@bongos/core 1.17.0

package/docs/adr/0087-compete-on-governance-not-tooling-cursor.md

@@ -0,0 +1,65 @@
+# ADR 0087 — Compete with Cursor on governance, not tooling
+
+**Status:** Accepted (2026-06-24) · task [#1505](https://example.com/builders#/task/1505) · **companion to** [ADR 0083](<redacted>.md) (modular-architecture strangler build plan); builds on [ADR 0016](<redacted>.md) (server-enforced trust boundary), [ADR 0043](<redacted>.md) (rank floor on permission paths), [ADR 0061](<redacted>.md) (context-layer decomposition), [ADR 0081](<redacted>.md) (tool-agnostic design layer), [ADR 0024](<redacted>.md) (MAS). **Red-teams** [`docs/design/modular-architecture/`](../design/modular-architecture/).
+
+## Context
+
+Cursor (Anysphere) is Cloud Bongos's primary competitor. The owner's strategic frame: *"We are moving from collaboration into tooling; Cursor is moving from tooling into collaboration. They have a ~$60B headstart."* This ADR records the decisions that came out of a competitive analysis of Cursor's public domain (a 17-agent research workflow — 7 angles, ~250 web fetches, key claims adversarially re-verified against primary sources) run against our modular-architecture design.
+
+**Verified competitor facts (2026-06-24 — fast-moving; re-verify before quoting):**
+
+- **$60B is an acquisition price, not a valuation.** SpaceX agreed to acquire Anysphere all-stock at **$60B**, announced **2026-06-16**, pending a Q3-2026 close, folding Cursor under the xAI umbrella. It superseded a ~$50B April-2026 private round.
+- **Scale:** ~$2–4B ARR, ~50,000 enterprise teams, ~64–67% of the Fortune 500, 1M+ daily users.
+- **Their real moat is the usage-data → RL flywheel**, *not* model access (which is commoditized — analysts quote "burning $1 to make 90¢"; Anthropic throttled Cursor's Claude access in June 2025). Composer is RL-post-trained on their own users' coding trajectories atop an open base (Kimi K2.5); they are now training a from-scratch model on SpaceX/xAI compute. Plus enterprise switching costs.
+- **They explicitly framed their own trajectory** as "from individual tool to org-wide platform" (Oct 2025) and shipped the collaboration layer: Organizations, Team Rules, Slack/GitHub/Linear-triggered agents, Bugbot-in-the-PR-loop, SOC2/SSO/SCIM/RBAC/audit/CMEK.
+
+**The design under review** ([`docs/design/modular-architecture/`](../design/modular-architecture/), now built as ADR 0083) is sound engineering. But it frames **"scope the agent to a module" as the AI-quality *centerpiece*** ([00 §6](../design/modular-architecture/00-research-report.md)). Cursor ran the opposite experiment and has the data: learned, agent-driven retrieval over the *whole* indexed repo (custom embeddings + Merkle sync + chained semantic/grep) measured **+12.5% answer accuracy vs grep alone**, larger on 1,000+ file repos — and their guidance tells users *not* to pin context manually unless they already know what's relevant. That contradicts the design's framing and forces a correction.
+
+## Decision
+
+### 1. Module-affinity is a *boundary*, not a context-quality lever
+
+Module scope answers **where a task's code may land** (ship-time diff⊆module + per-claim worktree). Retrieval answers **what the agent sees**. They are different axes and they *compose* — not compete.
+
+- Treat the module as the agent's **default starting context, not a wall.** Adopt Cursor-style agentic retrieval *within and across* it (chain grep + `/recall` + the generated repo-map). This is consistent with our own [03-builder-flows.md](../design/modular-architecture/03-builder-flows.md): read-access is unwalled; only the *ship-time diff* is enforced.
+- **Amends the design docs:** module-affinity is retained as an integrity/confidentiality boundary; its "centerpiece / smaller-context-is-higher-quality" framing is withdrawn.
+
+### 2. Compete on governance, not tooling
+
+Do **not** chase parity on the axes where Cursor is structurally ahead — editing UX (Tab, Fast Apply), model quality (Composer), distribution, scale, or capital. **Concede all of them.** Trying to out-tool a $60B incumbent on a $5k budget is the wrong axis of effort.
+
+Compete where the **platform-native design is structurally ahead and Cursor is *retrofitting* onto client-trust**:
+
+- the **server-enforced rank ladder** (ADR 0016) — authority lives in the DB, re-checked per request; local edits grant zero authority;
+- the **immutable GDS ledger** (every claim → grade → ship is a permanent, attributable record);
+- **per-claim worktree isolation** (treat it as a *trust-boundary control*, not just a parallelism mechanism);
+- **accumulated org memory** (learnings, BFG, per-builder memory/karma).
+
+Modularity itself is **not** a moat — it is commodity hygiene (VS Code, Backstage, Fastify all do it). The **trust + governance substrate is the hard-to-copy asset.** When pitching the self-hostable Cloud Bongos product, lead with *"the audit trail, rank governance, and org memory are yours and hard to leave"* — not the AI features, which any competitor can match.
+
+### 3. Harden the trust boundary against Cursor's CVE classes — during the reorg
+
+Cursor's 2025 RCE record is the canonical failure mode of putting enforcement on a client the agent controls — CurXecute (CVE-2025-54135, RCE via the agent *creating* `.cursor/mcp.json` because creation wasn't gated like editing), MCPoison (CVE-2025-54136, swapping an already-approved command), a case-sensitivity bypass (CVE-2025-59944), a `.cursorignore` bypass (CVE-2025-64110), and the invisible-Unicode "Rules File Backdoor." Our architecture is designed against this (the DB is king; CLAUDE.md is descriptive-only), but the specific bypasses are subtle. Pre-empt the equivalents:
+
+- **Gate file *creation* as strictly as edits** on the permission core, `migrations/`, `infra/`, `.github/workflows/`, `settings.json`, and hook files (a not-yet-existing protected file must not be a creation loophole).
+- **Path matching must be case-insensitive AND Unicode-normalized** so a `settings.JSON` or a homoglyph can't slip past the protected-path glob.
+- **A fitness check** asserting no agent-authored diff touches a permission-core file without a recorded Gate approval (extends the post-push main-audit, ADR 0043).
+
+Bake these into the **loader + `fitness.js`** while ADR 0083 Phase 0–1 is already touching them — cheapest possible moment, and it defends the one real moat.
+
+## Alternatives considered
+
+- **Out-tool Cursor (chase editing/model/scale parity).** Rejected — we lose on every one of those axes and it spends scarce effort where the headstart is largest.
+- **Keep module-scoping as the AI-quality mechanism.** Rejected on Cursor's A/B evidence; retained as a *boundary* only, with retrieval layered on top.
+- **Defer CVE-hardening to a later security pass.** Rejected — it is cheapest to fold into the reorg that is already rewiring the loader/fitness, and it protects the differentiator.
+
+## Consequences
+
+- ADR 0083's build plan proceeds unchanged; only the **framing** of module-scoping in the design docs is amended (boundary, not quality lever).
+- **Follow-on work (cheap-first), to be filed as tasks under BONGOS-V1:** (a) agentic retrieval within the module default (grep + `/recall` + repo-map chaining); (b) the three trust-boundary hardenings above; (c) a four-way rule-attachment taxonomy (always / glob / agent-requested / manual) on nested module docs, kept as plain markdown (Cursor found *structured* nested rules silently break). Further candidates: a tiered autonomy dial (allowlist + sandbox + cheap-Haiku intent classifier), a pre-push grader review + best-of-N, and worktree-as-shadow-workspace in-turn validation.
+- **Strategic messaging** for the self-host/standalone product pivots to governance / audit / org-memory.
