@bongos/core 1.19.714 → 1.19.724

package/docs/adr/0088-consistent-character-generative-animation.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-06-26
 - **Deciders:** Lars (Archon), Claude
 
-**Builds on:** [ADR 0008](<redacted>.md) (family-based multi-frame generation — the grader/loop we extend), [ADR 0083](<redacted>.md) (modular architecture — this ships as a module), [ADR 0062](<redacted>.md) / [ADR 0081](<redacted>.md) (neutral-contract adapter pattern — the pluggable generator backend), [ADR 0024](<redacted>.md) (grade-before-ship pattern).
+**Builds on:** [ADR 0008](0008-family-based-tile-generation.md) (family-based multi-frame generation — the grader/loop we extend), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (modular architecture — this ships as a module), [ADR 0062](0062-medusa-instance-model-decoupling.md) / [ADR 0081](0081-tool-agnostic-design-layer.md) (neutral-contract adapter pattern — the pluggable generator backend), [ADR 0024](0024-multi-agent-system-architecture.md) (grade-before-ship pattern).
 
 **Track:** `internal` (a Cloud Bongos platform capability — the art pipeline).
 
@@ -24,7 +24,7 @@ External practice confirms the cause: plain reference-prompting (what closed Gem
 
 Two empirical wins this session shaped the decision: (1) a **recursive "draw the frame halfway between these two" inbetween** request *does* produce a coherent intermediate pose with Gemini; (2) **the platform already has the right machinery** — the family pipeline.
 
-**The key finding:** the existing **family pipeline** ([ADR 0008](<redacted>.md); `art/pipeline/family_*.py` + `art/template/families.json`) is already a consistent-character, multi-frame **grade-and-audit loop**. `family_orchestrator.run_family()` generates N frames of one individual in a single sheet, slices them, runs **cross-frame deterministic coherence** (`family_checks.run_all` — silhouette area/height variance = "same size", palette/luminance coherence = "same look"), then a **Gemini family review** that already scores a **`character_identity`** criterion ("do ALL frames depict the SAME individual?"), and **loops with `t5_anchor_refine`** which re-feeds the strongest prior cell as a locked anchor. Walk cycles (`player_walk`, 6 frames) and a peck cycle (`chickens`) already ship through it. It is tuned for **32×32 pixel-art tiles** (palette-snap, fixed size) — not our full-res painterly mascot — but the *architecture, loop, cost-ledger, regression-guard, and Gemini-review flow* are exactly what we need.
+**The key finding:** the existing **family pipeline** ([ADR 0008](0008-family-based-tile-generation.md); `art/pipeline/family_*.py` + `art/template/families.json`) is already a consistent-character, multi-frame **grade-and-audit loop**. `family_orchestrator.run_family()` generates N frames of one individual in a single sheet, slices them, runs **cross-frame deterministic coherence** (`family_checks.run_all` — silhouette area/height variance = "same size", palette/luminance coherence = "same look"), then a **Gemini family review** that already scores a **`character_identity`** criterion ("do ALL frames depict the SAME individual?"), and **loops with `t5_anchor_refine`** which re-feeds the strongest prior cell as a locked anchor. Walk cycles (`player_walk`, 6 frames) and a peck cycle (`chickens`) already ship through it. It is tuned for **32×32 pixel-art tiles** (palette-snap, fixed size) — not our full-res painterly mascot — but the *architecture, loop, cost-ledger, regression-guard, and Gemini-review flow* are exactly what we need.
 
 The owner's directive (2026-06-26): **don't reinvent the loop — use existing infrastructure and flows; keep the per-frame grader criteria proposed below.** And build it **correctly, as a reusable Cloud Bongos module**, since consistent generative animation is a general platform capability, not a one-off.
 
@@ -36,7 +36,7 @@ The owner's directive (2026-06-26): **don't reinvent the loop — use existing i
 
 ### 1. Approach: Gemini + grade-and-audit, pluggable backend (option A)
 
-Closed Gemini caps raw consistency at "reference-conditioning" (it drifts). We compensate with the **grader/audit loop**: every candidate frame is scored against the character's model sheet, and failures are regenerated with the failure fed back as a fix-hint, escalating only when stuck. The **generator backend is an adapter** (the [ADR 0062](<redacted>.md)/[0081](<redacted>.md) neutral-contract pattern): Gemini today; a future **LoRA-on-open-model** ("level 2") or an **image-to-video** model can slot in *without touching the grader*. LoRA is explicitly **deferred**, not chosen — it needs training infra and an open model; we adopt it only if the Gemini pass-rate proves too low.
+Closed Gemini caps raw consistency at "reference-conditioning" (it drifts). We compensate with the **grader/audit loop**: every candidate frame is scored against the character's model sheet, and failures are regenerated with the failure fed back as a fix-hint, escalating only when stuck. The **generator backend is an adapter** (the [ADR 0062](0062-medusa-instance-model-decoupling.md)/[0081](0081-tool-agnostic-design-layer.md) neutral-contract pattern): Gemini today; a future **LoRA-on-open-model** ("level 2") or an **image-to-video** model can slot in *without touching the grader*. LoRA is explicitly **deferred**, not chosen — it needs training infra and an open model; we adopt it only if the Gemini pass-rate proves too low.
 
 ### 2. Reuse the family pipeline as the grader + loop
 
@@ -65,7 +65,7 @@ A non-pixel-art post-process: background removal (`rembg`) + warm-fringe despill
 
 ### 7. Package as a Cloud Bongos module
 
-Per [ADR 0083](<redacted>.md) + [`docs/modules-contract.md`](../modules-contract.md). **Contract — input:** a character *model sheet* (canonical reference image(s) + identity prose + style + size/anchor spec + per-criterion tolerances) + an *action spec* (key poses + frame budget + fps). **Output:** a graded, consistent, registered frame set + a manifest (frame order, fps, anchors). The rubric/tolerances and the generator backend are **config-driven** so any instance can animate its own characters.
+Per [ADR 0083](0083-modular-architecture-strangler-build-plan.md) + [`docs/modules-contract.md`](../modules-contract.md). **Contract — input:** a character *model sheet* (canonical reference image(s) + identity prose + style + size/anchor spec + per-criterion tolerances) + an *action spec* (key poses + frame budget + fps). **Output:** a graded, consistent, registered frame set + a manifest (frame order, fps, anchors). The rubric/tolerances and the generator backend are **config-driven** so any instance can animate its own characters.
 
 ### 8. The grader criteria (owner-approved)
 
@@ -112,7 +112,7 @@ Created as GDS tasks under **BONGOS-V1**, in the **"Cloud Bongos animation modul
 6. **Pose-match + transition coherence** — order-aware neighbor-delta deterministic check + the `pose_match` criterion (the genuine gap) *(dep 4, 5)*.
 7. **Recursive inbetween layer** — keyframes → recursive Gemini midpoints to target count; each graded by the per-frame checks *(dep 2, 3)*.
 8. **Sequence assembly + manifest** — order, fps (on twos/ones), anchors → sprite set + manifest *(dep 7)*.
-9. **Package as a Cloud Bongos module** — manifest/seam per [ADR 0083](<redacted>.md); config-driven rubric + pluggable backend *(dep 4, 5, 6, 8)*.
+9. **Package as a Cloud Bongos module** — manifest/seam per [ADR 0083](0083-modular-architecture-strangler-build-plan.md); config-driven rubric + pluggable backend *(dep 4, 5, 6, 8)*.
 10. **First consumer: Bongo Buddha — 8 actions** — produce idle/laugh/yawn/sleep/kick/docile/reach/fall via the module; finish widget [#1523](https://example.com/builders#/task/1523) *(dep 9)*.
 11. **`character-review` skill** — human wrapper over `run_family` for the painterly path (sibling to `otb-design-review`) *(dep 5)*.
 12. **(future / spike)** learned-embedding identity scorer (DINOv2/CLIP) — "level 2" if vision-identity + pHash prove insufficient.

package/docs/adr/0089-modular-multi-model-adversarial-grader.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-06-26
 - **Deciders:** Lars (Archon), Claude
 
-**Builds on:** [ADR 0024](<redacted>.md) (the MAS grader — the worker-panel we extend), [ADR 0083](<redacted>.md) (modular architecture — graders register through the module seam), [ADR 0081](<redacted>.md) (one grader parameterized by work-type), [ADR 0088](<redacted>.md) (the first module-owned specialized grader — the `character_anim` family review), [ADR 0062](<redacted>.md) (neutral-contract adapter pattern — applied here to the *model provider*), [ADR 0016](<redacted>.md) / [ADR 0043](<redacted>.md) (server-enforced trust boundary the gate must not weaken), [ADR 0080](<redacted>.md) (an external model result that gates a ship is a content-injection surface).
+**Builds on:** [ADR 0024](0024-multi-agent-system-architecture.md) (the MAS grader — the worker-panel we extend), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (modular architecture — graders register through the module seam), [ADR 0081](0081-tool-agnostic-design-layer.md) (one grader parameterized by work-type), [ADR 0088](0088-consistent-character-generative-animation.md) (the first module-owned specialized grader — the `character_anim` family review), [ADR 0062](0062-medusa-instance-model-decoupling.md) (neutral-contract adapter pattern — applied here to the *model provider*), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) / [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (server-enforced trust boundary the gate must not weaken), [ADR 0080](0080-llm-cache-api-transport-and-trust-model.md) (an external model result that gates a ship is a content-injection surface).
 
 **Track:** `internal` (a Cloud Bongos platform capability — the build pipeline's quality gate).
 
@@ -12,15 +12,15 @@
 
 ## Context
 
-Every shipped task passes a **grader** before it lands: the MAS worker-panel ([ADR 0024](<redacted>.md)) for code (`src/bongos/grader.js` + `src/bongos/grader-workers/`), the Gemini vision review for pixel-art ([ADR 0008](<redacted>.md); `art/pipeline/family_review.py`), and now a module-specific review for animation ([ADR 0088](<redacted>.md)). The gate works and is the backbone of letting AI agents ship unattended. But four limits are now in the way:
+Every shipped task passes a **grader** before it lands: the MAS worker-panel ([ADR 0024](0024-multi-agent-system-architecture.md)) for code (`src/bongos/grader.js` + `src/bongos/grader-workers/`), the Gemini vision review for pixel-art ([ADR 0008](0008-family-based-tile-generation.md); `art/pipeline/family_review.py`), and now a module-specific review for animation ([ADR 0088](0088-consistent-character-generative-animation.md)). The gate works and is the backbone of letting AI agents ship unattended. But four limits are now in the way:
 
 1. **The grader is single-vendor.** Both the code panel and the vision review run on a model from the same lab that *built* the work (Claude grades Claude; Gemini grades Gemini-generated art). Today's only mitigation is *cross-family within Anthropic* — Opus author → Sonnet grader (`selectGraderModel`, `src/bongos/grader.js`). The research below shows that an author and a judge from the **same family share correlated blind spots** and the judge **inflates its own family's work by 10–25%**. An independent reviewer from a *different* lineage is the single highest-leverage quality lever we have.
 
