Files

T

kami 0cc6302245 Audit Phase 1: correctness and scheduling safety

Implements every P0 from AUDIT.md plus four P1s, across both halves of the
pipeline. Verified by CPU-only self-checks and the orchestrator test suite.
No GPU work ran and no pipeline ran.

workpc:
- worker_scene: read speaker_ref, not the rewritten speaker field. Every line
  narrated as "Someone" before this. Emit `actions` for the verifier.
- worker_script: declare beat + verifier_feedback (pydantic dropped both, so
  the retry was blind) and render them as a repair prompt.
- worker_vision: gate face->identity pairing on containment, assign globally
  shortest-first, map an out-of-range resolver index to `unresolved` instead
  of minting a character, parse JSON with raw_decode.
- session_manager: tear down a server whose lease vanished mid-load, and spawn
  the supervisor respawn unlocked.

orchestrator (edited in place, NOT committed there):
- tracklets: canonicalize gender, add co-presence cannot-links, block
  transitive bridges across a hard constraint.
- correctness: stop failing valid narration on sentence-initial capitals and
  short quotes; read action evidence from the singular key.
- db: stop orphan flags leaking into every chapter; resolve by flag id.
- service: TTS returns instead of raising under GATES, auto-resolves under
  autonomous mode; job admission control; registry names on dialogue resume.
- session_proxy: queue on 409 instead of stealing the lease; run heartbeats.

Docs restructured per the repo-structure layout: CLAUDE.md is a pointer table,
NEXT.md replaces HANDOFF.md, plus ROADMAP.md, JOURNAL.md, decisions/ and
caveats/. AUDIT.md now points at those instead of restating them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XD7cAy81MZrc7gCr6aZGWr

2026-08-11 10:16:24 +04:00

3.6 KiB

Raw Blame History

ROADMAP

Ordered outcomes past the current one. Phase 1 landed on 2026-08-11 and moved to decisions/audit-phase1.md. The reasoning behind every phase is in AUDIT.md.

Approval boundary from the audit: ship Phase 2 and measure it. Then decide whether Phase 3 and 4 are worth the size of the change.

Phase 2: safe throughput

Unblocks: a chapter that finishes in a fraction of the current wall time without changing any model. Done when: the same labeled chapter runs with two gemma loads instead of seven. The acceptance numbers below are recorded in a report.

Two-phase gemma lease schedule, so the model stays resident across compatible stages.
JSON-schema-constrained generation for detect, dialogue, roster, direction, same-person, and resolve.
--media-path /dev/shm and file:// image paths instead of base64 data URIs.
An ephemeral /dev/shm cache keyed by S3 URI plus etag, and reused direction downloads.
Batched siglip embeddings, one forward pass per bounded image batch.
Batched scene construction and SQLite writes. Set busy_timeout first (caveats/audit-open.md#sqlite-locking).
Bounded fetch and framed-page crop concurrency.
Images before the differing instruction in every multi-call prompt, so llama-server reuses its KV cache prefix across the two direction passes.

Phase 3: multi-view constrained identity

Unblocks: an identity that survives a reviewer disagreeing with it. Done when: false merges and false splits are reported per labeled chapter and the resolver beats the Phase 1 baseline on both.

Chapter-local tracklets persisted as a resumable homesrv artifact, not worker memory.
Face and body galleries with crop-quality selection, and 2-4 query views per tracklet.
Global constraints at resolution: must-link inside a tracklet, cannot-link for co-presence, gender and species gates, manual locks, one appearance per character per panel.
Name claims separated from visual identity. Roster names stay candidate vocabulary.
Reversible merges: a cluster with canonical_id, member_ids, and cannot_link, replacing the destructive delete (caveats/audit-open.md#destructive-reconcile).
Identity evaluation extended to purity, fragmentation, name binding, and speaker accuracy.

Phase 4: evidence-ledger narration

Unblocks: narration that can be checked against the panel rather than trusted. Done when: every beat carries an evidence artifact and the verifier reports quote grounding, action coverage, and future-fact leakage against it.

Ordered beat evidence: panels, actions, chronology, dialogue ids, typed speaker refs, uncertainty.
Scene-scoped story and turn-taking state, reset on location and time changes.
Script chunks of 6-12 consecutive beats per text-only call, returning evidence ids.
Confidence-aware wording: a weak speaker becomes someone, not a confident name.
Targeted per-beat repair driven by the exact failures.

Acceptance criteria

Capture a baseline and compare the same labeled chapter after every phase.

Stage wall time and model-load time.
Gemma call count and repair call count.
MinIO bytes moved, prompt-evaluation and generation timings.
Tracklet false merges and splits, identity accuracy.
Name and speaker accuracy, unresolved correctness flags.
Script repetition, unsupported facts, verifier retry rate.
The share of narrated lines whose speaker is a named character rather than Someone. That one number would have caught decisions/audit-phase1.md#speaker-ref-is-canonical the day it landed.

Read caveats/audit-open.md#inconsistent-stage-policy before trusting any per-stage count.