One harness, five roles

code assemble decides what this task sees: the locks that bind it, what changed since it last read them, its open flags, its last rationale. The bundle is recorded.

→

model generate writes one part of the artifact it owns, and may FLAG, ASK or OFFER on the side.

→

model · a different prompt critique scores the proposal on three named dimensions against the locks; can force one revision before commit.

→

code resolve pins the answer to the ids it asked for, merges the part in, bumps the lock, routes flags to the Director and asks to the Producer.

→

code record appends every step, with its cause and its cost, to the log. Then the department sleeps.

Two of the five steps are a model. Three are code, and code cannot be talked out of anything.

Who sees what

Read access is a permission; attention is a budget. The design separates them.

• Readable. The whole log, every artifact, every bundle. No department is ever denied a read.
• Woken. Only by subscription. Camera does not wake when Sound commits a cue, because it does not subscribe to the audio timeline. Broadcast would burn the budget on no-op wakes.
• Bundled. What the assembler actually puts in front of the model: the artifacts this department subscribes to, each annotated with what changed since it last read it (script v4 → v5), the open flags on its own work, and its own last rationale. Not the whole script. Not the whole log.

The bundle is stored on the wake event, part by part with a token count each, so when an output is wrong, the first question (what did it have in front of it?) is a click away in the Inspector.

Two departments see everything, by design. The Director is subscribed to every FLAG and OFFER, because resolving conflicts is its artifact. The Producer is subscribed to every ASK and every cost, because the Brief and the ledger are its artifacts.

The critic

The critic is the same department in a different role with a different prompt. It scores the proposal on three named dimensions against the binding locks (holds, true, earned for Story; consistency, authenticity, generatable for Look & Cast) and returns a severity. Revise or block sends the generator round once more with the critic’s notes before anything is committed. The scores land on the commit, so the Margins show what the department thought of its own work.

The design’s bet is that the critic should be a different model family from the generator, because two families rarely share a blind spot and a critic that agrees with everything is worse than none. The prototype runs one model in every role. Which model ran which role is on every event, so the bet can be measured later rather than believed.

Written in parts

The first thing that broke was the size of an answer. Ask a department for the whole shot list and the reply arrives cut off, or as valid JSON about the wrong shots. So every artifact is written in parts. Story plans the scenes in one call and writes each scene’s shots in another. Look & Cast writes the look, then the characters in twos. Camera writes shot list entries a few ids at a time. Each retry pass asks for fewer ids than the last, until it is asking for one, which is what a struggling model can manage.

The resolver pins every answer to the ids it asked for. Entries about other ids are dropped; if none match but the count is right, the answer is taken in the order asked and a note says so; if nothing matches, the batch is refused rather than committed. A failed call costs one part. The same code is the recovery path: the board’s only retry button is write the missing parts, and a projection decides what is missing.

Recovery is a projection

“What is still unwritten at this gate” is computed from the log, not remembered by the runtime: scenes without shots, characters the shot list cites that the bible does not define, shots without a cue, without a test, without a video prompt. Close the tab mid-round and reopen it: the list is the same, and the button does the same thing.