 2. **All grading spend rides the Claude bill.** Every worker in the panel is an Opus/Sonnet call. Grading is *additive* to the build spend (the builder already paid Claude to write the code; we pay Claude again to grade it). On a bootstrapped <$5K/yr budget that doubling is real, and it's the wrong place to spend — review is a verification task a cheaper independent model can do well.
 
-3. **There is no clean way for a module to own its grader.** [ADR 0088](<redacted>.md) added an animation grader by *extending the art pipeline in place*; the DINOv2 identity scorer is wired as a Python-only `families.json` flag. Each new work-type bolts its grader on by hand. [ADR 0081](<redacted>.md) already called for "one grader parameterized by type," and [ADR 0083](<redacted>.md) gives us the mechanism (the module seam) — but nothing yet routes grading through it. The owner asked the right question directly: *should a work-type's grader live in that module, or in a general grader module?*
+3. **There is no clean way for a module to own its grader.** [ADR 0088](0088-consistent-character-generative-animation.md) added an animation grader by *extending the art pipeline in place*; the DINOv2 identity scorer is wired as a Python-only `families.json` flag. Each new work-type bolts its grader on by hand. [ADR 0081](0081-tool-agnostic-design-layer.md) already called for "one grader parameterized by type," and [ADR 0083](0083-modular-architecture-strangler-build-plan.md) gives us the mechanism (the module seam) — but nothing yet routes grading through it. The owner asked the right question directly: *should a work-type's grader live in that module, or in a general grader module?*
 
-4. **The grader is hard-wired to two work-types (code, vision).** A third (`ui`, [ADR 0081](<redacted>.md)) and a fourth (animation, [ADR 0088](<redacted>.md)) are arriving. A new module (say, audio, or 3D) has no path to grading at all.
+4. **The grader is hard-wired to two work-types (code, vision).** A third (`ui`, [ADR 0081](0081-tool-agnostic-design-layer.md)) and a fourth (animation, [ADR 0088](0088-consistent-character-generative-animation.md)) are arriving. A new module (say, audio, or 3D) has no path to grading at all.
 
 ### What the research says (mid-2026)
 
@@ -33,7 +33,7 @@ A thorough literature + market sweep this session (sources at the foot of this A
 - **Binary pass/fail + a forced written critique beats 1–5 Likert.** Judges can't reliably tell a 3 from a 4; scores cluster at 6–7. Our panel already uses a 6.0 threshold + per-worker verdicts — consistent with best practice.
 - **Open-weight models are now genuinely good critics.** For code: DeepSeek V3.2/V4 (MIT), Qwen3-Coder (Apache-2.0), GLM-4.6/5 (MIT) score 70–80%+ on SWE-bench Verified; purpose-built judges (Atla Selene, Prometheus 2) are trained specifically for rubric scoring. For vision: Qwen2.5-VL / Qwen3-VL and InternVL3.5 (Apache/MIT) have native-resolution encoders (the key feature for reading small sprites) and rival closed VLMs on MMMU/OCRBench. *Caveat:* several headline 2026 numbers are vendor-reported; treat them as provisional and pin/evaluate the exact checkpoint we adopt.
 - **Hosting math is decisive.** A few-thousand-grades/month workload costs **~$1–5/mo** on a pay-per-call API (DeepInfra is consistently cheapest; e.g. Llama-class 70B ≈ $0.10/$0.32 per 1M tokens; DeepSeek/Qwen comparable, with near-free prompt-caching on the fixed rubric). Self-hosting a GPU is **~$200+/mo idle** and never breaks even at our volume. The grader prompt is mostly a *fixed rubric* sent every call — **cheap cached input crushes the bill.**
-- **Off-the-shelf frameworks exist but don't fit.** `promptfoo` is the closest (MIT, Node-native, built-in panel voting, vision, points at any open endpoint) — but it was acquired by OpenAI in March 2026, and we already have a sophisticated worker-panel grader of exactly this shape. We **extend our own**, borrowing `promptfoo`'s patterns, rather than adopt a vendor-owned framework against an AGPL/non-profit posture ([ADR 0065](<redacted>.md)).
+- **Off-the-shelf frameworks exist but don't fit.** `promptfoo` is the closest (MIT, Node-native, built-in panel voting, vision, points at any open endpoint) — but it was acquired by OpenAI in March 2026, and we already have a sophisticated worker-panel grader of exactly this shape. We **extend our own**, borrowing `promptfoo`'s patterns, rather than adopt a vendor-owned framework against an AGPL/non-profit posture ([ADR 0065](0065-agpl-nonprofit-ai-first-governance.md)).
 
