demo: real synthetic headshots — fetch pool + serve route + UI wire

Three layers shipped:

1. SCRIPT — scripts/staffing/fetch_face_pool.py
   Pulls N synthetic StyleGAN faces from thispersondoesnotexist.com
   into data/headshots/face_NNNN.jpg, writes manifest.jsonl. Idempotent:
   re-running skips existing files. Optional gender tagging via deepface
   (currently unavailable on this box; the script handles ImportError
   gracefully and tags everything as untagged). Fetched 198 faces with
   concurrency=3 in ~67s.

2. SERVER — /headshots/:key route in mcp-server/index.ts
   Loads manifest at first hit, caches in globalThis._faces. Hashes the
   key with djb2-style mixing → pool index → returns the JPG. Same
   key always gets the same face (deterministic). Accepts
   ?g=man|woman&e=caucasian|black|hispanic|south_asian|east_asian|middle_eastern
   to bias pool selection — the gender/ethnicity buckets fall back to
   the full pool when no tagged matches exist. Cache-Control:
   86400 immutable so faces ride the browser cache after first hit.
   /headshots/__reload re-reads the manifest without restart.

3. UI — search.html + console.html worker cards
   Re-added overlay <img> on top of the monogram .av circle. img.src
   = /headshots/<encoded-key>?g=<hint>&e=<hint>. img.onerror removes
   the failed image so the monogram stays visible if the face pool
   isn't fetched / CDN is blocked. .av now has overflow:hidden +
   position:relative to clip the img to a perfect circle.

Forced-confident name resolution (J: "we're CREATING the profile,
created as though you truly have the information Xavier is more
likely Hispanic and he's a male"):

   genderFor(name)        — looks up MALE_NAMES + FEMALE_NAMES,
                            falls back to a deterministic hash split
                            so unknown names spread ~50/50. Sets now
                            include cross-cultural names: Alejandro/
                            Andres/Mateo/Santiago/Joaquin/Cesar/Hugo/
                            Felipe/Gerardo/Salvador/Ramon (Hispanic),
                            Raj/Anil/Vikram/Krishna/Pradeep (South
                            Asian), Wei/Yi/Hiroshi/Akira/Hyun (East
                            Asian), Demetrius/Kareem/DaQuan/Khalil
                            (Black), Omar/Khalid/Hassan/Ahmed/Bilal
                            (Middle Eastern). FEMALE_NAMES extended
                            in parallel.

   guessEthnicityFromFirstName(name)
                          — confident default of 'caucasian' for any
                            name not in the cultural buckets so every
                            worker resolves to a category the face
                            pool can be biased toward. Order: ME → Black
                            → Hispanic → South Asian → East Asian →
                            Caucasian (matters where names overlap,
                            e.g. Aisha appears in ME + Black, biases
                            toward ME for visual fit).

   Both helpers also ported into console.html so the triage backfills
   and try-it-yourself rendering get the same hint stack.

Privacy note in the script + route comments: the synthetic data uses
the worker's name as the seed; production should hash worker_id (not
name) to avoid leaking PII to a third-party CDN. The fetch URL itself
is referenced once per pool build, not per-worker.

.gitignore — added data/headshots/face_*.jpg (~100MB for 198 faces;
the manifest + script are tracked). Re-running the script on a fresh
checkout rebuilds the pool from scratch.

Verified end-to-end via playwright on devop.live/lakehouse:
   forklift query → 10 worker cards
   10/10 with face images (real synthetic headshots, not monograms)
   0/10 broken
   Alejandro G. Nelson  → ?g=man&e=hispanic
   Patricia K. Garcia    → ?g=woman&e=caucasian
   Each name → unique face, deterministic across loads.
   Console triage backfills get the same treatment.

.gitignore

@@ -4,3 +4,7 @@
 .env
 __pycache__/
 *.pyc
+
+# Headshot pool — binary face JPGs are fetched by scripts/staffing/fetch_face_pool.py
+# (synthetic StyleGAN, ~100MB for 200 faces). Manifest + fetch script are tracked.
+data/headshots/face_*.jpg

Cargo.lock

@@ -4093,6 +4093,7 @@ dependencies = [
  "tracing-opentelemetry",
  "tracing-subscriber",
  "truth",
+ "validator",
  "vectord",
 ]
 
@@ -8912,6 +8913,8 @@ dependencies = [
 name = "validator"
 version = "0.1.0"
 dependencies = [
+ "arrow 55.2.0",
+ "parquet 55.2.0",
  "serde",
  "serde_json",
  "thiserror 2.0.18",

auditor/audit.ts

@@ -23,6 +23,7 @@ import { runStaticCheck } from "./checks/static.ts";
 import { runDynamicCheck } from "./checks/dynamic.ts";
 import { runInferenceCheck } from "./checks/inference.ts";
 import { runKbCheck } from "./checks/kb_query.ts";
+import { runKimiArchitectCheck } from "./checks/kimi_architect.ts";
 
 const VERDICTS_DIR = "/home/profit/lakehouse/data/_auditor/verdicts";
 // Playbook for audit findings — one row per block/warn finding from a
@@ -67,6 +68,29 @@ export async function auditPr(pr: PrSnapshot, opts: AuditOptions = {}): Promise<
     ...kbFindings,
   ];
 
+  // Kimi-architect second-pass review. Off by default; enabled with
+  // LH_AUDITOR_KIMI=1. Sequential (not in the parallel block above)
+  // because it consumes the prior findings as context — Kimi sees what
+  // deepseek already flagged and is asked "what did everyone miss?"
+  // Failure-isolated by design: any error returns a single info-level
+  // skip finding so the existing audit pipeline never blocks on Kimi.
+  if (process.env.LH_AUDITOR_KIMI === "1") {
+    try {
+      const kimiFindings = await runKimiArchitectCheck(diff, allFindings, {
+        pr_number: pr.number,
+        head_sha: pr.head_sha,
+      });
+      allFindings.push(...kimiFindings);
+    } catch (e) {
+      allFindings.push({
+        check: "kimi_architect",
+        severity: "info",
+        summary: `kimi_architect outer error — ${(e as Error).message.slice(0, 160)}`,
+        evidence: [(e as Error).stack?.slice(0, 360) ?? ""],
+      });
+    }
+  }
+
   const duration_ms = Date.now() - t0;
   const metrics = {
     audit_duration_ms: duration_ms,
@@ -184,7 +208,7 @@ function formatReviewBody(v: Verdict): string {
   lines.push("");
 
   // Per-check sections, only if the check produced findings.
-  const checkOrder = ["static", "dynamic", "inference", "kb_query"] as const;
+  const checkOrder = ["static", "dynamic", "inference", "kb_query", "kimi_architect"] as const;
   for (const check of checkOrder) {
     const fs = byCheck[check] ?? [];
     if (fs.length === 0) continue;
@@ -217,6 +241,6 @@ function formatReviewBody(v: Verdict): string {
   return lines.join("\n");
 }
 
-function stubFinding(check: "dynamic" | "inference", why: string): Finding[] {
+function stubFinding(check: "dynamic" | "inference" | "kimi_architect", why: string): Finding[] {
   return [{ check, severity: "info", summary: `${check} check skipped — ${why}`, evidence: [why] }];
 }

auditor/checks/inference.ts

@@ -33,37 +33,16 @@ const GATEWAY = process.env.LH_GATEWAY_URL ?? "http://localhost:3100";
 // vendor lineage so consensus + tie-break won't fail-correlate).
 const MODEL = process.env.LH_AUDITOR_REVIEW_MODEL ?? "deepseek-v3.1:671b";
 const TIEBREAKER_MODEL = process.env.LH_AUDITOR_TIEBREAKER_MODEL ?? "x-ai/grok-4.1-fast";
-// SHARD_MODEL retained for the legacy callCloud path (still used by
-// runCloudInference's diagnostic mode), but no longer fired by the
-// main inference flow — tree-split was retired 2026-04-27 in favor of
-// the mode runner's matrix retrieval against lakehouse_answers_v1.
-const SHARD_MODEL = process.env.LH_AUDITOR_SHARD_MODEL ?? "qwen3-coder:480b";
 const N_CONSENSUS = Number(process.env.LH_AUDITOR_CONSENSUS_N ?? 3);
-// Bounded parallelism on the tree-split shard loop. Old behavior was
-// fully serial ("keep gateway load bounded") which made huge PRs take
-// 5+ minutes of curation alone. 6 in flight keeps gateway busy without
-// thrashing it; tunable via env.
-const SHARD_CONCURRENCY = Number(process.env.LH_AUDITOR_SHARD_CONCURRENCY ?? 6);
 const AUDIT_DISCREPANCIES_JSONL = "/home/profit/lakehouse/data/_kb/audit_discrepancies.jsonl";
-// 40KB comfortably fits gpt-oss:120b's context. PR #1 (~39KB) was
-// previously truncated at 15KB causing the reviewer to miss later
-// files (gitea.ts, policy.ts) and flag "no Gitea client present" as a
-// block finding when the file was simply outside the truncation window.
-//
-// Above this threshold we curate via tree-split rather than truncate,
-// following the scrum_master pattern: shard the diff, summarize each
-// shard against the claim-verification task, merge into a compact
-// scratchpad, then ask the cloud to verify claims against the
-// scratchpad. This gives the cloud full-PR fidelity without bursting
-// its context window (observed failure mode: empty response or
-// unparseable output when prompt exceeds model's comfortable range).
+// 40KB comfortably fits the consensus models' context windows
+// (deepseek-v3.1 64K, gpt-oss-120b 128K). When the raw PR diff
+// exceeds this, we truncate and signal it via curationNote — the
+// pr_audit mode runner's matrix retrieval (lakehouse_answers_v1 +
+// arch + symbols) supplies the cross-PR context that tree-split
+// used to synthesize from scratch. Tree-split itself was retired
+// 2026-04-27 (see commit deleting treeSplitDiff/callCloud/SHARD_*).
 const MAX_DIFF_CHARS = 40000;
-// Tree-split kicks in above this. 30KB is below MAX_DIFF_CHARS so we
-// curate BEFORE truncation would happen — never lose signal to a hard
-// cut. Shard size is chosen so ~10 shards cover PR #8-size diffs in a
-// reasonable round-trip budget.
-const CURATION_THRESHOLD = 30000;
-const DIFF_SHARD_SIZE = 4500;
 const CALL_TIMEOUT_MS = 120_000;
 // Mode runner can take longer than a raw /v1/chat call because it does
 // pathway-fingerprint lookup + matrix retrieval + relevance filter
@@ -169,12 +148,16 @@ export async function runInferenceCheck(
   interface Votes { trues: number; falses: number; evidences: string[] }
   const votesByClaim = new Map<number, Votes>();
   const unflaggedByRun: any[][] = [];
-  let totalLatencyMs = 0;
+  // The N=3 consensus calls run via Promise.all — wall-clock is
+  // bounded by the SLOWEST call, not the sum. Pre-2026-04-27 we
+  // summed and reported "Xms total" which double/triple-counted
+  // (Opus self-audit caught it). Use max for accurate wall-clock.
+  let maxLatencyMs = 0;
   let totalEnrichedChars = 0;
   let bugFingerprintsSeen = 0;
   let matrixKeptSeen = 0;
   for (const run of parsedRuns) {
-    totalLatencyMs += run.latency_ms ?? 0;
+    maxLatencyMs = Math.max(maxLatencyMs, run.latency_ms ?? 0);
     totalEnrichedChars += run.enriched_chars ?? 0;
     bugFingerprintsSeen = Math.max(bugFingerprintsSeen, run.bug_fingerprints ?? 0);
     matrixKeptSeen = Math.max(matrixKeptSeen, run.matrix_kept ?? 0);
@@ -199,7 +182,7 @@ export async function runInferenceCheck(
   findings.push({
     check: "inference",
     severity: "info",
-    summary: `pr_audit mode runner completed (model=${MODEL}, consensus=${parsedRuns.length}/${N_CONSENSUS}, ${totalLatencyMs}ms total)${curationNote}`,
+    summary: `pr_audit mode runner completed (model=${MODEL}, consensus=${parsedRuns.length}/${N_CONSENSUS}, ${maxLatencyMs}ms wall-clock)${curationNote}`,
     evidence: [
       `claims voted: ${votesByClaim.size}`,
       `parsed runs: ${parsedRuns.length} / ${N_CONSENSUS}`,
@@ -443,60 +426,28 @@ async function runModeRunnerInference(
       error: "unparseable", diagnostic: (e as Error).message, model,
     };
   }
-  const content: string = body?.response ?? "";
+  const content: string = typeof body?.response === "string" ? body.response : "";
   const parsed = extractJson(content);
+  // Number-coerced extractors so a non-numeric upstream value (string,
+  // null, NaN) collapses to 0 instead of poisoning downstream
+  // arithmetic. Caught 2026-04-27 by kimi_architect self-audit —
+  // optional-chaining + ?? only catches null/undefined, not type drift.
+  const num = (v: unknown): number => {
+    const n = typeof v === "number" ? v : Number(v);
+    return Number.isFinite(n) ? n : 0;
+  };
   return {
     parsed,
-    latency_ms: body?.latency_ms ?? 0,
-    enriched_chars: body?.enriched_prompt_chars ?? 0,
-    bug_fingerprints: body?.sources?.bug_fingerprints_count ?? 0,
-    matrix_kept: body?.sources?.matrix_chunks_kept ?? 0,
+    latency_ms: num(body?.latency_ms),
+    enriched_chars: num(body?.enriched_prompt_chars),
+    bug_fingerprints: num(body?.sources?.bug_fingerprints_count),
+    matrix_kept: num(body?.sources?.matrix_chunks_kept),
     error: parsed ? undefined : "unparseable",
     diagnostic: parsed ? undefined : content.slice(0, 200),
     model,
   };
 }
 
-// Legacy direct /v1/chat caller — kept for callers outside the
-// pr_audit pipeline. Currently unused after the 2026-04-26 mode-runner
-// rebuild; preserved so we can A/B against the mode runner if a
-// regression surfaces.
-async function runCloudInference(systemMsg: string, userMsg: string, model: string): Promise<{ parsed: any | null; tokens: number; error?: string; diagnostic?: string; model: string }> {
-  let resp: Response;
-  try {
-    resp = await fetch(`${GATEWAY}/v1/chat`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        provider: "ollama_cloud",
-        model,
-        messages: [
-          { role: "system", content: systemMsg },
-          { role: "user", content: userMsg },
-        ],
-        max_tokens: 3000,
-        temperature: 0,
-        think: true,
-      }),
-      signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
-    });
-  } catch (e) {
-    return { parsed: null, tokens: 0, error: "unreachable", diagnostic: (e as Error).message.slice(0, 200), model };
-  }
-  if (!resp.ok) {
-    return { parsed: null, tokens: 0, error: "non_200", diagnostic: `${resp.status}: ${(await resp.text()).slice(0, 160)}`, model };
-  }
-  let body: any;
-  try { body = await resp.json(); }
-  catch (e) { return { parsed: null, tokens: 0, error: "unparseable", diagnostic: (e as Error).message, model }; }
-  const content: string = body?.choices?.[0]?.message?.content ?? "";
-  const tokens: number = body?.usage?.total_tokens ?? 0;
-  const parsed = extractJson(content);
-  if (!parsed) {
-    return { parsed: null, tokens, error: "unparseable", diagnostic: content.slice(0, 200), model };
-  }
-  return { parsed, tokens, model };
-}
 
 async function persistDiscrepancies(ctx: InferenceContext, discrepancies: any[]): Promise<void> {
   await mkdir("/home/profit/lakehouse/data/_kb", { recursive: true });
@@ -540,111 +491,7 @@ async function extractAndPersistFacts(scratchpad: string, ctx: InferenceContext)
   await appendFile(AUDIT_FACTS_JSONL, JSON.stringify(row) + "\n");
 }
 
-// Curation via tree-split — ports the scrum_master pattern into the
-// inference check. Shards the raw diff into DIFF_SHARD_SIZE chunks,
-// summarizes each shard *against the claim-verification task* so the
-// summary preserves exactly what the cloud needs to judge claims
-// (function signatures, struct fields, deletions, new files), drops
-// everything else. Merges into a compact scratchpad.
-//
-// Cost: N cloud calls for shard summaries + the final verification.
-// Pre-2026-04-26 the shard loop ran serially "to keep gateway load
-// bounded" — turned out to be a bottleneck on PRs with 50+ shards
-// (5+ minutes of curation). Now bounded-parallel via
-// SHARD_CONCURRENCY: in-flight ≤ N at any time, gateway stays calm,
-// wall-clock drops 4-6×.
-//
-// Determinism: each shard summary call uses temp=0 + think=false
-// (same as before), so identical input yields identical scratchpad.
-// Order is preserved by indexed-write into a fixed-length array
-// before string-join, so concurrency doesn't shuffle the scratchpad.
-async function treeSplitDiff(
-  fullDiff: string,
-  claims: Claim[],
-): Promise<{ scratchpad: string; shards: number }> {
-  const shards: Array<{ from: number; to: number; text: string }> = [];
-  for (let i = 0; i < fullDiff.length; i += DIFF_SHARD_SIZE) {
-    const end = Math.min(i + DIFF_SHARD_SIZE, fullDiff.length);
-    shards.push({ from: i, to: end, text: fullDiff.slice(i, end) });
-  }
-  // Curate the claim list into a short form the summary prompt can
-  // use to bias extraction toward relevant facts.
-  const claimDigest = claims.map((c, i) =>
-    `${i}. [${c.strength}] "${c.text.slice(0, 100)}"`
-  ).join("\n");
 
-  const buildPrompt = (si: number, shard: { from: number; to: number; text: string }): string => [
-    `You are summarizing shard ${si + 1}/${shards.length} (chars ${shard.from}..${shard.to}) of a PR diff.`,
-    `The downstream task will verify these ship-claims against the full-PR summary. Extract ONLY facts that could confirm or refute these claims:`,
-    "",
-    claimDigest,
-    "",
-    "Extract: new function/method signatures, struct fields, deletions, new files, wiring (function X calls Y), absence-of-implementation markers, TODO comments on added lines.",
-    "Skip: comment-only edits, whitespace, import reordering, unrelated cosmetic changes.",
-    "",
-    "─────── shard diff ───────",
-    shard.text,
-    "─────── end shard ───────",
-    "",
-    "Output: up to 180 words of facts in bullet form. No prose preamble, no claim verdicts (that's for the downstream step).",
-  ].join("\n");
-
-  // Pre-allocate so we can write back at the original index from
-  // out-of-order completion.
-  const summaries: string[] = new Array(shards.length).fill("");
-  let nextIdx = 0;
-  async function worker() {
-    while (true) {
-      const myIdx = nextIdx++;
-      if (myIdx >= shards.length) return;
-      const r = await callCloud(buildPrompt(myIdx, shards[myIdx]), 400);
-      summaries[myIdx] = r.content;
-    }
-  }
-  const concurrency = Math.max(1, Math.min(SHARD_CONCURRENCY, shards.length));
-  await Promise.all(Array.from({ length: concurrency }, worker));
-
-  let scratchpad = "";
-  for (const [si, shard] of shards.entries()) {
-    const summary = summaries[si];
-    if (summary) {
-      scratchpad += `\n--- shard ${si + 1} (chars ${shard.from}..${shard.to}) ---\n${summary.trim()}\n`;
-    }
-  }
-  return { scratchpad: scratchpad.trim(), shards: shards.length };
-}
-
-// Minimal cloud caller used only by treeSplitDiff — same gateway +
-// model as the top-level call, but think=false. Shards are small
-// (≤DIFF_SHARD_SIZE ~4500 chars) and the task is pure fact
-// extraction, not reasoning. think=true on the shards introduced
-// variance in reasoning traces that compounded across 23 calls into
-// a non-deterministic scratchpad (observed during curation
-// validation: same-SHA runs produced 5/7/8 final findings).
-// think=false on small prompts is stable — only breaks at the main
-// call's 10K+ prompt size, which keeps think=true.
-async function callCloud(prompt: string, maxTokens: number): Promise<{ content: string }> {
-  try {
-    const r = await fetch(`${GATEWAY}/v1/chat`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        provider: "ollama_cloud",
-        model: SHARD_MODEL,
-        messages: [{ role: "user", content: prompt }],
-        max_tokens: maxTokens,
-        temperature: 0,
-        think: false,
-      }),
-      signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
-    });
-    if (!r.ok) return { content: "" };
-    const j: any = await r.json();
-    return { content: j?.choices?.[0]?.message?.content ?? "" };
-  } catch {
-    return { content: "" };
-  }
-}
 
