Operator → Driver — the fleet-tooling rename, audited and planned

Every place the fleet's tooling still says operator, sorted into what should become driver, what must stay because it is the product's word, and what is a wire-level key that needs a compatibility shim rather than a rename. With the four-PR plan to get there without breaking a running fleet.

2026-09-13 · scope: ~/.local/bin (local-bin), ~/.claude (dotclaude), agentflow, agent-smith, propflow-docs, and the agentflow slice of propflowai · status: audit complete, part 1 opened, parts 2–4 planned, ADR amendment drafted (not merged)

The three buckets

How the counts were made: git grep -nE "operator|Operator|OPERATOR|\bop-|opSid" per repo and grep -rnE over ~/.local/bin and ~/.claude (excluding logs, .bak, __pycache__ and the six repo-main mirrors under ~/.claude/scripts), then a line-level classifier: a line is (K) if it names a known identifier (operatorSid, operatorFirst, op-task, op-${…}, operator-${…}, start-operator, OperatorTaskWorkflow, name: operator, --actor operator, …), (A) if it lives in a portfolio/product page, else (R). The totals are approximate — a census of matches, not of meanings. Every item named in the tables below was classified by reading the surrounding code, and every (K) reader marked "run" was executed against the live task.json.

(R) — fleet-ROLE usages that should say "driver" (the important ones)

(A) — ARCHITECTURE usages that must NOT change (the boundary)

(K) — load-bearing KEYS and identifiers: shim, do not rename

Each row is a string some process starts, greps, parses or keys on. "Run" means the reader was executed today against the live ~/.claude/jobs/tasks/sess-propflow-ef/task.json (driver 9fa34932, worker 1fdb267c, state working) and consumed the field; "source" means the consumption was read in code but the path could not be exercised (no live incident, or it runs inside Temporal).

The plan — four vertical slices, each ≤300 lines, each off origin/main, never stacked

The ADR finding

ADR-0021 covers the doctrine rename and, in §4, explicitly keeps operatorSid, operatorFirst, operatorKickoff, superviseOperators, the operator-<task> prefix and the op- prefix "on purpose". Its Consequences say only that "the second half is a separate, later change … after the Sunday 2026-09-13 rollout deadline" — a date, and no mechanism. Its 2026-09-11 amendment covers the skill name: inversion (part 2c above, followed verbatim). ADR-0025 superseded §5's target type only (DriverWorkflow). So the identifier-level rename is not covered, and per ADR-0004 it is not done until its record is written. Per ADR-0020 (two records of one decision is the defect) this is an amendment to 0021, not a new ADR. Drafted below; not merged — it goes in with part 3a, by whoever is in the room when 3a opens, and only after the #7545 question is answered.

## Amendment 2026-09-13 — the identifier half: a dual-key cutover, retired by a count

- **Amends:** decision 4 (the list of things that "still say operator, on purpose") and
  the last Consequences bullet ("the second half is a separate, later change"). Nothing
  else changes: the role is the Driver, `/operator` stays a live door, the product's
  `operator` does not move, `op-` stays the Supervisor's namespace.
- **Date:** 2026-09-13. Gera, same day: *"why do we see operator everywhere? Shouldn't
  it be driver? I thought we've gone away from the word operator since it's now being
  claimed by our architecture."*
- **Why an amendment:** decision 4 deferred the identifiers with a date and no
  mechanism. The date has arrived; this supplies the mechanism.