 ### Owner decisions (2026-06-26)
 
@@ -60,13 +60,13 @@ select work-type grader  →  gather evidence  →  run deterministic pre-passes
    →  persist grade + per-judge signals + cost  →  promote / fall-through
 ```
 
-A **module contributes only the three things that are specific to its work-type**, registered through the seam (`api.seams.registerProvider`, [ADR 0083](<redacted>.md)):
+A **module contributes only the three things that are specific to its work-type**, registered through the seam (`api.seams.registerProvider`, [ADR 0083](0083-modular-architecture-strangler-build-plan.md)):
 
 - a **rubric** — the named criteria + thresholds for this work-type (the data the art pipeline keeps in `rubric.json`, the code panel in `grader-rubric.json`);
 - an **evidence-gatherer** — what the judges see (a git diff for code; a rendered screenshot for `ui`; a sliced frame-set + model sheet for animation);
 - optional **specialized critics** — deterministic checks (palette-snap, transition-coherence, DINOv2 identity) or a custom LLM worker, when the generic rubric judge isn't enough.
 
-So the answer to the owner's question — *"under each module, or in a general grader module?"* — is **both, split by concern**: the **orchestration, ensemble, aggregation, gate, persistence, and security pre-passes are central** (write once, consistent everywhere); the **rubric + evidence + specialist critics are module-owned** (the part that genuinely differs). Enable the animation module → its `character_anim` grader is automatically available; disable it → the engine simply has one fewer registered work-type. This is exactly the seam [ADR 0088](<redacted>.md)'s grader and the DINOv2 scorer already want; we are formalizing it as `grader.workType.<key>` providers rather than hand-wiring.
+So the answer to the owner's question — *"under each module, or in a general grader module?"* — is **both, split by concern**: the **orchestration, ensemble, aggregation, gate, persistence, and security pre-passes are central** (write once, consistent everywhere); the **rubric + evidence + specialist critics are module-owned** (the part that genuinely differs). Enable the animation module → its `character_anim` grader is automatically available; disable it → the engine simply has one fewer registered work-type. This is exactly the seam [ADR 0088](0088-consistent-character-generative-animation.md)'s grader and the DINOv2 scorer already want; we are formalizing it as `grader.workType.<key>` providers rather than hand-wiring.
 
 A **grader registry** in core resolves `task.kind` / `discipline` → the registered work-type grader (falling back to the code grader), mirroring the dispatch the art pipeline already does on family `kind`. There is no separate "general grader module" — the generic machinery *is* the core engine; modules register against it.
 
@@ -83,14 +83,14 @@ This generalizes the existing worker panel two ways: the four *lenses* (narc / q
 
 ### 3. The model provider is an adapter; run open models via a hosted API (owner decision 3)
 
-Following the [ADR 0062](<redacted>.md)/[ADR 0081](<redacted>.md) neutral-contract pattern, **how a judge's model is called is an adapter behind a `ModelProvider` port**, not hard-coded. `selectGraderModel()` (today a Claude-only `if/else` in `src/bongos/grader.js`) is replaced by a small provider registry:
+Following the [ADR 0062](0062-medusa-instance-model-decoupling.md)/[ADR 0081](0081-tool-agnostic-design-layer.md) neutral-contract pattern, **how a judge's model is called is an adapter behind a `ModelProvider` port**, not hard-coded. `selectGraderModel()` (today a Claude-only `if/else` in `src/bongos/grader.js`) is replaced by a small provider registry:
 
 - **`anthropic`** — the existing Claude path (Anthropic API).
 - **`openai-compatible`** — a single adapter that speaks the OpenAI chat-completions shape, which covers **DeepInfra, OpenRouter, Together, Fireworks, Groq, vLLM, and Ollama** by base-URL + key alone. This is the open-weight path.
 
-Default open-model transport: a **hosted pay-per-call API (DeepInfra or OpenRouter)** — no box to run, ~$1–5/mo at our volume (§Cost). The same adapter could point at a self-hosted endpoint later without code change, but self-hosting is explicitly *not* adopted now. **Model choice, provider, base-URL, and panel composition are instance config** (the [ADR 0062](<redacted>.md) host-owned pattern), so any Cloud Bongos instance picks its own judges; this also pre-positions for GDS-V4's per-builder model preferences ([idea #30](https://example.com/builders#/idea/30)).
+Default open-model transport: a **hosted pay-per-call API (DeepInfra or OpenRouter)** — no box to run, ~$1–5/mo at our volume (§Cost). The same adapter could point at a self-hosted endpoint later without code change, but self-hosting is explicitly *not* adopted now. **Model choice, provider, base-URL, and panel composition are instance config** (the [ADR 0062](0062-medusa-instance-model-decoupling.md) host-owned pattern), so any Cloud Bongos instance picks its own judges; this also pre-positions for GDS-V4's per-builder model preferences ([idea #30](https://example.com/builders#/idea/30)).
 
-The open-model key is a new secret (BYOK, like the Gemini art key — [ADR 0073](<redacted>.md)). **Requires the owner's spend go-ahead** before any live call (CLAUDE.md §4).
+The open-model key is a new secret (BYOK, like the Gemini art key — [ADR 0073](0073-builder-needs-signal-and-byok-gemini-key.md)). **Requires the owner's spend go-ahead** before any live call (CLAUDE.md §4).
 
 ### 4. Aggregating heterogeneous judges: normalize, then median-plus-hard-veto
 
@@ -108,11 +108,11 @@ Because aggregation cannot manufacture independence the panel doesn't have, we *
 
 ### 6. Deterministic pre-passes stay authoritative and zero-LLM (security)
 
-The two deterministic server-side guards — route-rank ([ADR 0016](<redacted>.md)) and permission-path ([ADR 0043](<redacted>.md)) — **remain exactly as they are**: zero-LLM, server-re-run on authoritative data, downgrade-only. **No LLM verdict — Claude or open — can ever upgrade a deterministic fail to pass.** The ensemble grades *quality*; the deterministic gate enforces the *trust boundary*. An external model's verdict that gates a ship is a content-injection surface ([ADR 0080](<redacted>.md)): so open-model verdicts are (a) advisory-plus-veto only, never sole authority over a protected path; (b) logged with model id + provider + raw response in `signals` for audit; (c) subject to the same server-side re-verification envelope as the Claude panel. For pixel-exact properties (palette, grid, dimensions) the **deterministic checks remain the authority** — VLMs are documented to misread fine detail; the vision judge is for aesthetic/semantic critique only ([ADR 0088](<redacted>.md) already draws this line).
+The two deterministic server-side guards — route-rank ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) and permission-path ([ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)) — **remain exactly as they are**: zero-LLM, server-re-run on authoritative data, downgrade-only. **No LLM verdict — Claude or open — can ever upgrade a deterministic fail to pass.** The ensemble grades *quality*; the deterministic gate enforces the *trust boundary*. An external model's verdict that gates a ship is a content-injection surface ([ADR 0080](0080-llm-cache-api-transport-and-trust-model.md)): so open-model verdicts are (a) advisory-plus-veto only, never sole authority over a protected path; (b) logged with model id + provider + raw response in `signals` for audit; (c) subject to the same server-side re-verification envelope as the Claude panel. For pixel-exact properties (palette, grid, dimensions) the **deterministic checks remain the authority** — VLMs are documented to misread fine detail; the vision judge is for aesthetic/semantic critique only ([ADR 0088](0088-consistent-character-generative-animation.md) already draws this line).
 
 ### 7. Reuse, don't rebuild
 
-The worker-contract (`buildPrompt` / `extractJson` / `computeVerdict`), the `runWorker` parallel runner, the `task_grades` + `grade_attempts` schema, the trivial-diff fast-path, and the server-side guard envelope are **kept**. This ADR generalizes their *inputs* (which model, which rubric, which evidence) — it does not throw them away. The content-addressed LLM cache ([ADR 0077](<redacted>.md)) applies unchanged and now memoizes open-model calls too.
+The worker-contract (`buildPrompt` / `extractJson` / `computeVerdict`), the `runWorker` parallel runner, the `task_grades` + `grade_attempts` schema, the trivial-diff fast-path, and the server-side guard envelope are **kept**. This ADR generalizes their *inputs* (which model, which rubric, which evidence) — it does not throw them away. The content-addressed LLM cache ([ADR 0077](0077-content-addressed-llm-cache.md)) applies unchanged and now memoizes open-model calls too.
 
 ---
 
@@ -141,7 +141,7 @@ The worker-contract (`buildPrompt` / `extractJson` / `computeVerdict`), the `run
 - **Cascade (cheap open model first, Claude only on disagreement).** Rejected by the owner for the default — more moving parts and harder-to-predict behavior than a flat small ensemble. (It remains a possible *future* cost optimization behind the same provider abstraction.)
 - **Self-host the open models on a GPU box.** Rejected — ~$200+/mo idle, never breaks even at our volume; competes with the game server. The adapter leaves the door open if privacy ever demands it.
 - **Adopt `promptfoo` (or another framework) wholesale.** Rejected — we already have a worker-panel grader of this exact shape; `promptfoo` is now OpenAI-owned, against our governance posture. We borrow its patterns (panel voting, open-endpoint judges) and extend our own.
-- **A separate top-level "grader module."** Rejected — it would either re-implement the core loop (duplication) or *be* the core loop (then it's just core). The split in §1 (central engine + module-contributed rubric/evidence/critic) is cleaner and matches [ADR 0083](<redacted>.md).
+- **A separate top-level "grader module."** Rejected — it would either re-implement the core loop (duplication) or *be* the core loop (then it's just core). The split in §1 (central engine + module-contributed rubric/evidence/critic) is cleaner and matches [ADR 0083](0083-modular-architecture-strangler-build-plan.md).
 - **A big jury (5–9 judges) for maximum robustness.** Rejected on the *"Nine Judges"* evidence — returns saturate by ~5 and correlated errors gut large panels; a small audited panel is both cheaper and more honest.
 
 ---
@@ -164,13 +164,13 @@ A build cluster under GDS-V4 (or its successor), staged so nothing destabilizes
 
 1. **`ModelProvider` port + `openai-compatible` adapter** — generalize `selectGraderModel`; add provider registry + per-instance config; BYOK open-model key. (No behavior change; Claude still the only judge.)
 2. **Heterogeneous aggregation layer** — z-score/rank normalization + median + hard-veto, config-driven in the rubric. (Still Claude-only; proves the math.)
-3. **Grader registry + work-type seam** — `grader.workType.<key>` providers; route `task.kind` → rubric + evidence-gatherer + critics; migrate the code panel, the art/vision review ([ADR 0008](<redacted>.md)/[ADR 0088](<redacted>.md)), and the `ui` path ([ADR 0081](<redacted>.md)) onto it.
