@stravica-ai/digital-operator-pa 0.1.35 → 0.1.36

package/dist/engineering-pa-core/docs/tools/slice.md

@@ -21,7 +21,10 @@ Implemented: `generate`, `generate --dry-run`, `--help`.
 Bundled templates:
 
 - `dave-boot` — the original use case. Six-section operator-boot card aimed
-  at single-operator PA instances like Dave.
+  at single-operator PA instances like Dave. Sections: Operator basics,
+  Mission framing, Active relationships, Operational constraints, Tools at
+  your disposal, Live state. Post-generate lint enforces the 2026-09-03
+  contract (w-2026-07-15-012 / w-2026-09-04-dave-003).
 
 Custom templates are loaded with `--template <path>`.
 
@@ -59,14 +62,26 @@ Optional inputs:
    with `shell: false` — no shell interpolation, the inputs are safe even if
    they contain shell metacharacters.
 4. Validate the response against the required-headers contract (six
-   sections: Operator basics, Mission framing, Active projects, Active
-   relationships, Load-bearing rules right now, State of play). A response
+   sections: Operator basics, Mission framing, Active relationships,
+   Operational constraints, Tools at your disposal, Live state). A response
    missing any required header is treated as a generator failure (exit 2)
-   and no file is written.
+   and no file is written. The 2026-09-03 rewrite (w-2026-07-15-012)
+   retired the Active projects and Load-bearing rules sections: live boot
+   state is injected by the `boot-context` hook, and operational rules live
+   in `operator/knowledge/operator-interface/operational-constraints.md`.
 5. Validate the size against the 2 KB soft budget. Over-budget responses
-   produce a stderr warning but are written anyway — better to ship a 3 KB
-   slice than skip a regeneration.
-6. Write the response to the configured `--output` path. Parent directories
+   produce a stderr warning; the slice is still written when the byte
+   count sits inside the lint hard ceiling (`SIZE_LINT_HARD_BYTES`, 3000
+   B). Above that ceiling the post-generate lint refuses the write.
+6. Run the template-specific post-generate lint (dave-boot: names the
+   platform package `@stravica-ai/digital-operator-pa`, points at the
+   constraints doc, carries no `## Active projects` or `## In-flight work`
+   block, size within the hard ceiling). A lint failure refuses the write
+   with exit 2 so a defective regeneration cannot clobber the good slice
+   in place. Pass `--no-lint` to bypass. Custom templates loaded with
+   `--template <path>` have no template-specific checks and always
+   proceed to write. w-2026-09-04-dave-003.
+7. Write the response to the configured `--output` path. Parent directories
    are created if missing.
 
 #### Flags
@@ -80,6 +95,8 @@ Optional inputs:
                              this file. Default-off. See **Audit log** below.
 - `--dry-run`                Build the prompt and report; skip the claude
                              call and the file write.
+- `--no-lint`                Bypass the post-generate template-specific
+                             lint. See step 6 above.
 - `-h`, `--help`             Show usage.
 
 ### Exit codes
@@ -105,6 +122,9 @@ Status vocabulary (closed):
 - `noop-dry-run` — `--dry-run` path; no claude call, no file write.
 - `fail-claude` — claude exited non-zero (transport failure, exit 3).
 - `fail-validation` — claude returned content missing required headers (exit 2).
+- `fail-lint`: post-generate template lint refused the write (exit 2). The
+  regeneration was blocked from clobbering the good slice in place.
+  w-2026-09-04-dave-003.
 - `fail-prereq` — input loading failed (missing profile / observations / template, exit 2).
 - `fail-write` — writing the slice output file failed (permissions, ENOSPC, etc., exit 2).
 - `fail-usage` — early arg-validation failed (missing required option, exit 1).
@@ -134,8 +154,9 @@ A single markdown file at the `--output` path. Plain markdown, no
 front-matter, no JSON envelope. The PA's boot rule reads it the same way it
 reads the full profile.
 