+- All competitor numbers are dated **2026-06-24**; Cursor ships weekly — treat ARR/valuation/release facts as perishable and re-verify before reuse.
+
+## Provenance
+
+17-agent workflow · 7 research angles (indexing/retrieval, agent capabilities, the teams/collaboration push, rules & context-scoping, security/trust, business & moat, engineering-blog lessons) · ~250 web fetches · riskiest claims adversarially re-verified against primary sources (cursor.com docs/blog, Turbopuffer, Bloomberg/CNBC/TechCrunch, GHSA advisories). The full dimension-by-dimension scorecard and the ranked "what to learn from Cursor" list live in the session log for this task.

package/docs/adr/0088-consistent-character-generative-animation.md

@@ -0,0 +1,169 @@
+# 0088 — Consistent-character generative animation (grade-and-audit, on the family pipeline)
+
+- **Status:** Accepted; **amended 2026-06-30** — generation mechanism revised **again** to **Veo image-to-video → keyed transparent sprite** (the owner rejected *both* the per-frame edit-the-hero redraw *and* the 2026-06-27 rig; see the 2026-06-30 Amendment at the end). The grade-and-audit philosophy and the **sprite + manifest output contract** still stand; the *generator* is now a video model, not the family/edit/rig path. (Prior amendment 2026-06-27: edit-the-hero + reference-kit + surgical loop + rigged motion — now itself superseded as the mechanism.)
+- **Date:** 2026-06-26
+- **Deciders:** Lars (Archon), Claude
+
+**Builds on:** [ADR 0008](<redacted>.md) (family-based multi-frame generation — the grader/loop we extend), [ADR 0083](<redacted>.md) (modular architecture — this ships as a module), [ADR 0062](<redacted>.md) / [ADR 0081](<redacted>.md) (neutral-contract adapter pattern — the pluggable generator backend), [ADR 0024](<redacted>.md) (grade-before-ship pattern).
+
+**Track:** `internal` (a Cloud Bongos platform capability — the art pipeline).
+
+---
+
+## Context
+
+We need **animation**: many frames of the *same* character in *different* poses, frame-to-frame consistent. Building the Bongo Buddha mascot widget ([#1523](https://example.com/builders#/task/1523)) we hit the wall that defines this ADR — **generative image models drift between independent generations.** Concretely observed this session:
+
+- **Identity/proportion drift** between frames.
+- **Anatomy failures** — a frame with *four hands* when asked to raise both arms.
+- **Spurious auras/rings** the model adds despite "no glow," which the matte keeps.
+- **Size + framing variance** — the same pose drawn at different scales / zoom.
+- **Sparse motion** — a still-image model packs "12 frames" into one sheet as ~6 distinct poses then near-duplicates; it does not understand motion.
+
+External practice confirms the cause: plain reference-prompting (what closed Gemini offers) **biases attention but does not lock identity, so it drifts after a few shots**. The gold standard for a recurring character is a trained **LoRA** (85–95% feature retention), but that requires GPU training and an **open** model — not closed Gemini. Automated consistency is a measurable thing (subject embedding similarity, vision-judge, geometric checks).
+
+Two empirical wins this session shaped the decision: (1) a **recursive "draw the frame halfway between these two" inbetween** request *does* produce a coherent intermediate pose with Gemini; (2) **the platform already has the right machinery** — the family pipeline.
+
+**The key finding:** the existing **family pipeline** ([ADR 0008](<redacted>.md); `art/pipeline/family_*.py` + `art/template/families.json`) is already a consistent-character, multi-frame **grade-and-audit loop**. `family_orchestrator.run_family()` generates N frames of one individual in a single sheet, slices them, runs **cross-frame deterministic coherence** (`family_checks.run_all` — silhouette area/height variance = "same size", palette/luminance coherence = "same look"), then a **Gemini family review** that already scores a **`character_identity`** criterion ("do ALL frames depict the SAME individual?"), and **loops with `t5_anchor_refine`** which re-feeds the strongest prior cell as a locked anchor. Walk cycles (`player_walk`, 6 frames) and a peck cycle (`chickens`) already ship through it. It is tuned for **32×32 pixel-art tiles** (palette-snap, fixed size) — not our full-res painterly mascot — but the *architecture, loop, cost-ledger, regression-guard, and Gemini-review flow* are exactly what we need.
+
+The owner's directive (2026-06-26): **don't reinvent the loop — use existing infrastructure and flows; keep the per-frame grader criteria proposed below.** And build it **correctly, as a reusable Cloud Bongos module**, since consistent generative animation is a general platform capability, not a one-off.
+
+---
+
+## Decision
+
+**Produce frame-consistent character animation with a `generate → grade → audit → regenerate` loop, implemented by *extending the existing family pipeline* (not building a new grader or loop), with a *pluggable* generator backend. Ship it as a Cloud Bongos module. Use Gemini now; the durable asset is the grader/audit, which is backend-agnostic.**
+
+### 1. Approach: Gemini + grade-and-audit, pluggable backend (option A)
+
+Closed Gemini caps raw consistency at "reference-conditioning" (it drifts). We compensate with the **grader/audit loop**: every candidate frame is scored against the character's model sheet, and failures are regenerated with the failure fed back as a fix-hint, escalating only when stuck. The **generator backend is an adapter** (the [ADR 0062](<redacted>.md)/[0081](<redacted>.md) neutral-contract pattern): Gemini today; a future **LoRA-on-open-model** ("level 2") or an **image-to-video** model can slot in *without touching the grader*. LoRA is explicitly **deferred**, not chosen — it needs training infra and an open model; we adopt it only if the Gemini pass-rate proves too low.
+
+### 2. Reuse the family pipeline as the grader + loop
+
+The grade-and-audit loop **is** `family_orchestrator.run_family()`. We reuse, verbatim where possible: the attempt loop, `t5_anchor_refine` (lock-the-character-and-re-pose), `family_checks.run_all` (deterministic gate before spending a Gemini call), `family_review.review_family` (the vision grader, including `character_identity`), `cost_ledger` gating, and `regression_detector` (don't overwrite a better existing frame). Animation frames are **family members**.
+
+### 3. A painterly `character_anim` family kind
+
+Add a new family `kind` (and `slice_strategy`) for **full-res painterly characters**, configured in `families.json` like any other family. It **drops the pixel-art-specific deterministic checks** (palette-snap to `palette.json`, 32×32 size, anti-grid) which do not apply to painterly art, and **keeps** the size-coherence check (`silhouette_area`/`silhouette_height` variance). Identity, for now, leans on the existing **`character_identity` vision criterion** + perceptual-hash/anchor similarity (`regression_detector` pHash/dHash) + palette/luminance coherence — **no new heavy ML dependency** (the pipeline deliberately avoids even `imagehash`). A learned **embedding** identity scorer (DINOv2/CLIP) is captured as an optional future enhancement, not core.
+
+### 4. Close the genuine gaps: pose-match + transition coherence
+
+The existing family checks enforce **sameness** (low variance across the set) and are **order-agnostic** — they would pass a *shuffled* animation. Animation needs the opposite-but-complementary checks:
+
+- **`pose_match`** (vision criterion) — does each frame match its *intended* pose? (controlled difference)
+- **transition coherence** (deterministic, order-aware) — is frame *N+1* a plausible small step from frame *N*? (neighbor-delta within a band → catches both jumps *and* dead/duplicate frames)
+
+These are the only genuinely new grader criteria; everything else is reuse.