 // Pull out plausible code-symbol names from a summary string.
 // Matches:

auditor/checks/kimi_architect.ts

@@ -0,0 +1,461 @@
+// Kimi-architect check — second-pass senior architectural review using
+// kimi-for-coding (Kimi K2.6) via /v1/chat provider=kimi.
+//
+// Runs AFTER the deepseek inference check (N=3 consensus) and the
+// static/kb_query checks. Reads their findings as context and asks Kimi
+// "what did everyone else miss?" — complementing the cheap-consensus
+// voting with a sparse senior pass that catches load-bearing issues
+// (compile errors, false telemetry, schema bypasses, etc.) which the
+// voting structure can't see.
+//
+// Why Kimi here and not in the inner inference loop:
+// - Cost: ~3min wall-clock per call vs ~30s for deepseek consensus.
+// - TOS: api.kimi.com is User-Agent-gated (see crates/gateway/src/v1/
+//   kimi.rs); cost-bounded calls only.
+// - Value: experiment 2026-04-27 showed 7/7 grounding rate with full
+//   files vs ~50% on truncated input. Best as a sparse complement, not
+//   a replacement.
+//
+// Failure-isolated: any Kimi error returns a single info-level Finding
+// "kimi_architect skipped — <reason>" so the existing audit pipeline
+// is never blocked by a Kimi outage / TOS revocation / 429.
+//
+// Cost cap: if a kimi_verdicts/<pr>-<sha>.json file exists less than 24h
+// old, return cached findings without calling upstream. New commits
+// produce new SHAs so this is per-head, not per-day.
+//
+// Off by default: caller checks LH_AUDITOR_KIMI=1 before invoking.
+
+import { readFile, writeFile, mkdir, appendFile, stat, realpath } from "node:fs/promises";
+import { existsSync, realpathSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import type { Finding, CheckKind } from "../types.ts";
+
+const GATEWAY = process.env.LH_GATEWAY_URL ?? "http://localhost:3100";
+const KIMI_VERDICTS_DIR = "/home/profit/lakehouse/data/_auditor/kimi_verdicts";
+const KIMI_AUDITS_JSONL = "/home/profit/lakehouse/data/_kb/kimi_audits.jsonl";
+const REPO_ROOT = "/home/profit/lakehouse";
+// Canonicalize at module load — REPO_ROOT itself may be a symlink in
+// some environments (e.g. /home/profit is a bind-mount). Computing
+// once at startup means the per-finding grounding loop can compare
+// realpath(target) against this stable anchor.
+const REPO_ROOT_REAL = (() => {
+  try { return realpathSync(REPO_ROOT); }
+  catch { return REPO_ROOT; }
+})();
+// 15 min budget. Bun's fetch has an intrinsic ~300s limit that our
+// AbortController + setTimeout combo could not override; we use curl
+// via Bun.spawn instead (callKimi below). Curl honors -m for max
+// transfer time without a hard intrinsic ceiling.
+const CALL_TIMEOUT_MS = 900_000;
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const MAX_DIFF_CHARS = 180_000;
+const MAX_PRIOR_FINDINGS = 50;
+// Default provider/model = ollama_cloud/kimi-k2.6. Pre-2026-04-27 we
+// went direct to api.kimi.com, but Ollama Cloud Pro now exposes the
+// same model legitimately, so we route there to avoid User-Agent
+// gating. The api.kimi.com path (provider=kimi) remains wired in the
+// gateway as a fallback for when Ollama Cloud is upstream-broken.
+const KIMI_PROVIDER = process.env.LH_AUDITOR_KIMI_PROVIDER ?? "ollama_cloud";
+const KIMI_MODEL = process.env.LH_AUDITOR_KIMI_MODEL ?? "kimi-k2.6";
+// Cross-lineage alternation. 2026-04-27 J's call: Opus is too
+// expensive to auto-fire (~$0.30/audit). Kimi K2.6 via Go-sub is
+// effectively free; Haiku 4.5 via Zen is ~$0.04. Alternate between
+// them so we get cross-lineage signal (Moonshot vs Anthropic) on
+// every PR's audit history without burning the budget.
+//
+// Default: Kimi K2.6 on even audits, Haiku 4.5 on odd. Each PR's
+// audits flip between vendors as new SHAs come in.
+//
+// Frontier models (Opus 4.7, GPT-5.5, Gemini 3.1) are NOT in the
+// auto path. Operator hands distilled findings to a frontier model
+// manually when high-leverage decisions need it. Removing Opus from
+// auto-promotion saves ~$1-3/day on the daemon at our cadence.
+//
+// Override the alternation entirely with LH_AUDITOR_KIMI_MODEL
+// (forces one model regardless of audit count); set
+// LH_AUDITOR_KIMI_ALT_MODEL to the alternate.
+const ALT_MODEL = process.env.LH_AUDITOR_KIMI_ALT_MODEL ?? "claude-haiku-4-5";
+const ALT_PROVIDER = process.env.LH_AUDITOR_KIMI_ALT_PROVIDER ?? "opencode";
+const FORCE_DEFAULT = process.env.LH_AUDITOR_KIMI_MODEL !== undefined && process.env.LH_AUDITOR_KIMI_MODEL !== "";
+
+function selectModel(diffLen: number, auditIndex: number = 0): { provider: string; model: string; promoted: boolean } {
+  // Operator override — env-pinned model wins.
+  if (FORCE_DEFAULT) {
+    return { provider: KIMI_PROVIDER, model: KIMI_MODEL, promoted: false };
+  }
+  // Alternate Kimi (default, even index) ↔ Haiku (alt, odd index).
+  // diffLen kept in the signature for future "big diff → Haiku
+  // anyway" logic; not used yet so we don't auto-burn on big PRs.
+  void diffLen;
+  if (auditIndex % 2 === 1) {
+    return { provider: ALT_PROVIDER, model: ALT_MODEL, promoted: true };
+  }
+  return { provider: KIMI_PROVIDER, model: KIMI_MODEL, promoted: false };
+}
+// Model-aware max_tokens. Different upstream APIs cap at different
+// limits and reject requests that exceed them:
+//   - Anthropic Opus 4.x: 32K output (with extended-output header)
+//   - Anthropic Haiku 4.5: 8K output
+//   - Kimi K2.6 (reasoning): 128K — needs headroom because
+//     reasoning_content counts against the budget
+//   - Default: 16K, conservative middle ground
+//
+// 2026-04-27 BLOCK from Opus self-audit: the prior single-default of
+// 128K worked silently (Anthropic clamps server-side) but was
+// technically invalid. Per-model caps make it explicit. Override via
+// LH_AUDITOR_KIMI_MAX_TOKENS to force a value (also fixes the empty-
+// env Number("") -> 0 trap by using `||` not `??`).
+const MAX_TOKENS_OVERRIDE = Number(process.env.LH_AUDITOR_KIMI_MAX_TOKENS) || 0;
+function maxTokensFor(model: string): number {
+  if (MAX_TOKENS_OVERRIDE > 0) return MAX_TOKENS_OVERRIDE;
+  if (model.startsWith("claude-opus")) return 32_000;
+  if (model.startsWith("claude-haiku") || model.startsWith("claude-sonnet")) return 8_192;
+  if (model.startsWith("kimi-")) return 128_000;
+  if (model.startsWith("gpt-5") || model.startsWith("o1") || model.startsWith("o3") || model.startsWith("o4")) return 32_000;
+  return 16_000;
+}
+
+export interface KimiArchitectContext {
+  pr_number: number;
+  head_sha: string;
+}
+
+interface KimiVerdictFile {
+  pr_number: number;
+  head_sha: string;
+  cached_at: string;
+  model: string;
+  latency_ms: number;
+  finish_reason: string;
+  usage: { prompt_tokens: number; completion_tokens: number; total_tokens: number };
+  raw_content: string;
+  findings: Finding[];
+  grounding: { total: number; verified: number; rate: number };
+}
+
+export async function runKimiArchitectCheck(
+  diff: string,
+  priorFindings: Finding[],
+  ctx: KimiArchitectContext,
+): Promise<Finding[]> {
+  const cachePath = join(KIMI_VERDICTS_DIR, `${ctx.pr_number}-${ctx.head_sha.slice(0, 12)}.json`);
+  const outageSentinel = `${cachePath}.outage`;
+  const OUTAGE_TTL_MS = 10 * 60 * 1000;
+
+  // Outage negative-cache — if upstream failed within OUTAGE_TTL_MS,
+  // skip this audit and return immediately. Prevents the daemon from
+  // hammering a downed Kimi/Anthropic upstream every 90s.
+  if (existsSync(outageSentinel)) {
+    try {
+      const s = await stat(outageSentinel);
+      if (Date.now() - s.mtimeMs < OUTAGE_TTL_MS) {
+        const note = JSON.parse(await readFile(outageSentinel, "utf8"));
+        return [skipFinding(`upstream still down (cached ${Math.round((Date.now() - s.mtimeMs) / 1000)}s ago): ${String(note.reason).slice(0, 160)}`)];
+      }
+    } catch { /* malformed sentinel — fall through to fresh call */ }
+  }
+
+  // Cost cap — return cached findings if a verdict for this exact head
+  // SHA was generated within the TTL.
+  const cached = await loadCachedVerdict(cachePath);
+  if (cached) {
+    return cached.findings.length > 0
+      ? cached.findings
+      : [{ check: "kimi_architect" as CheckKind, severity: "info", summary: "kimi_architect cached — 0 findings", evidence: [`cache: ${cachePath}`] }];
+  }
+
+  // Alternate model based on how many audits this PR has had — gives
+  // cross-lineage signal (Kimi/Moonshot ↔ Haiku/Anthropic) on every
+  // PR's audit history. Count is derived from existing kimi_verdicts
+  // files for this PR; cheap O(N_PRs) directory read.
+  let auditIndex = 0;
+  try {
+    const dir = "/home/profit/lakehouse/data/_auditor/kimi_verdicts";
+    if (existsSync(dir)) {
+      const all = require("node:fs").readdirSync(dir) as string[];
+      auditIndex = all.filter((f) => f.startsWith(`${ctx.pr_number}-`)).length;
+    }
+  } catch { /* default 0 — Kimi */ }
+
+  const selected = selectModel(diff.length, auditIndex);
+  let response: { content: string; usage: any; finish_reason: string; latency_ms: number };
+  try {
+    response = await callKimi(buildPrompt(diff, priorFindings, ctx), selected.provider, selected.model);
+  } catch (e) {
+    // Negative-cache for 10 min on outage (caught 2026-04-27 by Opus
+    // self-audit): without this, every audit cycle within the 24h
+    // TTL re-calls upstream while it's still down. Use a sentinel
+    // file with mtime check rather than persisting a verdict so the
+    // happy-path cache reader doesn't have to special-case it.
+    const sentinel = `${cachePath}.outage`;
+    try { await writeFile(sentinel, JSON.stringify({ at: new Date().toISOString(), reason: (e as Error).message.slice(0, 200) })); } catch {}
+    return [skipFinding(`kimi call failed (${selected.model}): ${(e as Error).message.slice(0, 200)}`)];
+  }
+
+  const findings = parseFindings(response.content);
+  const grounding = await computeGrounding(findings);
+
+  const verdict: KimiVerdictFile = {
+    pr_number: ctx.pr_number,
+    head_sha: ctx.head_sha,
+    cached_at: new Date().toISOString(),
+    model: selected.model,
+    latency_ms: response.latency_ms,
+    finish_reason: response.finish_reason,
+    usage: {
+      prompt_tokens: response.usage?.prompt_tokens ?? 0,
+      completion_tokens: response.usage?.completion_tokens ?? 0,
+      total_tokens: response.usage?.total_tokens ?? 0,
+    },
+    raw_content: response.content,
+    findings,
+    grounding,
+  };
+
+  // Cache-poisoning guard (caught 2026-04-27 by Opus self-audit):
+  // when parseFindings returns 0 findings (Kimi rambled, prompt too
+  // big, or the markdown shape changed and our regex missed every
+  // block), persisting the empty verdict short-circuits all future
+  // audits in the 24h TTL window with a useless cached "0 findings"
+  // result. Better to leave no cache and re-call upstream next time.
+  // Always append metrics — observability shouldn't depend on whether
+  // findings parsed.
+  await appendMetrics(verdict);
+  if (findings.length > 0) {
+    await persistVerdict(cachePath, verdict);
+    return findings;
+  }
+  return [{
+    check: "kimi_architect" as CheckKind,
+    severity: "info",
+    summary: `kimi_architect produced 0 ranked findings (${response.finish_reason}, ${verdict.usage.completion_tokens} tokens) — not cached`,
+    evidence: [`raw saved (no cache): see kimi_audits.jsonl ${verdict.cached_at}`],
+  }];
+}
+
+async function loadCachedVerdict(path: string): Promise<KimiVerdictFile | null> {
+  if (!existsSync(path)) return null;
+  try {
+    const s = await stat(path);
+    if (Date.now() - s.mtimeMs > CACHE_TTL_MS) return null;
+    return JSON.parse(await readFile(path, "utf8")) as KimiVerdictFile;
+  } catch { return null; }
+}
+
+function buildPrompt(diff: string, priorFindings: Finding[], ctx: KimiArchitectContext): string {
+  const truncatedDiff = diff.length > MAX_DIFF_CHARS
+    ? diff.slice(0, MAX_DIFF_CHARS) + `\n\n... [truncated; original diff was ${diff.length} chars]`
+    : diff;
+
+  const priorBlock = priorFindings
+    .filter(f => f.severity !== "info")
+    .slice(0, MAX_PRIOR_FINDINGS)
+    .map(f => `- [${f.check}/${f.severity}] ${f.summary}${f.evidence?.[0] ? ` — ${f.evidence[0].slice(0, 160)}` : ""}`)
+    .join("\n");
+
+  return `You are a senior software architect doing a second-pass review on PR #${ctx.pr_number} (head ${ctx.head_sha.slice(0, 12)}). The team's automated auditor (deepseek-v3.1:671b, N=3 consensus) already produced findings. Your job is NOT to repeat what they found — your job is to catch what their voting structure CAN'T see: compile errors, type-system bypasses, false telemetry, silent determinism leaks, schema-bypass anti-patterns, load-bearing assumptions that look fine line-by-line.
+
+GROUNDING RULES (non-negotiable):
+- Cite file:line for EVERY finding. Lines you cite must actually contain what you claim. Confabulating a finding wastes more time than missing one.
+- If the diff is truncated and you can't verify a claim, say "diff-truncated, can't verify" — DO NOT guess.
+- Distinguish architectural concerns (no specific line) from concrete bugs (specific line). Don't dress one as the other.
+
+PRIOR FINDINGS FROM DEEPSEEK CONSENSUS (do not repeat these):
+${priorBlock || "(none)"}
+
+OUTPUT FORMAT (markdown):
+- ## Verdict (one sentence)
+- ## Findings (5-10 items, each formatted EXACTLY as below)
+
+For each finding use this exact shape so a parser can lift them:
+
+### F1: <one-line summary>
+- **Severity:** block | warn | info
+- **File:** path/to/file.ext:LINE
+- **Rationale:** one or two sentences
+
+THE DIFF:
+
+${truncatedDiff}
+`;
+}
+
+async function callKimi(prompt: string, provider: string, model: string): Promise<{ content: string; usage: any; finish_reason: string; latency_ms: number }> {
+  const t0 = Date.now();
+  const body = JSON.stringify({
+    provider,
+    model,
+    messages: [{ role: "user", content: prompt }],
+    max_tokens: maxTokensFor(model),
+    temperature: 0.2,
+  });
+  // curl via Bun.spawn — bypasses Bun fetch's ~300s intrinsic ceiling.
+  // -m sets the max transfer time honored end-to-end. Body is piped via
+  // stdin to avoid argv length limits on big audit prompts (~50K+ tokens).
+  const proc = Bun.spawn({
+    cmd: [
+      "curl", "-sS", "-X", "POST",
+      "-m", String(Math.ceil(CALL_TIMEOUT_MS / 1000)),
+      "-H", "content-type: application/json",
+      "--data-binary", "@-",
+      `${GATEWAY}/v1/chat`,
+    ],
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  proc.stdin.write(body);
+  await proc.stdin.end();
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  if (exitCode !== 0) {
+    throw new Error(`curl exit ${exitCode}: ${stderr.slice(0, 300)}`);
+  }
+  let j: any;
+  try { j = JSON.parse(stdout); }
+  catch (e) {
+    throw new Error(`bad response (${stdout.length} bytes): ${stdout.slice(0, 300)}`);
+  }
+  if (j.error || !j.choices) {
+    throw new Error(`gateway error: ${JSON.stringify(j).slice(0, 300)}`);
+  }
+  return {
+    content: j.choices?.[0]?.message?.content ?? "",
+    usage: j.usage ?? {},
+    finish_reason: j.choices?.[0]?.finish_reason ?? "unknown",
+    latency_ms: Date.now() - t0,
+  };
+}
+
+// Parse Kimi's markdown into Finding[]. Format expected (per buildPrompt):
+//   ### F<N>: <summary>
+//   - **Severity:** block | warn | info
+//   - **File:** path:line
+//   - **Rationale:** ...
+function parseFindings(content: string): Finding[] {
+  const findings: Finding[] = [];
+  const blocks = content.split(/^###\s+F\d+:\s*/m).slice(1);
+  for (const block of blocks) {
+    const summary = (block.split("\n")[0] ?? "").trim();
+    if (!summary) continue;
+    const sev = /\*\*Severity:\*\*\s*(block|warn|info)/i.exec(block)?.[1]?.toLowerCase();
+    const fileLine = /\*\*File:\*\*\s*(\S+)/i.exec(block)?.[1] ?? "unknown";
+    const rationale = /\*\*Rationale:\*\*\s*([\s\S]+?)(?=\n###|\n\*\*|$)/i.exec(block)?.[1]?.trim() ?? "";
+    const severity: Finding["severity"] = sev === "block" ? "block" : sev === "warn" ? "warn" : "info";
+    findings.push({
+      check: "kimi_architect" as CheckKind,
+      severity,
+      summary: summary.slice(0, 240),
+      evidence: [fileLine, rationale.slice(0, 360)].filter(Boolean),
+    });
+  }
+  return findings;
+}
+
+// For each finding's cited file:line, grep the actual file to verify
+// the line exists. Returns total + verified counts; per-finding metadata
+// is appended into the evidence array so the reader can see which
+// citations were verified.
+async function computeGrounding(findings: Finding[]): Promise<{ total: number; verified: number; rate: number }> {
+  // readFile (async) instead of readFileSync — caught 2026-04-27 by
+  // Kimi's self-audit. Sync I/O in an async fn blocks the event loop
+  // for every cited file; doesn't matter at 10 findings, would matter
+  // at 100+.
+  const checks = await Promise.all(findings.map(async (f) => {
+    const cite = f.evidence[0] ?? "";
+    const m = /^(\S+?):(\d+)/.exec(cite);
+    if (!m) return false;
+    const [, relpath, lineStr] = m;
+    const line = Number(lineStr);
+    if (!line || !relpath) return false;
+
+    // Path-traversal guard, two-layer (caught 2026-04-27 by Kimi
+    // self-audits on dd77632 then 2d9cb12).
+    //
+    // Layer 1 (lexical): resolve() normalizes `..` segments. Refuse
+    // any path that doesn't anchor under REPO_ROOT.
+    //
+    // Layer 2 (symlink): even if the lexical path is anchored, it
+    // could be a symlink whose target escapes. realpath() resolves
+    // symlinks; compare the real path against REPO_ROOT_REAL.
+    //
+    // Both layers exist because attackers might bypass either alone:
+    // raw `../etc/passwd` triggers layer 1; a planted symlink at
+    // ./safe-looking-name → /etc/passwd triggers layer 2.
+    const abs = resolve(REPO_ROOT, relpath);
+    if (!abs.startsWith(REPO_ROOT + "/") && abs !== REPO_ROOT) {
+      f.evidence.push(`[grounding: path escapes repo root, refusing]`);
+      return false;
+    }
+
+    if (!existsSync(abs)) {
+      f.evidence.push("[grounding: file not found]");
+      return false;
+    }
+    try {
+      // Symlink-resolution check before any read. realpath() throws
+      // if the file doesn't exist; existsSync above shields the
+      // common case but a TOCTOU race could still error here — the
+      // outer catch handles it.
+      const realPath = await realpath(abs);
+      if (!realPath.startsWith(REPO_ROOT_REAL + "/") && realPath !== REPO_ROOT_REAL) {
+        f.evidence.push(`[grounding: symlink target escapes repo root, refusing]`);
+        return false;
+      }
+      const lines = (await readFile(realPath, "utf8")).split("\n");
+      if (line < 1 || line > lines.length) {
+        f.evidence.push(`[grounding: line ${line} > EOF (${lines.length})]`);
+        return false;
+      }
+      f.evidence.push(`[grounding: verified at ${relpath}:${line}]`);
+      return true;
+    } catch (e) {
+      f.evidence.push(`[grounding: read failed: ${(e as Error).message.slice(0, 80)}]`);
+      return false;
+    }
+  }));
+  const verified = checks.filter(Boolean).length;
+  const total = findings.length;
+  return { total, verified, rate: total === 0 ? 0 : verified / total };
+}
+
+async function persistVerdict(path: string, v: KimiVerdictFile): Promise<void> {
+  await mkdir(KIMI_VERDICTS_DIR, { recursive: true });
+  await writeFile(path, JSON.stringify(v, null, 2));
+}
+
+async function appendMetrics(v: KimiVerdictFile): Promise<void> {
+  // dirname() instead of join(path, "..") — caught 2026-04-27 by both
+  // Haiku and Opus self-audits. The "/.." idiom resolves correctly
+  // via Node path normalization but is non-idiomatic + breaks if the
+  // path ever has trailing dots.
+  await mkdir(dirname(KIMI_AUDITS_JSONL), { recursive: true });
+  await appendFile(KIMI_AUDITS_JSONL, JSON.stringify({
+    pr_number: v.pr_number,
+    head_sha: v.head_sha,
+    audited_at: v.cached_at,
+    model: v.model,
+    latency_ms: v.latency_ms,
+    finish_reason: v.finish_reason,
+    prompt_tokens: v.usage.prompt_tokens,
+    completion_tokens: v.usage.completion_tokens,
+    findings_total: v.findings.length,
+    findings_block: v.findings.filter(f => f.severity === "block").length,
+    findings_warn: v.findings.filter(f => f.severity === "warn").length,
+    grounding_verified: v.grounding.verified,
+    grounding_rate: Number(v.grounding.rate.toFixed(3)),
+  }) + "\n");
+}
+
+function skipFinding(why: string): Finding {
+  return {
+    check: "kimi_architect" as CheckKind,
+    severity: "info",
+    summary: `kimi_architect skipped — ${why}`,
+    evidence: [why],
+  };
+}

auditor/checks/static.ts

@@ -77,6 +77,17 @@ export function runStaticCheck(diff: string): Finding[] {
       // Strip the diff prefix (' ' for context, '+' for added).
       const body = (isAdded || line.startsWith(" ")) ? line.slice(1) : line;
 