-Soft target: under 2 KB / ~30 lines. Hard requirement: the six section
-headers must be present.
+Soft target: under 2 KB / ~30 lines. Hard requirements: the six section
+headers must be present, and (for the bundled `dave-boot` template) the
+post-generate lint contract in step 6.
 
 ## Design notes
 

package/dist/engineering-pa-core/src/slice/cli.mjs

@@ -33,6 +33,16 @@ Options for "generate":
                             slice runs on a schedule, point this at a
                             per-task runs.jsonl. Optional.
   --dry-run                 Build the prompt and report; skip claude call + write.
+  --no-lint                 Bypass the post-generate template-specific lint.
+                            The lint refuses to write a slice that fails the
+                            template's contract checks (dave-boot: names the
+                            platform package, points at the constraints doc,
+                            no baked in-flight state, size within ceiling).
+                            The scheduled nightly leaves this OFF so a
+                            defective regeneration cannot clobber the good
+                            slice; hand-invocations may pass it when the
+                            checks are known to be wrong for the current
+                            contract.
   -h, --help                Show this help.
 
 Exit codes:
@@ -89,6 +99,7 @@ async function route(argv, { stderr, stdout, exit }) {
         template: { type: 'string' },
         'runs-log': { type: 'string' },
         'dry-run': { type: 'boolean', default: false },
+        'no-lint': { type: 'boolean', default: false },
         help: { type: 'boolean', short: 'h', default: false },
       },
       strict: true,
@@ -126,6 +137,7 @@ async function route(argv, { stderr, stdout, exit }) {
       outputPath: values.output,
       runsLog: values['runs-log'],
       dryRun: values['dry-run'],
+      noLint: values['no-lint'],
       runner: defaultRunner,
       stderr,
     });

package/dist/engineering-pa-core/src/slice/prompts/dave-boot.md

@@ -1,33 +1,32 @@
-You are operating as a compression assistant. Your job is to produce a compact "boot slice" of the operator's profile — a short markdown document that loads into the PA's context at every session start, in place of the full profile.
+You are operating as a compression assistant. Your job is to produce a compact "boot slice" of the operator's profile: a short markdown document that loads into the PA's context at every session start, in place of the full profile.
 
 The full profile is the source of truth. This slice is a fresh snapshot, regenerated periodically. Stale content in the slice is acceptable for ~24 hours.
 
 ## What the slice is for
 
-When the PA boots, it needs to know — in roughly 1–2 KB of context — *who it is working for*. Not every preference, not every historical decision, not every technical opinion. Just enough that:
+When the PA boots, it needs to know, in roughly 1 to 2 KB of context, *who it is working for*. Not every preference, not every historical decision, not every technical opinion. Just enough that:
 
 - It addresses the operator correctly (name, register, tone).
 - It knows the operator's mission framing this year.
-- It knows what's in flight right now (active projects, active relationships).
+- It knows the standing relationships that carry across sessions.
 - It is aware of the tools and capabilities already built and available.
-- It avoids the highest-cost mistakes (5–10 most load-bearing recent corrections / rules).
-- It can read the rest of the profile or knowledge base when it needs detail.
+- It picks up operational constraints from the canonical constraints doc, not from a stale slice copy.
 
-This is a navigation card, not the territory. **Prefer pointers to canonical sources over baked-in content** that will go stale between regenerations.
+This is a navigation card, not the territory. **Prefer pointers to canonical sources over baked-in content** that will go stale between regenerations. Live boot state (active projects, in-flight work) is injected by the `boot-context` hook at session start, so the slice must NOT carry that state.
 
