance. Run: git diff --name-only"}'
PostToolUse	Read	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_skill_reference_read.py
PostToolUse	*	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_output_secrets.py
PostToolUse	Edit\|Write\|MultiEdit	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_skill_bootstrap_post.py
PostToolUse	WebFetch\|WebSearch	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_webfetch_injection.py
PostToolUse	mcp__.*	bash "$CLAUDE_PROJECT_DIR/.claude/hooks/_python-hook.sh" check_mcp_response.py

Slash commands (27)

/agent-budget/architect/audit-page/audit-tokens/ceo-boot/ceo-info/context-budget/council/debate/effort/fan-plan/goap/lesson-evolve/lesson-review/memory-scratchpad/night-mode/onboard/pitfall/resume/self-test/skill-health/skill-review/spawn/squad-install/status/terse/veto-check

Permissions

deny (54)

Bash(git push --force*)

Edit(PROTOCOL.md)

Edit(.claude/settings.json)

Edit(SPEC/**)

Read(~/.ssh/**)

Read(~/.aws/**)

Read(~/.npmrc)

Read(~/.config/gcloud/**)

Read(~/.kube/config)

Read(~/.docker/config.json)

Read(~/.git-credentials)

Read(~/.netrc)

Read(~/.pypirc)

Read(**/.env)

Read(**/.env.local)

Read(**/.env.*.local)

Read(**/.env.development)

Read(**/.env.dev)

Read(**/.env.production)

Read(**/.env.prod)

Read(**/.env.staging)

Read(**/.env.test)

Read(**/.env.ci)

Bash(curl * | bash)

Edit(.claude/settings.local.json)

Edit(.claude/state/night-mode.json)

Edit(.claude/scripts/night-mode.py)

Bash(git push --force*)

Edit(PROTOCOL.md)

Edit(.claude/settings.json)

Edit(SPEC/**)

Read(~/.ssh/**)

Read(~/.aws/**)

Read(~/.npmrc)

Read(~/.config/gcloud/**)

Read(~/.kube/config)

Read(~/.docker/config.json)

Read(~/.git-credentials)

Read(~/.netrc)

Read(~/.pypirc)

Read(**/.env)

Read(**/.env.local)

Read(**/.env.*.local)

Read(**/.env.development)

Read(**/.env.dev)

Read(**/.env.production)

Read(**/.env.prod)

Read(**/.env.staging)

Read(**/.env.test)

Read(**/.env.ci)

Bash(curl * | bash)

Edit(.claude/settings.local.json)

Edit(.claude/state/night-mode.json)

Edit(.claude/scripts/night-mode.py)

ask (0)

—

allow (18)

Bash(git status*)

Bash(git log*)

Bash(git diff*)

Bash(ls)

Bash(ls *)

Bash(grep *)

Bash(head *)

Bash(tail *)

Bash(wc *)

Bash(git status*)

Bash(git log*)

Bash(git diff*)

Bash(ls)

Bash(ls *)

Bash(grep *)

Bash(head *)

Bash(tail *)

Bash(wc *)

Context tax

Instructions: 10.9kMCP tool schemas (est.): 0Skill metadata: 2.2kSubagent metadata: 1.1k

ALWAYS-LOADED FILES (claude-code)

≡

CLAUDE.md · 132 lines · ~9.8k tok

≡

templates/CLAUDE.md · 126 lines · ~1.1k tok

≡

AGENTS.md · 133 lines · ~2.0k tok

≡

templates/codex/AGENTS.md · 121 lines · ~2.0k tok

≡

templates/grok/AGENTS.md · 93 lines · ~1.3k tok

Estimate: characters ÷ 4 for instruction files and skill/subagent descriptions; MCP schema sizes from typical tool counts. Harnesses with deferred tool loading pay less. Method

Guardrails 4/5

✓

Blocks destructive commands

4 deny/ask rule(s) e.g. Bash(git push --force*)

✓

Protects secrets

Denies reads like Read(~/.ssh/**)

✓

Pre-tool screening hook

38 PreToolUse hook(s)

✓

No YOLO mode

Permission prompts stay on

✗

Sandbox or ask-first rules

No sandbox and no ask-first rules

Badge

Add to your README:

[![AgentRigs](https://agentrigs.dev/badge/rig/Canhada-Labs/ceo-orchestration.svg)](https://agentrigs.dev/r/Canhada-Labs/ceo-orchestration)

Indexed from commit 6ccde6b030ec on 2026-10-09. Data is structure only — env values and anything secret-looking are stripped.

Similar rigs

JantonioFC/skillsbank

archivo de skills

★ 9 project Claude CodeCodexCursor 2 mcp 124 skills 2mo ago

Skill Collector 21.1k tok ·

xu-xiang/everything-claude-code-zh

everything-claude-code 中文翻译项目：完整的 Claude Code 配置集合（agents, skills, hooks, commands, rules, MCPs）。源自 Anthropic 黑客松获胜者的实战配置，助力中文工程师高效理解与使用 Claude Code。

★ 1,475 project Claude CodeCodexCursor 4 mcp 58 skills 14 agents 7mo ago

Orchestrator 28.2k tok ·

zhouli1990/claude-code-dotfiles

claude code 配置文件自动同步

★ 0 setup Claude CodeCodex 51 skills 38 agents 33 hooks 6mo ago

YOLO Cowboy 6.9k tok ·

ORION2809/claude-Fulcrum

—

★ 0 collection Claude CodeCodexCursor 80 skills 6mo ago

Skill Collector 15.1k tok ·