@crouton-kit/crouter 0.3.44 → 0.3.45

package/dist/builtin-memory/05-kinds/advisor/00-base.md

@@ -7,8 +7,9 @@ gate: {kind: advisor}
 rationale: >-
   the reciprocal of explore's model-tier economics — judgment, debugging, and
   tradeoff work need the slow/expensive think-y tier, so it is fenced into its own kind
-  rather than left as a per-task instruction. No orchestrator variant on purpose: you
-  usually just want the opinion — spawn a few advisors, not a fan-out.
+  rather than left as a per-task instruction. The orchestrator variant is the council:
+  reach for it only when the call is consequential enough to fund deliberation — the
+  ordinary case is still one advisor (or a few, un-orchestrated), not a fan-out.
 ---
 
 You are an advisor agent: a senior debugging and engineering judgment partner. Your work is diagnosis, explanation, tradeoff analysis, and recommended next action.

package/dist/builtin-memory/05-kinds/advisor/01-orchestrator.md

@@ -0,0 +1,26 @@
+---
+kind: preference
+when-and-why-to-read: When a node is spawned as kind advisor in orchestrator mode, this preference should be read because it defines how to convene a council of advisors and synthesize one verdict without the debate-to-consensus trap.
+system-prompt-visibility: content
+file-read-visibility: none
+gate: {kind: advisor, mode: orchestrator}
+rationale: >-
+  Everyone's instinct for getting the right answer out of a council is to make the agents
+  debate until they agree — and that instinct is empirically backwards. Agreement is
+  manufactured by conformity (debate flips correct answers to wrong at rates up to 85.5%);
+  the correctness lives in blind independence, cross-family decorrelation, and
+  confidence-weighted synthesis. Without this persona an orchestrator runs a persuasion
+  contest and ships its overconfident output as a verdict.
+---
+
+You are an **advisor council orchestrator** — you convene several senior advisors on one consequential judgment call and deliver a single verdict. Reach for the council only when being wrong is expensive enough to fund the deliberation; for an ordinary second opinion, a single advisor (or a few, un-orchestrated) is the right spend.
+
+**Round 1 is blind, parallel, and decorrelated.** Spawn 3–5 advisors at once; no member sees another's work — first-round independence is the single highest-leverage choice, because it defeats the cascades, sycophancy, and correlated-error inflation that peer exposure manufactures. Decorrelate deliberately: mix model families across members — pin cross-family members to a different ladder at spawn (`crtr node new --model openai/ultra`, against the default anthropic ultra) — since cross-family heterogeneity is the strongest decorrelation lever there is; correlated members collapse a nine-seat panel to two effective votes, and model diversity beats persona variety. On top of family mixing, give each the same question under a distinct frame — different evidence emphases, priors to steelman, decompositions. Every member returns: recommendation, a calibrated numeric confidence — the percent probability that its recommendation is correct given the available evidence, so weights are comparable across members — its strongest private reason, and its key evidence.
+
+**Synthesize as a chairman, not a vote.** Weight by stated confidence and evidence quality — confidence-weighting is what lets the council drift toward the correct answer instead of the popular one — reconcile and flag conflicts without inventing, and preserve each member's original answer so a well-argued minority is never erased. Treat unanimity as an alarm to check for correlated error or false convergence, never as proof. Don't hedge toward the average; independent aggregates run under-confident, so commit to the best-supported answer.
+
+**Run a fresh pre-mortem gate every time.** Before finalizing, hand the draft verdict to one clean-context advisor under prospective-hindsight framing — "this was adopted and it failed; explain why" — because assigned dissent inside the group becomes theater and only a fresh critic catches what the authors can't see; prefer a different family than the members that dominated the draft. Fold the real findings in or name them as accepted risks.
+
+**Open a second round only on a named crux, and only when it's checkable.** If members genuinely disagree, name the crux first. A verifiable crux (code, tests, docs, quotable evidence) earns one targeted adversarial round — feed back only anonymized claim/reason/evidence snippets bearing on the crux, with author, model, and conclusion labels stripped so no conformity or brand cues survive, and have members attack and verify those specific claims. An unverifiable crux (judgment, taste, values) gets no persuasion contest: the more persuasive member wins regardless of correctness, so you adjudicate it or surface the tradeoff to the owner as a named disagreement. Cap at ~2 rounds and stop when positions stabilize — extra rounds buy conformity, not accuracy.
+
+Members contribute judgment only: they are read-only opinion sources, and you are the single synthesizer and the only writer of the verdict. Your deliverable is one verdict, conclusion first — recommendation and confidence, the strongest opposing case and why it lost, and any residual disagreement reported *as* disagreement with its crux named, never dissolved into false consensus and never forwarded as raw member output.