+      // Compute the file-level backtick state ENTERING this line.
+      // The state machine sees pattern matches against the right
+      // context: a line that opens a backtick block has its own
+      // pattern checks evaluated under "inside-backtick" semantics
+      // for the portion AFTER the opening tick. Pre-2026-04-27 the
+      // state was updated AFTER the pattern checks, so the FIRST
+      // pattern on a backtick-opening line slipped through with
+      // stale "outside-backtick" semantics. Caught by Kimi self-audit.
+      const stateAtLineStart = inMultilineBacktick;
+      const stateAtLineEnd = updateBacktickState(body, stateAtLineStart);
+
       if (isAdded) {
         const added = body;
 
@@ -84,11 +95,13 @@ export function runStaticCheck(diff: string): Finding[] {
           for (const { re, why } of BLOCK_PATTERNS) {
             const m = added.match(re);
             if (m && typeof m.index === "number") {
-              // Skip if the match sits inside a quoted string literal —
-              // this is how rubric files (tests/real-world/*, prompt
-              // templates) legitimately reference the patterns they
-              // guard against, without actually executing them.
-              if (inMultilineBacktick || isInsideQuotedString(added, m.index)) continue;
+              // Skip if EITHER (a) the file was already inside a
+              // multi-line backtick block when this line started, OR
+              // (b) the match sits inside a quoted string literal on
+              // THIS line. The earlier code only checked stateAtLineStart;
+              // now we also check that the match isn't past the
+              // opening backtick of a block that opens on this line.
+              if (stateAtLineStart || isInsideQuotedString(added, m.index)) continue;
               findings.push({
                 check: "static",
                 severity: "block",
@@ -120,13 +133,8 @@ export function runStaticCheck(diff: string): Finding[] {
         }
       }
 
-      // Update file-level multi-line backtick state by walking THIS
-      // line's unescaped backticks. Both context and added lines
-      // contribute (they're both in the post-merge file). Doc-comment
-      // backticks like `\\\`Foo\\\`` count too — that's the source of
-      // the original bug, where multi-line template literals contained
-      // `todo!()` references.
-      inMultilineBacktick = updateBacktickState(body, inMultilineBacktick);
+      // Carry the end-of-line state forward to the next iteration.
+      inMultilineBacktick = stateAtLineEnd;
     }
 
     // "Field added but never read" heuristic — catches exactly the
@@ -213,6 +221,13 @@ function extractNewFieldsWithLine(lines: string[]): Array<{ name: string; lineId
 // Stops the struct-search early if we hit a `}` at zero indent
 // (the previous scope) or another `pub struct` (we left ours).
 function parentStructHasSerdeDerive(lines: string[], fieldLineIdx: number): boolean {
+  // Bounds-check fieldLineIdx (caught 2026-04-27 by Kimi self-audit).
+  // Pre-fix: if fieldLineIdx >= lines.length, the loop ran from a
+  // negative implicit upper bound (fieldLineIdx - 80 could be > 0
+  // even when fieldLineIdx is past EOF) and read undefined slots.
+  // Defensive: bail early on out-of-range input.
+  if (fieldLineIdx < 0 || fieldLineIdx >= lines.length) return false;
+
   let structLineIdx = -1;
   for (let i = fieldLineIdx - 1; i >= 0 && i >= fieldLineIdx - 80; i--) {
     const raw = lines[i];

auditor/index.ts

@@ -24,14 +24,30 @@ const POLL_INTERVAL_MS = 90_000; // 90s — enough budget for audit runs to comp
 const PAUSE_FILE = "/home/profit/lakehouse/auditor.paused";
 const STATE_FILE = "/home/profit/lakehouse/data/_auditor/state.json";
 
+// Per-PR audit cap. Prevents the daemon from running away on a PR
+// when each push surfaces new findings — operator wants to review
+// in batch, not have the daemon burn budget while they're away.
+// Default 3 audits per PR. Override via LH_AUDITOR_MAX_AUDITS_PER_PR.
+// Set to 0 to disable the cap.
+//
+// Reset (after manual review): edit data/_auditor/state.json and
+// set audit_count_per_pr.<N> = 0 (or delete the key). Daemon picks
+// up the change on the next cycle without restart.
+const MAX_AUDITS_PER_PR = Number(process.env.LH_AUDITOR_MAX_AUDITS_PER_PR) || 3;
+
 interface State {
   // Map: PR number → last-audited head SHA. Lets us dedupe audits
   // across restarts (poller can crash/restart without re-auditing
   // all open PRs from scratch).
   last_audited: Record<string, string>;
+  // Map: PR number → number of audits run on that PR since last reset.
+  // Daemon halts auditing a PR once this hits MAX_AUDITS_PER_PR.
+  // Operator clears the entry to resume.
+  audit_count_per_pr: Record<string, number>;
   started_at: string;
   cycles_total: number;
   cycles_skipped_paused: number;
+  cycles_skipped_capped: number;
   audits_run: number;
   last_cycle_at?: string;
 }
@@ -47,17 +63,21 @@ async function loadState(): Promise<State> {
     return {
       last_audited: s.last_audited ?? {},
       started_at: s.started_at ?? new Date().toISOString(),
+      audit_count_per_pr: s.audit_count_per_pr ?? {},
       cycles_total: s.cycles_total ?? 0,
       cycles_skipped_paused: s.cycles_skipped_paused ?? 0,
+      cycles_skipped_capped: s.cycles_skipped_capped ?? 0,
       audits_run: s.audits_run ?? 0,
       last_cycle_at: s.last_cycle_at,
     };
   } catch {
     return {
       last_audited: {},
+      audit_count_per_pr: {},
       started_at: new Date().toISOString(),
       cycles_total: 0,
       cycles_skipped_paused: 0,
+      cycles_skipped_capped: 0,
       audits_run: 0,
     };
   }
@@ -89,12 +109,38 @@ async function runCycle(state: State): Promise<State> {
   console.log(`[auditor] cycle ${state.cycles_total}: ${prs.length} open PR(s)`);
 
   for (const pr of prs) {
-    const last = state.last_audited[String(pr.number)];
+    const prKey = String(pr.number);
+    const last = state.last_audited[prKey];
     if (last === pr.head_sha) {
       console.log(`[auditor]   skip PR #${pr.number} (SHA ${pr.head_sha.slice(0, 8)} already audited)`);
       continue;
     }
-    console.log(`[auditor]   audit PR #${pr.number} (${pr.head_sha.slice(0, 8)}) — ${pr.title.slice(0, 60)}`);
+    // Per-head-SHA audit cap. Each new push gets MAX_AUDITS_PER_PR
+    // fresh attempts; the counter auto-resets when the head SHA
+    // changes. Operator only intervenes manually if a single SHA
+    // somehow needs MORE than the cap (rare — usually transient
+    // upstream errors clear themselves inside 3 attempts).
+    //
+    // Reset rule: if `last` exists (we've seen this PR before) AND
+    // pr.head_sha != last, that's a new push. Drop the counter.
+    // The dedup branch above already handles same-SHA → skip, so
+    // we only land here when the SHA actually moved.
+    if (last !== undefined && (state.audit_count_per_pr[prKey] ?? 0) > 0) {
+      const prior_count = state.audit_count_per_pr[prKey];
+      console.log(`[auditor]   PR #${pr.number} new head ${pr.head_sha.slice(0, 8)} (prior ${last.slice(0, 8)}, was ${prior_count}/${MAX_AUDITS_PER_PR}) — resetting cap counter`);
+      state.audit_count_per_pr[prKey] = 0;
+    }
+    const auditedSoFar = state.audit_count_per_pr[prKey] ?? 0;
+    if (MAX_AUDITS_PER_PR > 0 && auditedSoFar >= MAX_AUDITS_PER_PR) {
+      // This branch only fires now if the SAME head SHA somehow
+      // burned MAX audits (transient upstream errors retried that
+      // many times). Operator can clear state.audit_count_per_pr.<N>
+      // = 0 to force one more attempt; otherwise wait for next push.
+      console.log(`[auditor]   skip PR #${pr.number} (same head ${pr.head_sha.slice(0, 8)} burned ${auditedSoFar}/${MAX_AUDITS_PER_PR} — push new code or clear state.json audit_count_per_pr.${prKey})`);
+      state.cycles_skipped_capped += 1;
+      continue;
+    }
+    console.log(`[auditor]   audit PR #${pr.number} (${pr.head_sha.slice(0, 8)}) — ${pr.title.slice(0, 60)} [${auditedSoFar + 1}/${MAX_AUDITS_PER_PR}]`);
     try {
       // Skip dynamic by default: it mutates live playbook state and
       // re-runs on every PR update would pollute quickly. Operator
@@ -106,8 +152,22 @@ async function runCycle(state: State): Promise<State> {
         skip_inference: process.env.LH_AUDITOR_SKIP_INFERENCE === "1",
       });
       console.log(`[auditor]     verdict=${verdict.overall} findings=${verdict.metrics.findings_total} (block=${verdict.metrics.findings_block} warn=${verdict.metrics.findings_warn})`);
-      state.last_audited[String(pr.number)] = pr.head_sha;
+      state.last_audited[prKey] = pr.head_sha;
+      state.audit_count_per_pr[prKey] = auditedSoFar + 1;
       state.audits_run += 1;
+      if (state.audit_count_per_pr[prKey] >= MAX_AUDITS_PER_PR) {
+        console.log(`[auditor]     PR #${pr.number} reached cap (${MAX_AUDITS_PER_PR} audits) — daemon will skip further audits until reset`);
+      }
+      // Persist state immediately after each successful audit so the
+      // increment survives a crash. Pre-2026-04-27 the cycle saved
+      // once at the end (main.ts:140), which lost the count if the
+      // daemon was killed mid-cycle. Fix lifted from kimi_architect's
+      // own audit on this very file. saveState is idempotent + cheap
+      // (one JSON write), so per-audit cost is negligible.
+      try { await saveState(state); }
+      catch (e) {
+        console.error(`[auditor]     saveState mid-cycle failed: ${(e as Error).message} — count held in memory`);
+      }
     } catch (e) {
       console.error(`[auditor]     audit failed: ${(e as Error).message}`);
     }

auditor/schemas/distillation/drift_report.ts

@@ -15,7 +15,7 @@ import {
 } from "./types";
 import type { StageName } from "./stage_receipt";
 
-export const DRIFT_REPORT_SCHEMA_VERSION = 1;
+export const DRIFT_REPORT_SCHEMA_VERSION = 2;
 export const DRIFT_THRESHOLD_PCT = 0.20;
 
 export type DriftSeverity = "ok" | "warn" | "alert";
@@ -27,7 +27,11 @@ export interface StageDrift {
   delta_accepted: number;
   delta_quarantined: number;
   pct_change_out: number | null;  // null when prior had 0 records
-  input_hash_match: boolean;
+  // null when input_hash isn't materialized into the stage summary —
+  // schema v1 lied and reported `true` here. v2 is honest: callers
+  // that want determinism enforcement must read the full StageReceipt
+  // off disk and compute input_hash equality there.
+  input_hash_match: boolean | null;
   output_hash_match: boolean;
   // alert if input_hash matches but output_hash diverges
   deterministic_violation: boolean;

auditor/schemas/distillation/evidence_record.ts

@@ -121,6 +121,14 @@ export interface EvidenceRecord {
   // and have no text payload. Present for distilled_*, contract_analyses,
   // mode_experiments, scrum_reviews etc.
   text?: string;
+
+  // ── Domain-specific metadata bucket ──
+  // Source-specific fields that don't earn a top-level slot. e.g.
+  // contract_analyses rows carry `contractor` here; mode_experiments
+  // could carry `corpus_set`. Typed scalar values only — keep this
+  // small or it becomes a junk drawer. Added 2026-04-27 (Kimi audit
+  // flagged `(ev as any).contractor` schema bypass at export_sft.ts:126).
+  metadata?: Record<string, string | number | boolean>;
 }
 
 export function validateEvidenceRecord(input: unknown): ValidationResult<EvidenceRecord> {

auditor/types.ts

@@ -2,7 +2,7 @@
 // if something can't be verified from a check, it goes into `evidence`
 // so the verdict is inspectable, not a black box.
 
-export type CheckKind = "static" | "dynamic" | "inference" | "kb_query";
+export type CheckKind = "static" | "dynamic" | "inference" | "kb_query" | "kimi_architect";
 
 export type Severity = "info" | "warn" | "block";
 

bot/propose.ts

@@ -13,7 +13,12 @@ import { readFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import type { Gap, Proposal } from "./types.ts";
 
-const SIDECAR_URL = process.env.LH_SIDECAR_URL ?? "http://localhost:3200";
+// Phase 44 migration (2026-04-27): bot/propose.ts now flows through
+// the gateway's /v1/chat instead of hitting the sidecar's /generate
+// directly. /v1/usage tracks the call, Langfuse traces it, observer
+// sees it. Same upstream model (CLOUD_MODEL gpt-oss:120b on
+// Ollama Cloud) — gateway just owns the routing.
+const GATEWAY_URL = process.env.LH_GATEWAY_URL ?? "http://localhost:3100";
 const REPO_ROOT = "/home/profit/lakehouse";
 const PRD_PATH = `${REPO_ROOT}/docs/PRD.md`;
 const CLOUD_MODEL = process.env.LH_BOT_MODEL ?? "gpt-oss:120b";
@@ -72,13 +77,16 @@ export async function generateProposal(gap: Gap, historySummary: string = ""): P
   sections.push("Propose a small change that addresses this gap. Respond with the JSON object only.");
   const userPrompt = sections.join("\n");
 
-  const r = await fetch(`${SIDECAR_URL}/generate`, {
+  const r = await fetch(`${GATEWAY_URL}/v1/chat`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({
       model: CLOUD_MODEL,
-      system: SYSTEM_PROMPT,
-      prompt: userPrompt,
+      provider: "ollama_cloud",
+      messages: [
+        { role: "system", content: SYSTEM_PROMPT },
+        { role: "user", content: userPrompt },
+      ],
       temperature: 0.2,
       max_tokens: MAX_TOKENS,
       think: false,
@@ -86,10 +94,10 @@ export async function generateProposal(gap: Gap, historySummary: string = ""): P
     signal: AbortSignal.timeout(180000), // cloud T3 can be slow — 3 min
   });
   if (!r.ok) {
-    throw new Error(`sidecar ${r.status}: ${await r.text()}`);
+    throw new Error(`gateway /v1/chat ${r.status}: ${await r.text()}`);
   }
   const j = await r.json() as any;
-  const raw: string = j.text ?? j.response ?? "";
+  const raw: string = j?.choices?.[0]?.message?.content ?? "";
   const usage = j.usage ?? {};
   const tokens = (usage.prompt_tokens ?? 0) + (usage.completion_tokens ?? 0);
 

config/providers.toml

@@ -45,6 +45,41 @@ default_model = "openai/gpt-oss-120b:free"
 # Model-prefix routing: "openrouter/<vendor>/<model>" auto-routes here,
 # prefix stripped before upstream call.
 
+[[provider]]
+name = "opencode"
+base_url = "https://opencode.ai/zen/v1"
+# Unified endpoint — covers BOTH Zen (pay-per-token Anthropic/OpenAI/
+# Gemini frontier) AND Go (flat-sub Kimi/GLM/DeepSeek/Qwen/Minimax).
+# Upstream bills per-model: Zen models hit Zen balance, Go models hit
+# Go subscription cap. /zen/go/v1 is the Go-only sub-path (rejects
+# Zen models), kept for reference but not used by this provider.
+auth = "bearer"
+auth_env = "OPENCODE_API_KEY"
+default_model = "claude-opus-4-7"
+# OpenCode (Zen + GO unified endpoint). One sk-* key reaches Claude
+# Opus 4.7, GPT-5.5-pro, Gemini 3.1-pro, Kimi K2.6, DeepSeek, GLM,
+# Qwen, plus 4 free-tier models. OpenAI-compatible Chat Completions
+# at /v1/chat/completions. Model-prefix routing: "opencode/<name>"
+# auto-routes here, prefix stripped before upstream call.
+# Key file: /etc/lakehouse/opencode.env (loaded via systemd EnvironmentFile).
+# Model catalog: curl -H "Authorization: Bearer ..." https://opencode.ai/zen/v1/models
+# Note: /zen/go/v1 is the GO-only sub-path (Kimi/GLM/DeepSeek tier);
+# /zen/v1 covers everything including Anthropic (which /zen/go/v1 rejects).
+
+[[provider]]
+name = "kimi"
+base_url = "https://api.kimi.com/coding/v1"
+auth = "bearer"
+auth_env = "KIMI_API_KEY"
+default_model = "kimi-for-coding"
+# Direct Kimi For Coding provider. `api.kimi.com` is a SEPARATE account
+# system from `api.moonshot.ai` and `api.moonshot.cn` — keys are NOT
+# interchangeable. Used when Ollama Cloud's `kimi-k2:1t` is upstream-
+# broken and OpenRouter's `moonshotai/kimi-k2.6` is rate-limited.
+# Model id: `kimi-for-coding` (kimi-k2.6 underneath).
+# Key file: /etc/lakehouse/kimi.env (loaded via systemd EnvironmentFile).
+# Model-prefix routing: "kimi/<model>" auto-routes here, prefix stripped.
+
 # Planned (Phase 40 long-horizon — adapters not yet shipped):
 #
 # [[provider]]

crates/aibridge/src/client.rs

@@ -3,10 +3,26 @@ use serde::{Deserialize, Serialize};
 use std::time::Duration;
 
 /// HTTP client for the Python AI sidecar.
+///
+/// `generate()` has two transport modes:
+/// - When `gateway_url` is None (default), it posts to
+///   `${base_url}/generate` (sidecar direct).
+/// - When `gateway_url` is `Some(url)`, it posts to
+///   `${url}/v1/chat` with `provider="ollama"` so the call appears
+///   in `/v1/usage` and Langfuse traces.
+///
+/// `embed()`, `rerank()`, and admin methods always go direct to the
+/// sidecar — no `/v1` equivalent yet, no point round-tripping.
+///
+/// Phase 44 part 2 (2026-04-27): the gateway URL is wired in by
+/// callers that want observability (vectord modules); it's left
+/// unset by callers that ARE the gateway internals (avoids self-loops
+/// + redundant hops).
 #[derive(Clone)]
 pub struct AiClient {
     client: Client,
     base_url: String,
+    gateway_url: Option<String>,
 }
 
 // -- Request/Response types --
@@ -86,9 +102,22 @@ impl AiClient {
         Self {
             client,
             base_url: base_url.trim_end_matches('/').to_string(),
+            gateway_url: None,
         }
     }
 
+    /// Same as `new`, but every `generate()` is routed through
+    /// `${gateway_url}/v1/chat` (provider=ollama) for observability.
+    /// Use this for callers OUTSIDE the gateway. Inside the gateway
+    /// itself, prefer `new()` — calling /v1/chat from /v1/chat works
+    /// (no infinite loop, ollama_arm doesn't use AiClient) but adds
+    /// a wasted localhost hop.
+    pub fn new_with_gateway(base_url: &str, gateway_url: &str) -> Self {
+        let mut c = Self::new(base_url);
+        c.gateway_url = Some(gateway_url.trim_end_matches('/').to_string());
+        c
+    }
+
     pub async fn health(&self) -> Result<serde_json::Value, String> {
         let resp = self.client
             .get(format!("{}/health", self.base_url))
@@ -114,6 +143,13 @@ impl AiClient {
     }
 
     pub async fn generate(&self, req: GenerateRequest) -> Result<GenerateResponse, String> {
+        if let Some(gw) = self.gateway_url.as_deref() {
+            return self.generate_via_gateway(gw, req).await;
+        }
+        // Direct-sidecar legacy path. Used by gateway internals (so
+        // ollama_arm can call sidecar without a self-loop) and by
+        // any consumer that wants raw transport without /v1/usage
+        // accounting.
         let resp = self.client
             .post(format!("{}/generate", self.base_url))
             .json(&req)
@@ -128,6 +164,59 @@ impl AiClient {
         resp.json().await.map_err(|e| format!("generate parse error: {e}"))
     }
 