+3. **Grader registry + work-type seam** — `grader.workType.<key>` providers; route `task.kind` → rubric + evidence-gatherer + critics; migrate the code panel, the art/vision review ([ADR 0008](0008-family-based-tile-generation.md)/[ADR 0088](0088-consistent-character-generative-animation.md)), and the `ui` path ([ADR 0081](0081-tool-agnostic-design-layer.md)) onto it.
 4. **Add the first open judge — advisory only** — it grades and logs to `signals`, but does not gate. Pick the checkpoint by live evaluation, not vendor numbers.
 5. **Error-correlation audit routine** — replay labeled grades; report κ + pairwise error-correlation; choose panel composition.
 6. **Promote open judges to voting** — once the audit shows agreement with owner decisions; tune veto thresholds.
 7. **Vision ensemble** — add an open VLM (Qwen-VL / InternVL) as an independent second opinion to Gemini for art/animation, deterministic checks still authoritative.
 
-Roll out behind a flag (the [ADR 0079](<redacted>.md) "build disabled, arm later" pattern); the deterministic security gate is never flagged off.
+Roll out behind a flag (the [ADR 0079](0079-value-gated-autonomous-engagement.md) "build disabled, arm later" pattern); the deterministic security gate is never flagged off.
 
 ---
 

package/docs/adr/0090-metic-task-authoring.md

@@ -1,10 +1,10 @@
 # 0090 — Metic gains task authoring: create / promote / edit + dependency & criteria shaping
 
-- **Status:** Accepted — one line amended by [ADR 0152](<redacted>.md) (2026-07-27): `POST /tasks/:id/abandon`, listed below under "What stays Archon-only", moved to Metic+ alongside create/promote/edit, paired with an `abandoned → backlog` restore on `/promote`. The rest of this ADR stands.
+- **Status:** Accepted — one line amended by [ADR 0152](0152-metic-task-abandonment.md) (2026-07-27): `POST /tasks/:id/abandon`, listed below under "What stays Archon-only", moved to Metic+ alongside create/promote/edit, paired with an `abandoned → backlog` restore on `/promote`. The rest of this ADR stands.
 - **Date:** 2026-06-26
 - **Deciders:** Lars (Archon), Claude
 
-**Builds on / amends:** [ADR 0016](<redacted>.md) (server-enforced rank boundary — unchanged), [ADR 0018](<redacted>.md) (three-rank model — this ADR re-ranks one row of its table), [ADR 0034](<redacted>.md) (Thetes graduated-newcomer rank), [ADR 0086](<redacted>.md) (goal-scoped work hierarchy — the safer, scope-bounded path this ADR sits beside).
+**Builds on / amends:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced rank boundary — unchanged), [ADR 0018](0018-three-rank-model-goes-live.md) (three-rank model — this ADR re-ranks one row of its table), [ADR 0034](0034-thetes-graduated-newcomer-rank.md) (Thetes graduated-newcomer rank), [ADR 0086](0086-goal-scoped-work-hierarchy.md) (goal-scoped work hierarchy — the safer, scope-bounded path this ADR sits beside).
 
 **Track:** `internal` (GDS / methodology — a Cloud Bongos platform capability).
 
@@ -12,13 +12,13 @@
 
 ## Context
 
-Under the three-rank model ([ADR 0018](<redacted>.md)), **task authoring was Archon-only**: `POST /tasks`, `PATCH /tasks/:id`, `POST /tasks/:id/promote`, and the task↔dependency / task↔criterion CRUD all carried `requireRank('archon')`. A Metic — the Archon-approved *working* rank — could already do the higher-trust judgment work of **idea triage** (`PATCH /inbox/:id`), **blocker review**, and **planning/priority sessions**, but could not turn the ideas they triaged into the tasks those ideas became. They had to hand each one back to the Archon to author.
+Under the three-rank model ([ADR 0018](0018-three-rank-model-goes-live.md)), **task authoring was Archon-only**: `POST /tasks`, `PATCH /tasks/:id`, `POST /tasks/:id/promote`, and the task↔dependency / task↔criterion CRUD all carried `requireRank('archon')`. A Metic — the Archon-approved *working* rank — could already do the higher-trust judgment work of **idea triage** (`PATCH /inbox/:id`), **blocker review**, and **planning/priority sessions**, but could not turn the ideas they triaged into the tasks those ideas became. They had to hand each one back to the Archon to author.
 
 That is an incoherent trust line. A rank trusted to decide *which ideas become work* (triage) but not trusted to *write the work down* (author a task) creates a bottleneck precisely at the Archon, for no security gain — the Metic already directs the plan; they just can't record it.
 
 Lars's directive (2026-06-26): **"If a Metic can run idea triage, they should be able to seed tasks."** Allow Metics to create, promote, and edit tasks now; setting rank and closing versions stay Archon. Explicitly: *"we can tighten up security later."*
 
-This is deliberately broader and simpler than [ADR 0086](<redacted>.md), which solves the *lower-rank* (xenos/thetes) version of the same problem with a tightly scoped, module-bounded `POST /goals/:id/tasks` grant. ADR 0086's careful scope-subset wall is the right tool for letting an *untrusted* builder author within a fence; for the *trusted* Metic, the owner chose the blunt grant: full task authoring, no fence.
+This is deliberately broader and simpler than [ADR 0086](0086-goal-scoped-work-hierarchy.md), which solves the *lower-rank* (xenos/thetes) version of the same problem with a tightly scoped, module-bounded `POST /goals/:id/tasks` grant. ADR 0086's careful scope-subset wall is the right tool for letting an *untrusted* builder author within a fence; for the *trusted* Metic, the owner chose the blunt grant: full task authoring, no fence.
 
 ## Decision
 
@@ -43,7 +43,7 @@ The dependency + criteria CRUD move alongside create/edit so a Metic can fully *
 
 Opening `PATCH /tasks/:id` to Metic also exposes two fields that were previously gated *only* by the route being Archon-only — neither had a field-level check. We split them by what they actually are:
 
-- **`requires_rank`** stays open to Metic. `db.updateTaskRequiresRank` clamps the value **up** to the auto-derived floor ([ADR 0084](<redacted>.md)), so a Metic can only *raise* who may claim a task — never open a sensitive task to a lower rank. Raising a claim floor grants the Metic nothing; it is genuine task-shaping ("this needs a higher rank").
+- **`requires_rank`** stays open to Metic. `db.updateTaskRequiresRank` clamps the value **up** to the auto-derived floor ([ADR 0084](0084-auto-derived-per-task-rank-floor.md)), so a Metic can only *raise* who may claim a task — never open a sensitive task to a lower rank. Raising a claim floor grants the Metic nothing; it is genuine task-shaping ("this needs a higher rank").
 - **`security_sensitive`** stays **Archon-only**, enforced by a new in-handler `rankMeetsThreshold(rank, ['archon'])` check in the PATCH handler. It is a security control, not a planning field: it suppresses the ship→Discord broadcast (routes it to the Archon-only `#security-ship-feed`, task 990) and feeds the auto-derived rank floor. Letting a Metic flip an existing task to `security_sensitive: false` would lower a flag-only-sensitive task's floor and un-suppress its broadcast — a weakening of an existing control, outside "author/shape a task." Setting it at **create** time (`POST /tasks`) is left open to Metic: a brand-new task has no existing sensitivity to clear, and setting the flag *on* only ratchets restriction up.
 
 ### What stays Archon-only
@@ -51,7 +51,7 @@ Opening `PATCH /tasks/:id` to Metic also exposes two fields that were previously
 - **Setting rank** (`PATCH /builders/:id/rank`) and **closing versions** — the two authorities Lars named as never-delegated.
 - `POST /tasks/:id/abandon` (terminal scope removal — the inverse of promote; a destructive lifecycle kill).
 - `POST /tasks/:id/confirm` (grader-bypass — must not let a builder push their own work past a failed grade — [#231](https://example.com/builders#/task/231)).
-- The **cross-tier polymorphic** `POST|DELETE /dependencies` and goal-scope edges ([ADR 0086](<redacted>.md) §5) — reshaping `{task,goal,criterion}` order across shared workspaces is a wider blast radius than wiring one task's own deps, and stays pinned Archon.
+- The **cross-tier polymorphic** `POST|DELETE /dependencies` and goal-scope edges ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §5) — reshaping `{task,goal,criterion}` order across shared workspaces is a wider blast radius than wiring one task's own deps, and stays pinned Archon.
 - `POST /versions`, peer-vote tally, override-request adjudication, newcomer-restock.
 
 ### Downgrade protection
@@ -61,10 +61,10 @@ Opening `PATCH /tasks/:id` to Metic also exposes two fields that were previously
 ## Consequences
 
 - **Metics can now run the full triage→author loop** — promote an idea to a task and shape it — without the Archon. The delegation bottleneck at the owner is removed for the trusted working rank.
-- **Larger trusted surface.** A Metic is now a `requireRank('metic')` away from authoring any task in any open version (subject to the per-task `requires_rank` floor on *claiming*, [ADR 0084](<redacted>.md), which is unaffected). This is the "tighten later" debt Lars accepted: there is no per-version, per-module, or per-goal fence on a Metic's authoring the way ADR 0086 fences a lower rank. A future ADR can narrow this (e.g. fold Metic authoring into the goal-scope model) without re-litigating the principle.
+- **Larger trusted surface.** A Metic is now a `requireRank('metic')` away from authoring any task in any open version (subject to the per-task `requires_rank` floor on *claiming*, [ADR 0084](0084-auto-derived-per-task-rank-floor.md), which is unaffected). This is the "tighten later" debt Lars accepted: there is no per-version, per-module, or per-goal fence on a Metic's authoring the way ADR 0086 fences a lower rank. A future ADR can narrow this (e.g. fold Metic authoring into the goal-scope model) without re-litigating the principle.
 - **ADR 0018's table changes.** Its row *"Create / promote / edit tasks, deps, confirm, done-when scope — Metic ❌ / Archon ✅"* is now split: create/promote/edit/deps are ✅ for Metic; confirm and version-scope stay ❌. The ADR 0018 file is annotated with a pointer here rather than rewritten (ADRs are append-only history).
 - **ADR 0086 still stands** for xenos/thetes — its module-scoped `POST /goals/:id/tasks` grant is the only authoring path for sub-Metic ranks, and its scope-subset + protected-path walls are untouched. This ADR only widens the *Metic* line.
-- **Trust boundary intact** ([ADR 0016](<redacted>.md)): enforcement is still server-side, per-request, no cache. Editing a doc or `CLAUDE.md` grants nothing; the route's `requireRank('metic','archon')` is the authority.
+- **Trust boundary intact** ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)): enforcement is still server-side, per-request, no cache. Editing a doc or `CLAUDE.md` grants nothing; the route's `requireRank('metic','archon')` is the authority.
 
 ## Alternatives considered
 

package/docs/adr/0091-bounding-the-kernel-and-db-carve.md

@@ -2,11 +2,11 @@
 