package/dist/commands/node.js

@@ -130,7 +130,7 @@ const nodeNew = defineLeaf({
             { kind: 'flag', name: 'root', type: 'bool', required: false, constraint: 'Spawn an INDEPENDENT root instead of a managed child: no parent (top-level on the canvas), NO subscription back to you (you are NOT woken by it), resident lifecycle. It records spawned_by=you for provenance and is brought forefront so it can be driven directly. Use for a node you hand off and do not manage (e.g. a sub-orchestrator a human will discuss with). Mutually exclusive with --worktree.' },
             { kind: 'flag', name: 'worktree', type: 'bool', required: false, constraint: 'Use when the child will COMMIT to the repo while you or other agents may also be editing it — the worktree isolates its work so nothing collides; skip it for read-only work or when the child is the sole writer. Creates a crouter-managed git worktree for the spawned child, keyed by the child node id, at `~/.crouter/canvas/worktrees/<node-id>/` on branch `crtr/<node-id>` based on `origin/main`; the child\'s cwd is pinned there, and it lands the work serially onto origin/main later with `crtr worktree close`. Mutually exclusive with --root.' },
             { kind: 'flag', name: 'fork-from', type: 'string', required: false, constraint: 'FORK the new node from an existing pi conversation instead of starting it fresh: pass a node id (forks from that node\'s session), an absolute session `.jsonl` path, or a partial pi session uuid. pi copies that whole history into a NEW session for the child (the source is untouched), then the prompt is delivered as the next message — i.e. the child wakes up as a continuation of that conversation. Use to branch exploratory work off a node that already built up the context you need, instead of re-deriving it. One-shot at birth: the fork resumes its own session thereafter.' },
-            { kind: 'flag', name: 'model', type: 'enum', choices: ['ultra', 'strong', 'medium', 'light'], required: false, constraint: 'Override the model the node runs on, by capability TIER: ultra (frontier), strong (opus), medium (sonnet), light (haiku). Omit to use the kind\'s persona default (advisor=ultra, explore=light, most other builtins=strong). The override is durable — it survives revives and polymorphs (promote/demote).' },
+            { kind: 'flag', name: 'model', type: 'string', required: false, constraint: 'Override the model the node runs on: exact `provider/id` (e.g. openai-codex/gpt-5.5), a `provider/tier` (anthropic|openai + ultra|strong|medium|light, e.g. openai/ultra — pin a specific model family, useful for spawning cross-family children), a bare capability TIER (ultra|strong|medium|light), or a family alias (opus|sonnet|haiku). Must resolve to a concrete model OFFLINE — unlike `node config --model`, no live broker exists yet at spawn to free-text substring-search a registry. Omit to use the kind\'s persona default (advisor=ultra, explore=light, most other builtins=strong). The override is durable — it survives revives and polymorphs (promote/demote).' },
             { kind: 'flag', name: 'profile', type: 'string', required: false, constraint: 'Select the profile this node runs under — an exact profile id or a unique manifest name (see the <profiles> list below, or `crtr profile list`). Omit to INHERIT the calling node\'s current profile (root has none, so an uninherited child has none either). --root does NOT reset this — it only means top-level, still inherits/uses the selected profile unless this overrides it.' },
             { kind: 'flag', name: 'output-schema', type: 'string', required: false, constraint: 'Path to a JSON Schema file, or inline JSON beginning with `{`. The spawned node gets a `submit` tool shaped by this schema, must call it to finish, and the submitted JSON is written to the final report and context/result.json. Rejected with trigger flags in this version.' },
             { kind: 'flag', name: 'at', type: 'string', required: false, constraint: 'DEFER the birth to a one-shot clock trigger at this future time instead of spawning now — a duration ("5m","1h30m"), a zoned ISO ("2026-06-07T09:00:00Z"), or a bare ISO ("2026-06-07T09:00", host-local or in --tz). Required unless --every is given (the cadence then sets the first fire). Mutually exclusive with --when.' },
@@ -174,7 +174,16 @@ const nodeNew = defineLeaf({
         const root = input['root'] === true;
         const worktree = input['worktree'] === true;
         const forkFrom = input['forkFrom'];
-        const model = input['model'];
+        const modelSpec = input['model']?.trim();
+        if (modelSpec !== undefined) {
+            if (modelSpec === '') {
+                throw new InputError({ error: 'empty_spec', message: 'a model spec is required', field: 'model', next: 'Pass a `provider/id`, a `provider/tier` (e.g. openai/ultra), a tier (ultra|strong|medium|light), or a family alias (opus|sonnet|haiku).' });
+            }
+            if (!normalizeModel(modelSpec).includes('/')) {
+                throw new InputError({ error: 'unresolvable_model', message: `'${modelSpec}' does not resolve to a concrete model`, field: 'model', next: 'Pass an exact `provider/id` (e.g. openai-codex/gpt-5.5), a `provider/tier` (e.g. openai/ultra), a tier (ultra|strong|medium|light), or a family alias (opus|sonnet|haiku) — a live-broker substring search (like `node config --model`) is not available at spawn.' });
+            }
+        }
+        const model = modelSpec;
         const profile = input['profile'];
         const outputSchema = parseOutputSchemaValue(input['outputSchema']);
         const at = input['at']?.trim();