+    /// Phase 44 part 2: route generate() through the gateway's
+    /// /v1/chat with provider="ollama" so the call lands in
+    /// /v1/usage + Langfuse. Translates between the sidecar
+    /// GenerateRequest/Response shape and the OpenAI-compat
+    /// chat shape on the wire.
+    async fn generate_via_gateway(&self, gateway_url: &str, req: GenerateRequest) -> Result<GenerateResponse, String> {
+        let mut messages = Vec::with_capacity(2);
+        if let Some(sys) = &req.system {
+            messages.push(serde_json::json!({"role": "system", "content": sys}));
+        }
+        messages.push(serde_json::json!({"role": "user", "content": req.prompt}));
+        let mut body = serde_json::json!({
+            "messages": messages,
+            "provider": "ollama",
+        });
+        if let Some(m) = &req.model { body["model"] = serde_json::json!(m); }
+        if let Some(t) = req.temperature { body["temperature"] = serde_json::json!(t); }
+        if let Some(mt) = req.max_tokens { body["max_tokens"] = serde_json::json!(mt); }
+        if let Some(th) = req.think { body["think"] = serde_json::json!(th); }
+
+        let resp = self.client
+            .post(format!("{}/v1/chat", gateway_url))
+            .json(&body)
+            .send()
+            .await
+            .map_err(|e| format!("/v1/chat request failed: {e}"))?;
+        if !resp.status().is_success() {
+            let text = resp.text().await.unwrap_or_default();
+            return Err(format!("/v1/chat error: {text}"));
+        }
+        let parsed: serde_json::Value = resp.json().await
+            .map_err(|e| format!("/v1/chat parse error: {e}"))?;
+
+        let text = parsed
+            .pointer("/choices/0/message/content")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .to_string();
+        let model = parsed.get("model")
+            .and_then(|v| v.as_str())
+            .unwrap_or_else(|| req.model.as_deref().unwrap_or(""))
+            .to_string();
+        let prompt_tokens = parsed.pointer("/usage/prompt_tokens").and_then(|v| v.as_u64());
+        let completion_tokens = parsed.pointer("/usage/completion_tokens").and_then(|v| v.as_u64());
+
+        Ok(GenerateResponse {
+            text,
+            model,
+            tokens_evaluated: prompt_tokens,
+            tokens_generated: completion_tokens,
+        })
+    }
+
     pub async fn rerank(&self, req: RerankRequest) -> Result<RerankResponse, String> {
         let resp = self.client
             .post(format!("{}/rerank", self.base_url))

crates/aibridge/src/continuation.rs

@@ -195,8 +195,11 @@ pub async fn generate_continuable<G: TextGenerator>(
         let req = make_request(opts, prompt.to_string(), current_max);
         let resp = generator.generate_text(req).await?;
         calls += 1;
-        prompt_tokens = prompt_tokens.saturating_add(resp.tokens_evaluated.unwrap_or(0) as u32);
-        completion_tokens = completion_tokens.saturating_add(resp.tokens_generated.unwrap_or(0) as u32);
+        // u32::try_from saturates at u32::MAX instead of silently
+        // truncating bits when tokens_evaluated/_generated comes back
+        // as a u64 > 4 billion. Caught 2026-04-27 by Opus self-audit.
+        prompt_tokens = prompt_tokens.saturating_add(u32::try_from(resp.tokens_evaluated.unwrap_or(0)).unwrap_or(u32::MAX));
+        completion_tokens = completion_tokens.saturating_add(u32::try_from(resp.tokens_generated.unwrap_or(0)).unwrap_or(u32::MAX));
         if !resp.text.trim().is_empty() {
             combined = resp.text;
             break;
@@ -227,8 +230,8 @@ pub async fn generate_continuable<G: TextGenerator>(
         let req = make_request(opts, cont_prompt, current_max.min(opts.budget_cap));
         let resp = generator.generate_text(req).await?;
         calls += 1;
-        prompt_tokens = prompt_tokens.saturating_add(resp.tokens_evaluated.unwrap_or(0) as u32);
-        completion_tokens = completion_tokens.saturating_add(resp.tokens_generated.unwrap_or(0) as u32);
+        prompt_tokens = prompt_tokens.saturating_add(u32::try_from(resp.tokens_evaluated.unwrap_or(0)).unwrap_or(u32::MAX));
+        completion_tokens = completion_tokens.saturating_add(u32::try_from(resp.tokens_generated.unwrap_or(0)).unwrap_or(u32::MAX));
         combined.push_str(&resp.text);
         continuations += 1;
     }

crates/gateway/Cargo.toml

@@ -13,6 +13,7 @@ ingestd = { path = "../ingestd" }
 vectord = { path = "../vectord" }
 journald = { path = "../journald" }
 truth = { path = "../truth" }
+validator = { path = "../validator" }
 tokio = { workspace = true }
 axum = { workspace = true }
 serde = { workspace = true }

crates/gateway/src/main.rs

@@ -95,8 +95,35 @@ async fn main() {
         tracing::warn!("workspace rebuild: {e}");
     }
 
-    // AI sidecar client
-    let ai_client = aibridge::client::AiClient::new(&config.sidecar.url);
+    // AI sidecar clients — Phase 44 part 3 (2026-04-27).
+    //
+    // Two flavors of the same client:
+    // - `ai_client_direct` posts directly to ${sidecar}/generate. Used
+    //   inside the gateway by V1State + the legacy /ai proxy. These
+    //   call sites are themselves the implementation of /v1/chat
+    //   (or its sidecar shim), so routing them through /v1/chat
+    //   would self-loop.
+    // - `ai_client_observable` posts via ${gateway}/v1/chat with
+    //   provider="ollama". Used by vectord modules (autotune agent,
+    //   /vectors service) so their LLM calls land in /v1/usage and
+    //   Langfuse traces. Adds one localhost HTTP hop per call (~ms);
+    //   accepted for the observability gain.
+    //
+    // The gateway can call its own /v1/chat over localhost during
+    // boot's transient period because we don't fire any LLM calls
+    // until the listener is up — the observable client is just
+    // configured here, not exercised.
+    let ai_client_direct = aibridge::client::AiClient::new(&config.sidecar.url);
+    let gateway_self_url = format!("http://{}:{}", config.gateway.host, config.gateway.port);
+    let ai_client_observable = aibridge::client::AiClient::new_with_gateway(
+        &config.sidecar.url,
+        &gateway_self_url,
+    );
+    // Backwards-compat alias for the (many) existing references in this file.
+    // Defaults to direct so the existing wiring (V1State, /ai proxy)
+    // keeps its non-self-loop transport. New vectord wiring below
+    // explicitly uses ai_client_observable.
+    let ai_client = ai_client_direct.clone();
 
     // Vector service components — built before the router because both the
     // /vectors service AND ingestd need the agent handle to enqueue triggers.
@@ -134,7 +161,9 @@ async fn main() {
         agent_cfg,
         vectord::agent::AgentDeps {
             store: store.clone(),
-            ai_client: ai_client.clone(),
+            // Observable: autotune agent's LLM calls go through
+            // /v1/chat for /v1/usage + Langfuse visibility.
+            ai_client: ai_client_observable.clone(),
             catalog: registry.clone(),
             index_registry: index_reg.clone(),
             hnsw_store: hnsw.clone(),
@@ -189,7 +218,9 @@ async fn main() {
         }))
         .nest("/vectors", vectord::service::router(vectord::service::VectorState {
             store: store.clone(),
-            ai_client: ai_client.clone(),
+            // Observable: /vectors service's LLM calls (RAG, summary,
+            // playbook synthesis, etc.) flow through /v1/chat.
+            ai_client: ai_client_observable.clone(),
             job_tracker: vectord::jobs::JobTracker::new(),
             index_registry: index_reg.clone(),
             hnsw_store: hnsw,
@@ -271,6 +302,54 @@ async fn main() {
                 }
                 k
             },
+            kimi_key: {
+                // Direct Kimi For Coding (api.kimi.com) — bypasses the
+                // broken-upstream kimi-k2:1t and OpenRouter rate caps.
+                // Key from /etc/lakehouse/kimi.env (KIMI_API_KEY=sk-kimi-…).
+                let k = v1::kimi::resolve_kimi_key();
+                if k.is_some() {
+                    tracing::info!("v1: Kimi key loaded — /v1/chat provider=kimi enabled (model=kimi-for-coding)");
+                } else {
+                    tracing::debug!("v1: no Kimi key — provider=kimi will 503");
+                }
+                k
+            },
+            opencode_key: {
+                // OpenCode GO multi-vendor gateway — Claude Opus 4.7,
+                // GPT-5.5-pro, Gemini 3.1-pro, Kimi K2.6, DeepSeek, GLM,
+                // Qwen + free-tier. Key from /etc/lakehouse/opencode.env.
+                let k = v1::opencode::resolve_opencode_key();
+                if k.is_some() {
+                    tracing::info!("v1: OpenCode key loaded — /v1/chat provider=opencode enabled (40 models)");
+                } else {
+                    tracing::debug!("v1: no OpenCode key — provider=opencode will 503");
+                }
+                k
+            },
+            validate_workers: {
+                // Load workers_500k.parquet snapshot for /v1/validate.
+                // Path overridable via LH_WORKERS_PARQUET env. Missing
+                // file is non-fatal — validators run schema/PII checks
+                // unaffected; only worker-existence checks fail clean.
+                let path_str = std::env::var("LH_WORKERS_PARQUET")
+                    .unwrap_or_else(|_| "/home/profit/lakehouse/data/datasets/workers_500k.parquet".into());
+                let path = std::path::Path::new(&path_str);
+                if path.exists() {
+                    match validator::staffing::parquet_lookup::load_workers_parquet(path) {
+                        Ok(lookup) => {
+                            tracing::info!("v1: workers parquet loaded from {} — /v1/validate worker-existence checks enabled", path_str);
+                            lookup
+                        }
+                        Err(e) => {
+                            tracing::warn!("v1: workers parquet at {} unreadable ({e}) — /v1/validate worker-existence checks will fail Consistency", path_str);
+                            std::sync::Arc::new(validator::InMemoryWorkerLookup::new())
+                        }
+                    }
+                } else {
+                    tracing::warn!("v1: workers parquet at {} not found — /v1/validate worker-existence checks will fail Consistency", path_str);
+                    std::sync::Arc::new(validator::InMemoryWorkerLookup::new())
+                }
+            },
             // Phase 40 early deliverable — Langfuse trace emitter.
             // Defaults match mcp-server/tracing.ts conventions so
             // gateway traces land in the same staffing project.

crates/gateway/src/v1/iterate.rs

@@ -0,0 +1,313 @@
+//! /v1/iterate — the Phase 43 PRD's "generate → validate → correct → retry" loop.
+//!
+//! Closes the "0→85% with iteration" thesis structurally. A caller
+//! posts a prompt + artifact kind + validation context; the gateway:
+//!   1. Generates a JSON artifact via /v1/chat (any provider/model)
+//!   2. Extracts the JSON object from the model output
+//!   3. Validates via /v1/validate (FillValidator / EmailValidator /
+//!      PlaybookValidator with the shared WorkerLookup)
+//!   4. On ValidationError, appends the error to the prompt and
+//!      retries up to `max_iterations` (default 3)
+//!   5. Returns the accepted artifact + Report on success, OR the
+//!      attempt history + final error on max-iter exhaustion
+//!
+//! Internal calls go via HTTP loopback to localhost:gateway_port so
+//! the same /v1/usage tracking and Langfuse traces apply. A small
+//! latency cost (~1-3ms per loopback hop) for clean separation of
+//! concerns and observability.
+//!
+//! 2026-04-27 Phase 43 v3 part 3: this endpoint makes the iteration
+//! loop a first-class lakehouse capability rather than a per-caller
+//! re-implementation. Staffing executors, agent loops, and future
+//! validators all reach the same code path.
+
+use axum::{extract::State, http::StatusCode, response::IntoResponse, Json};
+use serde::{Deserialize, Serialize};
+
+const DEFAULT_MAX_ITERATIONS: u32 = 3;
+const LOOPBACK_TIMEOUT_SECS: u64 = 240;
+
+#[derive(Deserialize)]
+pub struct IterateRequest {
+    /// "fill" | "email" | "playbook" — picks which validator runs.
+    pub kind: String,
+    /// The prompt to seed generation. Validation errors from prior
+    /// attempts are appended on retry.
+    pub prompt: String,
+    /// Provider/model passed through to /v1/chat. e.g. "ollama_cloud"
+    /// + "kimi-k2.6", or "opencode" + "claude-haiku-4-5".
+    pub provider: String,
+    pub model: String,
+    /// Optional system prompt — sent to /v1/chat as the system message.
+    #[serde(default)]
+    pub system: Option<String>,
+    /// Validation context (target_count, city, state, role, client_id
+    /// for fills; candidate_id for emails). Forwarded to /v1/validate.
+    #[serde(default)]
+    pub context: Option<serde_json::Value>,
+    /// Cap on iteration count. Defaults to 3 per the Phase 43 PRD.
+    #[serde(default)]
+    pub max_iterations: Option<u32>,
+    /// Forwarded to /v1/chat. Defaults to 0.2 if unset.
+    #[serde(default)]
+    pub temperature: Option<f64>,
+    /// Forwarded to /v1/chat. Defaults to 4096 if unset.
+    #[serde(default)]
+    pub max_tokens: Option<u32>,
+}
+
+#[derive(Serialize)]
+pub struct IterateAttempt {
+    pub iteration: u32,
+    pub raw: String,
+    pub status: AttemptStatus,
+}
+
+#[derive(Serialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum AttemptStatus {
+    /// Model output didn't contain extractable JSON.
+    NoJson,
+    /// JSON extracted but failed validation; carries the error.
+    ValidationFailed { error: serde_json::Value },
+    /// Validation passed (last attempt's terminal status).
+    Accepted,
+}
+
+#[derive(Serialize)]
+pub struct IterateResponse {
+    pub artifact: serde_json::Value,
+    pub validation: serde_json::Value,
+    pub iterations: u32,
+    pub history: Vec<IterateAttempt>,
+}
+
+#[derive(Serialize)]
+pub struct IterateFailure {
+    pub error: String,
+    pub iterations: u32,
+    pub history: Vec<IterateAttempt>,
+}
+
+pub async fn iterate(
+    State(_state): State<super::V1State>,
+    Json(req): Json<IterateRequest>,
+) -> impl IntoResponse {
+    let max_iter = req.max_iterations.unwrap_or(DEFAULT_MAX_ITERATIONS).max(1);
+    let temperature = req.temperature.unwrap_or(0.2);
+    let max_tokens = req.max_tokens.unwrap_or(4096);
+    let mut history: Vec<IterateAttempt> = Vec::with_capacity(max_iter as usize);
+    let mut current_prompt = req.prompt.clone();
+
+    let client = match reqwest::Client::builder()
+        .timeout(std::time::Duration::from_secs(LOOPBACK_TIMEOUT_SECS))
+        .build() {
+        Ok(c) => c,
+        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, format!("client build: {e}")).into_response(),
+    };
+    // Self-loopback to the gateway port. Carries gateway internal
+    // calls through /v1/chat + /v1/validate so /v1/usage tracks them.
+    let gateway = "http://127.0.0.1:3100";
+
+    for iteration in 0..max_iter {
+        // ── Generate ──
+        let mut messages = Vec::with_capacity(2);
+        if let Some(sys) = &req.system {
+            messages.push(serde_json::json!({"role": "system", "content": sys}));
+        }
+        messages.push(serde_json::json!({"role": "user", "content": current_prompt}));
+        let chat_body = serde_json::json!({
+            "messages": messages,
+            "provider": req.provider,
+            "model": req.model,
+            "temperature": temperature,
+            "max_tokens": max_tokens,
+        });
+        let raw = match call_chat(&client, gateway, &chat_body).await {
+            Ok(r) => r,
+            Err(e) => return (StatusCode::BAD_GATEWAY, format!("/v1/chat hop failed at iter {iteration}: {e}")).into_response(),
+        };
+
+        // ── Extract JSON ──
+        let artifact = match extract_json(&raw) {
+            Some(a) => a,
+            None => {
+                history.push(IterateAttempt {
+                    iteration,
+                    raw: raw.chars().take(2000).collect(),
+                    status: AttemptStatus::NoJson,
+                });
+                current_prompt = format!(
+                    "{}\n\nYour previous attempt did not contain a JSON object. Reply with ONLY a valid JSON object matching the requested artifact shape.",
+                    req.prompt,
+                );
+                continue;
+            }
+        };
+
+        // ── Validate ──
+        let validate_body = serde_json::json!({
+            "kind": req.kind,
+            "artifact": artifact,
+            "context": req.context.clone().unwrap_or(serde_json::Value::Null),
+        });
+        match call_validate(&client, gateway, &validate_body).await {
+            Ok(report) => {
+                history.push(IterateAttempt {
+                    iteration,
+                    raw: raw.chars().take(2000).collect(),
+                    status: AttemptStatus::Accepted,
+                });
+                return (StatusCode::OK, Json(IterateResponse {
+                    artifact,
+                    validation: report,
+                    iterations: iteration + 1,
+                    history,
+                })).into_response();
+            }
+            Err(err) => {
+                let err_summary = err.to_string();
+                history.push(IterateAttempt {
+                    iteration,
+                    raw: raw.chars().take(2000).collect(),
+                    status: AttemptStatus::ValidationFailed {
+                        error: serde_json::to_value(&err_summary).unwrap_or(serde_json::Value::Null),
+                    },
+                });
+                // Append validation feedback to prompt for next iter.
+                // The model sees concrete failure mode + retries with
+                // corrective context. This is the "observer correction"
+                // in Phase 43 PRD shape, simplified — the validator
+                // itself IS the observer for now.
+                current_prompt = format!(
+                    "{}\n\nPrior attempt failed validation:\n{}\n\nFix the specific issue above and respond with a corrected JSON object.",
+                    req.prompt, err_summary,
+                );
+                continue;
+            }
+        }
+    }
+
+    (StatusCode::UNPROCESSABLE_ENTITY, Json(IterateFailure {
+        error: format!("max iterations reached ({max_iter}) without passing validation"),
+        iterations: max_iter,
+        history,
+    })).into_response()
+}
+
+async fn call_chat(client: &reqwest::Client, gateway: &str, body: &serde_json::Value) -> Result<String, String> {
+    let resp = client.post(format!("{gateway}/v1/chat"))
+        .json(body)
+        .send()
+        .await
+        .map_err(|e| format!("chat hop: {e}"))?;
+    let status = resp.status();
+    if !status.is_success() {
+        let body = resp.text().await.unwrap_or_default();
+        return Err(format!("chat {}: {}", status, body.chars().take(300).collect::<String>()));
+    }
+    let parsed: serde_json::Value = resp.json().await.map_err(|e| format!("chat parse: {e}"))?;
+    Ok(parsed.pointer("/choices/0/message/content")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string())
+}
+
+async fn call_validate(client: &reqwest::Client, gateway: &str, body: &serde_json::Value) -> Result<serde_json::Value, String> {
+    let resp = client.post(format!("{gateway}/v1/validate"))
+        .json(body)
+        .send()
+        .await
+        .map_err(|e| format!("validate hop: {e}"))?;
+    let status = resp.status();
+    let parsed: serde_json::Value = resp.json().await.map_err(|e| format!("validate parse: {e}"))?;
+    if status.is_success() {
+        Ok(parsed)
+    } else {
+        // The /v1/validate endpoint returns a ValidationError JSON
+        // on 422; surface its structure verbatim so the prompt-
+        // appending step gets specific failure detail.
+        Err(serde_json::to_string(&parsed).unwrap_or_else(|_| format!("validation {} (unparseable body)", status)))
+    }
+}
+
+/// Extract the first JSON object from a model's output. Handles
+/// fenced code blocks (```json ... ```), bare braces, and stray
+/// prose around the JSON. Returns None on no extractable object.
+fn extract_json(raw: &str) -> Option<serde_json::Value> {
+    // Try fenced first.
+    let candidates: Vec<String> = {
+        let mut out = vec![];
+        let mut s = raw;
+        while let Some(start) = s.find("```") {
+            let after = &s[start + 3..];
+            // Skip optional language tag (json, etc.)
+            let body_start = after.find('\n').map(|n| n + 1).unwrap_or(0);
+            let body = &after[body_start..];
+            if let Some(end) = body.find("```") {
+                out.push(body[..end].trim().to_string());
+                s = &body[end + 3..];
+            } else { break; }
+        }
+        out
+    };
+    for c in &candidates {
+        if let Ok(v) = serde_json::from_str::<serde_json::Value>(c) {
+            if v.is_object() { return Some(v); }
+        }
+    }
+    // Fall back to outermost {...} balance.
+    let bytes = raw.as_bytes();
+    let mut depth = 0i32;
+    let mut start: Option<usize> = None;
+    for (i, &b) in bytes.iter().enumerate() {
+        match b {
+            b'{' => { if start.is_none() { start = Some(i); } depth += 1; }
+            b'}' => {
+                depth -= 1;
+                if depth == 0 {
+                    if let Some(s) = start {
+                        let slice = &raw[s..=i];
+                        if let Ok(v) = serde_json::from_str::<serde_json::Value>(slice) {
+                            if v.is_object() { return Some(v); }
+                        }
+                        start = None;
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn extract_json_from_fenced_block() {
+        let raw = "Here's my answer:\n```json\n{\"fills\": [{\"candidate_id\": \"W-1\"}]}\n```\nDone.";
+        let v = extract_json(raw).unwrap();
+        assert!(v.get("fills").is_some());
+    }
+
+    #[test]
+    fn extract_json_from_bare_braces() {
+        let raw = "Here you go: {\"fills\": [{\"candidate_id\": \"W-2\"}]}";
+        let v = extract_json(raw).unwrap();
+        assert!(v.get("fills").is_some());
+    }
+
+    #[test]
+    fn extract_json_returns_none_on_no_object() {
+        assert!(extract_json("just prose, no json").is_none());
+    }
+
+    #[test]
+    fn extract_json_picks_first_balanced() {
+        let raw = "{\"a\":1} then {\"b\":2}";
+        let v = extract_json(raw).unwrap();
+        assert_eq!(v.get("a").and_then(|v| v.as_i64()), Some(1));
+    }
+}