+
+### 5. A recursive inbetween layer (for smoothness)
+
+A single sheet reliably yields only ~4–6 *distinct* keyframes. Animation wants ~12–24 drawings (anime/ATLA convention: "on twos" ≈ 12/sec, "on ones" ≈ 24/sec). So: the family pipeline produces the consistent **keyframes**; a new **inbetween step** generates the frames between them by feeding two adjacent (approved) frames and asking Gemini for the midpoint, **recursively halving** to any target count. Each generated inbetween is graded by the same per-frame criteria; failures regenerate. (If/when a video/interpolation backend is plugged in per §1, it replaces this step behind the same contract.)
+
+### 6. Painterly cutout + registration post-process
+
+A non-pixel-art post-process: background removal (`rembg`) + warm-fringe despill + magenta/halo cleanup + **registration** (scale to a locked body size, align the seat/anchor) so frames composite over the separately-rendered glow/cloud and never change size. This is distinct from the tile `post_process.process` (which palette-snaps + downscales) and was prototyped this session.
+
+### 7. Package as a Cloud Bongos module
+
+Per [ADR 0083](<redacted>.md) + [`docs/modules-contract.md`](../modules-contract.md). **Contract — input:** a character *model sheet* (canonical reference image(s) + identity prose + style + size/anchor spec + per-criterion tolerances) + an *action spec* (key poses + frame budget + fps). **Output:** a graded, consistent, registered frame set + a manifest (frame order, fps, anchors). The rubric/tolerances and the generator backend are **config-driven** so any instance can animate its own characters.
+
+### 8. The grader criteria (owner-approved)
+
+Per frame, scored within the reused grader machinery (reusing the existing `pass / retry / escalate_tier` + `fix_hint` verdict shape):
+
+| Criterion | Mechanism | Status |
+|---|---|---|
+| Same character | `character_identity` (vision) + pHash/dHash + palette/luminance coherence | **reuse** |
+| Correct anatomy (exactly 2 hands, no malformations) | vision judge | new criterion (reuse machinery) |
+| Right size + framing | `silhouette_area`/`silhouette_height` variance + registration | **reuse** |
+| Clean (no aura/ring/bg-bleed) | alpha/halo analysis + vision | new deterministic + vision |
+| Matches intended pose | vision judge (`pose_match`) | **new** |
+| No flicker / smooth transition | order-aware neighbor-delta | **new** |
+
+---
+
+## Consequences
+
+- **Minimal net-new code.** The loop, cost-ledger, anchor-refine, regression-guard, and the `character_identity` grader already exist. Net-new ≈ a painterly family kind, two criteria (`pose_match` + transition), the inbetween layer, and the painterly post-process.
+- **Cheap.** Gemini image gen ≈ $0.04/frame; a full action ≈ <$1 even with retries.
+- **Pluggable + reusable.** The grader is the durable asset; backends swap behind a contract; any Cloud Bongos instance can animate its characters.
+- **Accepted limitation.** Gemini drift means some frames take multiple attempts (cost/time); the audit loop is what makes that acceptable. If the pass-rate is too low, escalate to the deferred LoRA "level 2."
+- **Two deterministic-check sets** to maintain (pixel-art vs painterly) — contained behind the family `kind` dispatch.
+- **No blocking.** The widget ([#1523](https://example.com/builders#/task/1523)) interactions (tickle, scruff-pickup, drop, whale-catch) ship now with the static poses; smooth animation swaps in per-action as this module delivers.
+
+## Alternatives considered
+
+- **Per-character LoRA on an open model (B).** Gold-standard consistency, but GPU training infra + off-Gemini. **Deferred** as "level 2" behind the pluggable backend.
+- **Build a new grader + loop.** Rejected — the family pipeline already does it; reuse per the owner's directive.
+- **Image-to-video / interpolation model for motion.** Orthogonal and promising; slots in later as a generator backend replacing the inbetween layer (§5) behind the same contract.
+- **One dense sprite sheet for all frames.** Rejected — empirically caps at ~6 distinct frames then degenerates to near-duplicates (a still model has no motion model).
+
+---
+
+## Implementation — the engineering epic
+
+Created as GDS tasks under **BONGOS-V1**, in the **"Cloud Bongos animation module" goal** (goal [#9](https://example.com/builders#/task/9), scope `art-pipeline`) — the platform-version home for this module. Task IDs: 1 = [#1548](https://example.com/builders#/task/1548) (this ADR/scope), 2 = [#1549](https://example.com/builders#/task/1549), 3 = [#1550](https://example.com/builders#/task/1550), 4 = [#1552](https://example.com/builders#/task/1552), 5 = [#1553](https://example.com/builders#/task/1553), 6 = [#1555](https://example.com/builders#/task/1555), 7 = [#1554](https://example.com/builders#/task/1554), 8 = [#1556](https://example.com/builders#/task/1556), 9 = [#1558](https://example.com/builders#/task/1558), 10 = [#1559](https://example.com/builders#/task/1559), 11 = [#1557](https://example.com/builders#/task/1557), 12 = [#1551](https://example.com/builders#/task/1551). Dependencies in parentheses:
+
+1. **(this ADR)** decision + scope — `0088`.
+2. **Painterly cutout/register post-process** — `rembg` + despill + halo-zap + registration; the non-tile cutout path (productionize this session's prototype).
+3. **`character_anim` family kind** — `slice_strategy` + `families.json` config + `family_loader`; painterly (no palette-snap/32×32).
+4. **Painterly cross-frame deterministic checks** — adapt `family_checks.run_all` for the new kind: reuse silhouette-size coherence; add clean-edge/halo; pHash/anchor identity *(dep 3)*.
+5. **Character vision criteria** — extend `family_review._criteria_for`: reuse `character_identity`; add `anatomy_correct` + `pose_match` *(dep 3)*.
+6. **Pose-match + transition coherence** — order-aware neighbor-delta deterministic check + the `pose_match` criterion (the genuine gap) *(dep 4, 5)*.
+7. **Recursive inbetween layer** — keyframes → recursive Gemini midpoints to target count; each graded by the per-frame checks *(dep 2, 3)*.
+8. **Sequence assembly + manifest** — order, fps (on twos/ones), anchors → sprite set + manifest *(dep 7)*.
+9. **Package as a Cloud Bongos module** — manifest/seam per [ADR 0083](<redacted>.md); config-driven rubric + pluggable backend *(dep 4, 5, 6, 8)*.
+10. **First consumer: Bongo Buddha — 8 actions** — produce idle/laugh/yawn/sleep/kick/docile/reach/fall via the module; finish widget [#1523](https://example.com/builders#/task/1523) *(dep 9)*.
+11. **`character-review` skill** — human wrapper over `run_family` for the painterly path (sibling to `otb-design-review`) *(dep 5)*.
+12. **(future / spike)** learned-embedding identity scorer (DINOv2/CLIP) — "level 2" if vision-identity + pHash prove insufficient.
+
+---
+
+## Amendment — generation strategy: reference-kit + edit-the-hero + surgical loop + rigged motion (2026-06-27)
+
+- **Date:** 2026-06-27 · **Deciders:** Lars (Archon), Claude · **Tasks:** [#1559](https://example.com/builders#/task/1559) (acceptance trial) + [#1622](https://example.com/builders#/task/1622)–[#1626](https://example.com/builders#/task/1626) (this fix). Supersedes the §3/§6 *generation* mechanism only; the grade-and-audit loop, the family pipeline, and the criteria (§4/§8) stand.
+
+**What we hit.** Per-frame painterly generation (task [#1616](https://example.com/builders#/task/1616)) fixed the *structural* problem (still-image models ignore an N×M sheet grid — learning `#102`) but the live Bongo Buddha idle still **drifted** frame-to-frame (vision grader `character_identity=2`, `pose_match=1`); the owner rejected it. **Root cause:** each keyframe was drawn *independently from one reference*. A reference biases attention but does **not lock** identity, so every fresh draw reinterprets the character. (HANDOFF: [`docs/handoffs/character-anim-1559/HANDOFF.md`](../handoffs/character-anim-1559/HANDOFF.md).)