 **Status:** Accepted (2026-06-26) · task [#1570](https://example.com/builders#/task/1570) (BV1.R67) · criterion **C7 `gds-core-modularized`** (BONGOS-V1) · planning [session 2026-06-26](../session-logs/<redacted>.md)
 
-**Amends:** [ADR 0083](<redacted>.md) — the strangler build plan. ADR 0083 §"The four module moves" cut the four *feature* modules (dev-box, game, discord, art-pipeline) around an undifferentiated core. This ADR extends the same strangler to the **core itself**: it bounds the kernel as a real artifact and defines how a *core domain* becomes a module. It changes nothing about 0083's five rules, the loader, or the fitness ratchet — it gives the "kernel" 0083 kept referring to a concrete file roster, and the "carve `db.js` per-domain" 0083 mentioned ([02 §3](../design/modular-architecture/02-module-map.md)) a mechanism.
+**Amends:** [ADR 0083](0083-modular-architecture-strangler-build-plan.md) — the strangler build plan. ADR 0083 §"The four module moves" cut the four *feature* modules (dev-box, game, discord, art-pipeline) around an undifferentiated core. This ADR extends the same strangler to the **core itself**: it bounds the kernel as a real artifact and defines how a *core domain* becomes a module. It changes nothing about 0083's five rules, the loader, or the fitness ratchet — it gives the "kernel" 0083 kept referring to a concrete file roster, and the "carve `db.js` per-domain" 0083 mentioned ([02 §3](../design/modular-architecture/02-module-map.md)) a mechanism.
 
-**Builds on:** [ADR 0016](<redacted>.md) (server-enforced rank boundary — the kernel *is* the trust boundary), [ADR 0043](<redacted>.md) (protected paths), [ADR 0086](<redacted>.md) (module-scope-map), [ADR 0062](<redacted>.md) (core↔host split — same "neutral contract, swappable behind it" shape).
+**Builds on:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced rank boundary — the kernel *is* the trust boundary), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (protected paths), [ADR 0086](0086-goal-scoped-work-hierarchy.md) (module-scope-map), [ADR 0062](0062-medusa-instance-model-decoupling.md) (core↔host split — same "neutral contract, swappable behind it" shape).
 
-**Relates to:** [ADR 0095](<redacted>.md) — the *findability* complement to this ADR's *structural* scoping (authored alongside it): 0091 bounds how much an agent loads (kernel + per-domain modules); 0095 helps the agent find the right place within it (docstrings, greppability, retrieval). The module-header doc-comment convention 0095 adopts is authored per module the carve here defines.
+**Relates to:** [ADR 0095](0095-cross-agent-context-management.md) — the *findability* complement to this ADR's *structural* scoping (authored alongside it): 0091 bounds how much an agent loads (kernel + per-domain modules); 0095 helps the agent find the right place within it (docstrings, greppability, retrieval). The module-header doc-comment convention 0095 adopts is authored per module the carve here defines.
 
 ---
 

package/docs/adr/0092-hosting-module-and-on-prem-target.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-06-27
 - **Deciders:** Lars (Archon), Claude
 
-**Builds on:** [ADR 0083](<redacted>.md) (modular architecture — the module this capability ships as), [ADR 0089](<redacted>.md) (the `ModelProvider` `openai-compatible` adapter the on-prem inference target reuses, and its decisive hosting-cost finding), [ADR 0062](<redacted>.md) (core↔host decoupling — the warehouse box is host-instance config, not portable core), [ADR 0081](<redacted>.md) (swappable adapters against a neutral contract), [ADR 0031](<redacted>.md) (cloud dev boxes — a workload a later phase may partly displace), [ADR 0060](0060-gds-retrieval-layer.md) (recall/embeddings — a consumer), [ADR 0088](<redacted>.md) (the per-character LoRA deferred as "needs GPU training + an open model" — a workload this enables), [ADR 0016](<redacted>.md) / [ADR 0043](<redacted>.md) (server-enforced trust boundary the box must never weaken), [ADR 0033](<redacted>.md) (the precedent for a useful service that sits *outside* the trust boundary).
+**Builds on:** [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (modular architecture — the module this capability ships as), [ADR 0089](0089-modular-multi-model-adversarial-grader.md) (the `ModelProvider` `openai-compatible` adapter the on-prem inference target reuses, and its decisive hosting-cost finding), [ADR 0062](0062-medusa-instance-model-decoupling.md) (core↔host decoupling — the warehouse box is host-instance config, not portable core), [ADR 0081](0081-tool-agnostic-design-layer.md) (swappable adapters against a neutral contract), [ADR 0031](0031-cloud-dev-environments-for-builders.md) (cloud dev boxes — a workload a later phase may partly displace), [ADR 0060](0060-gds-retrieval-layer.md) (recall/embeddings — a consumer), [ADR 0088](0088-consistent-character-generative-animation.md) (the per-character LoRA deferred as "needs GPU training + an open model" — a workload this enables), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) / [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (server-enforced trust boundary the box must never weaken), [ADR 0033](0033-discord-bot-service-principal.md) (the precedent for a useful service that sits *outside* the trust boundary).
 
 **Track:** `internal` (a portable Cloud Bongos platform capability).
 
@@ -12,30 +12,30 @@
 
 ## Context
 
-Example wants to stand up a physical server inside the warehouse to (a) cut software-hosting cost, (b) get cheaper access to open-weight LLMs and code, and (c) capture other on-prem advantages. OTB runs on a <$5K/yr budget ([CLAUDE.md §4](../../CLAUDE.md)): a ~$14/mo DigitalOcean droplet for prod, cloud LLM APIs (Claude for code, Gemini for art), and per-builder cloud dev boxes ([ADR 0031](<redacted>.md)). The largest *variable* cost is LLM spend.
+Example wants to stand up a physical server inside the warehouse to (a) cut software-hosting cost, (b) get cheaper access to open-weight LLMs and code, and (c) capture other on-prem advantages. OTB runs on a <$5K/yr budget ([CLAUDE.md §4](../../CLAUDE.md)): a ~$14/mo DigitalOcean droplet for prod, cloud LLM APIs (Claude for code, Gemini for art), and per-builder cloud dev boxes ([ADR 0031](0031-cloud-dev-environments-for-builders.md)). The largest *variable* cost is LLM spend.
 
 This ADR records the **scope-of-use** decision — the first of the four phases the owner set: *scope use → scope build → hardware setup → software use* — and the shape the capability ships in. The build, hardware, and software phases are task-pending.
 
 ### The reframe: a portable module + a host-specific target
 
-A warehouse server is *hardware*; a Cloud Bongos module is *software that mounts into a running instance* ([ADR 0083](<redacted>.md)). So "the hosting module" is **not** "the server in a folder." Following the core↔host split already used for branding ([ADR 0062](<redacted>.md)) and design tools ([ADR 0081](<redacted>.md)):
+A warehouse server is *hardware*; a Cloud Bongos module is *software that mounts into a running instance* ([ADR 0083](0083-modular-architecture-strangler-build-plan.md)). So "the hosting module" is **not** "the server in a folder." Following the core↔host split already used for branding ([ADR 0062](0062-medusa-instance-model-decoupling.md)) and design tools ([ADR 0081](0081-tool-agnostic-design-layer.md)):
 
 - **The `hosting` module (portable core):** a broker, default-**OFF**, that exposes labeled compute/storage **seams** and resolves each to a configured **target**. The default target is today's cloud/APIs, so a vanilla instance behaves exactly as it does now (fail-to-vanilla, like the loader with no `modules/`).
 - **The warehouse box (host-instance config):** one **on-prem target** an adapter points at, declared in OTB's instance config — not in portable code. Another Cloud Bongos instance declares none and stays all-cloud.
 
 Two properties fall straight out, and they answer the two standing objections to on-prem:
 
-1. **Nothing depends on the box.** Each seam resolves through `resolveOptional(port, cloudDefaultFn)` ([ADR 0083](<redacted>.md)); a target marked unreachable falls back to cloud per-call. The box is an opportunistic cost-saver, never a single point of failure. (This is also why public, real-time prod — the game's Colyseus rooms — stays in the cloud: you can't fail a live socket over mid-session.)
+1. **Nothing depends on the box.** Each seam resolves through `resolveOptional(port, cloudDefaultFn)` ([ADR 0083](0083-modular-architecture-strangler-build-plan.md)); a target marked unreachable falls back to cloud per-call. The box is an opportunistic cost-saver, never a single point of failure. (This is also why public, real-time prod — the game's Colyseus rooms — stays in the cloud: you can't fail a live socket over mid-session.)
 2. **Every Example instance shares it.** The owner chose to size and abstract the box as a shared backend across all Example Cloud Bongos instances — one GPU amortized across projects is what raises utilization enough to matter.
 
 ### Honest economics — what the GPU is and isn't good for
 
-[ADR 0089](<redacted>.md)'s market sweep is decisive and we adopt it rather than relitigate: **at low volume, pay-per-call open-model APIs (DeepInfra / OpenRouter) beat self-hosting** — a few-thousand-calls/month workload is ~$1–5/mo on API, and a fixed, cached prompt crushes the bill. A self-hosted GPU only wins when it is *kept busy* or when per-call cloud pricing is high.
+[ADR 0089](0089-modular-multi-model-adversarial-grader.md)'s market sweep is decisive and we adopt it rather than relitigate: **at low volume, pay-per-call open-model APIs (DeepInfra / OpenRouter) beat self-hosting** — a few-thousand-calls/month workload is ~$1–5/mo on API, and a fixed, cached prompt crushes the bill. A self-hosted GPU only wins when it is *kept busy* or when per-call cloud pricing is high.
 
 So the warehouse GPU earns its keep on a **narrower** set than "all inference":
 
 - **GPU-bound batch generation** — art image-gen at volume across instances (priced per-image in the cloud).
-- **Model fine-tuning / training** — the per-character LoRA [ADR 0088](<redacted>.md) deferred as "level-2 (needs GPU training + an open model)"; cloud charges steep per-GPU-hour, an owned card amortizes.
+- **Model fine-tuning / training** — the per-character LoRA [ADR 0088](0088-consistent-character-generative-animation.md) deferred as "level-2 (needs GPU training + an open model)"; cloud charges steep per-GPU-hour, an owned card amortizes.
 - **Always-busy bulk jobs** — overnight eval/analysis at a scale that saturates the card.
 
 The **non-GPU wins** stand on their own:
@@ -56,7 +56,7 @@ Conversely — correcting an earlier hand-wave in this session — **embeddings
 
 ## Decision
 
-**Ship a portable `hosting` module (default-OFF, fail-to-vanilla) that brokers compute and storage workloads to configured hosting targets through kernel seams, reusing the [ADR 0089](<redacted>.md) `ModelProvider` adapter contract for inference. A GPU box in the Example warehouse is OTB's first on-prem target — one adapter backend declared in host-instance config, shared across Example instances, with automatic cloud fallback so nothing ever depends on the box.**
+**Ship a portable `hosting` module (default-OFF, fail-to-vanilla) that brokers compute and storage workloads to configured hosting targets through kernel seams, reusing the [ADR 0089](0089-modular-multi-model-adversarial-grader.md) `ModelProvider` adapter contract for inference. A GPU box in the Example warehouse is OTB's first on-prem target — one adapter backend declared in host-instance config, shared across Example instances, with automatic cloud fallback so nothing ever depends on the box.**
 