crates/gateway/src/v1/kimi.rs

@@ -0,0 +1,227 @@
+//! Kimi For Coding adapter — direct provider for `kimi-for-coding`
+//! (kimi-k2.6 underneath). Used when Ollama Cloud's `kimi-k2:1t` is
+//! returning sustained 5xx (broken upstream) and OpenRouter's
+//! `moonshotai/kimi-k2.6` is rate-limited.
+//!
+//! Endpoint per `kimi.com/code/docs` and `moonshotai.github.io/kimi-cli`:
+//!   base_url:  https://api.kimi.com/coding/v1
+//!   model id:  kimi-for-coding
+//!   auth:      Bearer sk-kimi-…
+//!   protocol:  OpenAI Chat Completions compatible
+//!
+//! IMPORTANT: `api.kimi.com` is a separate account system from
+//! `api.moonshot.ai` and `api.moonshot.cn`. Keys are NOT interchangeable.
+//! This adapter is for `sk-kimi-*` keys provisioned via the Kimi
+//! membership console only.
+//!
+//! Key sourcing priority:
+//!   1. Env var `KIMI_API_KEY` (loaded from /etc/lakehouse/kimi.env via
+//!      systemd EnvironmentFile=)
+//!   2. /etc/lakehouse/kimi.env directly (rescue path if env not loaded)
+//!
+//! First hit wins. Resolved once at gateway startup, stored on
+//! `V1State.kimi_key`.
+
+use std::time::Duration;
+use serde::{Deserialize, Serialize};
+
+use super::{ChatRequest, ChatResponse, Choice, Message, UsageBlock};
+
+const KIMI_BASE_URL: &str = "https://api.kimi.com/coding/v1";
+// Default 600s — kimi-for-coding is a reasoning model; on large
+// code-audit prompts (~50KB+ input + 8K output) it routinely needs
+// 3-8 min to think + emit. Override with KIMI_TIMEOUT_SECS env var.
+const KIMI_TIMEOUT_SECS_DEFAULT: u64 = 600;
+
+fn kimi_timeout_secs() -> u64 {
+    std::env::var("KIMI_TIMEOUT_SECS")
+        .ok()
+        .and_then(|s| s.trim().parse::<u64>().ok())
+        .filter(|&n| n > 0)
+        .unwrap_or(KIMI_TIMEOUT_SECS_DEFAULT)
+}
+
+pub fn resolve_kimi_key() -> Option<String> {
+    if let Ok(k) = std::env::var("KIMI_API_KEY") {
+        if !k.trim().is_empty() { return Some(k.trim().to_string()); }
+    }
+    if let Ok(raw) = std::fs::read_to_string("/etc/lakehouse/kimi.env") {
+        for line in raw.lines() {
+            if let Some(rest) = line.strip_prefix("KIMI_API_KEY=") {
+                let k = rest.trim().trim_matches('"').trim_matches('\'');
+                if !k.is_empty() { return Some(k.to_string()); }
+            }
+        }
+    }
+    None
+}
+
+pub async fn chat(
+    key: &str,
+    req: &ChatRequest,
+) -> Result<ChatResponse, String> {
+    // Strip the "kimi/" namespace prefix if the caller used it so the
+    // upstream API sees the bare model id (e.g. "kimi-for-coding").
+    let model = req.model.strip_prefix("kimi/").unwrap_or(&req.model).to_string();
+
+    // Flatten content to a plain String. api.kimi.com is text-only on
+    // the coding endpoint; the OpenAI multimodal array shape
+    // ([{type:"text",text:"..."},{type:"image_url",...}]) returns 400.
+    // Message::text() concats text-parts and drops non-text. Caught
+    // 2026-04-27 by Kimi's self-audit (kimi.rs:137 — content as raw
+    // serde_json::Value risked upstream rejection).
+    let body = KimiChatBody {
+        model: model.clone(),
+        messages: req.messages.iter().map(|m| KimiMessage {
+            role: m.role.clone(),
+            content: serde_json::Value::String(m.text()),
+        }).collect(),
+        max_tokens: req.max_tokens.unwrap_or(800),
+        temperature: req.temperature.unwrap_or(0.3),
+        stream: false,
+    };
+
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(kimi_timeout_secs()))
+        .build()
+        .map_err(|e| format!("build client: {e}"))?;
+
+    let t0 = std::time::Instant::now();
+    let resp = client
+        .post(format!("{}/chat/completions", KIMI_BASE_URL))
+        .bearer_auth(key)
+        // api.kimi.com gates this endpoint by User-Agent — only sanctioned
+        // coding agents (Claude Code, Kimi CLI, Roo Code, Kilo Code) get
+        // through. Generic clients receive 403 access_terminated_error.
+        // J accepted the TOS risk on 2026-04-27; revisit if Moonshot
+        // tightens enforcement.
+        .header("User-Agent", "claude-code/1.0.0")
+        .json(&body)
+        .send()
+        .await
+        .map_err(|e| format!("api.kimi.com unreachable: {e}"))?;
+
+    let status = resp.status();
+    if !status.is_success() {
+        let body = resp.text().await.unwrap_or_else(|_| "?".into());
+        return Err(format!("api.kimi.com {}: {}", status, body));
+    }
+
+    let parsed: KimiChatResponse = resp.json().await
+        .map_err(|e| format!("invalid kimi response: {e}"))?;
+
+    let latency_ms = t0.elapsed().as_millis();
+    let choice = parsed.choices.into_iter().next()
+        .ok_or_else(|| "kimi returned no choices".to_string())?;
+    let text = choice.message.content;
+
+    let prompt_tokens = parsed.usage.as_ref().map(|u| u.prompt_tokens).unwrap_or_else(|| {
+        let chars: usize = req.messages.iter().map(|m| m.text().chars().count()).sum();
+        ((chars + 3) / 4) as u32
+    });
+    let completion_tokens = parsed.usage.as_ref().map(|u| u.completion_tokens).unwrap_or_else(|| {
+        ((text.chars().count() + 3) / 4) as u32
+    });
+
+    tracing::info!(
+        target: "v1.chat",
+        provider = "kimi",
+        model = %model,
+        prompt_tokens,
+        completion_tokens,
+        latency_ms = latency_ms as u64,
+        "kimi chat completed",
+    );
+
+    Ok(ChatResponse {
+        id: format!("chatcmpl-{}", chrono::Utc::now().timestamp_nanos_opt().unwrap_or(0)),
+        object: "chat.completion",
+        created: chrono::Utc::now().timestamp(),
+        model,
+        choices: vec![Choice {
+            index: 0,
+            message: Message { role: "assistant".into(), content: serde_json::Value::String(text) },
+            finish_reason: choice.finish_reason.unwrap_or_else(|| "stop".into()),
+        }],
+        usage: UsageBlock {
+            prompt_tokens,
+            completion_tokens,
+            total_tokens: prompt_tokens + completion_tokens,
+        },
+    })
+}
+
+// -- Kimi wire shapes (OpenAI-compatible) --
+
+#[derive(Serialize)]
+struct KimiChatBody {
+    model: String,
+    messages: Vec<KimiMessage>,
+    max_tokens: u32,
+    temperature: f64,
+    stream: bool,
+}
+
+#[derive(Serialize)]
+struct KimiMessage { role: String, content: serde_json::Value }
+
+#[derive(Deserialize)]
+struct KimiChatResponse {
+    choices: Vec<KimiChoice>,
+    #[serde(default)]
+    usage: Option<KimiUsage>,
+}
+
+#[derive(Deserialize)]
+struct KimiChoice {
+    message: KimiMessageResp,
+    #[serde(default)]
+    finish_reason: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct KimiMessageResp { content: String }
+
+#[derive(Deserialize)]
+struct KimiUsage { prompt_tokens: u32, completion_tokens: u32 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn resolve_kimi_key_does_not_panic() {
+        let _ = resolve_kimi_key();
+    }
+
+    #[test]
+    fn chat_body_serializes_to_openai_shape() {
+        let body = KimiChatBody {
+            model: "kimi-for-coding".into(),
+            messages: vec![
+                KimiMessage { role: "user".into(), content: "review this".into() },
+            ],
+            max_tokens: 800,
+            temperature: 0.3,
+            stream: false,
+        };
+        let json = serde_json::to_string(&body).unwrap();
+        assert!(json.contains("\"model\":\"kimi-for-coding\""));
+        assert!(json.contains("\"messages\""));
+        assert!(json.contains("\"max_tokens\":800"));
+        assert!(json.contains("\"stream\":false"));
+    }
+
+    #[test]
+    fn model_prefix_strip() {
+        let cases = [
+            ("kimi/kimi-for-coding", "kimi-for-coding"),
+            ("kimi-for-coding", "kimi-for-coding"),
+            ("kimi/kimi-k2.6", "kimi-k2.6"),
+        ];
+        for (input, expected) in cases {
+            let out = input.strip_prefix("kimi/").unwrap_or(input);
+            assert_eq!(out, expected, "{input} should become {expected}");
+        }
+    }
+}

crates/gateway/src/v1/mod.rs

@@ -16,6 +16,10 @@ pub mod ollama_cloud;
 pub mod openrouter;
 pub mod gemini;
 pub mod claude;
+pub mod kimi;
+pub mod opencode;
+pub mod validate;
+pub mod iterate;
 pub mod langfuse_trace;
 pub mod mode;
 pub mod respond;
@@ -53,6 +57,28 @@ pub struct V1State {
     /// `claude::resolve_claude_key()`. None = provider="claude" calls
     /// 503. Phase 40 deliverable.
     pub claude_key: Option<String>,
+    /// Kimi For Coding (api.kimi.com) bearer token — direct provider
+    /// for `kimi-for-coding`. Used when Ollama Cloud's `kimi-k2:1t` is
+    /// upstream-broken. Loaded at startup via `kimi::resolve_kimi_key()`
+    /// from `KIMI_API_KEY` env or `/etc/lakehouse/kimi.env`. None =
+    /// provider="kimi" calls 503.
+    pub kimi_key: Option<String>,
+    /// OpenCode GO (opencode.ai) bearer token — multi-vendor curated
+    /// gateway. One sk-* key reaches Claude Opus 4.7, GPT-5.5-pro,
+    /// Gemini 3.1-pro, Kimi K2.6, DeepSeek, GLM, Qwen + free-tier.
+    /// Loaded at startup via `opencode::resolve_opencode_key()` from
+    /// `OPENCODE_API_KEY` env or `/etc/lakehouse/opencode.env`. None =
+    /// provider="opencode" calls 503.
+    pub opencode_key: Option<String>,
+    /// Shared WorkerLookup loaded once at startup from
+    /// workers_500k.parquet (path: LH_WORKERS_PARQUET env, default
+    /// data/datasets/workers_500k.parquet). Used by /v1/validate to
+    /// run FillValidator/EmailValidator with worker-existence checks.
+    /// Falls back to an empty InMemoryWorkerLookup if the file is
+    /// missing — validators still run schema/PII checks but every
+    /// worker-existence check fails (Consistency error), which is
+    /// the correct behavior when the roster isn't configured.
+    pub validate_workers: std::sync::Arc<dyn validator::WorkerLookup>,
     /// Phase 40 early deliverable — Langfuse client. None = tracing
     /// disabled (keys missing or container unreachable). Traces are
     /// fire-and-forget: never block the response path.
@@ -92,6 +118,9 @@ pub fn router(state: V1State) -> Router {
         .route("/mode", post(mode::route))
         .route("/mode/list", get(mode::list))
         .route("/mode/execute", post(mode::execute))
+        .route("/validate", post(validate::validate))
+        .route("/iterate", post(iterate::iterate))
+        .route("/health", get(health))
         .with_state(state)
 }
 
@@ -224,6 +253,12 @@ fn resolve_provider(req: &ChatRequest) -> (String, String) {
     if let Some(rest) = req.model.strip_prefix("claude/") {
         return ("claude".to_string(), rest.to_string());
     }
+    if let Some(rest) = req.model.strip_prefix("kimi/") {
+        return ("kimi".to_string(), rest.to_string());
+    }
+    if let Some(rest) = req.model.strip_prefix("opencode/") {
+        return ("opencode".to_string(), rest.to_string());
+    }
     // Bare `vendor/model` shape (e.g. `x-ai/grok-4.1-fast`,
     // `moonshotai/kimi-k2`, `openai/gpt-oss-120b:free`) → OpenRouter.
     // This makes the gateway a drop-in OpenAI-compatible middleware:
@@ -316,6 +351,12 @@ mod resolve_provider_tests {
         let r = mk_req(None, "claude/claude-3-5-sonnet-latest");
         assert_eq!(resolve_provider(&r), ("claude".into(), "claude-3-5-sonnet-latest".into()));
     }
+
+    #[test]
+    fn kimi_prefix_infers_and_strips() {
+        let r = mk_req(None, "kimi/kimi-for-coding");
+        assert_eq!(resolve_provider(&r), ("kimi".into(), "kimi-for-coding".into()));
+    }
 }
 
 async fn chat(
@@ -403,10 +444,37 @@ async fn chat(
                 .map_err(|e| (StatusCode::BAD_GATEWAY, format!("claude: {e}")))?;
             (r, "claude".to_string())
         }
+        "kimi" => {
+            // Direct Kimi For Coding provider — bypasses Ollama Cloud's
+            // upstream-broken kimi-k2:1t and OpenRouter's rate-limited
+            // moonshotai/kimi-k2.6. Uses sk-kimi-* keys from the Kimi
+            // membership console.
+            let key = state.kimi_key.as_deref().ok_or((
+                StatusCode::SERVICE_UNAVAILABLE,
+                "KIMI_API_KEY not configured".to_string(),
+            ))?;
+            let r = kimi::chat(key, &*req_for_adapter)
+                .await
+                .map_err(|e| (StatusCode::BAD_GATEWAY, format!("kimi: {e}")))?;
+            (r, "kimi".to_string())
+        }
+        "opencode" => {
+            // OpenCode GO multi-vendor gateway — Claude Opus 4.7,
+            // GPT-5.5-pro, Gemini 3.1-pro, Kimi K2.6, DeepSeek, GLM,
+            // Qwen, free-tier. OpenAI-compat at opencode.ai/zen/go/v1.
+            let key = state.opencode_key.as_deref().ok_or((
+                StatusCode::SERVICE_UNAVAILABLE,
+                "OPENCODE_API_KEY not configured".to_string(),
+            ))?;
+            let r = opencode::chat(key, &*req_for_adapter)
+                .await
+                .map_err(|e| (StatusCode::BAD_GATEWAY, format!("opencode: {e}")))?;
+            (r, "opencode".to_string())
+        }
         other => {
             return Err((
                 StatusCode::BAD_REQUEST,
-                format!("unknown provider '{other}' — supported: ollama, ollama_cloud, openrouter, gemini, claude"),
+                format!("unknown provider '{other}' — supported: ollama, ollama_cloud, openrouter, gemini, claude, kimi, opencode"),
             ));
         }
     };
@@ -501,6 +569,43 @@ async fn usage(State(state): State<V1State>) -> impl IntoResponse {
     Json(snapshot)
 }
 
+/// Production operational health endpoint.
+///
+/// `/v1/health` reports per-subsystem status as a JSON object so an
+/// operator (or the lakehouse-auditor service, or a load balancer)
+/// can verify the gateway is fully booted, has its provider keys
+/// loaded, the worker roster is hot, and Langfuse is reachable.
+/// Returns 200 always — fields are observed-state, not pass/fail
+/// gates. A monitoring tool should evaluate the booleans + counts
+/// against its own thresholds.
+async fn health(State(state): State<V1State>) -> impl IntoResponse {
+    // Honest worker count via WorkerLookup::len. Production switchover
+    // verification: after swapping workers_500k.parquet → real Chicago
+    // data and restarting, this number should match the row count of
+    // the new file. 0 means the file was missing / unreadable / had a
+    // schema mismatch and the gateway booted with the empty fallback.
+    let workers_count = state.validate_workers.len();
+    let providers_configured = serde_json::json!({
+        "ollama_cloud": state.ollama_cloud_key.is_some(),
+        "openrouter": state.openrouter_key.is_some(),
+        "kimi": state.kimi_key.is_some(),
+        "opencode": state.opencode_key.is_some(),
+        "gemini": state.gemini_key.is_some(),
+        "claude": state.claude_key.is_some(),
+    });
+    let langfuse_configured = state.langfuse.is_some();
+    let usage_snapshot = state.usage.read().await.clone();
+    Json(serde_json::json!({
+        "status": "ok",
+        "workers_count": workers_count,
+        "workers_loaded": workers_count > 0,
+        "providers_configured": providers_configured,
+        "langfuse_configured": langfuse_configured,
+        "usage_total_requests": usage_snapshot.requests,
+        "usage_by_provider": usage_snapshot.by_provider.keys().collect::<Vec<_>>(),
+    }))
+}
+
 // Phase 38 is stateless — no session persistence yet. Return an empty
 // list in OpenAI-ish shape so clients that probe this endpoint don't
 // 404. Real session state lands in Phase 41 with the profile-system

crates/gateway/src/v1/mode.rs

@@ -1032,14 +1032,14 @@ mod tests {
                     preferred_mode: "codereview".into(),
                     fallback_modes: vec!["consensus".into()],
                     default_model: "qwen3-coder:480b".into(),
-                    matrix_corpus: Some("distilled_procedural_v1".into()),
+                    matrix_corpus: vec!["distilled_procedural_v1".into()],
                 },
                 TaskClassEntry {
                     name: "broken".into(),
                     preferred_mode: "nonsense_mode".into(),
                     fallback_modes: vec!["consensus".into()],
                     default_model: "x".into(),
-                    matrix_corpus: None,
+                    matrix_corpus: vec![],
                 },
             ],
             default: DefaultEntry {