+
+**The strategy evolution:** single sheet → per-frame → **edit-the-hero from a locked reference kit**, with motion split off to a rig.
+
+1. **Reference kit + a locked hero (the closed-model substitute for a trained character model).** A small, locked model sheet — `brand/cloud-bongos/assets/mascot/kit/` (`kit.json` + hero + component crops) built deterministically by `kit_build.py`. Everything downstream conditions on it. (Owner-approved layer model: the animated frames are **figure + bongos only**; the cloud and the golden glow are **separate static composited layers**, not in the frames.)
+2. **Edit-the-hero generation.** nano-banana (`gemini-2.5-flash-image`) is fundamentally an **edit** model: editing the locked hero's *pixels* preserves identity far better than redraw-from-reference. Each keyframe is an EDIT of the hero into the target pose, **multi-shot** conditioned on the kit (hero first = edit base; face + bongos crops = detail refs) + the nearest approved neighbour. `family_generator.build_frame_prompt` emits EDIT framing (lock identity / change only pose+expression) using the kit's identity prose. **Result: `character_identity` 2 → 9–10.**
+3. **Surgical per-frame loop + chaining.** `run_family_painterly` keeps the frames that pass and regenerates **only** the failures, feeding each the grader's **per-frame** complaint (`family_review` now returns `per_frame`); frames chain from the nearest *approved* neighbour so drift can't accumulate; a **plateau early-stop** halts a systemic miss instead of burning attempts.
+4. **Per-action edit-base (`kit_hero`).** Identity-lock is so strong that editing the *grinning* hero keeps the grin — `pose_match` stayed low because the idle's calm closed-eye expression never appeared. Fix: a **calm-faced hero** (`gen_idle_hero.py`, one edit) that the idle family selects via a `kit_hero` override; action families keep the grinning hero. **Result: expression fixed, total 8.0.**
+5. **Rigged motion for subtle/repetitive actions (the new fallback, replacing "level 2 = LoRA" as the *first* fallback).** Generative editing locks identity + expression but **cannot calibrate subtle, repetitive idle motion** (the grader read taps as either a dead frame or a "wave"). A **2D puppet rig** (`puppet_rig.py`) animates *one approved hero* by geometric transforms (breath squash/stretch + alternating hand-tap layer moves) — identity perfect by construction, clears the deterministic gate 8/8, **zero per-frame model spend**. **Decision: generative for identity + expression (and expressive one-shots like laugh/fall); rig for simple repetitive motion (idle breathe/tap).** Per action, pick generative vs rigged.
+
+**Consequences / guidance.**
+- The durable asset is still the grader/audit; the *generator* is now "edit the locked hero," and **motion may be rigged rather than generated** for simple cycles.
+- **Spend:** identity+expression cost ~$1.64 across the idle trials; the rig is free per frame. Every live run is owner-approved per round (≈$0.04/frame).
+- **Known check limitation (learning):** `transition_no_dead` via coarse dHash can't see sub-perceptual motion (real in pixels, invisible to the hash) — rig amplitudes are tuned above that floor; a pixel-MAD motion signal is a candidate improvement.
+- **Open:** the LoRA "level 2" (§"Alternatives") remains the deferred path *only if* identity ever proves insufficient — edit-the-hero made it unnecessary for now. Remaining [#1559](https://example.com/builders#/task/1559) scope (widget wiring + the other 7 actions, applying generative-or-rig per action) is released to `ready`.
+
+---
+
+## Amendment — generation mechanism: Veo image-to-video → keyed transparent sprite (2026-06-30)
+
+- **Date:** 2026-06-30 · **Deciders:** Lars (Archon), Claude · **Task:** [#1559](https://example.com/builders#/task/1559). Supersedes the *generation mechanism* of both the original (§3/§6, per-frame) and the 2026-06-27 amendment (edit-the-hero + rig). **What still stands:** the grade-and-audit philosophy, and the **registered sprite + `manifest.json` output contract** a consumer plays (§7) — unchanged; the widget doesn't care how the frames were made.
+
+**What we hit (the owner rejected both prior mechanisms on sight).**
+- **The 2026-06-27 rig** — "the bongos play themselves" (a translated region dragged the drums with the hand) and "the buddha squeezes in and out" (whole-image vertical scale). A rig distorts one flat image; it cannot pose a hand or hold the drums still.
+- **Per-frame edit-the-hero** — identity held (9–10), but in motion the **outline and ears boil** frame-to-frame, because every frame is still an *independent redraw*. A still-image model cannot hold an exact silhouette across frames.
+
+**The insight.** A **video model maintains temporal consistency for free** — the one thing neither a rig nor per-frame redraw can give. So use video as the **motion source**, then convert its frames into a transparent sprite we own (which restores interactivity + lets every action share one background).
+
+**The method (committed: [`brand/cloud-bongos/anim/`](../../brand/cloud-bongos/anim/README.md)).**
+1. **Shoot on a PLAIN background** (`shoot.py`) — a flat-grey "green screen" seed from the locked hero → **Veo 3** (`veo-3.0-generate-001`) image-to-video. Veo bakes its background into the clip, so shooting figure-only is what lets rembg key cleanly **and** what keeps all 8 actions on one consistent (our) background. ~$3/clip on the owner's Gemini key.
+2. **Spritify** (`spritify.py`) — decode → **auto-detect the zoom-free stretch** → pick the latest clean loop → **rembg** key each frame → align on **one union crop** → webp sprite + `manifest.json`.
+3. **Build the widget** (`build_widget.py`) — composite the transparent sprite on **our** cloud + golden glow; drag / scrub / poke / play. Seed of the full interactive widget ([#1523](https://example.com/builders#/task/1523)).
+
+**Gotchas (each cost real iteration on the idle — captured as a learning).**
+- **Veo dollies in** even when told "static camera" → `spritify` auto-trims the zoomed tail by watching the figure's head-to-base height (the zoom was a *sampling* problem, not a registration one).
+- **Use the whole stable stretch, not the first cycle** — the second hand only acts later in the clip, so a short loop reads as "one hand."
+- **Align on ONE fixed crop, never per-frame** — a raised hand fools per-frame centering and slides the body; the body is static, only the hands move.
+- **Veo under-animates calm prompts** → prompt for energetic, clearly two-handed motion; re-roll (~$3) if thin. **This is the method's main cost/reliability tax.**
+- **Motion blur** on fast hands is baked into Veo frames — sharpened, not fully removable (the one cosmetic compromise).
+
+**Consequences.**
+- The durable asset is the **keyed sprite + manifest** (contract unchanged); the *generator* is now a video model. The family painterly generator + the puppet rig stay in the repo but are **off the mascot path**.
+- **Spend:** ~$3/action (Veo) + free keying; the idle proof ran **~$6.31** total (2 Veo clips + early image trials).
+- **idle delivered** ([`brand/cloud-bongos/assets/anim/idle/`](../../brand/cloud-bongos/assets/anim/idle/)); blocker [#51](https://example.com/builders#/blocker/51) cleared (spend approved, mascot reviewed, path built). The other 7 actions + the full interactive widget are the follow-up.