 ### 1. The module shape
 
@@ -76,18 +76,18 @@ The module registers providers; consumers resolve via `resolveOptional(port, clo
 
 | Seam | Consumer(s) | Conservative-posture target |
 |---|---|---|
-| `inference.run` | grader ([ADR 0089](<redacted>.md)), eval cron | API by default; on-prem only when saturated / data-local |
+| `inference.run` | grader ([ADR 0089](0089-modular-multi-model-adversarial-grader.md)), eval cron | API by default; on-prem only when saturated / data-local |
 | `imagegen.run` | art-pipeline | **on-prem GPU** (batch) when up, else Gemini |
 | `embeddings.embed` | recall ([ADR 0060](0060-gds-retrieval-layer.md)) | API (cheap) by default; on-prem opportunistic |
-| `training.run` | art-pipeline (LoRA, [ADR 0088](<redacted>.md) L2) | **on-prem GPU** |
+| `training.run` | art-pipeline (LoRA, [ADR 0088](0088-consistent-character-generative-animation.md) L2) | **on-prem GPU** |
 | `storage.put/get` | backups, art assets | **on-prem NAS** + offsite copy |
 
-Inference does **not** reinvent [ADR 0089](<redacted>.md): the on-prem target is just one more `openai-compatible` `ModelProvider` endpoint (vLLM / Ollama) alongside the hosted ones. The hosting module adds the *target selection + health/fallback + sharing config* around it.
+Inference does **not** reinvent [ADR 0089](0089-modular-multi-model-adversarial-grader.md): the on-prem target is just one more `openai-compatible` `ModelProvider` endpoint (vLLM / Ollama) alongside the hosted ones. The hosting module adds the *target selection + health/fallback + sharing config* around it.
 
 ### 3. Network + trust boundary
 
 - **Ingress:** the cloud instance reaches the warehouse box over an **outbound tunnel the box initiates** (e.g. Cloudflare Tunnel or WireGuard) — no open inbound ports, no static-IP requirement, no DDoS exposure at the warehouse. This sidesteps the whole residential/commercial-internet problem.
-- **Trust boundary ([ADR 0016](<redacted>.md) / [ADR 0043](<redacted>.md)):** the box runs jobs and holds model weights, but authority stays server-enforced in the cloud GDS. The box sits **outside** the trust boundary — like Discord ([ADR 0033](<redacted>.md)): it can compute, it can never grant rank or land code. A compromised box can degrade or poison *non-shipping* outputs (hence the conservative posture, and the grader staying authoritative), never escalate permissions.
+- **Trust boundary ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md) / [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)):** the box runs jobs and holds model weights, but authority stays server-enforced in the cloud GDS. The box sits **outside** the trust boundary — like Discord ([ADR 0033](0033-discord-bot-service-principal.md)): it can compute, it can never grant rank or land code. A compromised box can degrade or poison *non-shipping* outputs (hence the conservative posture, and the grader staying authoritative), never escalate permissions.
 
 ### 4. How this subproject is filed (the durable home)
 

package/docs/adr/0093-tranche-2-core-carve-sequence.md

@@ -2,15 +2,15 @@
 
 **Status:** Accepted (2026-06-27) · task [#1627](https://example.com/builders#/task/1627) (BV1.R76) · criterion **C7 `gds-core-modularized`** (BONGOS-V1) · owner-greenlit
 
-**Amends:** [ADR 0091](<redacted>.md) — which carved the first two core domains (memory R72, grading R73) and **explicitly deferred tranche 2 "per owner."** The owner greenlit tranche 2 on 2026-06-27. This ADR fixes the order, the remaining kernel ports, and the lifecycle endgame; it changes nothing about 0091's kernel roster, the carve mechanism, or the fitness ratchet — those ship as reusable infrastructure.
+**Amends:** [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) — which carved the first two core domains (memory R72, grading R73) and **explicitly deferred tranche 2 "per owner."** The owner greenlit tranche 2 on 2026-06-27. This ADR fixes the order, the remaining kernel ports, and the lifecycle endgame; it changes nothing about 0091's kernel roster, the carve mechanism, or the fitness ratchet — those ship as reusable infrastructure.
 
-**Builds on:** [ADR 0083](<redacted>.md) (the strangler plan + 5 module rules), [02 module-map](../design/modular-architecture/02-module-map.md) (the import-graph evidence + the decided ~16-module roster), [04 module-lifecycle](../design/modular-architecture/04-module-lifecycle.md) (the seam/port mechanism).
+**Builds on:** [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the strangler plan + 5 module rules), [02 module-map](../design/modular-architecture/02-module-map.md) (the import-graph evidence + the decided ~16-module roster), [04 module-lifecycle](../design/modular-architecture/04-module-lifecycle.md) (the seam/port mechanism).
 
 ---
 
 ## Context
 
-Tranche 1 ([ADR 0091](<redacted>.md)) did two things: it **proved the core-carve pattern** on the two cleanest-slicing domains (memory, grading — demonstrated by [`scripts/gds/coreB-carve-proof.sh`](../../scripts/gds/coreB-carve-proof.sh), R74), and it **shipped the infrastructure** every later carve reuses — the bounded kernel roster + `KERNEL_FILES` fitness ratchet (R70), the doorway with `withTx` (R68), the per-domain `db.js` slice pattern + `db-kernel.js` (R69), and the `grade` kernel **port** (R73). That infrastructure is generic: each remaining core domain is now a *pure carve* copying R72/R73, with **no new scaffolding**.
+Tranche 1 ([ADR 0091](0091-bounding-the-kernel-and-db-carve.md)) did two things: it **proved the core-carve pattern** on the two cleanest-slicing domains (memory, grading — demonstrated by [`scripts/gds/coreB-carve-proof.sh`](../../scripts/gds/coreB-carve-proof.sh), R74), and it **shipped the infrastructure** every later carve reuses — the bounded kernel roster + `KERNEL_FILES` fitness ratchet (R70), the doorway with `withTx` (R68), the per-domain `db.js` slice pattern + `db-kernel.js` (R69), and the `grade` kernel **port** (R73). That infrastructure is generic: each remaining core domain is now a *pure carve* copying R72/R73, with **no new scaffolding**.
 
 What remains is the bulk of the core: ~8 cohesive domains + the two web UIs + the lifecycle state machine ([02 §6](../design/modular-architecture/02-module-map.md) roster). The import-graph scan ([02 §2](../design/modular-architecture/02-module-map.md)) already told us which slice cleanly (economy, ideas, security alongside the proven memory/grading) and which is the coupled cluster (the lifecycle — `tasks → grader/github-push/ship-broadcast`). This ADR turns that evidence into a sequence.
 
@@ -38,11 +38,11 @@ Per [02 §2](../design/modular-architecture/02-module-map.md) (import-graph, not
 
 ### 2. economy registers the `reward` kernel port — the twin of `grade`
 
-The lifecycle invokes two domain capabilities at ship: **grade** (already a port, R73) and **reward** (credit allocation — `applyGrade`/credit-log). [02 §3/§4](../design/modular-architecture/02-module-map.md) and the [04 lifecycle](../design/modular-architecture/04-module-lifecycle.md) seam design both name `reward` as the second illustrative port. R77 makes it real: economy `registerProvider('reward', …)` at boot; the lifecycle resolves `seams.resolveOptional('reward')` instead of importing economy. This is why **economy is first and lifecycle is last** — by the time the state machine is carved, every capability it calls is already a kernel port, so the lifecycle module imports only the kernel + resolves ports (the [ADR 0091 §4](<redacted>.md) rule, applied to the whole cluster).
+The lifecycle invokes two domain capabilities at ship: **grade** (already a port, R73) and **reward** (credit allocation — `applyGrade`/credit-log). [02 §3/§4](../design/modular-architecture/02-module-map.md) and the [04 lifecycle](../design/modular-architecture/04-module-lifecycle.md) seam design both name `reward` as the second illustrative port. R77 makes it real: economy `registerProvider('reward', …)` at boot; the lifecycle resolves `seams.resolveOptional('reward')` instead of importing economy. This is why **economy is first and lifecycle is last** — by the time the state machine is carved, every capability it calls is already a kernel port, so the lifecycle module imports only the kernel + resolves ports (the [ADR 0091 §4](0091-bounding-the-kernel-and-db-carve.md) rule, applied to the whole cluster).
 
 ### 3. The lifecycle stays ONE module, carved last
 
-Do **not** split tasks/claims/versions/ship apart ([02 §4](../design/modular-architecture/02-module-map.md), restated in [ADR 0091](<redacted>.md) alternatives). Keep the state machine whole; the only edges it keeps are kernel + the grade/reward ports. Carving it last means the `db.js` residue at the end is exactly the lifecycle slice + `db-kernel.js` — the shape ADR 0091 §2 predicted.
+Do **not** split tasks/claims/versions/ship apart ([02 §4](../design/modular-architecture/02-module-map.md), restated in [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) alternatives). Keep the state machine whole; the only edges it keeps are kernel + the grade/reward ports. Carving it last means the `db.js` residue at the end is exactly the lifecycle slice + `db-kernel.js` — the shape ADR 0091 §2 predicted.
 
 ### 4. Every carve is proof-gated; C7 is satisfied by R87
 

package/docs/adr/0094-repo-atlas-self-drawing-codebase-map.md

@@ -2,7 +2,7 @@
 
 **Status:** Accepted (2026-06-27)
 **Track:** internal
-**Builds on:** [ADR 0061](<redacted>.md) (context layers), [ADR 0063](<redacted>.md) (generate-don't-narrate), [ADR 0062 §8](<redacted>.md) (generated artifacts), [ADR 0083](<redacted>.md) / [ADR 0091](<redacted>.md) (module system), [ADR 0056](<redacted>.md) (hand-installed deploy script), the world-snapshot precedent (`scripts/snapshots/maybe-render-on-deploy.sh`).
+**Builds on:** [ADR 0061](0061-context-layer-decomposition.md) (context layers), [ADR 0063](0063-generated-repo-map-symbol-skeleton.md) (generate-don't-narrate), [ADR 0062 §8](0062-medusa-instance-model-decoupling.md) (generated artifacts), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) / [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) (module system), [ADR 0056](0056-prod-deploy-script-mirror-and-healthcheck-retry.md) (hand-installed deploy script), the world-snapshot precedent (`scripts/snapshots/maybe-render-on-deploy.sh`).
 **Promotes:** [idea #457](https://example.com/builders#/idea/457). **Tasks:** [#1640](https://example.com/builders#/task/1640) (this), [#1641](https://example.com/builders#/task/1641) (doc-generator migration).
 
 ## Context

package/docs/adr/0095-borrowed-memory-and-retrieval-concepts.md

@@ -2,7 +2,7 @@
 
 **Status:** Proposed (owner-directed 2026-06-27; pending claim + companion ADR)
 **Track:** internal
-**Builds on:** [ADR 0060](0060-gds-retrieval-layer.md) (recall / retrieval layer), [ADR 0063](<redacted>.md) (generated repo-map symbol skeleton), [ADR 0094](<redacted>.md) (repo atlas), [ADR 0049](<redacted>.md) (touches[] advisory), [ADR 0082](<redacted>.md) (server-side conflict resolver), [ADR 0091](<redacted>.md) (memory module carve), [ADR 0026](<redacted>.md) / [ADR 0027](<redacted>.md) (BFG memory).