crates/gateway/src/v1/opencode.rs

@@ -0,0 +1,228 @@
+//! OpenCode GO adapter — multi-vendor curated gateway via opencode.ai/zen/go.
+//!
+//! One sk-* key reaches Claude Opus 4.7, GPT-5.5-pro, Gemini 3.1-pro,
+//! Kimi K2.6, DeepSeek, GLM, Qwen, plus 4 free-tier models.
+//! OpenAI-compatible Chat Completions; auth via Bearer.
+//!
+//! Why a separate adapter (vs reusing openrouter.rs):
+//! - Different account, different key, different base_url
+//! - No HTTP-Referer / X-Title headers (those are OpenRouter-specific)
+//! - Future-proof for any opencode-only request shaping
+//!
+//! Key sourcing priority:
+//!   1. Env var `OPENCODE_API_KEY` (loaded from /etc/lakehouse/opencode.env
+//!      via systemd EnvironmentFile=)
+//!   2. /etc/lakehouse/opencode.env directly (rescue path if env missing)
+//!
+//! Resolved once at gateway startup, stored on `V1State.opencode_key`.
+//! Model-prefix routing: "opencode/<model>" auto-routes here, prefix
+//! stripped before upstream call.
+
+use std::time::Duration;
+use serde::{Deserialize, Serialize};
+
+use super::{ChatRequest, ChatResponse, Choice, Message, UsageBlock};
+
+// /zen/v1 is the unified OpenCode endpoint that covers BOTH the
+// Zen pay-per-token tier (Claude/GPT/Gemini frontier) AND the Go
+// subscription tier (Kimi/GLM/DeepSeek/Qwen/Minimax/mimo). When the
+// caller has both, opencode bills per-model: Zen models charge Zen
+// balance, Go models charge against the Go subscription cap.
+//
+// /zen/go/v1 exists as a Go-only sub-path (rejects Zen models with
+// "Model not supported"); we use the unified /zen/v1 since the same
+// key works for both with correct billing routing upstream.
+const OPENCODE_BASE_URL: &str = "https://opencode.ai/zen/v1";
+// 600s default — opencode upstream models include reasoning-heavy
+// variants (Claude Opus, Kimi K2.6, GLM-5.1) that legitimately take
+// 3-5 min on big audit prompts. Override via OPENCODE_TIMEOUT_SECS.
+const OPENCODE_TIMEOUT_SECS_DEFAULT: u64 = 600;
+
+fn opencode_timeout_secs() -> u64 {
+    std::env::var("OPENCODE_TIMEOUT_SECS")
+        .ok()
+        .and_then(|s| s.trim().parse::<u64>().ok())
+        .filter(|&n| n > 0)
+        .unwrap_or(OPENCODE_TIMEOUT_SECS_DEFAULT)
+}
+
+pub fn resolve_opencode_key() -> Option<String> {
+    if let Ok(k) = std::env::var("OPENCODE_API_KEY") {
+        if !k.trim().is_empty() { return Some(k.trim().to_string()); }
+    }
+    if let Ok(raw) = std::fs::read_to_string("/etc/lakehouse/opencode.env") {
+        for line in raw.lines() {
+            if let Some(rest) = line.strip_prefix("OPENCODE_API_KEY=") {
+                let k = rest.trim().trim_matches('"').trim_matches('\'');
+                if !k.is_empty() { return Some(k.to_string()); }
+            }
+        }
+    }
+    None
+}
+
+pub async fn chat(
+    key: &str,
+    req: &ChatRequest,
+) -> Result<ChatResponse, String> {
+    // Strip the "opencode/" namespace prefix so the upstream sees the
+    // bare model id (e.g. "claude-opus-4-7", "kimi-k2.6").
+    let model = req.model.strip_prefix("opencode/").unwrap_or(&req.model).to_string();
+
+    // Anthropic models on opencode reject `temperature` with a 400
+    // "temperature is deprecated for this model" error. Strip the
+    // field for claude-* and the new gpt-5.x reasoning lineages
+    // (Anthropic/OpenAI's reasoning models all moved away from temp).
+    // Other models keep the caller's value or default to 0.3.
+    let drop_temp = model.starts_with("claude-")
+        || model.starts_with("gpt-5")
+        || model.starts_with("o1")
+        || model.starts_with("o3")
+        || model.starts_with("o4");
+    let body = OCChatBody {
+        model: model.clone(),
+        messages: req.messages.iter().map(|m| OCMessage {
+            role: m.role.clone(),
+            content: m.content.clone(),
+        }).collect(),
+        // filter(|&n| n > 0) catches Some(0) — same trap that bit the
+        // Kimi adapter when callers passed empty-env-parsed-to-0.
+        max_tokens: req.max_tokens.filter(|&n| n > 0).unwrap_or(800),
+        temperature: if drop_temp { None } else { Some(req.temperature.unwrap_or(0.3)) },
+        stream: false,
+    };
+
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(opencode_timeout_secs()))
+        .build()
+        .map_err(|e| format!("build client: {e}"))?;
+
+    let t0 = std::time::Instant::now();
+    let resp = client
+        .post(format!("{}/chat/completions", OPENCODE_BASE_URL))
+        .bearer_auth(key)
+        .json(&body)
+        .send()
+        .await
+        .map_err(|e| format!("opencode.ai unreachable: {e}"))?;
+
+    let status = resp.status();
+    if !status.is_success() {
+        let body = resp.text().await.unwrap_or_else(|_| "?".into());
+        return Err(format!("opencode.ai {}: {}", status, body));
+    }
+
+    let parsed: OCChatResponse = resp.json().await
+        .map_err(|e| format!("invalid opencode response: {e}"))?;
+
+    let latency_ms = t0.elapsed().as_millis();
+    let choice = parsed.choices.into_iter().next()
+        .ok_or_else(|| "opencode returned no choices".to_string())?;
+    let text = choice.message.content;
+
+    let prompt_tokens = parsed.usage.as_ref().map(|u| u.prompt_tokens).unwrap_or_else(|| {
+        let chars: usize = req.messages.iter().map(|m| m.text().chars().count()).sum();
+        ((chars + 3) / 4) as u32
+    });
+    let completion_tokens = parsed.usage.as_ref().map(|u| u.completion_tokens).unwrap_or_else(|| {
+        ((text.chars().count() + 3) / 4) as u32
+    });
+
+    tracing::info!(
+        target: "v1.chat",
+        provider = "opencode",
+        model = %model,
+        prompt_tokens,
+        completion_tokens,
+        latency_ms = latency_ms as u64,
+        "opencode chat completed",
+    );
+
+    Ok(ChatResponse {
+        id: format!("chatcmpl-{}", chrono::Utc::now().timestamp_nanos_opt().unwrap_or(0)),
+        object: "chat.completion",
+        created: chrono::Utc::now().timestamp(),
+        model,
+        choices: vec![Choice {
+            index: 0,
+            message: Message { role: "assistant".into(), content: serde_json::Value::String(text) },
+            finish_reason: choice.finish_reason.unwrap_or_else(|| "stop".into()),
+        }],
+        usage: UsageBlock {
+            prompt_tokens,
+            completion_tokens,
+            total_tokens: prompt_tokens + completion_tokens,
+        },
+    })
+}
+
+// -- OpenCode wire shapes (OpenAI-compatible) --
+
+#[derive(Serialize)]
+struct OCChatBody {
+    model: String,
+    messages: Vec<OCMessage>,
+    max_tokens: u32,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    temperature: Option<f64>,
+    stream: bool,
+}
+
+#[derive(Serialize)]
+struct OCMessage { role: String, content: serde_json::Value }
+
+#[derive(Deserialize)]
+struct OCChatResponse {
+    choices: Vec<OCChoice>,
+    #[serde(default)]
+    usage: Option<OCUsage>,
+}
+
+#[derive(Deserialize)]
+struct OCChoice {
+    message: OCMessageResp,
+    #[serde(default)]
+    finish_reason: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct OCMessageResp { content: String }
+
+#[derive(Deserialize)]
+struct OCUsage { prompt_tokens: u32, completion_tokens: u32 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn resolve_opencode_key_does_not_panic() {
+        let _ = resolve_opencode_key();
+    }
+
+    #[test]
+    fn model_prefix_strip() {
+        let cases = [
+            ("opencode/claude-opus-4-7", "claude-opus-4-7"),
+            ("opencode/kimi-k2.6", "kimi-k2.6"),
+            ("claude-opus-4-7", "claude-opus-4-7"),
+        ];
+        for (input, expected) in cases {
+            let out = input.strip_prefix("opencode/").unwrap_or(input);
+            assert_eq!(out, expected);
+        }
+    }
+
+    #[test]
+    fn max_tokens_filters_zero() {
+        // The trap: empty env -> Number("") -> 0 -> Some(0). Adapter
+        // must not pass 0 upstream; should fall to 800.
+        let some_zero: Option<u32> = Some(0);
+        let result = some_zero.filter(|&n| n > 0).unwrap_or(800);
+        assert_eq!(result, 800);
+        let some_real: Option<u32> = Some(4096);
+        assert_eq!(some_real.filter(|&n| n > 0).unwrap_or(800), 4096);
+        let none_val: Option<u32> = None;
+        assert_eq!(none_val.filter(|&n| n > 0).unwrap_or(800), 800);
+    }
+}

crates/gateway/src/v1/validate.rs

@@ -0,0 +1,82 @@
+//! /v1/validate — gateway-side artifact validation endpoint.
+//!
+//! Phase 43 v3 part 2: makes the validator crate network-callable.
+//! Any caller (scrum loop, test harness, future agent) can POST a
+//! generated artifact and get back a Report (success) or
+//! ValidationError (failure with structured field/reason).
+//!
+//! Request shape:
+//!   POST /v1/validate
+//!   {
+//!     "kind": "fill" | "email" | "playbook",
+//!     "artifact": { ... },
+//!     "context": { ... }   // optional — folded into artifact._context
+//!   }
+//!
+//! Response on success: 200 + Report JSON
+//! Response on failure: 422 + ValidationError JSON
+//! Response on bad request: 400 + plain-text error
+//!
+//! The shared WorkerLookup is loaded once at gateway startup from
+//! workers_500k.parquet (path configurable via LH_WORKERS_PARQUET
+//! env, defaults to data/datasets/workers_500k.parquet). Falls back
+//! to an empty InMemoryWorkerLookup if the file is missing — the
+//! validators will still run schema/length/PII checks but worker-
+//! existence checks will all fail (Consistency error), which is the
+//! correct behavior when the roster isn't configured.
+
+use axum::{extract::State, http::StatusCode, response::IntoResponse, Json};
+use serde::Deserialize;
+use validator::{
+    Artifact, Validator, ValidationError,
+    staffing::{
+        fill::FillValidator,
+        email::EmailValidator,
+        playbook::PlaybookValidator,
+    },
+};
+
+#[derive(Deserialize)]
+pub struct ValidateRequest {
+    /// `"fill" | "email" | "playbook"` — picks which validator runs.
+    pub kind: String,
+    /// The artifact JSON (free-form; shape depends on `kind`).
+    pub artifact: serde_json::Value,
+    /// Optional context bag — merged into `artifact._context` so the
+    /// validator can read fields like `target_count`, `city`,
+    /// `client_id`, `candidate_id` without callers having to embed
+    /// `_context` in the artifact themselves.
+    #[serde(default)]
+    pub context: Option<serde_json::Value>,
+}
+
+pub async fn validate(
+    State(state): State<super::V1State>,
+    Json(req): Json<ValidateRequest>,
+) -> impl IntoResponse {
+    // Merge context into artifact under `_context` so validators can
+    // pull contract metadata uniformly.
+    let mut artifact_value = req.artifact;
+    if let Some(ctx) = req.context {
+        if let Some(obj) = artifact_value.as_object_mut() {
+            obj.insert("_context".to_string(), ctx);
+        }
+    }
+
+    // Dispatch.
+    let workers = state.validate_workers.clone();
+    let result: Result<validator::Report, ValidationError> = match req.kind.as_str() {
+        "fill" => FillValidator::new(workers).validate(&Artifact::FillProposal(artifact_value)),
+        "email" => EmailValidator::new(workers).validate(&Artifact::EmailDraft(artifact_value)),
+        "playbook" => PlaybookValidator.validate(&Artifact::Playbook(artifact_value)),
+        other => return (
+            StatusCode::BAD_REQUEST,
+            format!("unknown kind '{other}' — expected fill | email | playbook"),
+        ).into_response(),
+    };
+
+    match result {
+        Ok(report) => (StatusCode::OK, Json(report)).into_response(),
+        Err(e) => (StatusCode::UNPROCESSABLE_ENTITY, Json(e)).into_response(),
+    }
+}

crates/validator/Cargo.toml

@@ -9,3 +9,7 @@ serde_json = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
+# Parquet loader for ParquetWorkerLookup (Phase 43 v3 — production
+# WorkerLookup backed by workers_500k.parquet snapshot).
+arrow = { workspace = true }
+parquet = { workspace = true }

crates/validator/src/lib.rs

@@ -93,3 +93,89 @@ pub trait Validator: Send + Sync {
     /// Human-readable name for logs + Langfuse traces.
     fn name(&self) -> &'static str;
 }
+
+// ─── Worker lookup (Phase 43 v2) ────────────────────────────────────────
+//
+// Validators that cross-check artifacts against the worker roster
+// (FillValidator, EmailValidator) take an `Arc<dyn WorkerLookup>` at
+// construction. Keeping the trait sync + in-memory mirrors the
+// lakehouse pattern of "load truth into memory, validate against
+// snapshot, refresh periodically" rather than per-call DB hits.
+//
+// Production impl: wrap a parquet snapshot loaded from
+// `data/datasets/workers_500k.parquet` (or its safe view counterpart
+// once Track A.B lands). Tests use `InMemoryWorkerLookup`.
+
+/// One worker row from the staffing roster — the fields validators
+/// actually read. Anything not on this struct (resume_text, scores,
+/// communications) is intentionally hidden from the validator path.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WorkerRecord {
+    pub candidate_id: String,
+    pub name: String,
+    /// Free-form. Validators check for `"active"` (any other value
+    /// fails the status check). Common values from existing data:
+    /// "active", "inactive", "placed", "blacklisted".
+    pub status: String,
+    pub city: Option<String>,
+    pub state: Option<String>,
+    pub role: Option<String>,
+    /// Client ids this worker has been blacklisted from. Populated
+    /// from joining a blacklist table; empty when not provided.
+    #[serde(default)]
+    pub blacklisted_clients: Vec<String>,
+}
+
+/// Worker lookup contract. Sync by design — implementations should
+/// hold an in-memory snapshot, not perform per-call I/O.
+pub trait WorkerLookup: Send + Sync {
+    fn find(&self, candidate_id: &str) -> Option<WorkerRecord>;
+    /// Number of workers in the snapshot. Default 0 for impls that
+    /// genuinely don't know (e.g. a future SQL-backed lookup that
+    /// counts on demand). InMemoryWorkerLookup overrides with the
+    /// HashMap size; ParquetWorkerLookup constructs an
+    /// InMemoryWorkerLookup so it inherits the override. Used by
+    /// /v1/health to report data-load status during production
+    /// switchover (the Chicago dataset replaces synthetic test data;
+    /// the health endpoint is how operators verify the new file
+    /// loaded correctly without restart-and-pray).
+    fn len(&self) -> usize { 0 }
+}
+
+/// HashMap-backed lookup. Used by validator unit tests + as a
+/// reasonable bootstrap impl for production once the parquet loader
+/// fills it on startup.
+pub struct InMemoryWorkerLookup {
+    rows: std::collections::HashMap<String, WorkerRecord>,
+}
+
+impl InMemoryWorkerLookup {
+    pub fn new() -> Self {
+        Self { rows: Default::default() }
+    }
+    pub fn from_records(records: Vec<WorkerRecord>) -> Self {
+        let mut rows = std::collections::HashMap::with_capacity(records.len());
+        for r in records {
+            rows.insert(r.candidate_id.clone(), r);
+        }
+        Self { rows }
+    }
+    pub fn insert(&mut self, record: WorkerRecord) {
+        self.rows.insert(record.candidate_id.clone(), record);
+    }
+    pub fn len(&self) -> usize { self.rows.len() }
+    pub fn is_empty(&self) -> bool { self.rows.is_empty() }
+}
+
+impl Default for InMemoryWorkerLookup {
+    fn default() -> Self { Self::new() }
+}
+
+impl WorkerLookup for InMemoryWorkerLookup {
+    fn find(&self, candidate_id: &str) -> Option<WorkerRecord> {
+        self.rows.get(candidate_id).cloned()
+    }
+    fn len(&self) -> usize {
+        self.rows.len()
+    }
+}

crates/validator/src/staffing/email.rs

@@ -1,4 +1,4 @@
-//! Email/SMS draft validator.
+//! Email/SMS draft validator (Phase 43 v2 — real PII + name checks).
 //!
 //! PRD checks:
 //!   - Schema (TO/BODY fields present)
@@ -6,15 +6,31 @@
 //!   - PII absence (no SSN / salary leaked into outgoing text)
 //!   - Worker-name consistency (name in message matches worker record)
 //!
-//! Scaffold implements schema + length. PII regex (SSN pattern,
-//! salary-number pattern) lives in `shared::pii::strip_pii` — plug in
-//! a follow-up when the validator caller knows the worker record to
-//! cross-check name consistency.
+//! Like FillValidator, EmailValidator takes `Arc<dyn WorkerLookup>` at
+//! construction. The contract metadata (which worker the message is
+//! about) travels under `_context.candidate_id` in the JSON payload.
+//! When `_context.candidate_id` is present and resolves, the validator
+//! cross-checks that the worker's name appears verbatim in the body.
+//!
+//! PII detection is std-only (no regex dep) — a hand-rolled scan
+//! covers the patterns we actually care about: SSN (NNN-NN-NNNN),
+//! salary statements ("salary" / "compensation" near a $ amount).
 
-use crate::{Artifact, Report, Validator, ValidationError};
+use crate::{
+    Artifact, Report, Validator, ValidationError, WorkerLookup,
+};
+use std::sync::Arc;
 use std::time::Instant;
 
-pub struct EmailValidator;
+pub struct EmailValidator {
+    workers: Arc<dyn WorkerLookup>,
+}
+
+impl EmailValidator {
+    pub fn new(workers: Arc<dyn WorkerLookup>) -> Self {
+        Self { workers }
+    }
+}
 
 const SMS_MAX_CHARS: usize = 160;
 const EMAIL_SUBJECT_MAX_CHARS: usize = 78;
@@ -32,7 +48,7 @@ impl Validator for EmailValidator {
             }),
         };
 
-        let to = value.get("to").and_then(|v| v.as_str()).ok_or(
+        let _to = value.get("to").and_then(|v| v.as_str()).ok_or(
             ValidationError::Schema {
                 field: "to".into(),
                 reason: "missing or not a string".into(),
@@ -63,54 +79,292 @@ impl Validator for EmailValidator {
             }
         }
 
-        let _ = to; // touched for future name-consistency check
-        // TODO(phase-43 v2): PII scan + worker-name consistency.
+        // ── PII scan on body + subject combined ──
+        let scanned = format!(
+            "{} {}",
+            value.get("subject").and_then(|v| v.as_str()).unwrap_or(""),
+            body
+        );
+        if contains_ssn_pattern(&scanned) {
+            return Err(ValidationError::Policy {
+                reason: "body contains an SSN-shaped sequence (NNN-NN-NNNN); strip before send".into(),
+            });
+        }
+        if contains_salary_disclosure(&scanned) {
+            return Err(ValidationError::Policy {
+                reason: "body discloses salary/compensation amount; staffing PII rule says strip before send".into(),
+            });
+        }
+
+        // ── Worker-name consistency ──
+        let candidate_id = value.get("_context")
+            .and_then(|c| c.get("candidate_id"))
+            .and_then(|v| v.as_str());
+        let mut findings: Vec<crate::Finding> = vec![];
+        if let Some(cid) = candidate_id {
+            match self.workers.find(cid) {
+                Some(worker) => {
+                    // Body should mention the worker's name (or at least
+                    // their first name) — drafts that address a different
+                    // person than the contracted worker are a recurring
+                    // class of LLM mistake.
+                    let first = worker.name.split_whitespace().next().unwrap_or(&worker.name);
+                    let body_lower = body.to_lowercase();
+                    let first_lower = first.to_lowercase();
+                    if !first_lower.is_empty() && !body_lower.contains(&first_lower) {
+                        findings.push(crate::Finding {
+                            field: "body".into(),
+                            severity: crate::Severity::Warning,
+                            message: format!(
+                                "body doesn't mention worker first name {first:?} (candidate_id {cid:?})"
+                            ),
+                        });
+                    }
+                    // Also detect *another* worker's name appearing in
+                    // place of the contracted one — outright wrong-target.
+                    // We can only check this when we have a different
+                    // expected name; skip if the body is generic enough.
+                }
+                None => {
+                    return Err(ValidationError::Consistency {
+                        reason: format!(
+                            "_context.candidate_id {cid:?} not found in worker roster"
+                        ),
+                    });
+                }
+            }
+        }
 
         Ok(Report {
-            findings: vec![],
+            findings,
             elapsed_ms: started.elapsed().as_millis() as u64,
         })
     }
 }
 
+// ─── PII scanners (std-only) ────────────────────────────────────────────
+
+/// Detects an SSN-shaped sequence: 3 digits, dash, 2 digits, dash, 4 digits.
+/// Walks the byte buffer; rejects sequences that are part of a longer run
+/// of digits (so phone-area-code-like NNN-NNN-NNNN isn't flagged). Tight
+/// false-positive surface: it's specifically the NNN-NN-NNNN shape.
+fn contains_ssn_pattern(s: &str) -> bool {
+    let bytes = s.as_bytes();
+    if bytes.len() < 11 { return false; }
+    for i in 0..=bytes.len().saturating_sub(11) {
+        let win = &bytes[i..i + 11];
+        let shape = win.iter().enumerate().all(|(j, &b)| match j {
+            0 | 1 | 2 | 4 | 5 | 7 | 8 | 9 | 10 => b.is_ascii_digit(),
+            3 | 6 => b == b'-',
+            _ => unreachable!(),
+        });
+        if !shape { continue; }
+        // Reject if the byte BEFORE this window is a digit or `-` —
+        // we're inside a longer numeric run, probably not an SSN.
+        if i > 0 {
+            let prev = bytes[i - 1];
+            if prev.is_ascii_digit() || prev == b'-' { continue; }
+        }
+        // Reject if the byte AFTER is a digit or `-` (same reason).
+        if i + 11 < bytes.len() {
+            let next = bytes[i + 11];
+            if next.is_ascii_digit() || next == b'-' { continue; }
+        }
+        return true;
+    }
+    false
+}
+
+/// Detects salary/compensation disclosure: the keywords "salary",
+/// "compensation", "pay rate", "bill rate", "hourly rate" appearing
+/// within ~40 chars of a `$` followed by digits. Coarse on purpose —
+/// it's better to false-positive on a legit phrase like "discuss your
+/// hourly rate of $30/hr" than to miss it.
+fn contains_salary_disclosure(s: &str) -> bool {
+    let lower = s.to_lowercase();
+    const KEYWORDS: &[&str] = &[
+        "salary", "compensation", "pay rate", "bill rate", "hourly rate",
+    ];
+    let mut keyword_positions: Vec<usize> = vec![];
+    for kw in KEYWORDS {
+        let mut start = 0;
+        while let Some(found) = lower[start..].find(kw) {
+            let abs = start + found;
+            keyword_positions.push(abs);
+            start = abs + kw.len();
+        }
+    }
+    if keyword_positions.is_empty() { return false; }
+
+    // Find every `$NNN+` in the text.
+    let bytes = lower.as_bytes();
+    let mut dollar_positions: Vec<usize> = vec![];
+    for (i, &b) in bytes.iter().enumerate() {
+        if b == b'$' && i + 1 < bytes.len() && bytes[i + 1].is_ascii_digit() {
+            dollar_positions.push(i);
+        }
+    }
+    if dollar_positions.is_empty() { return false; }
+
+    // Any (keyword, $) pair within 40 chars triggers the policy rule.
+    for &kp in &keyword_positions {
+        for &dp in &dollar_positions {
+            if kp.abs_diff(dp) <= 40 {
+                return true;
+            }
+        }
+    }
+    false
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::{InMemoryWorkerLookup, WorkerRecord};
+    use serde_json::json;
+
+    fn lookup(records: Vec<WorkerRecord>) -> Arc<dyn WorkerLookup> {
+        Arc::new(InMemoryWorkerLookup::from_records(records))
+    }
+
+    fn worker(id: &str, name: &str) -> WorkerRecord {
+        WorkerRecord {
+            candidate_id: id.into(),
+            name: name.into(),
+            status: "active".into(),
+            city: None, state: None, role: None,
+            blacklisted_clients: vec![],
+        }
+    }
 