package/docs/adr/0089-modular-multi-model-adversarial-grader.md

@@ -0,0 +1,179 @@
+# 0089 — Modular, multi-model adversarial grader (open-weight ensemble)
+
+- **Status:** Accepted (direction decided with the owner 2026-06-26; build is task-pending — see Implementation)
+- **Date:** 2026-06-26
+- **Deciders:** Lars (Archon), Claude
+
+**Builds on:** [ADR 0024](<redacted>.md) (the MAS grader — the worker-panel we extend), [ADR 0083](<redacted>.md) (modular architecture — graders register through the module seam), [ADR 0081](<redacted>.md) (one grader parameterized by work-type), [ADR 0088](<redacted>.md) (the first module-owned specialized grader — the `character_anim` family review), [ADR 0062](<redacted>.md) (neutral-contract adapter pattern — applied here to the *model provider*), [ADR 0016](<redacted>.md) / [ADR 0043](<redacted>.md) (server-enforced trust boundary the gate must not weaken), [ADR 0080](<redacted>.md) (an external model result that gates a ship is a content-injection surface).
+
+**Track:** `internal` (a Cloud Bongos platform capability — the build pipeline's quality gate).
+
+---
+
+## Context
+
+Every shipped task passes a **grader** before it lands: the MAS worker-panel ([ADR 0024](<redacted>.md)) for code (`src/bongos/grader.js` + `src/bongos/grader-workers/`), the Gemini vision review for pixel-art ([ADR 0008](<redacted>.md); `art/pipeline/family_review.py`), and now a module-specific review for animation ([ADR 0088](<redacted>.md)). The gate works and is the backbone of letting AI agents ship unattended. But four limits are now in the way:
+
+1. **The grader is single-vendor.** Both the code panel and the vision review run on a model from the same lab that *built* the work (Claude grades Claude; Gemini grades Gemini-generated art). Today's only mitigation is *cross-family within Anthropic* — Opus author → Sonnet grader (`selectGraderModel`, `src/bongos/grader.js`). The research below shows that an author and a judge from the **same family share correlated blind spots** and the judge **inflates its own family's work by 10–25%**. An independent reviewer from a *different* lineage is the single highest-leverage quality lever we have.
+
+2. **All grading spend rides the Claude bill.** Every worker in the panel is an Opus/Sonnet call. Grading is *additive* to the build spend (the builder already paid Claude to write the code; we pay Claude again to grade it). On a bootstrapped <$5K/yr budget that doubling is real, and it's the wrong place to spend — review is a verification task a cheaper independent model can do well.
+
+3. **There is no clean way for a module to own its grader.** [ADR 0088](<redacted>.md) added an animation grader by *extending the art pipeline in place*; the DINOv2 identity scorer is wired as a Python-only `families.json` flag. Each new work-type bolts its grader on by hand. [ADR 0081](<redacted>.md) already called for "one grader parameterized by type," and [ADR 0083](<redacted>.md) gives us the mechanism (the module seam) — but nothing yet routes grading through it. The owner asked the right question directly: *should a work-type's grader live in that module, or in a general grader module?*
+
+4. **The grader is hard-wired to two work-types (code, vision).** A third (`ui`, [ADR 0081](<redacted>.md)) and a fourth (animation, [ADR 0088](<redacted>.md)) are arriving. A new module (say, audio, or 3D) has no path to grading at all.
+
+### What the research says (mid-2026)
+
+A thorough literature + market sweep this session (sources at the foot of this ADR) produced findings that shape every decision below:
+
+- **Self-preference is real and large.** GPT-4 inflates its own win rate ~10%, Claude-v1 ~25%; the effect is causally tied to a model *recognizing its own outputs* (Zheng 2023; Panickssery 2024). **Use a judge from a different family than the author** — the core argument for open-weight adversaries.
+- **A small diverse jury beats one big judge, and is cheaper** (PoLL, Verga 2024: 3 small judges, >7× cheaper, higher human-correlation than a single GPT-4). **But** the 2026 counter-finding matters: *"Nine Judges, Two Effective Votes"* shows panels buy far less independence than their size implies (9 judges ≈ 2 effective votes; returns saturate by ~5), and **family-diversity alone does not guarantee uncorrelated errors** — you must *audit* error-correlation, and aggregation cannot rescue a correlated panel. So: **a small (2–3), deliberately heterogeneous panel, audited for low error-correlation — not a big one.**
+- **Aggregating heterogeneous judges needs normalization.** Naively averaging judges on different scales lets a harsh or score-compressed judge silently dominate; **z-score or rank-normalize before combining**, and prefer median / reliability-weighting over naive mean (LLMs-as-Judges survey 2024).
+- **Adversarial "find the flaw" framing beats holistic scoring.** Judges prompted to *refute* (and debate setups) surface flaws a rubber-stamp misses (Khan 2024). Our existing default-fail worker prompts already lean this way — we keep and extend it.
+- **Binary pass/fail + a forced written critique beats 1–5 Likert.** Judges can't reliably tell a 3 from a 4; scores cluster at 6–7. Our panel already uses a 6.0 threshold + per-worker verdicts — consistent with best practice.
+- **Open-weight models are now genuinely good critics.** For code: DeepSeek V3.2/V4 (MIT), Qwen3-Coder (Apache-2.0), GLM-4.6/5 (MIT) score 70–80%+ on SWE-bench Verified; purpose-built judges (Atla Selene, Prometheus 2) are trained specifically for rubric scoring. For vision: Qwen2.5-VL / Qwen3-VL and InternVL3.5 (Apache/MIT) have native-resolution encoders (the key feature for reading small sprites) and rival closed VLMs on MMMU/OCRBench. *Caveat:* several headline 2026 numbers are vendor-reported; treat them as provisional and pin/evaluate the exact checkpoint we adopt.
+- **Hosting math is decisive.** A few-thousand-grades/month workload costs **~$1–5/mo** on a pay-per-call API (DeepInfra is consistently cheapest; e.g. Llama-class 70B ≈ $0.10/$0.32 per 1M tokens; DeepSeek/Qwen comparable, with near-free prompt-caching on the fixed rubric). Self-hosting a GPU is **~$200+/mo idle** and never breaks even at our volume. The grader prompt is mostly a *fixed rubric* sent every call — **cheap cached input crushes the bill.**
+- **Off-the-shelf frameworks exist but don't fit.** `promptfoo` is the closest (MIT, Node-native, built-in panel voting, vision, points at any open endpoint) — but it was acquired by OpenAI in March 2026, and we already have a sophisticated worker-panel grader of exactly this shape. We **extend our own**, borrowing `promptfoo`'s patterns, rather than adopt a vendor-owned framework against an AGPL/non-profit posture ([ADR 0065](<redacted>.md)).
+
+### Owner decisions (2026-06-26)
+
+Three forks were put to the owner; all three are settled and are the spine of this ADR:
+
+1. **Grader placement:** a **central grading engine** in core; **each module plugs in its own grader** (rubric + critic + evidence-gatherer) through the existing module seam. *Not* a full grader re-implemented per module.
+2. **Open-model role:** **ensemble vote** — Claude + one or two open-weight models from different families grade independently and their verdicts combine. *Not* replace-Claude, *not* cascade.
+3. **How to run it:** **hosted open-model API** (pay-per-call, e.g. DeepInfra or OpenRouter). *Not* self-hosted GPU, *not* free-tiers-only.
+
+---
+
+## Decision
+
+**Refactor the grader into a central, work-type-parameterized engine that runs an adversarial ensemble of judges drawn from different model families — Claude plus hosted open-weight models — where each module contributes the rubric, critic, and evidence-gatherer for its own work-type through the module seam. Verdicts from heterogeneous judges are normalized and aggregated with a median-plus-hard-veto policy; the panel is kept small and audited for error-independence; deterministic pre-passes remain the authoritative, zero-LLM security gate.**
+
+### 1. A central grading engine; module-contributed graders (placement — owner decision 1)
+
+The **engine lives in core** (`src/bongos/grader.js`, generalized). It owns the invariant loop, which is identical for every work-type:
+
+```
+select work-type grader  →  gather evidence  →  run deterministic pre-passes (zero-LLM, authoritative)
+   →  run the judge ensemble (each judge scores independently, adversarial posture)
+   →  normalize + aggregate verdicts  →  apply the gate (median + hard-veto)
+   →  persist grade + per-judge signals + cost  →  promote / fall-through
+```
+
+A **module contributes only the three things that are specific to its work-type**, registered through the seam (`api.seams.registerProvider`, [ADR 0083](<redacted>.md)):
+
+- a **rubric** — the named criteria + thresholds for this work-type (the data the art pipeline keeps in `rubric.json`, the code panel in `grader-rubric.json`);
+- an **evidence-gatherer** — what the judges see (a git diff for code; a rendered screenshot for `ui`; a sliced frame-set + model sheet for animation);
+- optional **specialized critics** — deterministic checks (palette-snap, transition-coherence, DINOv2 identity) or a custom LLM worker, when the generic rubric judge isn't enough.
