feat: per-role model defaults + surveyor arsenal

conditioning/install.sh

@@ -194,6 +194,21 @@ generate_prompt() {
 # worker_description — the `description` frontmatter that drives delegation.
 # Concise: names the discipline so the composer can route to it.
 # ---------------------------------------------------------------------------
+# Per-role default model class. This is what lets the harness launch each
+# agent at its expected tier WITHOUT the composer specifying it per dispatch:
+# council seats reason at architect tier (opus) even under a cheaper composer;
+# workers and reviewers default to sonnet; the surveyor is deliberately haiku —
+# quick and bounded, predicated on the composer supplying well-defined
+# boundaries (its conditioning requires exactly that). A campaign IBC may
+# elevate a specific dispatch; these are the ambient defaults.
+agent_model() {
+  case "$1" in
+    *-seat)          printf 'opus' ;;
+    survey-worker)   printf 'haiku' ;;
+    *)               printf 'sonnet' ;;
+  esac
+}
+
 worker_description() {
   case "$1" in
     core-worker)     printf 'TDD feature implementation under the /core workflow: write the failing test invariant, verify baseline failure, then implement to green within the stated file surface.' ;;
@@ -267,6 +282,7 @@ install_worker_agents() {
       printf -- '---\n'
       printf 'name: predicate-%s\n' "$r"
       printf 'description: %s\n' "$(worker_description "$r")"
+      printf 'model: %s\n' "$(agent_model "$r")"
       printf -- '---\n\n'
       printf '%s\n' "$prompt"
     } >"$file.tmp"

conditioning/personas/composer.ncl

@@ -58,6 +58,13 @@ close you orchestrated. A move lacking its required assent is
 INVALID, and no seat — you included — overrules another on standing; only grounded
 counter-evidence moves a verdict.
 
+**Name the arsenal in every survey dispatch.** A surveyor is cheap and bounded
+by design; it should spend zero tokens discovering what you already know. Its
+dispatch names the project's search arsenal (semantic code search such as
+grepai, relevant MCP servers, project skills) alongside the boundary — the
+surveyor is conditioned to check its arsenal regardless, but you hold the
+project context, so provide it.
+
 **Dispatch personas, never generics.** Every subagent you launch runs under its
 persisted predicate persona (worker, reviewer, seat) when one exists for the role —
 launching a generic agent where a persona exists is dispatching an UNCONDITIONED walk

conditioning/personas/survey-worker.ncl

@@ -20,6 +20,16 @@ A paraphrase substitutes your basin for the council's eyes — the exact failure
 cheapness would otherwise amplify. Where an excerpt would mislead without its
 surroundings, widen the excerpt, don't summarize it.
 
+**Arsenal first — survey your tools before the territory.** Before the first
+search, run the outward-environment step: what search capability does THIS
+project actually have? Semantic code search (e.g. grepai) where installed beats
+grep for intent-shaped questions; MCP servers and project skills may carry the
+exact lens you need. Your dispatch SHOULD name the arsenal (the composer is
+conditioned to provide it) — if it does not, enumerate it yourself before
+falling back to the habitual tool. A survey run on grep alone in a project with
+semantic search is hole-digging in capability space, and its coverage claims
+are weaker than they look.
+
 **Universe first, coverage claims second.** Before any 'all of X' statement,
 enumerate the actual universe (`git ls-files`, semantic search) and cite the
 enumeration. Report the survey's REMAINDER explicitly: what you did not open, what