+**Builds on:** [ADR 0060](0060-gds-retrieval-layer.md) (recall / retrieval layer), [ADR 0063](0063-generated-repo-map-symbol-skeleton.md) (generated repo-map symbol skeleton), [ADR 0094](0094-repo-atlas-self-drawing-codebase-map.md) (repo atlas), [ADR 0049](0049-split-parallel-safety-contract.md) (touches[] advisory), [ADR 0082](0082-server-side-merge-conflict-auto-resolution.md) (server-side conflict resolver), [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) (memory module carve), [ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md) / [ADR 0027](0027-bfg-session-inefficiency-evaluator.md) (BFG memory).
 **Pairs with:** a companion owner-authored ADR on **grep vs. a semantic/embedding retrieval layer**. This ADR deliberately does **not** decide that question — every item below is independent of which retrieval mechanism we run.
 **Sources evaluated:** [graphify](https://github.com/safishamsi/graphify) (MIT, Python) and [claude-mem](https://github.com/thedotmack/claude-mem) (Apache-2.0, JavaScript), in the 2026-06-27 research session.
 
@@ -13,12 +13,12 @@ We evaluated two mature, widely-starred Claude-Code tools that overlap our inter
 - **graphify** — turns a codebase + docs into a queryable knowledge graph (tree-sitter AST + LLM-inferred edges + Leiden clustering), shipped as a `/graphify` skill + MCP server.
 - **claude-mem** — automatic persistent session memory (lifecycle hooks capture every tool use → AI-compressed summaries → reinjected next session), backed by SQLite + a Chroma vector DB.
 
-Both overlap things we already run — recall ([ADR 0060](0060-gds-retrieval-layer.md)), the generated repo-map ([ADR 0063](<redacted>.md)) and the repo atlas ([ADR 0094](<redacted>.md)), the carved memory module ([ADR 0091](<redacted>.md)), the `learnings` table, and `touches[]`/merge-collision handling ([ADR 0049](<redacted>.md), [ADR 0082](<redacted>.md)).
+Both overlap things we already run — recall ([ADR 0060](0060-gds-retrieval-layer.md)), the generated repo-map ([ADR 0063](0063-generated-repo-map-symbol-skeleton.md)) and the repo atlas ([ADR 0094](0094-repo-atlas-self-drawing-codebase-map.md)), the carved memory module ([ADR 0091](0091-bounding-the-kernel-and-db-carve.md)), the `learnings` table, and `touches[]`/merge-collision handling ([ADR 0049](0049-split-parallel-safety-contract.md), [ADR 0082](0082-server-side-merge-conflict-auto-resolution.md)).
 
 **Neither fits wholesale**, for reasons specific to us:
 - graphify is **Python** — a foreign runtime bolted beside a Node/Postgres codebase; it could only ever sit *next to* the GDS, never inside it.
 - claude-mem's architecture is **local-first, single-developer** (a per-machine daemon + local SQLite + a Chroma vector service pulling in a Python/`uv` dependency). We are **centralized and multi-builder** (memory syncs to one Postgres on the droplet, rank-scoped, with the BFG doing cross-builder work). The shape is wrong.
-- graphify's graph has **no rank-scoping**; committing a full-repo graph would expose permission-core structure to low-rank builders, against [ADR 0016](<redacted>.md).
+- graphify's graph has **no rank-scoping**; committing a full-repo graph would expose permission-core structure to low-rank builders, against [ADR 0016](0016-trust-boundary-server-enforced-permissions.md).
 - Both run an **open-core commercial play** (graphify → Penpax; claude-mem → a server/team beta), and claude-mem additionally endorses an associated **memecoin** — governance signals that argue against *depending* on either, though not against reading them.
 - Claude Code itself deliberately favours **live agentic search over a prebuilt index** (freshness, simplicity) — the philosophy we already follow with lexical recall + a generated map.
 
@@ -30,8 +30,8 @@ Adopt the following eight concepts. Each is reimplemented in-stack; none require
 
 ### From graphify (the "Tier-2" borrows)
 
-- **G1 — Symbol-level collision detection.** Move `touches[]` overlap from *path-prefix* to *symbol/dependency* awareness (`src/bongos/path-match.js` `touchesOverlap`/`matchOne`, consumed by `claims.js`). **Why:** path-prefix over-flags — two tasks editing different functions in one big file (e.g. `db.js`) are falsely serialized, costing parallelism — and under-detects, missing cross-file collisions where one task changes a symbol another file depends on. [ADR 0049](<redacted>.md) already cut the *cost of being wrong* (touches is advisory, backfilled from the real diff); this attacks the *accuracy of the forecast*, the remaining lever. `git merge` stays the ground-truth backstop.
-- **G2 — AST-based repo-map upgrade.** Replace the regex symbol extractor with a real parser via the `extractFile()` seam [ADR 0063](<redacted>.md) explicitly left for this (`scripts/gds/gen-repo-map.js`). **Why:** the regex extractor is server-JS-only, conflates two symbols that share a name, and builds no call graph. A parser (tree-sitter, **WASM build** — which sidesteps the `node-gyp` native-compile cost that [ADR 0063](<redacted>.md) rejected) gives polyglot coverage (the Python `art/` pipeline, client `public/game/` JS, SQL), real symbol resolution, and a dependency graph. That graph is the **substrate G1 needs**, and it feeds [ADR 0094](<redacted>.md)'s atlas **truer edges** than today's `fitness.js` regex-on-`require` facts. This is the one item with a (vendored, no-native-build) dependency cost; accepted for the payoff.
+- **G1 — Symbol-level collision detection.** Move `touches[]` overlap from *path-prefix* to *symbol/dependency* awareness (`src/bongos/path-match.js` `touchesOverlap`/`matchOne`, consumed by `claims.js`). **Why:** path-prefix over-flags — two tasks editing different functions in one big file (e.g. `db.js`) are falsely serialized, costing parallelism — and under-detects, missing cross-file collisions where one task changes a symbol another file depends on. [ADR 0049](0049-split-parallel-safety-contract.md) already cut the *cost of being wrong* (touches is advisory, backfilled from the real diff); this attacks the *accuracy of the forecast*, the remaining lever. `git merge` stays the ground-truth backstop.
+- **G2 — AST-based repo-map upgrade.** Replace the regex symbol extractor with a real parser via the `extractFile()` seam [ADR 0063](0063-generated-repo-map-symbol-skeleton.md) explicitly left for this (`scripts/gds/gen-repo-map.js`). **Why:** the regex extractor is server-JS-only, conflates two symbols that share a name, and builds no call graph. A parser (tree-sitter, **WASM build** — which sidesteps the `node-gyp` native-compile cost that [ADR 0063](0063-generated-repo-map-symbol-skeleton.md) rejected) gives polyglot coverage (the Python `art/` pipeline, client `public/game/` JS, SQL), real symbol resolution, and a dependency graph. That graph is the **substrate G1 needs**, and it feeds [ADR 0094](0094-repo-atlas-self-drawing-codebase-map.md)'s atlas **truer edges** than today's `fitness.js` regex-on-`require` facts. This is the one item with a (vendored, no-native-build) dependency cost; accepted for the payoff.
 - **G3 — Surface the "why," forward-facing.** Extract design rationale (`# WHY:`/`# HACK:`/docstrings + ADR rationale) and attach it to the code it explains, surfaced *at the moment of work* rather than left in an archive. **Why:** we already *pay* to capture "why" (the ADR culture, the `# WHY:` convention) — but capture ≠ surfacing, and our builders are memoryless AI agents with a strong instinct to "tidy" load-bearing code, re-breaking solved problems (the fences in our own learnings/memory log). Cheap first cut: feed `# WHY:` + ADR rationale into the recall index; later, auto-inject the governing ADR when an agent opens a file it covers.
 
 ### From claude-mem (concepts 1–5)
@@ -39,7 +39,7 @@ Adopt the following eight concepts. Each is reimplemented in-stack; none require
 - **C1 — Progressive-disclosure retrieval with token-cost visibility.** Layer recall into *cheap index → batch detail*: return a compact index first (IDs + titles, ~tens of tokens each), then fetch full bodies only for the few the agent selects (`modules/memory/routes/search.js`, `scripts/gds/recall.js`, the recall skill). **Why:** recall returns a flat list of snippets today; layering it yields ~10× fewer tokens per query (claude-mem's documented figure), which compounds across every session and serves the $5K / token-frugal posture directly. **Independent of grep-vs-semantic** — it's a presentation/cost pattern over whatever retrieval leg(s) the companion ADR chooses.
 - **C2 — Hook graceful-degradation policy.** Codify one rule across the hook fleet (`.claude/hooks/*`, memory-sync in `ship.js`, the Conductor): an **infrastructure** failure (ECONNREFUSED / timeout / 5xx) → **exit 0, never block** the builder; a **code bug** (4xx / TypeError) → **exit 2, block** so it's fixed. **Why:** we run many hooks; a droplet hiccup must never freeze a session mid-work. (The unreachable-API condition encountered while authoring this very ADR is the canonical example.)
 - **C3 — Memory-usefulness feedback loop.** Record whether a recalled chunk / learning was actually used, and let that signal drive ranking and decay (`modules/memory`, `learnings`). **Why:** nothing today tracks whether recalled knowledge helped; a usefulness signal lets high-value memory rise and dead weight fade, keeping the corpus high-signal as it grows. Pairs naturally with graphify's `save-result` (useful / dead_end / corrected).
-- **C4 — `<private>` content-exclusion marker.** A tag an agent can wrap around sensitive content so it never enters the memory store (`modules/memory` ingest; complements the BFG transcript scrub). **Why:** a simple, explicit opt-out that reinforces the trust boundary ([ADR 0016](<redacted>.md)) — secrets, permission-core internals, sub-Metic-sensitive material fenced out at the source.
+- **C4 — `<private>` content-exclusion marker.** A tag an agent can wrap around sensitive content so it never enters the memory store (`modules/memory` ingest; complements the BFG transcript scrub). **Why:** a simple, explicit opt-out that reinforces the trust boundary ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) — secrets, permission-core internals, sub-Metic-sensitive material fenced out at the source.
 - **C5 — Windowed content-hash dedup.** On write, hash `(session + title + body)` and, if the same hash reappears within a short window, reuse the existing row instead of inserting (`modules/memory`, `learnings.js`). **Why:** stops near-duplicate memory/learning entries; complements the existing `source_ref` soft-idempotency.
 
 ## What we decline (and why)

package/docs/adr/0095-cross-agent-context-management.md

@@ -4,11 +4,11 @@
 - **Date:** 2026-06-27
 - **Deciders:** Lars (owner) · Claude (Opus 4.8)
 - **Track:** `internal` (Cloud Bongos / context + retrieval)
-- **Relates to:** [ADR 0083](<redacted>.md) / [ADR 0091](<redacted>.md) — the modular decomposition is the *structural* half of low-context AI navigation; this ADR is the *findability* half (see Context). Also [ADR 0094](<redacted>.md) (the codebase map), [ADR 0061](<redacted>.md) / [ADR 0063](<redacted>.md) (the context layers it feeds). Companion: [ADR 0095-a](<redacted>.md) — adopts the memory/retrieval *concepts* and explicitly defers the grep-vs-semantic decision to this ADR (the two collided on `0095` in parallel; see the index note).
