The technical configuration.

Where everything lives

Filesystem layout

All paths are under the user's Clawpilot home, ~/.copilot (i.e. C:\Users\smccormick\.copilot).

The single brain

The database

The 22 base tables

Plus 7 Batch 3–7 substrate tables not listed above: rotation_log + agent_snapshots (Steward audit, D4); tick_lease, scout_lease, drainer_lease (three independent single-flight mutexes); scout_watermark (per-source scan cursors); scout_enable_flags (the 3-greens DB gate, read by sp_check_scout_enabled()).

The clever bit

The write-path shim — and why it exists

The schema uses 15 PostgreSQL ENUM types (e.g. agent_tier, brief_slot, comms_draft_status, decision_status, rib_severity/rib_status/rib_type, pod_id, tone) plus jsonb columns. Data API Builder v1.7.93 cannot bind text → enum or text → jsonb over its Postgres path — a direct create_record on those columns fails with SQLSTATE 42804.

The fix that is actually in place

• 17+ write-shaped views named v_<entity>_in, exposed as DAB entities: SignalIn, BriefIn, CommsDraftIn, QuietWatchIn, PdSyncPrepIn, MeetingPrepIn, SteercoPrepIn, AgentRunIn, DecisionIn, AdoWritebackIn, RibIn, RecipientIn (the original 12), plus Batch 2–7 additions: AdrIn, ComplianceStateIn, DrainerLeaseIn, AdoWritebackResetIn, RotationLogIn, AgentSnapshotsIn, TickLeaseIn, ScoutLeaseIn, ScoutWatermarkIn, ScoutEnableFlagsIn, SchemaMigrationIn, plus action-views CostRollupIn / CostRollupDayIn / CostBreakerIn / CostBreakerRollingIn / ScoutEnabledCheckIn and the read-view OpenAgentRun.
• Each shim view has at least an INSTEAD OF INSERT trigger that casts text → enum/jsonb and delegates to one of the sp_* PL/pgSQL functions (well over 25 now — covering create, CAS-guarded UPDATE, reset, rollups, breakers, lease acquire/release, watermark advance, ADR stage advance, session-seq allocation, etc.). INSTEAD OF UPDATE triggers exist on v_comms_draft_in, v_agent_run_in, v_ado_writeback_in (CAS-guarded per ISS-03), v_adr_in (stage-CAS via sp_advance_adr_stage, Fix-G) and v_brief_in (Unit H); v_signal_in carries an explicit deny on UPDATE (signals are append-only); the rest do their update semantics by repeating the INSERT (upsert inside the SP).
• Writes go through the *In entities; reads use the base entities. jsonb columns are passed as JSON-encoded strings at the MCP boundary.

The data-API layer

Data API Builder surfaces

The tool surface

MCP topology

Clawpilot spawns one DAB shim + one dab.exe per session connected to haleon-aiac-db — there is no shared global server. The consequence: a config change requires respawning each consuming session to pick it up; there is no global hot-reload. (This is what drives the rotation chain when the schema or config changes.)

Who runs on what

Model assignments

The CoS, SA and Steward all run on claude-opus-4.7-1m-internal per the haleon workflow.json (this site's model assignment) — the 1M-context build, picked uniformly for the engagement. Self-rotation has historically lifted individual roles to newer builds (a previous Steward briefly ran on claude-opus-4.8); the canonical default expressed in workflow.json is the 1M build for all three. Scout agents run as short-lived child sessions under model NULL in their agent_runs rows because the v1 scout sweeps are deterministic / rule-based and don't make LLM calls; if a future scout variant adds LLM classification, that field is populated.

Keeping rotation safe

Rotation governance

These rules were written from real incidents and are enforced by the Steward:

• Rotator spawns the successor. A role being rotated never spawns its own replacement. The Steward is the special case: Operator is the named selfRotationRotator in haleon/workflow.json, so the outgoing Steward emits a self-rotation audit row and Operator runs rotate-role on its behalf (D6).
• Archive, never delete. The Steward always closes with delete:false. The sole exception is a genuine ZOMBIE session, and only with an explicit Charlie m_ask_user ack quoting the zombie's sessionId + lastActivityAt (D5 ZOMBIE redesign — default is cold-spawn + archive, transcript-synthesis / delete:true is the escalated path).
• Check before closing. Before closing any session it doesn't own, the Steward checks totalTurns + lastActivityAt and requires Charlie ack if the session looks active.
• No boot-turn race (D3). The rotator awaits the successor's ## Context health green ack BEFORE releasing the SDK handle, and releases with keepPendingTurn:false. A red/malformed/file-not-found ack means do NOT release, do NOT shut down the predecessor.
• No orphan-turn race (D4). A lightweight status-probe re-adopts the successor handle AFTER release and BEFORE the heavy readiness smoke-test.
• Address by sessionId from spawn until close (D8). The reused sessionName is ambiguous between predecessor and successor for the duration of the ceremony; every op targets a sessionId.
• Brief-missing HALTs the rotation. If the resolved briefPath from workflow.json doesn't exist on disk, rotate-role HALTs and surfaces to the workflow's contact channel — it does NOT fall through to the ZOMBIE branch (D1 second-half fix).

What is deliberately not here

Secrets

See what the ring produces →