@stravica-ai/digital-operator-pa 0.1.10 → 0.1.11

package/dist/engineering-pa-cli/src/launch/identity.mjs

@@ -1,32 +1,98 @@
 // identity.mjs — pure: load + validate an agent identity from the operator roster.
-// Roster path: <repoRoot>/operator/knowledge/hr/roster/<name>.json
+//
+// Roster resolution is mount-aware (w-2026-07-29-007). Rosters live at two
+// levels of the operator knowledge tree:
+//   1. Flat (HQ) path:      <repoRoot>/operator/knowledge/hr/roster/<name>.json
+//   2. Team-mount subtrees: <repoRoot>/operator/knowledge/<team>/hr/roster/<name>.json
+//      (e.g. WSD's dex at operator/knowledge/wsd/hr/roster/dex.json)
+//
+// The flat path is checked first, then every team mount. A single hit --
+// wherever it lives -- resolves. The SAME agent name present in more than one
+// roster (flat + team, or two teams) is an ambiguity the operator must fix:
+// the loader errors listing every matching path rather than silently picking
+// one. Silent precedence is exactly the failure mode this guards against -- a
+// stale flat copy shadowing a team roster (or vice versa) would launch an
+// agent under the wrong identity with no signal.
+//
 // Required fields: id, name, roleId, runFolder, status
-import { readFile } from 'node:fs/promises';
+import { readFile, readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 
 const REQUIRED_FIELDS = ['id', 'name', 'roleId', 'runFolder', 'status'];
 
-export async function loadIdentity(repoRoot, agentName) {
-  const path = join(repoRoot, 'operator', 'knowledge', 'hr', 'roster', `${agentName}.json`);
-  let raw;
+const ROSTER_SEGMENTS = ['hr', 'roster'];
+
+function flatRosterPath(repoRoot, agentName) {
+  return join(repoRoot, 'operator', 'knowledge', ...ROSTER_SEGMENTS, `${agentName}.json`);
+}
+
+// Enumerate team-mount roster candidates: operator/knowledge/<team>/hr/roster/<name>.json.
+// Directory listing is sorted so error output is deterministic across
+// filesystems. The flat tree's own `hr/` directory is skipped --
+// `operator/knowledge/hr` is the flat roster's parent, not a team mount, and
+// matching it would double-count the flat path.
+async function teamRosterPaths(repoRoot, agentName) {
+  const knowledgeRoot = join(repoRoot, 'operator', 'knowledge');
+  let entries;
+  try {
+    entries = await readdir(knowledgeRoot, { withFileTypes: true });
+  } catch {
+    return []; // no knowledge tree at all -- nothing to scan
+  }
+  return entries
+    .filter((e) => e.isDirectory() && e.name !== 'hr')
+    .map((e) => e.name)
+    .sort()
+    .map((team) => join(knowledgeRoot, team, ...ROSTER_SEGMENTS, `${agentName}.json`));
+}
+
+// Read a roster file's raw content, distinguishing "not there" (null) from
+// real read failures (thrown, exitCode 3).
+async function readRosterFile(path, agentName) {
   try {
-    raw = await readFile(path, 'utf8');
+    return await readFile(path, 'utf8');
   } catch (err) {
-    if (err.code === 'ENOENT') {
-      const e = new Error(`agent "${agentName}" not found in roster (${path})`);
-      e.exitCode = 2;
-      throw e;
-    }
+    if (err.code === 'ENOENT' || err.code === 'ENOTDIR') return null;
     const e = new Error(`could not read roster file for "${agentName}": ${err.message}`);
     e.exitCode = 3;
     throw e;
   }
+}
+
+export async function loadIdentity(repoRoot, agentName) {
+  const flatPath = flatRosterPath(repoRoot, agentName);
+  const candidates = [flatPath, ...(await teamRosterPaths(repoRoot, agentName))];
+
+  const hits = [];
+  for (const candidate of candidates) {
+    const content = await readRosterFile(candidate, agentName);
+    if (content !== null) hits.push({ path: candidate, content });
+  }
+
+  if (hits.length === 0) {
+    const e = new Error(
+      `agent "${agentName}" not found in roster (searched ${flatPath} and team mounts operator/knowledge/*/hr/roster/)`,
+    );
+    e.exitCode = 2;
+    throw e;
+  }
+  if (hits.length > 1) {
+    const e = new Error(
+      `agent "${agentName}" is ambiguous -- found in ${hits.length} rosters: ${hits
+        .map((h) => h.path)
+        .join(', ')}. Remove the duplicate roster entry (or rename one agent) before launching.`,
+    );
+    e.exitCode = 2;
+    throw e;
+  }
+
+  const { path: resolvedPath, content: raw } = hits[0];
 
   let data;
   try {
     data = JSON.parse(raw);
   } catch (err) {
-    const e = new Error(`roster file for "${agentName}" is not valid JSON: ${err.message}`);
+    const e = new Error(`roster file for "${agentName}" is not valid JSON (${resolvedPath}): ${err.message}`);
     e.exitCode = 2;
     throw e;
   }