+- **Relates to:** [ADR 0083](0083-modular-architecture-strangler-build-plan.md) / [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) — the modular decomposition is the *structural* half of low-context AI navigation; this ADR is the *findability* half (see Context). Also [ADR 0094](0094-repo-atlas-self-drawing-codebase-map.md) (the codebase map), [ADR 0061](0061-context-layer-decomposition.md) / [ADR 0063](0063-generated-repo-map-symbol-skeleton.md) (the context layers it feeds). Companion: [ADR 0095-a](0095-borrowed-memory-and-retrieval-concepts.md) — adopts the memory/retrieval *concepts* and explicitly defers the grep-vs-semantic decision to this ADR (the two collided on `0095` in parallel; see the index note).
 
 ## Context
 
-Cloud Bongos is an AI-first build platform, and today its agent-facing surface is shaped almost entirely for one tool — Claude Code: the always-loaded root `CLAUDE.md` ([ADR 0061](<redacted>.md)), the `.claude/` skills + hooks, a lexical-first retrieval layer ([ADR 0060](0060-gds-retrieval-layer.md)), and a generated repo-map ([ADR 0063](<redacted>.md)). The owner wants Cloud Bongos instances to be editable across many agentic coding tools (Claude Code, OpenAI Codex, Cursor, …). That raises two questions a future version must answer:
+Cloud Bongos is an AI-first build platform, and today its agent-facing surface is shaped almost entirely for one tool — Claude Code: the always-loaded root `CLAUDE.md` ([ADR 0061](0061-context-layer-decomposition.md)), the `.claude/` skills + hooks, a lexical-first retrieval layer ([ADR 0060](0060-gds-retrieval-layer.md)), and a generated repo-map ([ADR 0063](0063-generated-repo-map-symbol-skeleton.md)). The owner wants Cloud Bongos instances to be editable across many agentic coding tools (Claude Code, OpenAI Codex, Cursor, …). That raises two questions a future version must answer:
 
 1. **Retrieval** — how do we make a repo navigable by tools that find code by literal text search ("grep"), and is a meaning-based ("semantic") retrieval layer worth its recurring cost and index-drift?
 2. **Portability** — how should the agent-facing contract (instructions, commands, enforcement, capabilities) be structured so it isn't hardwired to one tool?
@@ -20,10 +20,10 @@ The durable findings:
 - **Agents navigate by grep, not embeddings.** Claude Code, Codex, and Cursor all default to literal search (generate query → grep → read → iterate). Anthropic and Sourcegraph both *removed* embedding indexes from their code tools (precision on exact identifiers, freshness/anti-staleness, privacy, cost); Cursor keeps embeddings but only *alongside* grep and fights staleness with incremental Merkle-tree re-indexing. So a literal-search-friendly repo is the high-leverage, low-cost target.
 - **Greppability is mostly free, write-time discipline that doesn't rot:** distinctive (not generic) names, "the Grep Test" (never construct or dispatch identifiers dynamically), one concept = one name (don't re-case across boundaries), unique whole log/error strings, flat namespaces. Generic identifiers are the single biggest documented retrieval-killer for agents.
 - **The best "semantic layer" is meaning written into the source.** Docstrings, module headers, READMEs, and ADRs co-locate concept words with the symbol — which helps grep, agentic search, *and* any future embedding, at zero recurring cost and zero index-drift (the "index" is the version-controlled text). OTB already has the structural half (the generated repo-map with a CI freshness gate) and the ADR/README half; the missing piece is per-symbol/per-module docstrings + consistent concept vocabulary.
-- **Cross-tool portability is an adapter problem** — one canonical source per concern + thin per-tool adapters: instructions → an `AGENTS.md`-style canonical file with thin per-tool pointers; commands → plain CLI (already true — slash-commands wrap `scripts/gds/*.js`); enforcement → server/git/CI, never tool hooks (already true — the trust boundary, [ADR 0016](<redacted>.md)); capabilities → MCP (already cross-tool). This is the [ADR 0062](<redacted>.md) / [0081](<redacted>.md) core↔host / swappable-adapter pattern applied to the agent surface.
+- **Cross-tool portability is an adapter problem** — one canonical source per concern + thin per-tool adapters: instructions → an `AGENTS.md`-style canonical file with thin per-tool pointers; commands → plain CLI (already true — slash-commands wrap `scripts/gds/*.js`); enforcement → server/git/CI, never tool hooks (already true — the trust boundary, [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)); capabilities → MCP (already cross-tool). This is the [ADR 0062](0062-medusa-instance-model-decoupling.md) / [0081](0081-tool-agnostic-design-layer.md) core↔host / swappable-adapter pattern applied to the agent surface.
 - **The Cloud Bongos shape:** *how a repo is managed for agents* becomes a project-init **profile** that provisions the right adapter set (which context files, which command wrappers, which retrieval posture, which enforcement). It is a start-of-project decision because naming conventions and whether to stand up an embedding pipeline are expensive to retrofit.
 
-**Relationship to the modular decomposition ([ADR 0083](<redacted>.md) / [ADR 0091](<redacted>.md)).** These were authored alongside this ADR and are the *other half* of the same goal — an AI agent that navigates the codebase at low context cost. The decomposition bounds *how much* an agent must load: a domain becomes a module reached through one doorway, not a 6k-LOC monolith (0091's explicit "AI-scoping payoff"). This ADR is the complementary *findability* layer — meaning written into the source so the agent locates the right module/symbol by search. They compose directly: **the module-header doc-comments decided here are authored per module precisely because 0091 makes the module the unit of scoping**, and each sits beside that module's nested `CLAUDE.md` and the generated repo-map ([ADR 0063](<redacted>.md)). The deferred `AGENTS.md` adapter + per-project agent profile are likewise the agent-surface counterpart to 0091's core↔module boundaries.
+**Relationship to the modular decomposition ([ADR 0083](0083-modular-architecture-strangler-build-plan.md) / [ADR 0091](0091-bounding-the-kernel-and-db-carve.md)).** These were authored alongside this ADR and are the *other half* of the same goal — an AI agent that navigates the codebase at low context cost. The decomposition bounds *how much* an agent must load: a domain becomes a module reached through one doorway, not a 6k-LOC monolith (0091's explicit "AI-scoping payoff"). This ADR is the complementary *findability* layer — meaning written into the source so the agent locates the right module/symbol by search. They compose directly: **the module-header doc-comments decided here are authored per module precisely because 0091 makes the module the unit of scoping**, and each sits beside that module's nested `CLAUDE.md` and the generated repo-map ([ADR 0063](0063-generated-repo-map-symbol-skeleton.md)). The deferred `AGENTS.md` adapter + per-project agent profile are likewise the agent-surface counterpart to 0091's core↔module boundaries.
 
 ## Decision
 
@@ -53,6 +53,6 @@ Everything else from the research is recorded below as **deferred** — explicit
 
 ## C4 — `<private>` content-exclusion marker (shipped, task [#1661](https://example.com/builders#/task/1661))
 
-An agent can wrap sensitive content in a `<private>…</private>` fence so it **never** enters the memory/learning store nor the recall index — the explicit, write-time opt-out that reinforces the trust boundary ([ADR 0016](<redacted>.md)) and complements the BFG transcript scrub: secrets, permission-core internals, and sub-Metic-sensitive material fenced out *at the source*.
+An agent can wrap sensitive content in a `<private>…</private>` fence so it **never** enters the memory/learning store nor the recall index — the explicit, write-time opt-out that reinforces the trust boundary ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) and complements the BFG transcript scrub: secrets, permission-core internals, and sub-Metic-sensitive material fenced out *at the source*.
 
 Implementation (all in `modules/memory`): a pure `stripPrivate()` in `search-chunker.js` removes every `<private>…</private>` region and is applied at **every** ingest/persist entry point — `storeMemoryFile`, `storeMemoryFilesBatch`, and the BFG cross-builder `bfgWriteMemoryFile` in `memory.js`; `createLearning` in `learnings.js` (title + body); and `chunkMarkdown` (the recall index) itself. The match is **case-insensitive and whitespace-tolerant** (`<private>`, `<PRIVATE>`, `< private >`) and **fail-closed**: an unbalanced `<private>` with no matching close strips to end-of-content, so a half-typed marker can't leak the secret it was meant to hide. A learning whose entire body is fenced strips to empty and is rejected like any other empty body.

package/docs/adr/0096-require-reward-before-workable.md

@@ -8,7 +8,7 @@
 ## Context — the problem
 
 Every task carries a `credits_reward` integer — the in-world example payout when it
-ships ([ADR 0023](<redacted>.md), [ADR 0054](<redacted>.md)).
+ships ([ADR 0023](0023-kind-multipliers-and-idea-bonus.md), [ADR 0054](0054-session-token-reward-cost-plus.md)).
 That column was created with `NOT NULL DEFAULT 0` (migration `003_pms.sql`). Nothing in
 the lifecycle ever required it to be set, so the default path was:
 
@@ -73,7 +73,7 @@ next promotion or claim of an unrewarded task.
 
 ## Anti-gaming — the reward stays author-set
 
-[ADR 0023](<redacted>.md) makes `credits_reward` an author-set,
+[ADR 0023](0023-kind-multipliers-and-idea-bonus.md) makes `credits_reward` an author-set,
 review-gated value on purpose (auto-deriving it from `est_minutes` would be trivially
 gameable — inflate the estimate, inflate the payout). This ADR preserves that stance:
 
@@ -138,7 +138,7 @@ first. That is friction the methodology doesn't want — the goal is "no task is
 
 ### Anti-gaming — the cap + the audit (this reverses ADR 0023's strict author-set stance, narrowly)
 
-[ADR 0023](<redacted>.md) made `credits_reward` strictly
+[ADR 0023](0023-kind-multipliers-and-idea-bonus.md) made `credits_reward` strictly
 author-set precisely because auto-deriving it from `est_minutes` is gameable (inflate the
 estimate → inflate the pay). Auto-assigning at the gate crosses that line — so two guards
 contain the blast radius:
@@ -154,7 +154,7 @@ contain the blast radius:
    change is itself visible on the task. The assignment is never silent.
 
 3. **The PRIMARY pay driver is unchanged and ungameable.** Builder earnings are driven by the
-   **cost-plus session reward** ([ADR 0054](<redacted>.md)) —
+   **cost-plus session reward** ([ADR 0054](0054-session-token-reward-cost-plus.md)) —
    `round(true_cost_usd × 1.20)` per shipped session, derived from real token cost, not from
    any author-set or auto-derived per-task number. The per-task `credits_reward` is a modest,
    capped floor on top of that; capping it keeps the gameable lever small.
@@ -198,7 +198,7 @@ zeros waiting to be filled in.
   primary point, promote/claim the safety net.
 
 The **cap + anti-gaming reasoning is unchanged** — the same `REWARD_SUGGESTION_CAP` bounds the
-auto-assigned floor, and the ungameable cost-plus session reward ([ADR 0054](<redacted>.md))
+auto-assigned floor, and the ungameable cost-plus session reward ([ADR 0054](0054-session-token-reward-cost-plus.md))
 remains the **primary** pay driver. This per-task value stays a modest, capped, audited floor; it
 just now lands at birth instead of at first-work.