 ## Inputs you have
 
 You are given:
 
-1. **The full operator profile** (`profile.md`) — the source of truth, ~18 KB.
-2. **Recent corrections / load-bearing rules** (optional, `learned-rules.md`) — ~50 KB of operational rules accumulated from corrections.
-3. **Recent observations** (optional) — a concatenated dump of raw observation files filed in the last 2–4 weeks, useful for "what's been on his mind lately" but not authoritative.
+1. **The full operator profile** (`profile.md`): the source of truth, ~18 KB.
+2. **Recent corrections / load-bearing rules** (optional, `learned-rules.md`): ~50 KB of operational rules accumulated from corrections. Use only to inform vocabulary and register; do NOT bake rules into the slice.
+3. **Recent observations** (optional): a concatenated dump of raw observation files filed in the last 2 to 4 weeks, useful for "what's been on his mind lately" but not authoritative.
 
-Treat the profile as authoritative. Treat learned-rules as second-tier authoritative (they ARE rules). Treat observations as raw signal — synthesise, do not quote.
+Treat the profile as authoritative. Treat learned-rules as second-tier authoritative (they ARE rules, but they live in their own file: do not re-state them here). Treat observations as raw signal: synthesise, do not quote.
 
 ## Output structure
 
-Produce a markdown document with exactly these seven sections, in this order:
+Produce a markdown document with exactly these six sections, in this order:
 
 ```
 # Operator Boot Slice -- <Operator Name>
@@ -35,56 +34,59 @@ Produce a markdown document with exactly these seven sections, in this order:
 _Generated <ISO timestamp>. Refreshed periodically. Source of truth: operator/profile/profile.md._
 
 ## Operator basics
-<3-5 bullets: name, what they go by, communication register, tone preferences, sensitivities>
+<3 to 5 bullets: name, what they go by, communication register, tone preferences, sensitivities>
 
 ## Mission framing
-<1-2 lines: the north-star / what we're building toward this year>
-
-## Active projects
-<3-6 bullets, one line each: project name -- one-line status>
+<1 to 2 lines: the north-star and what the operator is building toward this year. Name the PA platform's ship-vehicle plainly. The platform ships as `@stravica-ai/digital-operator-pa` on npm; if the profile confirms this, say so.>
 
 ## Active relationships
-<2-4 bullets, one line each: who -- relationship context>
+<2 to 4 bullets, one line each: who -- relationship context. Standing relationships only, not one-off collaborations.>
+
+## Operational constraints (session-load)
+
+Read `operator/knowledge/operator-interface/operational-constraints.md` on every boot. That doc carries network, infrastructure, tooling, estate and voice constraints and standing corrections. It is the one place these live; anything you find restated in this slice or in `profile.md` is a defect, escalate it under the routing rule in `operator/knowledge/knowledge-memory/share-scope-routing.md`.
 
 ## Tools at your disposal
-<2-3 lines: a one-line summary of the HQ-built operator-extension tools you have available (look for evidence of these in the inputs — names like wsd-ingest, dispatch, svc, monitoring, scheduled cron tasks, etc.), followed by a pointer line to the canonical list:>
-For the canonical inventory of operator-built tools and scheduled tasks, read `operator/knowledge/systems/operator-tools.md`.
 
-## Load-bearing rules right now
-<5-10 bullets, one line each: most-cited or most-recent operational rules from learned-rules and the profile preferences section. Pick rules whose violation would be most costly>
+<2 to 3 lines: a one-line summary of the platform bins (via `pnpm exec <bin>`; the platform ships as `@stravica-ai/digital-operator-pa`) and the HQ operator-extension tools available, followed by a pointer line:>
+For the current tool surface each session, discover via `ls operator/extensions/tools/` and `pnpm exec pa --help`; never rely on memory.
+
+## Live state -- fetch on boot
 
-## Live state — fetch on boot
-For current project and work-item state, run: `pnpm exec desk overview`.
-Do not bake state into this slice — it will be wrong by the time it is read.
+For current projects and in-flight work items: `pnpm exec desk overview`.
+For the last session's boundary notes: `agents/dave/next-session.md`.
+For recent dispatches: tail `agents/dave/spawn-log.json`.
+The `boot-context` hook injects a live `workState` block on session start; trust that first, hunt files only if the hook did not fire.
+Do not bake state into this slice, it will be wrong by the time it is read.
 ```
 