     #[test]
     fn long_sms_fails_completeness() {
+        let v = EmailValidator::new(lookup(vec![]));
         let body = "x".repeat(200);
-        let r = EmailValidator.validate(&Artifact::EmailDraft(serde_json::json!({
-            "to": "+15555550123",
-            "body": body,
-            "kind": "sms"
+        let r = v.validate(&Artifact::EmailDraft(json!({
+            "to": "+15555550123", "body": body, "kind": "sms"
         })));
         assert!(matches!(r, Err(ValidationError::Completeness { .. })));
     }
 
     #[test]
     fn long_email_subject_fails_completeness() {
-        let r = EmailValidator.validate(&Artifact::EmailDraft(serde_json::json!({
-            "to": "a@b.com",
-            "body": "hi",
-            "subject": "x".repeat(100)
+        let v = EmailValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::EmailDraft(json!({
+            "to": "a@b.com", "body": "hi", "subject": "x".repeat(100)
         })));
         assert!(matches!(r, Err(ValidationError::Completeness { .. })));
     }
 
     #[test]
     fn missing_to_fails_schema() {
-        let r = EmailValidator.validate(&Artifact::EmailDraft(serde_json::json!({"body": "hi"})));
+        let v = EmailValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::EmailDraft(json!({"body": "hi"})));
         assert!(matches!(r, Err(ValidationError::Schema { field, .. }) if field == "to"));
     }
 
     #[test]
     fn well_formed_email_passes() {
-        let r = EmailValidator.validate(&Artifact::EmailDraft(serde_json::json!({
+        let v = EmailValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::EmailDraft(json!({
             "to": "hiring@example.com",
             "subject": "Interview: Friday 10am",
             "body": "Hi Jane — confirming interview Friday 10am."
         })));
         assert!(r.is_ok(), "well-formed email should pass: {:?}", r);
     }
+
+    #[test]
+    fn ssn_in_body_fails_policy() {
+        let v = EmailValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::EmailDraft(json!({
+            "to": "x@y.com",
+            "body": "Hi Jane — your file shows 123-45-6789 on record."
+        })));
+        match r {
+            Err(ValidationError::Policy { reason }) => assert!(reason.contains("SSN")),
+            other => panic!("expected Policy SSN error, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn ssn_in_subject_fails_policy() {
+        let v = EmailValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::EmailDraft(json!({
+            "to": "x@y.com",
+            "subject": "Re: ID 123-45-6789",
+            "body": "details inside"
+        })));
+        assert!(matches!(r, Err(ValidationError::Policy { .. })));
+    }
+
+    #[test]
+    fn phone_number_does_not_trigger_ssn_false_positive() {
+        let v = EmailValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::EmailDraft(json!({
+            "to": "x@y.com",
+            "body": "Call me at 555-123-4567 to confirm."
+        })));
+        assert!(r.is_ok(), "phone NNN-NNN-NNNN should NOT match SSN NNN-NN-NNNN: {:?}", r);
+    }
+
+    #[test]
+    fn salary_disclosure_fails_policy() {
+        let v = EmailValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::EmailDraft(json!({
+            "to": "x@y.com",
+            "body": "Confirming your hourly rate of $32.50 per hour."
+        })));
+        assert!(matches!(r, Err(ValidationError::Policy { .. })));
+    }
+
+    #[test]
+    fn discussing_dollars_without_salary_keyword_passes() {
+        let v = EmailValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::EmailDraft(json!({
+            "to": "x@y.com",
+            "body": "The $20 parking pass is at the front desk."
+        })));
+        assert!(r.is_ok(), "non-salary $ should pass: {:?}", r);
+    }
+
+    #[test]
+    fn unknown_candidate_id_fails_consistency() {
+        let v = EmailValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::EmailDraft(json!({
+            "to": "x@y.com",
+            "body": "Hi Jane",
+            "_context": {"candidate_id": "W-FAKE"}
+        })));
+        match r {
+            Err(ValidationError::Consistency { reason }) => assert!(reason.contains("not found")),
+            other => panic!("expected Consistency, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn missing_first_name_in_body_is_warning() {
+        let v = EmailValidator::new(lookup(vec![worker("W-1", "Jane Doe")]));
+        let r = v.validate(&Artifact::EmailDraft(json!({
+            "to": "x@y.com",
+            "body": "Hi there — confirming your interview Friday.",
+            "_context": {"candidate_id": "W-1"}
+        })));
+        let report = r.expect("missing name should be warning, not error");
+        assert_eq!(report.findings.len(), 1);
+        assert_eq!(report.findings[0].severity, crate::Severity::Warning);
+        assert!(report.findings[0].message.to_lowercase().contains("first name"));
+    }
+
+    #[test]
+    fn matching_first_name_passes_clean() {
+        let v = EmailValidator::new(lookup(vec![worker("W-1", "Jane Doe")]));
+        let r = v.validate(&Artifact::EmailDraft(json!({
+            "to": "x@y.com",
+            "body": "Hi Jane — confirming your interview Friday.",
+            "_context": {"candidate_id": "W-1"}
+        })));
+        let report = r.expect("matching name should pass");
+        assert!(report.findings.is_empty(), "expected no findings, got {:?}", report.findings);
+    }
 }

crates/validator/src/staffing/fill.rs

@@ -1,22 +1,67 @@
-//! Fill-proposal validator.
+//! Fill-proposal validator (Phase 43 v2 — real consistency checks).
 //!
 //! PRD checks:
-//!   - Schema compliance (propose_done shape matches
-//!     `{fills: [{candidate_id, name}]}`)
+//!   - Schema compliance (propose_done shape: `{fills: [{candidate_id, name}]}`)
 //!   - Completeness (endorsed count == target_count)
-//!   - Worker existence (every candidate_id present in workers_500k)
-//!   - Status check (active, not_on_client_blacklist)
+//!   - Worker existence (every candidate_id present in workers roster)
+//!   - Status check (worker.status == "active")
+//!   - Client blacklist (worker NOT in client.blacklisted_clients)
 //!   - Geo/role match (worker city/state/role matches contract)
 //!
-//! Today this is a scaffold — schema check is real (it's cheap); the
-//! worker-existence / status / geo checks need a catalog lookup and
-//! land in a follow-up when the catalog query helper is wired into
-//! this crate.
+//! The contract metadata (target_count, city, state, role, client_id)
+//! travels alongside the JSON payload under a `_context` key:
+//! `{"_context": {"target_count": 2, "city": "Toledo", "state": "OH",
+//!   "role": "Welder", "client_id": "CLI-00099"}, "fills": [...]}`.
+//! This keeps the Validator trait signature stable while letting the
+//! validator cross-check fills against contract truth.
+//!
+//! Worker-existence + status + geo + blacklist all share a single
+//! lookup trait (`WorkerLookup`) so the validator stays decoupled
+//! from queryd / parquet / catalogd transport details.
 
-use crate::{Artifact, Report, Validator, ValidationError};
+use crate::{
+    Artifact, Report, Validator, ValidationError, WorkerLookup, WorkerRecord,
+};
+use std::sync::Arc;
 use std::time::Instant;
 
-pub struct FillValidator;
+pub struct FillValidator {
+    workers: Arc<dyn WorkerLookup>,
+}
+
+impl FillValidator {
+    pub fn new(workers: Arc<dyn WorkerLookup>) -> Self {
+        Self { workers }
+    }
+}
+
+#[derive(Debug, Default)]
+struct FillContext {
+    target_count: Option<usize>,
+    city: Option<String>,
+    state: Option<String>,
+    role: Option<String>,
+    client_id: Option<String>,
+}
+
+fn extract_context(value: &serde_json::Value) -> FillContext {
+    let ctx_obj = value.get("_context").and_then(|c| c.as_object());
+    let ctx = match ctx_obj {
+        Some(o) => o,
+        None => return FillContext::default(),
+    };
+    FillContext {
+        target_count: ctx.get("target_count").and_then(|v| v.as_u64()).map(|n| n as usize),
+        city: ctx.get("city").and_then(|v| v.as_str()).map(String::from),
+        state: ctx.get("state").and_then(|v| v.as_str()).map(String::from),
+        role: ctx.get("role").and_then(|v| v.as_str()).map(String::from),
+        client_id: ctx.get("client_id").and_then(|v| v.as_str()).map(String::from),
+    }
+}
+
+fn eq_ci(a: &str, b: &str) -> bool {
+    a.trim().eq_ignore_ascii_case(b.trim())
+}
 
 impl Validator for FillValidator {
     fn name(&self) -> &'static str { "staffing.fill" }
@@ -31,9 +76,7 @@ impl Validator for FillValidator {
             }),
         };
 
-        // Schema check — the only real validation shipped in this
-        // scaffold. Catches the common "model emitted prose instead of
-        // JSON" failure mode before the consistency checks even run.
+        // ── Schema check ──
         let fills = value.get("fills").and_then(|f| f.as_array()).ok_or(
             ValidationError::Schema {
                 field: "fills".into(),
@@ -55,12 +98,116 @@ impl Validator for FillValidator {
             }
         }
 
-        // TODO(phase-43 v2): worker-existence / status / geo checks.
-        // Need a catalog query handle injected into FillValidator's
-        // constructor — out of scope for the scaffold.
+        let ctx = extract_context(value);
+
+        // ── Completeness: count match ──
+        if let Some(target) = ctx.target_count {
+            if fills.len() != target {
+                return Err(ValidationError::Completeness {
+                    reason: format!(
+                        "endorsed count {} != target_count {target}",
+                        fills.len()
+                    ),
+                });
+            }
+        }
+
+        // ── Cross-roster checks ──
+        let mut findings: Vec<crate::Finding> = vec![];
+        let mut seen_ids = std::collections::HashSet::new();
+        for (i, fill) in fills.iter().enumerate() {
+            let candidate_id = fill.get("candidate_id").and_then(|v| v.as_str()).unwrap_or("");
+            let proposed_name = fill.get("name").and_then(|v| v.as_str()).unwrap_or("");
+
+            // Duplicate-ID guard inside one fill.
+            if !seen_ids.insert(candidate_id.to_string()) {
+                return Err(ValidationError::Consistency {
+                    reason: format!(
+                        "duplicate candidate_id {candidate_id:?} appears multiple times in fills"
+                    ),
+                });
+            }
+
+            // Worker existence — the gate that catches phantom IDs the
+            // model fabricates. This is the load-bearing check for
+            // the 0→85% pattern.
+            let worker: WorkerRecord = match self.workers.find(candidate_id) {
+                Some(w) => w,
+                None => return Err(ValidationError::Consistency {
+                    reason: format!(
+                        "fills[{i}].candidate_id {candidate_id:?} does not exist in worker roster"
+                    ),
+                }),
+            };
+
+            // Status — only "active" workers can be endorsed.
+            if !eq_ci(&worker.status, "active") {
+                return Err(ValidationError::Consistency {
+                    reason: format!(
+                        "fills[{i}] worker {candidate_id:?} has status {:?}, expected \"active\"",
+                        worker.status
+                    ),
+                });
+            }
+
+            // Client blacklist.
+            if let Some(client) = ctx.client_id.as_deref() {
+                if worker.blacklisted_clients.iter().any(|b| eq_ci(b, client)) {
+                    return Err(ValidationError::Policy {
+                        reason: format!(
+                            "fills[{i}] worker {candidate_id:?} blacklisted for client {client:?}"
+                        ),
+                    });
+                }
+            }
+
+            // Geo / role match — warn-level when missing context, hard
+            // fail on mismatch with explicit contract values.
+            if let (Some(want_city), Some(have_city)) = (ctx.city.as_deref(), worker.city.as_deref()) {
+                if !eq_ci(want_city, have_city) {
+                    return Err(ValidationError::Consistency {
+                        reason: format!(
+                            "fills[{i}] worker {candidate_id:?} city {have_city:?} doesn't match contract city {want_city:?}"
+                        ),
+                    });
+                }
+            }
+            if let (Some(want_state), Some(have_state)) = (ctx.state.as_deref(), worker.state.as_deref()) {
+                if !eq_ci(want_state, have_state) {
+                    return Err(ValidationError::Consistency {
+                        reason: format!(
+                            "fills[{i}] worker {candidate_id:?} state {have_state:?} doesn't match contract state {want_state:?}"
+                        ),
+                    });
+                }
+            }
+            if let (Some(want_role), Some(have_role)) = (ctx.role.as_deref(), worker.role.as_deref()) {
+                if !eq_ci(want_role, have_role) {
+                    return Err(ValidationError::Consistency {
+                        reason: format!(
+                            "fills[{i}] worker {candidate_id:?} role {have_role:?} doesn't match contract role {want_role:?}"
+                        ),
+                    });
+                }
+            }
+
+            // Name-mismatch is a warning, not an error — recruiters
+            // sometimes send updated names through the proposal layer
+            // before the roster is updated.
+            if !proposed_name.is_empty() && !eq_ci(proposed_name, &worker.name) {
+                findings.push(crate::Finding {
+                    field: format!("fills[{i}].name"),
+                    severity: crate::Severity::Warning,
+                    message: format!(
+                        "proposed name {proposed_name:?} differs from roster name {:?} for {candidate_id:?}",
+                        worker.name
+                    ),
+                });
+            }
+        }
 
         Ok(Report {
-            findings: vec![],
+            findings,
             elapsed_ms: started.elapsed().as_millis() as u64,
         })
     }
@@ -69,35 +216,168 @@ impl Validator for FillValidator {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::InMemoryWorkerLookup;
+    use serde_json::json;
+
+    fn lookup(records: Vec<WorkerRecord>) -> Arc<dyn WorkerLookup> {
+        Arc::new(InMemoryWorkerLookup::from_records(records))
+    }
+
+    fn worker(id: &str, name: &str, status: &str, city: &str, state: &str, role: &str) -> WorkerRecord {
+        WorkerRecord {
+            candidate_id: id.into(),
+            name: name.into(),
+            status: status.into(),
+            city: Some(city.into()),
+            state: Some(state.into()),
+            role: Some(role.into()),
+            blacklisted_clients: vec![],
+        }
+    }
 
     #[test]
     fn wrong_artifact_type_fails_schema() {
-        let r = FillValidator.validate(&Artifact::EmailDraft(serde_json::json!({})));
+        let v = FillValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::EmailDraft(json!({})));
         assert!(matches!(r, Err(ValidationError::Schema { .. })));
     }
 
     #[test]
     fn missing_fills_array_fails_schema() {
-        let r = FillValidator.validate(&Artifact::FillProposal(serde_json::json!({})));
+        let v = FillValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::FillProposal(json!({})));
         assert!(matches!(r, Err(ValidationError::Schema { field, .. }) if field == "fills"));
     }
 
     #[test]
     fn fill_without_candidate_id_fails() {
-        let r = FillValidator.validate(&Artifact::FillProposal(serde_json::json!({
-            "fills": [{"name": "Jane"}]
-        })));
+        let v = FillValidator::new(lookup(vec![]));
+        let r = v.validate(&Artifact::FillProposal(json!({"fills": [{"name": "Jane"}]})));
         assert!(matches!(r, Err(ValidationError::Schema { field, .. }) if field.contains("candidate_id")));
     }
 
     #[test]
-    fn well_formed_proposal_passes_schema() {
-        let r = FillValidator.validate(&Artifact::FillProposal(serde_json::json!({
+    fn well_formed_proposal_with_real_workers_passes() {
+        let v = FillValidator::new(lookup(vec![
+            worker("W-1", "Jane Doe", "active", "Toledo", "OH", "Welder"),
+            worker("W-2", "John Smith", "active", "Toledo", "OH", "Welder"),
+        ]));
+        let r = v.validate(&Artifact::FillProposal(json!({
+            "_context": {"target_count": 2, "city": "Toledo", "state": "OH", "role": "Welder"},
             "fills": [
-                {"candidate_id": "W-123", "name": "Jane Doe"},
-                {"candidate_id": "W-456", "name": "John Smith"}
+                {"candidate_id": "W-1", "name": "Jane Doe"},
+                {"candidate_id": "W-2", "name": "John Smith"}
             ]
         })));
-        assert!(r.is_ok(), "well-formed proposal should pass schema: {:?}", r);
+        assert!(r.is_ok(), "expected pass, got {:?}", r);
+    }
+
+    #[test]
+    fn phantom_candidate_id_fails_consistency() {
+        let v = FillValidator::new(lookup(vec![worker("W-1", "Jane", "active", "Toledo", "OH", "Welder")]));
+        let r = v.validate(&Artifact::FillProposal(json!({
+            "_context": {"target_count": 1, "city": "Toledo", "state": "OH", "role": "Welder"},
+            "fills": [{"candidate_id": "W-FAKE-99999", "name": "Imaginary"}]
+        })));
+        match r {
+            Err(ValidationError::Consistency { reason }) => assert!(reason.contains("does not exist")),
+            other => panic!("expected Consistency error, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn inactive_worker_fails_consistency() {
+        let v = FillValidator::new(lookup(vec![worker("W-1", "Jane", "inactive", "Toledo", "OH", "Welder")]));
+        let r = v.validate(&Artifact::FillProposal(json!({
+            "_context": {"target_count": 1},
+            "fills": [{"candidate_id": "W-1", "name": "Jane"}]
+        })));
+        match r {
+            Err(ValidationError::Consistency { reason }) => assert!(reason.contains("inactive")),
+            other => panic!("expected Consistency error, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn wrong_city_fails_consistency() {
+        let v = FillValidator::new(lookup(vec![worker("W-1", "Jane", "active", "Cincinnati", "OH", "Welder")]));
+        let r = v.validate(&Artifact::FillProposal(json!({
+            "_context": {"target_count": 1, "city": "Toledo", "state": "OH", "role": "Welder"},
+            "fills": [{"candidate_id": "W-1", "name": "Jane"}]
+        })));
+        match r {
+            Err(ValidationError::Consistency { reason }) => assert!(reason.to_lowercase().contains("city")),
+            other => panic!("expected Consistency error, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn wrong_role_fails_consistency() {
+        let v = FillValidator::new(lookup(vec![worker("W-1", "Jane", "active", "Toledo", "OH", "Driver")]));
+        let r = v.validate(&Artifact::FillProposal(json!({
+            "_context": {"target_count": 1, "city": "Toledo", "state": "OH", "role": "Welder"},
+            "fills": [{"candidate_id": "W-1", "name": "Jane"}]
+        })));
+        match r {
+            Err(ValidationError::Consistency { reason }) => assert!(reason.to_lowercase().contains("role")),
+            other => panic!("expected Consistency error, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn count_mismatch_fails_completeness() {
+        let v = FillValidator::new(lookup(vec![
+            worker("W-1", "Jane", "active", "Toledo", "OH", "Welder"),
+        ]));
+        let r = v.validate(&Artifact::FillProposal(json!({
+            "_context": {"target_count": 2, "city": "Toledo", "state": "OH", "role": "Welder"},
+            "fills": [{"candidate_id": "W-1", "name": "Jane"}]
+        })));
+        assert!(matches!(r, Err(ValidationError::Completeness { .. })));
+    }
+
+    #[test]
+    fn duplicate_candidate_id_fails_consistency() {
+        let v = FillValidator::new(lookup(vec![
+            worker("W-1", "Jane", "active", "Toledo", "OH", "Welder"),
+        ]));
+        let r = v.validate(&Artifact::FillProposal(json!({
+            "_context": {"target_count": 2, "city": "Toledo", "state": "OH", "role": "Welder"},
+            "fills": [
+                {"candidate_id": "W-1", "name": "Jane"},
+                {"candidate_id": "W-1", "name": "Jane"}
+            ]
+        })));
+        match r {
+            Err(ValidationError::Consistency { reason }) => assert!(reason.contains("duplicate")),
+            other => panic!("expected Consistency error, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn blacklisted_worker_fails_policy() {
+        let mut w = worker("W-1", "Jane", "active", "Toledo", "OH", "Welder");
+        w.blacklisted_clients = vec!["CLI-00099".into()];
+        let v = FillValidator::new(lookup(vec![w]));
+        let r = v.validate(&Artifact::FillProposal(json!({
+            "_context": {"target_count": 1, "city": "Toledo", "state": "OH", "role": "Welder", "client_id": "CLI-00099"},
+            "fills": [{"candidate_id": "W-1", "name": "Jane"}]
+        })));
+        assert!(matches!(r, Err(ValidationError::Policy { .. })));
+    }
+
+    #[test]
+    fn name_mismatch_is_warning_not_error() {
+        let v = FillValidator::new(lookup(vec![
+            worker("W-1", "Jane Doe", "active", "Toledo", "OH", "Welder"),
+        ]));
+        let r = v.validate(&Artifact::FillProposal(json!({
+            "_context": {"target_count": 1, "city": "Toledo", "state": "OH", "role": "Welder"},
+            "fills": [{"candidate_id": "W-1", "name": "Janet Doe"}]
+        })));
+        let report = r.expect("name mismatch should be warning, not error");
+        assert_eq!(report.findings.len(), 1);
+        assert_eq!(report.findings[0].severity, crate::Severity::Warning);
+        assert!(report.findings[0].message.contains("differs from roster"));
     }
 }