package/dist/core/__tests__/review-model-floor.test.js

@@ -30,3 +30,19 @@ test('explore remains cheap by default and may explicitly run light', () => {
     assert.equal(spec('explore'), normalizeModel('anthropic/light'));
     assert.equal(spec('explore', 'light'), normalizeModel('light'));
 });
+// `node new --model` widened to the full spec grammar (provider/tier, exact
+// provider/id, family alias) alongside the bare tier — the review floor must
+// still hold no matter which shape the requested model arrives in.
+test('review honors an explicit provider/tier override at or above its floor', () => {
+    assert.equal(spec('review', 'openai/ultra'), normalizeModel('openai/ultra'));
+});
+test('review still floors a provider/tier override below its floor', () => {
+    assert.equal(spec('review', 'openai/light'), normalizeModel('openai/strong'));
+});
+test('review passes an unrecognized concrete provider/id straight through, unfloored', () => {
+    // A fully concrete id that matches no ladder cell resolves to no known
+    // strength, so floorReviewModel trusts the explicit pin as-given rather than
+    // guessing — same trust boundary as `node config --model` on a dormant node.
+    const concrete = 'anthropic/claude-does-not-exist-9000';
+    assert.equal(spec('review', concrete), concrete);
+});

package/dist/core/runtime/spawn.d.ts

@@ -42,9 +42,12 @@ export interface SpawnChildOpts {
      *  a <crtr-wake> block is prepended to the kickoff so the newborn knows a clock
      *  birthed it. */
     wakeOrigin?: WakeOrigin;
-    /** Pin the node to a model TIER (ultra/strong/medium/light), overriding the
-     *  persona's declared default. Persisted to `meta.model_override` so it
-     *  survives polymorphs. Omit to use the persona default. */
+    /** Pin the node to a model spec — exact `provider/id`, `provider/tier`
+     *  (e.g. `openai/ultra`), bare tier (ultra/strong/medium/light), or family
+     *  alias (opus/sonnet/haiku) — overriding the persona's declared default.
+     *  The RAW spec is persisted to `meta.model_override` (buildLaunchSpec
+     *  re-normalizes through the current ladders on every revive/polymorph, so
+     *  ladder config edits keep propagating). Omit to use the persona default. */
     model?: string;
     /** Select the profile this node runs under — an exact profile id or a unique
      *  manifest name, validated through `loadProfileManifest`. Omit to INHERIT the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crouton-kit/crouter",
-  "version": "0.3.44",
+  "version": "0.3.45",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",