+
+So the answer to the owner's question — *"under each module, or in a general grader module?"* — is **both, split by concern**: the **orchestration, ensemble, aggregation, gate, persistence, and security pre-passes are central** (write once, consistent everywhere); the **rubric + evidence + specialist critics are module-owned** (the part that genuinely differs). Enable the animation module → its `character_anim` grader is automatically available; disable it → the engine simply has one fewer registered work-type. This is exactly the seam [ADR 0088](<redacted>.md)'s grader and the DINOv2 scorer already want; we are formalizing it as `grader.workType.<key>` providers rather than hand-wiring.
+
+A **grader registry** in core resolves `task.kind` / `discipline` → the registered work-type grader (falling back to the code grader), mirroring the dispatch the art pipeline already does on family `kind`. There is no separate "general grader module" — the generic machinery *is* the core engine; modules register against it.
+
+### 2. An adversarial multi-model ensemble (owner decision 2)
+
+A grade runs a **small panel of independent judges from different model families**, each given the **same rubric and evidence** and an **adversarial "find what's wrong; default to fail if unsure" posture** (extending today's default-fail worker prompts). The panel composition is **config-driven per work-type**, with a default of:
+
+- **Claude** (the incumbent quality bar — kept, never the sole judge).
+- **One or two open-weight models from a *different lineage*** — e.g. for code, a DeepSeek (MIT) or Qwen3-Coder (Apache) judge; for vision, a Qwen-VL / InternVL judge independent of Gemini.
+
+Crucially (per the *"Nine Judges"* finding): **the panel is small (2–3 judges) and its members are chosen and *audited* to fail differently** — not maximally large, and not "different vendor" assumed-independent. We add an **error-correlation audit** (§5) so the panel composition is evidence-based, not faith-based.
+
+This generalizes the existing worker panel two ways: the four *lenses* (narc / quality / hacker / efficiency) become *rubric criteria* a judge scores, and the *judges* become a cross-family set. A judge may still be lens-specialized where it pays (e.g. keep a dedicated security worker), but the default is "N cross-family judges over one rubric."
+
+### 3. The model provider is an adapter; run open models via a hosted API (owner decision 3)
+
+Following the [ADR 0062](<redacted>.md)/[ADR 0081](<redacted>.md) neutral-contract pattern, **how a judge's model is called is an adapter behind a `ModelProvider` port**, not hard-coded. `selectGraderModel()` (today a Claude-only `if/else` in `src/bongos/grader.js`) is replaced by a small provider registry:
+
+- **`anthropic`** — the existing Claude path (Anthropic API).
+- **`openai-compatible`** — a single adapter that speaks the OpenAI chat-completions shape, which covers **DeepInfra, OpenRouter, Together, Fireworks, Groq, vLLM, and Ollama** by base-URL + key alone. This is the open-weight path.
+
+Default open-model transport: a **hosted pay-per-call API (DeepInfra or OpenRouter)** — no box to run, ~$1–5/mo at our volume (§Cost). The same adapter could point at a self-hosted endpoint later without code change, but self-hosting is explicitly *not* adopted now. **Model choice, provider, base-URL, and panel composition are instance config** (the [ADR 0062](<redacted>.md) host-owned pattern), so any Cloud Bongos instance picks its own judges; this also pre-positions for GDS-V4's per-builder model preferences ([idea #30](https://example.com/builders#/idea/30)).
+
+The open-model key is a new secret (BYOK, like the Gemini art key — [ADR 0073](<redacted>.md)). **Requires the owner's spend go-ahead** before any live call (CLAUDE.md §4).
+
+### 4. Aggregating heterogeneous judges: normalize, then median-plus-hard-veto
+
+Judges on different scales cannot be naively averaged (a harsh or score-compressed judge would silently dominate). The engine:
+
+1. **Normalizes** each judge's per-criterion scores before combining — **z-score or rank-normalize** against that judge's own observed distribution (research finding F42–F44).
+2. **Aggregates** with **median** of normalized scores (robust to one outlier judge) for the soft score, and a **hard veto** for safety-critical findings: *any* judge raising a critical/blocker finding fails the gate — preserving today's any-fail-vetoes behavior for the things that must never slip (security, completion). This keeps the gate *strict* (a single credible "this is broken" stops a ship) while making the *soft* score robust.
+3. **Position/order mitigations** are applied where a judge compares options (randomize criterion order; for any pairwise step, run both orders and average).
+
+The exact policy (veto thresholds, weights, whether to reliability-weight a judge down after it proves unreliable) is **config in the rubric**, so it tunes per work-type without code change.
+
+### 5. Error-correlation auditing (the panel must fail *differently*)
+
+Because aggregation cannot manufacture independence the panel doesn't have, we **measure it**. A periodic offline job (a new scheduled routine) replays a labeled set of past grades through each candidate judge and computes **pairwise error-correlation + per-judge Cohen's κ against the human/owner ground truth** (the confirm/reject decisions already in `grade_attempts` + owner overrides). Output: which judges add real independent signal, which are redundant, which are miscalibrated. **Panel composition is chosen from this evidence**, not assumed. This is the structural answer to *"Nine Judges, Two Effective Votes."*
+
+### 6. Deterministic pre-passes stay authoritative and zero-LLM (security)
+
+The two deterministic server-side guards — route-rank ([ADR 0016](<redacted>.md)) and permission-path ([ADR 0043](<redacted>.md)) — **remain exactly as they are**: zero-LLM, server-re-run on authoritative data, downgrade-only. **No LLM verdict — Claude or open — can ever upgrade a deterministic fail to pass.** The ensemble grades *quality*; the deterministic gate enforces the *trust boundary*. An external model's verdict that gates a ship is a content-injection surface ([ADR 0080](<redacted>.md)): so open-model verdicts are (a) advisory-plus-veto only, never sole authority over a protected path; (b) logged with model id + provider + raw response in `signals` for audit; (c) subject to the same server-side re-verification envelope as the Claude panel. For pixel-exact properties (palette, grid, dimensions) the **deterministic checks remain the authority** — VLMs are documented to misread fine detail; the vision judge is for aesthetic/semantic critique only ([ADR 0088](<redacted>.md) already draws this line).
+
+### 7. Reuse, don't rebuild
+
+The worker-contract (`buildPrompt` / `extractJson` / `computeVerdict`), the `runWorker` parallel runner, the `task_grades` + `grade_attempts` schema, the trivial-diff fast-path, and the server-side guard envelope are **kept**. This ADR generalizes their *inputs* (which model, which rubric, which evidence) — it does not throw them away. The content-addressed LLM cache ([ADR 0077](<redacted>.md)) applies unchanged and now memoizes open-model calls too.
+
+---
+
+## Consequences
+
+**Positive**
+
+- **Genuinely independent review.** A different-lineage judge removes the self-preference inflation (10–25%) that same-family grading can't — the owner's primary goal.