package/dist/engineering-pa-core/docs/tools/distill.md

@@ -46,13 +46,36 @@ any file changes distill produced.
 2. Count markdown observations under `agents/*/staging/` (depth ≤ 2,
    excluding `_archived/`). If zero, append a `noop-empty-staging`
    audit record and exit 0.
-3. Invoke `claude` with the librarian definition as an appended system
-   prompt and the distillation instructions as the positional prompt.
+3. Invoke `claude` with an explicit `--model` (see Model selection below),
+   the librarian definition as an appended system prompt, and the
+   distillation instructions as the positional prompt.
    Output is written to `<repoRoot>/.cache/distill/logs/<ts>.log`.
 4. Append a one-line JSON audit record to
    `<repoRoot>/.cache/distill/logs/runs.jsonl` (schema below).
 5. Exit 0 (ok) or 3 (claude transport failure).
 
+### Model selection
+
+The sweep passes `--model claude-opus-4-7` explicitly (operator ruling
+2026-07-29). Before the pin, no `--model` was passed and the Librarian
+inherited whatever the host CLI defaulted to -- so the model running the
+sweep was an accident of host configuration, and a host-side default bump
+silently changed sweep behaviour across the estate. The pin makes the
+choice deliberate. The reasoning behind 4.7 specifically: it follows
+briefs better than 4.8/5 in estate experience, and brief-following
+matters more for a scripted sweep than raw capability.
+
+Override per host or per run with the `DISTILL_MODEL` environment
+variable:
+
+```
+DISTILL_MODEL=claude-opus-4-8 pnpm exec distill run
+```
+
+An empty or whitespace-only `DISTILL_MODEL` is treated as unset. The
+dry-run plan reports the effective model and whether it came from the
+pinned default or the override.
+
 ### Librarian definition resolution
 
 The system prompt appended to the sweep session is resolved in this

package/dist/engineering-pa-core/src/distill/prompt.mjs

@@ -77,11 +77,30 @@ export function buildDistillPrompt({
  */
 export const DISTILL_PROMPT = buildDistillPrompt();
 
-export function claudeArgs({ sessionName, librarianDef, prompt = DISTILL_PROMPT }) {
+// The model the distillation sweep runs on, pinned explicitly (Baz ruling
+// 2026-07-29). Before this pin, claudeArgs passed no `--model`, so the
+// Librarian inherited whatever the host CLI happened to default to -- the
+// model choice was an accident of host config, and a host-side default bump
+// silently changed sweep behaviour. The pin makes the choice deliberate:
+// claude-opus-4-7 follows briefs better than 4.8/5 in estate experience,
+// which matters more for a scripted sweep than raw capability.
+//
+// Override per host or per run via the DISTILL_MODEL environment variable
+// (documented in docs/tools/distill.md).
+export const DEFAULT_DISTILL_MODEL = 'claude-opus-4-7';
+
+export function resolveDistillModel(env = process.env) {
+  const override = env.DISTILL_MODEL;
+  if (typeof override === 'string' && override.trim() !== '') return override.trim();
+  return DEFAULT_DISTILL_MODEL;
+}
+
+export function claudeArgs({ sessionName, librarianDef, prompt = DISTILL_PROMPT, model = resolveDistillModel() }) {
   // Positional prompt last. No shell interpolation — this array is
   // handed directly to child_process.spawn.
   return [
     '--print',
+    '--model', model,
     '--permission-mode', 'bypassPermissions',
     '--no-session-persistence',
     '--name', sessionName,

package/dist/engineering-pa-core/src/distill/run.mjs

@@ -37,7 +37,7 @@ import { basename, join } from 'node:path';
 
 import { resolvePrereqs } from './prereqs.mjs';
 import { countStagedObservations } from './staging.mjs';
-import { buildDistillPrompt, claudeArgs } from './prompt.mjs';
+import { buildDistillPrompt, claudeArgs, resolveDistillModel } from './prompt.mjs';
 
 function log(line, { stderr = process.stderr } = {}) {
   stderr.write(`[distill] ${line}\n`);
@@ -172,7 +172,8 @@ export async function runDistill({
     log(`  operator supplement:  ${supplementPlanLine}`, { stderr });
     log(`  composed total:       ${librarianIdentity.length} bytes`, { stderr });
     log(`  prompt:               <inline> (${prompt.length} bytes, --root ${repoRoot})`, { stderr });
-    log('  command:              claude --print --permission-mode bypassPermissions \\', { stderr });
+    log(`  model:                ${resolveDistillModel()}${process.env.DISTILL_MODEL ? ' (DISTILL_MODEL override)' : ' (pinned default)'}`, { stderr });
+    log(`  command:              claude --print --model ${resolveDistillModel()} --permission-mode bypassPermissions \\`, { stderr });
     log(`                          --no-session-persistence --name ${sessionName} \\`, { stderr });
     log('                          --append-system-prompt <librarian definition> \\', { stderr });
     log('                          <distill prompt as positional arg>', { stderr });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Digital Operator PA — single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",