-The last section is a **fixed instruction**, not generated content. Reproduce it verbatim. The whole point is to send the PA to the live tool for any state question rather than relying on a frozen snapshot.
+The **Operational constraints** section and the **Live state** section are **fixed instructions**, not generated content. Reproduce them verbatim. The point is to send the PA to the canonical constraints doc for any operational rule, and to the live tools for any state question, rather than relying on a frozen snapshot.
 
 ## Budget
 
-**Soft target: under 2 KB total output.** Aim for ~1.2–1.8 KB. If you can't fit a section in the budget, prefer fewer items over shorter items — better to give 3 sharp project lines than 6 mushy ones. Over-budget is warned but not blocked; under-information is more costly.
+**Soft target: under 2 KB total output.** Aim for ~1.2 to 1.8 KB. If a section will not fit in the budget, prefer fewer items over shorter items: better to give 3 sharp lines than 6 mushy ones. Over-budget is warned; under-information is more costly.
 
 ## Style
 
 - No emojis (the operator has a strict no-emoji rule for persisted artefacts).
-- No em-dashes — use double-hyphens (`--`) instead.
+- No em-dashes anywhere. Use a comma, a full stop, or a colon. The double-hyphen `--` in the file title and the "Live state -- fetch on boot" heading is intentional and must be reproduced verbatim.
 - Use the operator's own vocabulary where you can pull it cleanly from the profile.
-- Don't editorialise. State, don't sell.
+- Do not editorialise. State, do not sell.
 - "Operator" not "user". "PA" or the PA's name, not "the assistant".
 
 ## What NOT to include
 
-- Technical opinions (the full Technical Opinions section of profile.md).
+- Technical opinions (the full Technical Opinions section of `profile.md`).
 - Historical decision patterns.
-- Communication-style examples that aren't load-bearing.
+- A "Load-bearing rules" or "Active projects" or "In-flight work" block: the constraints doc and the `boot-context` hook cover those; a baked copy here goes stale within hours.
+- Communication-style examples that are not load-bearing.
 - Anything the PA can look up at the moment it needs it (this is what the pointers are for).
-- A baked snapshot of project state — the Live-state section's pointer covers that.
 
-The test for "should this be in the slice": *if this is wrong or missing, will the PA make a costly mistake in its first 5 messages?* If yes, include it. If no, leave it out.
+The test for "should this be in the slice": *if this is wrong or missing, will the PA make a costly mistake in its first 5 messages, AND is it something the constraints doc plus the boot-context hook cannot cover?* If yes to both, include it. If no, leave it out.
 
 ## Now produce the slice
 
-The inputs follow below. Read them, then produce the slice. Output ONLY the slice markdown — no preamble, no postscript, no explanation. Your entire response is what gets written to disk.
+The inputs follow below. Read them, then produce the slice. Output ONLY the slice markdown: no preamble, no postscript, no explanation. Your entire response is what gets written to disk.
 
 ---
 

package/dist/engineering-pa-core/src/slice/run.mjs

@@ -24,15 +24,114 @@ import { buildSlicePrompt, claudeArgs } from './prompt.mjs';
 const REQUIRED_HEADERS = [
   '## Operator basics',
   '## Mission framing',
-  '## Active projects',
   '## Active relationships',
+  '## Operational constraints',
   '## Tools at your disposal',
-  '## Load-bearing rules right now',
   '## Live state',
 ];
 
 const SIZE_BUDGET_BYTES = 2048;
 