+- **Cheaper, better-placed spend.** Open judges at ~pennies/grade move verification off the Claude bill; caching the fixed rubric makes it nearly free. Net grading cost likely *drops* while robustness *rises*.
+- **A clean module story.** New work-types (audio, 3D, copy) register a rubric + evidence + critic and get the full ensemble gate for free. Animation/UI/DINOv2 stop being hand-wired special cases.
+- **Vendor-independent and portable.** The `ModelProvider` + per-instance config means no lock-in; any instance picks its own judges; aligns with the AGPL/non-profit posture.
+- **Evidence-based panel.** The error-correlation audit keeps the jury honest instead of assuming diversity.
+
+**Negative / risks**
+
+- **More moving parts.** A model registry, an aggregation layer, and a new provider are net new surface. Mitigated by reusing the existing panel machinery and shipping behind a flag.
+- **Open-model reliability + drift.** Hosted endpoints can rate-limit, deprecate a model, or change behavior; vendor benchmark numbers are provisional. Mitigated by: Claude always in the panel (a hard floor on quality), the error-correlation audit catching a judge that degrades, and graceful-degrade (an unreachable open judge drops to a logged note, never a false pass).
+- **A new external trust surface.** An open-model verdict influences shipping. Bounded by §6 (advisory+veto, never sole authority over protected paths; deterministic gate unchanged; full logging).
+- **Calibration work.** Heterogeneous normalization + thresholds need tuning against the labeled set before the open judges get vote weight. Mitigated by rolling out **advisory-only first** (open judges grade and log, but don't yet gate), then promoting to voting once the audit shows they agree with the owner.
+
+---
+
+## Alternatives considered
+
+- **Replace Claude with open models entirely** (cheapest). Rejected by the owner — loses Claude's review quality and leans wholly on provisional open-model numbers. Claude stays as the quality floor.
+- **Cascade (cheap open model first, Claude only on disagreement).** Rejected by the owner for the default — more moving parts and harder-to-predict behavior than a flat small ensemble. (It remains a possible *future* cost optimization behind the same provider abstraction.)
+- **Self-host the open models on a GPU box.** Rejected — ~$200+/mo idle, never breaks even at our volume; competes with the game server. The adapter leaves the door open if privacy ever demands it.
+- **Adopt `promptfoo` (or another framework) wholesale.** Rejected — we already have a worker-panel grader of this exact shape; `promptfoo` is now OpenAI-owned, against our governance posture. We borrow its patterns (panel voting, open-endpoint judges) and extend our own.
+- **A separate top-level "grader module."** Rejected — it would either re-implement the core loop (duplication) or *be* the core loop (then it's just core). The split in §1 (central engine + module-contributed rubric/evidence/critic) is cleaner and matches [ADR 0083](<redacted>.md).
+- **A big jury (5–9 judges) for maximum robustness.** Rejected on the *"Nine Judges"* evidence — returns saturate by ~5 and correlated errors gut large panels; a small audited panel is both cheaper and more honest.
+
+---
+
+## Cost analysis
+
+Grading volume is roughly one panel per shipped task. At a few thousand grades/month, with each grade ~3K input (mostly the fixed, cacheable rubric) + ~1K output per open judge:
+
+- **DeepInfra**, Llama/Qwen/DeepSeek-class judge: ≈ $0.0006/call → **~$1–3/mo** for the open-judge leg, with prompt-caching driving input cost toward zero.
+- **Claude leg** is the existing spend (unchanged, or *reduced* if some lenses move to the cheaper open judge).
+- **Self-host** would be **~$200+/mo** — rejected.
+
+Net: the new capability is **additive single-digit dollars/month**, well inside the budget, and likely net-neutral-to-negative on total grading spend once open judges absorb load Claude carries today. One new secret (open-model API key); owner spend approval required before the first live call.
+
+---
+
+## Implementation (task-pending)
+
+A build cluster under GDS-V4 (or its successor), staged so nothing destabilizes the live gate:
+
+1. **`ModelProvider` port + `openai-compatible` adapter** — generalize `selectGraderModel`; add provider registry + per-instance config; BYOK open-model key. (No behavior change; Claude still the only judge.)
+2. **Heterogeneous aggregation layer** — z-score/rank normalization + median + hard-veto, config-driven in the rubric. (Still Claude-only; proves the math.)
+3. **Grader registry + work-type seam** — `grader.workType.<key>` providers; route `task.kind` → rubric + evidence-gatherer + critics; migrate the code panel, the art/vision review ([ADR 0008](<redacted>.md)/[ADR 0088](<redacted>.md)), and the `ui` path ([ADR 0081](<redacted>.md)) onto it.
+4. **Add the first open judge — advisory only** — it grades and logs to `signals`, but does not gate. Pick the checkpoint by live evaluation, not vendor numbers.
+5. **Error-correlation audit routine** — replay labeled grades; report κ + pairwise error-correlation; choose panel composition.
+6. **Promote open judges to voting** — once the audit shows agreement with owner decisions; tune veto thresholds.
+7. **Vision ensemble** — add an open VLM (Qwen-VL / InternVL) as an independent second opinion to Gemini for art/animation, deterministic checks still authoritative.
+
+Roll out behind a flag (the [ADR 0079](<redacted>.md) "build disabled, arm later" pattern); the deterministic security gate is never flagged off.
+
+---
+
+## Sources
+
+Open-weight code models & licenses: DeepSeek V3.2/V4 (MIT, ~70–80% SWE-bench), Qwen3-Coder-Next (Apache-2.0), GLM-4.6/5 (MIT), Devstral Small 2 (Apache-2.0), purpose-built judges Atla Selene 1 / Prometheus 2 — HF model cards, mistral.ai, swebench.com, livecodebench.github.io. Hosting/pricing: deepinfra.com/pricing, openrouter.ai/pricing, together.ai/pricing, api-docs.deepseek.com (cached-input ~98% off); self-host break-even via runpod.io/pricing. LLM-as-judge: Zheng 2023 (arXiv 2306.05685), Wang 2023 position bias (2305.17926), Panickssery 2024 self-recognition (2404.13076), G-Eval (2303.16634), PoLL/Verga 2024 (2404.18796), *Nine Judges, Two Effective Votes* 2026 (2605.29800), LLMs-as-Judges survey (2412.05579), Khan 2024 debate (2402.06782), Hamel Husain (hamel.dev/blog/posts/llm-judge). Open VLMs: Qwen2.5-VL/Qwen3-VL (Apache), InternVL3.5 (Apache/MIT, ~77.7% MMMU), Pixtral (Apache) — native-resolution encoders the key feature for small sprites; VLM-judges rank better than they score (Multimodal RewardBench ~70–76% ceiling). Frameworks: promptfoo (MIT, OpenAI-acquired 03/2026), Opik (Apache), Inspect AI (MIT) — none fit better than extending our own panel.

package/docs/adr/0090-metic-task-authoring.md

@@ -0,0 +1,73 @@
+# 0090 — Metic gains task authoring: create / promote / edit + dependency & criteria shaping
+
+- **Status:** Accepted
+- **Date:** 2026-06-26
+- **Deciders:** Lars (Archon), Claude
+
+**Builds on / amends:** [ADR 0016](<redacted>.md) (server-enforced rank boundary — unchanged), [ADR 0018](<redacted>.md) (three-rank model — this ADR re-ranks one row of its table), [ADR 0034](<redacted>.md) (Thetes graduated-newcomer rank), [ADR 0086](<redacted>.md) (goal-scoped work hierarchy — the safer, scope-bounded path this ADR sits beside).
+
+**Track:** `internal` (GDS / methodology — a Cloud Bongos platform capability).
