| 1 | # Fleet rebuild decisions (2026-08-04) |
| 2 | |
| 3 | Owner-steered requirements captured this session. Evidence-first: every claim |
| 4 | below is anchored to code or a user statement; nothing is aspiration. |
| 5 | |
| 6 | ## 1. Fleets are saved configurations (not shadowed role files) |
| 7 | |
| 8 | Today two parallel stores exist: |
| 9 | - per-role profile files (`~/.codewhale/agents/*.toml`, `.codewhale/agents/*.toml`, |
| 10 | `[fleet.profiles]`, built-ins) merged by id with `ShadowedProfile` receipts |
| 11 | (crates/tui/src/fleet/roster.rs) — the "⚠ shadow" pile the UI must not show; |
| 12 | - named fleet files (`fleets/<name>.toml` at `$CODEWHALE_HOME` or workspace) |
| 13 | consumed by the workflow crate (`crates/workflow/src/named_fleet.rs`, |
| 14 | `fleet_exact.rs`) with `QualifiedFleetId` ambiguity rejection. |
| 15 | |
| 16 | **Decision:** one concept — a named Fleet file. A Fleet contains: |
| 17 | - `name` (editable display name), `description`; |
| 18 | - `operator`: provider + exact model + reasoning (absent = inherit session route); |
| 19 | - `members`: role → model pin or inherit, provider (pins only, never inferred), |
| 20 | reasoning (only when the resolved route supports it), instructions, |
| 21 | capability requirements (e.g. `vision`); |
| 22 | - scope + source: personal (`$CODEWHALE_HOME/fleets/`) or workspace |
| 23 | (`.codewhale/fleets/`), the exact file path shown in the UI. |
| 24 | |
| 25 | New schema kind `schema = "fleet"` v2 owned by the TUI crate. The workflow |
| 26 | crate's `exact`/legacy parsers stay untouched; binding a v2 file to a Workflow |
| 27 | fails closed with "unknown fleet schema" until workflows are decoupled. |
| 28 | |
| 29 | ## 2. Selection: personal default + explicit workspace selection |
| 30 | |
| 31 | - `$CODEWHALE_HOME/fleets/selected` — user-global default Fleet (plain text name). |
| 32 | - `.codewhale/fleets/selected` — workspace selection, intentional and labeled. |
| 33 | - Resolution: workspace selection wins, then personal, then none (legacy roster). |
| 34 | - A new session starts on the selected Fleet's operator route unless CLI/env |
| 35 | override exists. |
| 36 | - Workspace config never silently shadows a personal Fleet: both remain listed, |
| 37 | scopes labeled, ambiguity surfaced (qualified `origin/name`). |
| 38 | |
| 39 | ## 3. Session route changes are temporary by default |
| 40 | |
| 41 | `/model` and `/provider` change only the live session route. Persistence is an |
| 42 | explicit choice: Update this Fleet / Save as a new Fleet / Save as my default |
| 43 | (no fleet selected) / Keep for session only. Never silently rewrite a saved |
| 44 | Fleet or the config file after an in-session route change. Every save receipt |
| 45 | names the exact file and scope it changed. |
| 46 | |
| 47 | ## 4. Scout replaces "faster" |
| 48 | |
| 49 | One visible fast exploratory role: Scout. `faster`/`model_strength`/`Fast` |
| 50 | loadout disappear from pickers, tool schemas, and Fleet config. Legacy parsing |
| 51 | survives for compatibility and migrates to the Scout policy with a receipt. |
| 52 | Unpinned Scout may receive a suggested fast companion from explicit catalog |
| 53 | metadata (provider/family → verified offering), never name-guessing; the exact |
| 54 | resolved Scout provider/model is shown before a run; explicit Scout pins win |
| 55 | and survive operator changes; no verified companion → show that clearly or |
| 56 | inherit deliberately. |
| 57 | |
| 58 | ## 5. Provider → model family → exact model picker |
| 59 | |
| 60 | The flat model list (model_picker.rs) becomes provider → family → exact model. |
| 61 | Each row truthfully shows provider + exact route id, readiness, explicit Fleet |
| 62 | role recommendation, input modalities (vision), tool + structured-output |
| 63 | support, reasoning levels, context/output limits. Compact by default; endpoint/ |
| 64 | cost/advanced behind disclosure. No `max`/`ultra` unless genuinely supported. |
| 65 | Capability-aware routing: vision work never silently goes to a non-vision |
| 66 | member. |
| 67 | |
| 68 | ## 6. Config/credential scope: user-global credentials, layered selection |
| 69 | |
| 70 | Verified: credentials/keychain/OAuth are already user-global |
| 71 | (crates/secrets, ~/.codex/auth.json, ~/.grok/auth.json, |
| 72 | $CODEWHALE_HOME/credentials/*). The "authorized here, locked there" failure is |
| 73 | a config-file-selection problem: an explicit --config/CODEWHALE_CONFIG_PATH |
| 74 | pointing at a workspace file makes THAT file the loaded config, and the |
| 75 | readiness gate (`provider_is_configured_for_active`) can then fail on a |
| 76 | credential that exists user-globally. Fix: readiness consults the user-global |
| 77 | credential sources regardless of which config file is loaded; every active |
| 78 | route shows its source (provider/model, credential source, config layer, |
| 79 | temporary vs saved, precise unavailable reason). |
| 80 | |
| 81 | ## 7. Members/roles pin to folders or users |
| 82 | |
| 83 | Fleet save scope is either user (personal) or folder (workspace); both are |
| 84 | always listed with scope + source labels; same-name fleets in two scopes are |
| 85 | distinct and never silently shadow — the UI surfaces the ambiguity and the |
| 86 | user picks a qualified origin/name. |
| 87 | |
| 88 | ## 8. Workflows will be simplified toward kimicode-swarm/grokbuild-style |
| 89 | ## orchestration (no fleet-file dependency) |
| 90 | |
| 91 | Research lane open (scout dispatched). Workflow runs should need only roles + |
| 92 | session route, with a default roster from built-ins; fleet files become an |
| 93 | optional pin layer, not a requirement. Do not redesign workflows in this |
| 94 | session beyond the research; the fleet rebuild must not deepen the coupling. |
| 95 | |
| 96 | ## 9. Copy is truthful |
| 97 | |
| 98 | Every label, receipt, status, and confirmation states only what the code can |
| 99 | prove: save receipts name the exact file changed; readiness states carry a |
| 100 | precise reason; "saved"/"selected"/"authorized" are never claimed without the |
| 101 | underlying write/credential check having succeeded. |
| 102 |