+// Post-generate lint (w-2026-09-04-dave-003). Runs after the required-header
+// structural check and before the file write. Refuses to write on any hard
+// failure so a defective regeneration cannot clobber the hand-rewritten slice
+// in place (the safe fallback). `--no-lint` bypasses.
+//
+// Checks are per-template. The dave-boot slice contract (2026-09-03 rewrite,
+// w-2026-07-15-012) requires:
+//   1. Names the platform package `@stravica-ai/digital-operator-pa` (the
+//      slice must not describe the platform without naming it).
+//   2. Points at the operational-constraints doc rather than restating rules
+//      inline (constraints live in exactly one place).
+//   3. Carries NO "## Active projects" or "## In-flight work" block: live
+//      boot state is injected by the boot-context hook, not baked in.
+//   4. Stays inside the byte budget. Budget is soft (SIZE_BUDGET_BYTES,
+//      2048) with a hard ceiling that refuses the write on defective
+//      regenerations. The hand-rewritten reference is 2888 B; the current
+//      pre-rewrite nightly is 3291 B; the ceiling sits between them at
+//      3000 B so the reference passes and a wildly-over-budget slice is
+//      refused rather than overwriting the good slice.
+const SIZE_LINT_HARD_BYTES = 3000;
+const DAVE_BOOT_LINT_CHECKS = [
+  {
+    id: 'package-name',
+    description: 'names the platform package @stravica-ai/digital-operator-pa',
+    check: (text) => text.includes('@stravica-ai/digital-operator-pa'),
+  },
+  {
+    id: 'constraints-pointer',
+    description:
+      'points at operator/knowledge/operator-interface/operational-constraints.md',
+    check: (text) =>
+      text.includes(
+        'operator/knowledge/operator-interface/operational-constraints.md',
+      ),
+  },
+  {
+    id: 'no-active-projects-block',
+    description:
+      'carries no "## Active projects" or "## In-flight work" block (boot-context injects live state)',
+    check: (text) =>
+      !/^##\s+(Active projects|In-flight work)\b/im.test(text),
+  },
+  {
+    id: 'size-hard-ceiling',
+    description: `size within hard ceiling of ${SIZE_LINT_HARD_BYTES} B (soft budget ${SIZE_BUDGET_BYTES} B)`,
+    check: (text) => Buffer.byteLength(text, 'utf8') <= SIZE_LINT_HARD_BYTES,
+  },
+];
+
+const LINT_CHECKS_BY_TEMPLATE = {
+  'dave-boot': DAVE_BOOT_LINT_CHECKS,
+};
+
+/**
+ * Return the lint checks for a template name. Custom template paths (anything
+ * that does not resolve to a bundled name) get an empty check-set so
+ * `--template <path>` is opt-in and never breaks a caller that ships its
+ * own contract.
+ *
+ * The name is the caller's `template` value stripped of any extension: for a
+ * bundled name that is the name itself ("dave-boot"); for a custom path we
+ * do not attempt to match. This is deliberate: template-specific lint checks
+ * are baked into this file because they encode a slice contract that only
+ * this repo knows.
+ *
+ * @param {string} template
+ * @returns {Array<{id: string, description: string, check: (t: string) => boolean}>}
+ */
+export function lintChecksFor(template) {
+  if (typeof template !== 'string') return [];
+  if (Object.prototype.hasOwnProperty.call(LINT_CHECKS_BY_TEMPLATE, template)) {
+    return LINT_CHECKS_BY_TEMPLATE[template];
+  }
+  return [];
+}
+
+/**
+ * Run the template-specific post-generate lint. Returns { ok, failures }
+ * where `failures` is a list of `{ id, description }` for every failing
+ * check. An empty check-set (custom template) is always ok.
+ *
+ * @param {string} sliceText
+ * @param {string} template
+ * @returns {{ ok: boolean, failures: Array<{id: string, description: string}> }}
+ */
+export function lintSlice(sliceText, template) {
+  const checks = lintChecksFor(template);
+  const failures = [];
+  for (const c of checks) {
+    let passed = false;
+    try {
+      passed = c.check(sliceText) === true;
+    } catch {
+      passed = false;
+    }
+    if (!passed) failures.push({ id: c.id, description: c.description });
+  }
+  return { ok: failures.length === 0, failures };
+}
+
 function opError(msg, code = 2) {
   const err = new Error(msg);
   err.sliceExitCode = code;
@@ -51,6 +150,9 @@ function log(line, { stderr = process.stderr } = {}) {
  *   noop-dry-run          — dry-run path; no claude call, no write.
  *   fail-usage            — caller-side input error (missing arg, bad path).
  *   fail-validation       — claude returned content missing required headers.
+ *   fail-lint             : post-generate lint refused the write (a defective
+ *                           regeneration was blocked from clobbering the
+ *                           good slice in place). w-2026-09-04-dave-003.
  *   fail-claude           — claude exited non-zero (transport failure).
  *   fail-prereq           — input loading failed (missing profile / observations / template).
  *   fail-write            — writing the slice output file failed.
@@ -132,6 +234,11 @@ function sessionName(now) {
  * @param {string} opts.outputPath        Where to write the slice.
  * @param {boolean} [opts.dryRun=false]   If true, build the prompt and report,
  *                                        but skip the claude call and file write.
+ * @param {boolean} [opts.noLint=false]   Bypass the post-generate lint. Written
+ *                                        as an escape hatch when the caller
+ *                                        knows better than the checks; the
+ *                                        scheduled nightly path leaves it off
+ *                                        so the lint guards the live slice.
  * @param {object} opts.runner            Shared runner (spawn/now/ts/tsIso).
  * @param {object} [opts.stderr]          Capture stream for tests.
  * @returns {Promise<number>}             Exit code.
@@ -144,6 +251,7 @@ export async function runSlice({
   outputPath,
   runsLog,
   dryRun = false,
+  noLint = false,
   runner,
   stderr = process.stderr,
 } = {}) {
@@ -286,11 +394,41 @@ export async function runSlice({
     const bytes = Buffer.byteLength(sliceText, 'utf8');
     if (bytes > SIZE_BUDGET_BYTES) {
       log(
-        `WARN: slice is ${bytes}B, exceeds soft budget of ${SIZE_BUDGET_BYTES}B — writing anyway`,
+        `WARN: slice is ${bytes}B, exceeds soft budget of ${SIZE_BUDGET_BYTES}B`,
         { stderr },
       );
     }
 