+
+---
+
+## Context
+
+Under the three-rank model ([ADR 0018](<redacted>.md)), **task authoring was Archon-only**: `POST /tasks`, `PATCH /tasks/:id`, `POST /tasks/:id/promote`, and the task↔dependency / task↔criterion CRUD all carried `requireRank('archon')`. A Metic — the Archon-approved *working* rank — could already do the higher-trust judgment work of **idea triage** (`PATCH /inbox/:id`), **blocker review**, and **planning/priority sessions**, but could not turn the ideas they triaged into the tasks those ideas became. They had to hand each one back to the Archon to author.
+
+That is an incoherent trust line. A rank trusted to decide *which ideas become work* (triage) but not trusted to *write the work down* (author a task) creates a bottleneck precisely at the Archon, for no security gain — the Metic already directs the plan; they just can't record it.
+
+Lars's directive (2026-06-26): **"If a Metic can run idea triage, they should be able to seed tasks."** Allow Metics to create, promote, and edit tasks now; setting rank and closing versions stay Archon. Explicitly: *"we can tighten up security later."*
+
+This is deliberately broader and simpler than [ADR 0086](<redacted>.md), which solves the *lower-rank* (xenos/thetes) version of the same problem with a tightly scoped, module-bounded `POST /goals/:id/tasks` grant. ADR 0086's careful scope-subset wall is the right tool for letting an *untrusted* builder author within a fence; for the *trusted* Metic, the owner chose the blunt grant: full task authoring, no fence.
+
+## Decision
+
+Re-rank these `src/bongos/routes/tasks.js` gates from `requireRank('archon')` to `requireRank('metic', 'archon')`:
+
+| Route | Was | Now |
+|---|---|---|
+| `POST /tasks` (create) | archon | **metic+** |
+| `PATCH /tasks/:id` (edit, incl. `newcomer_friendly`) | archon | **metic+** |
+| `POST /tasks/:id/promote` (backlog→ready) | archon | **metic+** |
+| `POST /tasks/:id/dependencies` (add edge) | archon | **metic+** |
+| `DELETE /tasks/:id/dependencies/:depId` | archon | **metic+** |
+| `PUT /tasks/:id/dependencies` (replace set) | archon | **metic+** |
+| `POST /tasks/:id/criteria` (link criterion) | archon | **metic+** |
+| `DELETE /tasks/:id/criteria/:criterionId` | archon | **metic+** |
+
+The dependency + criteria CRUD move alongside create/edit so a Metic can fully **shape** a task they author — without them, a Metic could mint a task but not order it (deps gate claiming) or make it count toward a version (`/status` rolls up via criterion links). "Full task shaping" was Lars's chosen scope when offered create/edit/promote-only vs. the broader set.
+
+`requireRank('metic', 'archon')` uses the existing threshold semantics ([#591](https://example.com/builders#/task/591)): the floor is `metic`, so `metic`, `archon`, and the divine tiers above pass; `thetes`/`xenos` and everything below the floor are denied (fail-closed). Thetes/Xenos still author nothing directly — they file ideas, and (per ADR 0086) may author goal-scoped tasks only within a module fence.
+
+### Two `PATCH /tasks/:id` fields are security controls, not planning fields
+
+Opening `PATCH /tasks/:id` to Metic also exposes two fields that were previously gated *only* by the route being Archon-only — neither had a field-level check. We split them by what they actually are:
+
+- **`requires_rank`** stays open to Metic. `db.updateTaskRequiresRank` clamps the value **up** to the auto-derived floor ([ADR 0084](<redacted>.md)), so a Metic can only *raise* who may claim a task — never open a sensitive task to a lower rank. Raising a claim floor grants the Metic nothing; it is genuine task-shaping ("this needs a higher rank").
+- **`security_sensitive`** stays **Archon-only**, enforced by a new in-handler `rankMeetsThreshold(rank, ['archon'])` check in the PATCH handler. It is a security control, not a planning field: it suppresses the ship→Discord broadcast (routes it to the Archon-only `#security-ship-feed`, task 990) and feeds the auto-derived rank floor. Letting a Metic flip an existing task to `security_sensitive: false` would lower a flag-only-sensitive task's floor and un-suppress its broadcast — a weakening of an existing control, outside "author/shape a task." Setting it at **create** time (`POST /tasks`) is left open to Metic: a brand-new task has no existing sensitivity to clear, and setting the flag *on* only ratchets restriction up.
+
+### What stays Archon-only
+
+- **Setting rank** (`PATCH /builders/:id/rank`) and **closing versions** — the two authorities Lars named as never-delegated.
+- `POST /tasks/:id/abandon` (terminal scope removal — the inverse of promote; a destructive lifecycle kill).
+- `POST /tasks/:id/confirm` (grader-bypass — must not let a builder push their own work past a failed grade — [#231](https://example.com/builders#/task/231)).
+- The **cross-tier polymorphic** `POST|DELETE /dependencies` and goal-scope edges ([ADR 0086](<redacted>.md) §5) — reshaping `{task,goal,criterion}` order across shared workspaces is a wider blast radius than wiring one task's own deps, and stays pinned Archon.
+- `POST /versions`, peer-vote tally, override-request adjudication, newcomer-restock.
+
+### Downgrade protection
+
+`POST /tasks` and `POST /tasks/:id/promote` are pinned in `EXPECTED_RANKS` (`src/bongos/route-rank-check.js`); both pins move to `metic+archon` in lockstep. A *silent further downgrade* (e.g. to any-builder) on either remains a hard CI fail. The route's `// rank:` annotation is updated to match the middleware, keeping the route-rank audit (`tests/route_rank_check.mjs`, the `unit` gate's fitness check) green.
+
+## Consequences
+
+- **Metics can now run the full triage→author loop** — promote an idea to a task and shape it — without the Archon. The delegation bottleneck at the owner is removed for the trusted working rank.
+- **Larger trusted surface.** A Metic is now a `requireRank('metic')` away from authoring any task in any open version (subject to the per-task `requires_rank` floor on *claiming*, [ADR 0084](<redacted>.md), which is unaffected). This is the "tighten later" debt Lars accepted: there is no per-version, per-module, or per-goal fence on a Metic's authoring the way ADR 0086 fences a lower rank. A future ADR can narrow this (e.g. fold Metic authoring into the goal-scope model) without re-litigating the principle.
+- **ADR 0018's table changes.** Its row *"Create / promote / edit tasks, deps, confirm, done-when scope — Metic ❌ / Archon ✅"* is now split: create/promote/edit/deps are ✅ for Metic; confirm and version-scope stay ❌. The ADR 0018 file is annotated with a pointer here rather than rewritten (ADRs are append-only history).
+- **ADR 0086 still stands** for xenos/thetes — its module-scoped `POST /goals/:id/tasks` grant is the only authoring path for sub-Metic ranks, and its scope-subset + protected-path walls are untouched. This ADR only widens the *Metic* line.
+- **Trust boundary intact** ([ADR 0016](<redacted>.md)): enforcement is still server-side, per-request, no cache. Editing a doc or `CLAUDE.md` grants nothing; the route's `requireRank('metic','archon')` is the authority.
+
+## Alternatives considered
+
+- **Create/edit/promote only, leave deps + criteria Archon.** Rejected (Lars chose full shaping): a Metic who can create a task but not wire its dependencies or criterion links produces half-formed tasks the Archon must finish — re-introducing the bottleneck one level down.
+- **Use the ADR 0086 goal-scoped path for Metics too.** Sound, and the likely "tighten later" destination, but heavier than the owner wanted now: it requires a goal to exist and a module scope to be set before a Metic can author. Lars opted for the direct grant and explicit deferral.
+- **Promote the relevant builders to Archon instead.** Rejected: Archon also carries rank-setting, version-close, grader-bypass, and infra — far more than "author tasks." The whole point of Metic is breadth-of-work without those keys.