### The decision

1. **`operatorSid` becomes `driverSid` by DUAL KEY, never by rename.** The same file
   carries both for the whole window. `operatorFirst`, `operatorRespawns` and
   `operatorKickoff` move the same way (`driverFirst`, `driverRespawns`,
   `driverKickoff`). The red-main `claim.json` moves with them; it has one writer.
2. **The Supervisor moves first, because it is the only writer that rewrites every
   task file.** `supervisor/src/tasks.ts readTasks` round-trips an allowlist and erases
   any key not on it; until that allowlist carries `driverSid`, a reader that prefers
   `driverSid` reads nothing. So the order is fixed: (a) supervisor accepts, carries and
   writes both; (b) every reader takes `driverSid ?? operatorSid`; (c) every other
   writer writes both; (d) the relay serves both over `/api/feed`; (e) propflowai reads
   the new key with fallback. No step may land before the one above it.
3. **Retirement is a COUNT, not a date.** The old key stops being written when
   `grep -L driverSid ~/.claude/jobs/tasks/*/task.json` prints nothing and the
   agent-smith and propflowai deploys that read `driverSid` are live. The fallbacks
   are deleted one release after that. Written as a command for the same reason §5.4
   was: a retirement condition nobody can execute is a fact somebody has to remember.
4. **Binaries move by FORWARDER, not by rename.** `start-driver`, `driver-here` and
   `driver-workflow` are the files; the old names `exec` them and log one
   `DEPRECATED-NAME` line per call. A forwarder is deleted when its log has been empty
   for 14 days after the last known caller merged. The second copy of `operator-here`
   in `~/.claude/scripts/` collapses into a forwarder in the same PR.
5. **The `op-` tmux prefix and the `op-task-` workflow-id prefix stay.** Neither can
   carry two names at once, and both are namespaces a running process keys on. They
   are documented as the Supervisor's namespace, not as an abbreviation of a role.
6. **§5's retirement condition is MET.** On 2026-09-13 the query returned
   `OperatorTaskWorkflow = 0`, `DriverTaskWorkflow = 0`, `DriverWorkflow = 1` running.
   The alias registrations in `worker.py` and the `WorkflowType IN (…)` queries retire
   now, as §5.4 licensed.
7. **Open, and blocking step (e):** propflowai PR #7545 ruled `fleet-operator-sense`
   → "fleet engineer / fleet agent", and its protect-list gates the fleet-sense
   identifiers on that ruling. Whether "Driver" is the specific role beneath the
   generic "fleet agent", or #7545 is superseded for the harness role, is Gera's to
   say. Until it is said, `operatorSid` in propflowai keeps its name and its baseline.

### Inventory of the surface that states the old shape (ADR-0004 §2)

| Surface | State |
|---|---|
| ADR-0021 decision 4 — the "on purpose" list | Amended: the list is now the *shim* list, each with its retirement count. |
| ADR-0021 Consequences, last bullet ("after the Sunday deadline") | Superseded by decision 3 above — a count, not a date. |
| `CLAUDE.md` (agentflow) vocabulary banner | Edit with 3a: names the dual-key window. |
| `SYSTEMS.md` — `operator-heartbeat`, `start-operator` mentions | Edit with 2e / 2a respectively, in the same PR as the file. |
| `canon/operator-SKILL.md` §top ("what still says operator on purpose") | Rewritten as part of the 2c inversion. |
| propflowai `protect-list.json` fleet-sense group | Untouched until decision 7 is answered. |

What was run, so the page is not a reading

• loop-keeplist --role with CLAUDE_CODE_SESSION_ID set to the live driver sid → operator; to a bogus sid → undetermined. The instrument is not uniform.
• fleet-grader --json → the DRIVER row names sess-propflow-ef(9fa34932 3m), read from operatorSid.
• roster → the task joins on workerSid first (roster:169), so the driver 9fa34932 renders as UNREGISTERED while its worker 1fdb267c carries the task. A display defect worth its own small fix; not a rename question.
• temporal workflow count ×3 with SMITH_TEMPORAL_* from propflowai/.env.local → 0 / 0 / 1 (above).
• tmux ls → op-sess-propflow-ef, op-red-main-6dd6dff06 live under the op- namespace.
• cmp ~/.claude/scripts/operator-here ~/.local/bin/operator-here → identical.
• Found on the way: tests/keeplist-says-driver-not-operator.py case 6 is red on local-bin origin/main today — it asserts the substring "do not assume driver" and the live line now reads "do not assume architect coordinator, driver, watched session, worker". A one-line test fix, not a rename question; noted in local-bin#186.
• Not run: the red-main claim readers (no incident open today), the relay → propflowai feed (deployed elsewhere), phase_table.py (runs inside Temporal). Marked "source" above, never "confirmed".

Method note. A grep proves absence only of the spelling searched, so every repo was searched for operator, Operator, OPERATOR, \bop- and opSid. Two things the classifier would have got wrong and were checked by hand: the supervisor's "no operator and mint cap reached" line is parsed by fleet-grader._supervisor_says — but on mint|respawn|cap, not the word, so it is safe to reword; and ~/.claude/hooks/tests/test_context_budget.py mentions "only Operators loop" only in a docstring and a failure message, never in an assertion, so part 1 breaks no test.