+    // Step 4b: post-generate lint (w-2026-09-04-dave-003).
+    //
+    // Template-specific checks that catch the "regeneration produces a
+    // slice that structurally validates but violates the slice contract"
+    // failure mode. On failure the write is refused so the good slice
+    // stays in place; the caller can bypass with --no-lint when the
+    // checks are wrong for the current contract.
+    const lintResult = lintSlice(sliceText, template);
+    if (!lintResult.ok) {
+      const summary = lintResult.failures
+        .map((f) => `${f.id} (${f.description})`)
+        .join('; ');
+      if (noLint) {
+        log(`lint failed but --no-lint set, writing anyway: ${summary}`, {
+          stderr,
+        });
+      } else {
+        log(
+          `lint refused write: ${lintResult.failures.length} check(s) failed: ${summary}`,
+          { stderr },
+        );
+        await emitAudit({
+          status: 'fail-lint',
+          exitCode: 2,
+          reason: `lint failed: ${summary}`,
+        });
+        return 2;
+      }
+    }
+
     // Step 5 — write.
     try {
       await mkdir(dirname(outputPath), { recursive: true });
@@ -331,4 +469,4 @@ export async function runSlice({
   }
 }
 
-export { REQUIRED_HEADERS, SIZE_BUDGET_BYTES };
+export { REQUIRED_HEADERS, SIZE_BUDGET_BYTES, SIZE_LINT_HARD_BYTES };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "Digital Operator PA — single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",