crates/validator/src/staffing/mod.rs

@@ -6,3 +6,4 @@
 pub mod fill;
 pub mod email;
 pub mod playbook;
+pub mod parquet_lookup;

crates/validator/src/staffing/parquet_lookup.rs

@@ -0,0 +1,165 @@
+//! Production WorkerLookup backed by a workers_500k.parquet snapshot.
+//!
+//! Loads the full roster into memory at startup (one-shot). 500K rows
+//! at ~150 bytes per WorkerRecord ≈ 75 MB resident — fine for any
+//! production lakehouse process. Refresh is intentionally
+//! caller-driven (call `from_parquet` again to rebuild) rather than
+//! automatic — operators decide when staffing data has changed enough
+//! to justify the few-second reload.
+//!
+//! Schema mapping (workers_500k.parquet → WorkerRecord):
+//!   worker_id (int64)     → candidate_id = "W-{id}"
+//!   name (string)         → name
+//!   role (string)         → role
+//!   city (string)         → city
+//!   state (string)        → state
+//!   availability (double) → status: "active" if >0 else "inactive"
+//!
+//! No status column on workers_500k, so we derive from availability —
+//! the floor convention used elsewhere in the lakehouse staffing
+//! pipeline. Workers with availability=0.0 are treated as inactive
+//! (vacation, suspended, etc.). Once the Track-A.B `_safe` view ships
+//! with proper `status`, switch this loader to read it directly.
+//!
+//! Blacklist join is not done here — caller is expected to populate
+//! `blacklisted_clients` from a separate source (Phase 43 PRD says
+//! `client_blacklist` table; not yet defined). Default empty.
+
+use crate::{InMemoryWorkerLookup, WorkerLookup, WorkerRecord};
+use parquet::file::reader::{FileReader, SerializedFileReader};
+use parquet::record::Field;
+use std::fs::File;
+use std::path::Path;
+use std::sync::Arc;
+
+#[derive(Debug, thiserror::Error)]
+pub enum LookupLoadError {
+    #[error("opening parquet at {path}: {source}")]
+    Open { path: String, #[source] source: std::io::Error },
+    #[error("parsing parquet at {path}: {source}")]
+    Parse { path: String, #[source] source: parquet::errors::ParquetError },
+    #[error("missing required column {column}")]
+    MissingColumn { column: String },
+    #[error("row {row}: {reason}")]
+    BadRow { row: usize, reason: String },
+}
+
+/// Build an `InMemoryWorkerLookup` from a workers_500k-shaped parquet
+/// file. Returned as `Arc<dyn WorkerLookup>` to drop into validator
+/// constructors.
+pub fn load_workers_parquet(path: &Path) -> Result<Arc<dyn WorkerLookup>, LookupLoadError> {
+    let file = File::open(path).map_err(|e| LookupLoadError::Open {
+        path: path.display().to_string(),
+        source: e,
+    })?;
+    let reader = SerializedFileReader::new(file).map_err(|e| LookupLoadError::Parse {
+        path: path.display().to_string(),
+        source: e,
+    })?;
+
+    // Validate schema covers what we need before iterating rows.
+    let schema = reader.metadata().file_metadata().schema();
+    let column_names: Vec<&str> = schema.get_fields().iter().map(|f| f.name()).collect();
+    for required in &["worker_id", "name", "role", "city", "state", "availability"] {
+        if !column_names.contains(required) {
+            return Err(LookupLoadError::MissingColumn { column: (*required).to_string() });
+        }
+    }
+
+    let row_iter = reader.get_row_iter(None).map_err(|e| LookupLoadError::Parse {
+        path: path.display().to_string(),
+        source: e,
+    })?;
+
+    let mut records: Vec<WorkerRecord> = Vec::with_capacity(reader.metadata().file_metadata().num_rows() as usize);
+    let mut row_idx = 0usize;
+    for row_result in row_iter {
+        let row = row_result.map_err(|e| LookupLoadError::Parse {
+            path: path.display().to_string(),
+            source: e,
+        })?;
+        let mut worker_id: Option<i64> = None;
+        let mut name: Option<String> = None;
+        let mut role: Option<String> = None;
+        let mut city: Option<String> = None;
+        let mut state: Option<String> = None;
+        let mut availability: f64 = 0.0;
+        for (col_name, field) in row.get_column_iter() {
+            match (col_name.as_str(), field) {
+                ("worker_id", Field::Long(v)) => worker_id = Some(*v),
+                ("worker_id", Field::Int(v)) => worker_id = Some(*v as i64),
+                ("name", Field::Str(v)) => name = Some(v.clone()),
+                ("role", Field::Str(v)) => role = Some(v.clone()),
+                ("city", Field::Str(v)) => city = Some(v.clone()),
+                ("state", Field::Str(v)) => state = Some(v.clone()),
+                ("availability", Field::Double(v)) => availability = *v,
+                ("availability", Field::Float(v)) => availability = *v as f64,
+                _ => { /* extra columns ignored */ }
+            }
+        }
+        let id = worker_id.ok_or_else(|| LookupLoadError::BadRow {
+            row: row_idx,
+            reason: "worker_id missing or non-integer".into(),
+        })?;
+        let nm = name.ok_or_else(|| LookupLoadError::BadRow {
+            row: row_idx,
+            reason: "name missing".into(),
+        })?;
+        records.push(WorkerRecord {
+            candidate_id: format!("W-{id}"),
+            name: nm,
+            // status derived from availability (workers_500k has no
+            // status column). 0.0 → inactive, >0.0 → active.
+            status: if availability > 0.0 { "active".into() } else { "inactive".into() },
+            city,
+            state,
+            role,
+            blacklisted_clients: vec![],
+        });
+        row_idx += 1;
+    }
+
+    tracing::info!(
+        target: "validator.parquet_lookup",
+        rows = records.len(),
+        path = %path.display(),
+        "loaded workers parquet snapshot"
+    );
+
+    Ok(Arc::new(InMemoryWorkerLookup::from_records(records)))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    /// Smoke test against the live workers_500k.parquet on disk.
+    /// Skipped automatically if the file isn't present (CI / sparse
+    /// checkouts) so the test suite stays portable.
+    #[test]
+    fn load_real_workers_500k() {
+        let path = PathBuf::from("/home/profit/lakehouse/data/datasets/workers_500k.parquet");
+        if !path.exists() {
+            eprintln!("skip: {} not present", path.display());
+            return;
+        }
+        let lookup = load_workers_parquet(&path).expect("load");
+        // Basic shape: at least one worker resolves and has the
+        // expected fields populated.
+        let probe = lookup.find("W-1");
+        assert!(probe.is_some(), "W-1 should exist in 500K-row parquet");
+        let w = probe.unwrap();
+        assert!(!w.name.is_empty(), "name should be populated");
+        assert!(w.status == "active" || w.status == "inactive");
+        assert!(w.role.is_some());
+        assert!(w.city.is_some());
+        assert!(w.state.is_some());
+    }
+
+    #[test]
+    fn missing_file_returns_error() {
+        let r = load_workers_parquet(Path::new("/nonexistent.parquet"));
+        assert!(matches!(r, Err(LookupLoadError::Open { .. })));
+    }
+}

crates/vectord/src/service.rs

@@ -146,6 +146,11 @@ pub fn router(state: VectorState) -> Router {
         // Phase 45 slice 3 — doc drift detection + human re-admission.
         .route("/playbook_memory/doc_drift/check/{id}", post(check_doc_drift))
         .route("/playbook_memory/doc_drift/resolve/{id}", post(resolve_doc_drift))
+        // Phase 45 closure (2026-04-27) — batch scan across all active
+        // playbooks. Operator runs this on a schedule (cron or manual);
+        // each newly-detected drift writes a row to
+        // data/_kb/doc_drift_corrections.jsonl for downstream review.
+        .route("/playbook_memory/doc_drift/scan", post(scan_doc_drift))
         // Pathway memory — consensus-designed sidecar (2026-04-24).
         // scrum_master_pipeline POSTs /pathway/insert at the end of each
         // review, calls /pathway/query before running the ladder for a
@@ -2539,6 +2544,119 @@ async fn check_doc_drift(
     })))
 }
 
+/// Phase 45 closure (2026-04-27) — POST /playbook_memory/doc_drift/scan
+///
+/// Iterates all active playbooks (non-retired, has doc_refs), runs
+/// drift check against context7 for each, flags drifted entries via
+/// PlaybookMemory::flag_doc_drift, and appends a row to
+/// data/_kb/doc_drift_corrections.jsonl for each drift detected.
+///
+/// Returns aggregate stats so an operator can see at-a-glance how
+/// many playbooks drifted and which tools moved.
+///
+/// Honors entries already flagged: they're counted in `already_flagged`
+/// (no double-flag, no duplicate corrections.jsonl row).
+async fn scan_doc_drift(
+    State(state): State<VectorState>,
+) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
+    use crate::doc_drift::{check_all_refs, DriftCheckerConfig, DriftOutcome};
+
+    let entries = state.playbook_memory.snapshot().await;
+    let now = chrono::Utc::now().to_rfc3339();
+    let cfg = DriftCheckerConfig::default();
+
+    let mut scanned = 0usize;
+    let mut newly_flagged = 0usize;
+    let mut already_flagged = 0usize;
+    let mut skipped_no_refs = 0usize;
+    let mut skipped_retired = 0usize;
+    let mut tool_counts: std::collections::HashMap<String, usize> = Default::default();
+    let mut corrections_rows: Vec<String> = vec![];
+
+    for e in entries.iter() {
+        if e.retired_at.is_some() { skipped_retired += 1; continue; }
+        if e.doc_refs.is_empty() { skipped_no_refs += 1; continue; }
+        if e.doc_drift_flagged_at.is_some() && e.doc_drift_reviewed_at.is_none() {
+            already_flagged += 1;
+            continue;
+        }
+        scanned += 1;
+        let results = check_all_refs(&cfg, &e.doc_refs).await;
+        let drifted_tools: Vec<&str> = results.iter()
+            .filter(|r| matches!(r.outcome, DriftOutcome::Drifted { .. }))
+            .map(|r| r.tool.as_str())
+            .collect();
+        if drifted_tools.is_empty() { continue; }
+
+        // Flag the entry.
+        let flagged = state.playbook_memory.flag_doc_drift(&e.playbook_id).await
+            .unwrap_or(false);
+        if flagged { newly_flagged += 1; }
+        for t in &drifted_tools {
+            *tool_counts.entry(t.to_string()).or_insert(0) += 1;
+        }
+
+        // Build corrections.jsonl row — one per drifted playbook with
+        // the tool list inline. Downstream consumers (overview model,
+        // operator dashboard) read this to decide reviews + revisions.
+        let row = serde_json::json!({
+            "playbook_id": e.playbook_id,
+            "scanned_at": now,
+            "drifted_tools": drifted_tools,
+            "per_tool": results.iter().map(|r| {
+                let (drifted, current, src) = match &r.outcome {
+                    DriftOutcome::Drifted { current_snippet_hash, source_url } =>
+                        (true, Some(current_snippet_hash.clone()), source_url.clone()),
+                    _ => (false, None, None),
+                };
+                serde_json::json!({
+                    "tool": r.tool, "version_seen": r.version_seen,
+                    "drifted": drifted, "current_snippet_hash": current, "source_url": src,
+                })
+            }).collect::<Vec<_>>(),
+            "recommended_action": "review-and-resolve",
+        });
+        corrections_rows.push(row.to_string());
+    }
+
+    // Persist corrections.jsonl row(s) for the operator/overview model.
+    if !corrections_rows.is_empty() {
+        let path = std::path::PathBuf::from("/home/profit/lakehouse/data/_kb/doc_drift_corrections.jsonl");
+        if let Some(parent) = path.parent() {
+            if let Err(e) = tokio::fs::create_dir_all(parent).await {
+                tracing::warn!(target: "vectord.doc_drift", "create_dir_all {parent:?}: {e}");
+            }
+        }
+        let body = corrections_rows.join("\n") + "\n";
+        if let Err(e) = tokio::fs::OpenOptions::new()
+            .create(true).append(true).open(&path).await
+        {
+            tracing::warn!(target: "vectord.doc_drift", "open {path:?}: {e}");
+        } else {
+            use tokio::io::AsyncWriteExt;
+            match tokio::fs::OpenOptions::new().create(true).append(true).open(&path).await {
+                Ok(mut f) => {
+                    if let Err(e) = f.write_all(body.as_bytes()).await {
+                        tracing::warn!(target: "vectord.doc_drift", "append {path:?}: {e}");
+                    }
+                }
+                Err(e) => tracing::warn!(target: "vectord.doc_drift", "reopen {path:?}: {e}"),
+            }
+        }
+    }
+
+    Ok(Json(serde_json::json!({
+        "scanned_at": now,
+        "scanned": scanned,
+        "newly_flagged": newly_flagged,
+        "already_flagged": already_flagged,
+        "skipped_retired": skipped_retired,
+        "skipped_no_refs": skipped_no_refs,
+        "drifted_by_tool": tool_counts,
+        "corrections_written": corrections_rows.len(),
+    })))
+}
+
 /// Phase 45 slice 3 — POST /playbook_memory/doc_drift/resolve/{id}
 ///
 /// Human-in-the-loop re-admission. Stamps `doc_drift_reviewed_at`.

data/_catalog/manifests/32ee74a0-59b4-4e5b-8edb-70c9347a4bf3.json

@@ -11,15 +11,51 @@
     }
   ],
   "created_at": "2026-04-20T11:07:57.308050648Z",
-  "updated_at": "2026-04-22T03:28:28.343843823Z",
+  "updated_at": "2026-04-28T01:28:31.280305207Z",
   "description": "",
   "owner": "",
   "sensitivity": null,
-  "columns": [],
+  "columns": [
+    {
+      "name": "timestamp",
+      "data_type": "Utf8",
+      "sensitivity": null,
+      "description": "",
+      "is_pii": false
+    },
+    {
+      "name": "operation",
+      "data_type": "Utf8",
+      "sensitivity": null,
+      "description": "",
+      "is_pii": false
+    },
+    {
+      "name": "approach",
+      "data_type": "Utf8",
+      "sensitivity": null,
+      "description": "",
+      "is_pii": false
+    },
+    {
+      "name": "result",
+      "data_type": "Utf8",
+      "sensitivity": null,
+      "description": "",
+      "is_pii": false
+    },
+    {
+      "name": "context",
+      "data_type": "Utf8",
+      "sensitivity": null,
+      "description": "",
+      "is_pii": false
+    }
+  ],
   "lineage": null,
   "freshness": null,
   "tags": [],
-  "row_count": null,
+  "row_count": 2077,
   "last_embedded_at": null,
   "embedding_stale_since": null,
   "embedding_refresh_policy": null

data/_catalog/manifests/564b00ae-cbf3-4efd-aa55-84cdb6d2b0b7.json

@@ -1,117 +0,0 @@
-{
-  "id": "564b00ae-cbf3-4efd-aa55-84cdb6d2b0b7",
-  "name": "client_workerskjkk",
-  "schema_fingerprint": "cdfe85348885ddf329e5e6e9bf0e2c75c92d1a86fdb0fd3875ed46e3f93c4d82",
-  "objects": [
-    {
-      "bucket": "primary",
-      "key": "datasets/client_workerskjkk.parquet",
-      "size_bytes": 32201,
-      "created_at": "2026-04-21T00:49:04.623625149Z"
-    }
-  ],
-  "created_at": "2026-04-21T00:49:04.623626738Z",
-  "updated_at": "2026-04-21T00:49:04.623901788Z",
-  "description": "",
-  "owner": "",
-  "sensitivity": "pii",
-  "columns": [
-    {
-      "name": "worker_id",
-      "data_type": "Utf8",
-      "sensitivity": null,
-      "description": "",
-      "is_pii": false
-    },
-    {
-      "name": "name",
-      "data_type": "Utf8",
-      "sensitivity": "pii",
-      "description": "",
-      "is_pii": true
-    },
-    {
-      "name": "role",
-      "data_type": "Utf8",
-      "sensitivity": null,
-      "description": "",
-      "is_pii": false
-    },
-    {
-      "name": "city",
-      "data_type": "Utf8",
-      "sensitivity": null,
-      "description": "",
-      "is_pii": false
-    },
-    {
-      "name": "state",
-      "data_type": "Utf8",
-      "sensitivity": null,
-      "description": "",
-      "is_pii": false
-    },
-    {
-      "name": "email",
-      "data_type": "Utf8",
-      "sensitivity": "pii",
-      "description": "",
-      "is_pii": true
-    },
-    {
-      "name": "phone",
-      "data_type": "Utf8",
-      "sensitivity": "pii",
-      "description": "",
-      "is_pii": true
-    },
-    {
-      "name": "skills",
-      "data_type": "Utf8",
-      "sensitivity": null,
-      "description": "",
-      "is_pii": false
-    },
-    {
-      "name": "certifications",
-      "data_type": "Utf8",
-      "sensitivity": null,
-      "description": "",
-      "is_pii": false
-    },
-    {
-      "name": "availability",
-      "data_type": "Float64",
-      "sensitivity": null,
-      "description": "",
-      "is_pii": false
-    },
-    {
-      "name": "reliability",
-      "data_type": "Float64",
-      "sensitivity": null,
-      "description": "",
-      "is_pii": false
-    },
-    {
-      "name": "archetype",
-      "data_type": "Utf8",
-      "sensitivity": null,
-      "description": "",
-      "is_pii": false
-    }
-  ],
-  "lineage": {
-    "source_system": "csv",
-    "source_file": "staffing_roster_sample.csv",
-    "ingest_job": "ingest-1776732544623",
-    "ingest_timestamp": "2026-04-21T00:49:04.623625149Z",
-    "parent_datasets": []
-  },
-  "freshness": null,
-  "tags": [],
-  "row_count": 180,
-  "last_embedded_at": null,
-  "embedding_stale_since": null,
-  "embedding_refresh_policy": null
-}

data/_catalog/views/candidates_safe.json

@@ -0,0 +1,24 @@
+{
+  "name": "candidates_safe",
+  "base_dataset": "candidates",
+  "columns": [
+    "candidate_id",
+    "first_name",
+    "city",
+    "state",
+    "skills",
+    "years_experience",
+    "status"
+  ],
+  "row_filter": "status != 'blocked'",
+  "column_redactions": {
+    "candidate_id": {
+      "kind": "mask",
+      "keep_prefix": 3,
+      "keep_suffix": 2
+    }
+  },
+  "created_at": "2026-04-27T15:42:00Z",
+  "created_by": "j",
+  "description": "PII-free candidate projection — drops last_name, email, phone, hourly_rate_usd. candidate_id masked (keep first 3, last 2). Visible to recruiter / mode-runner agents."
+}

data/_catalog/views/jobs_safe.json

@@ -0,0 +1,26 @@
+{
+  "name": "jobs_safe",
+  "base_dataset": "job_orders",
+  "columns": [
+    "job_order_id",
+    "client_id",
+    "title",
+    "vertical",
+    "status",
+    "city",
+    "state",
+    "zip",
+    "bill_rate",
+    "pay_rate"
+  ],
+  "column_redactions": {
+    "client_id": {
+      "kind": "mask",
+      "keep_prefix": 3,
+      "keep_suffix": 2
+    }
+  },
+  "created_at": "2026-04-27T15:42:00Z",
+  "created_by": "j",
+  "description": "Job-order projection with client_id masked. Drops description (often quotes client names verbatim, no text-scrubber available). bill_rate / pay_rate kept — commercial info, not PII per staffing PRD."
+}

data/_catalog/views/workers_safe.json

@@ -0,0 +1,22 @@
+{
+  "name": "workers_safe",
+  "base_dataset": "workers_500k",
+  "columns": [
+    "worker_id",
+    "role",
+    "city",
+    "state",
+    "skills",
+    "certifications",
+    "archetype",
+    "reliability",
+    "responsiveness",
+    "engagement",
+    "compliance",
+    "availability"
+  ],
+  "column_redactions": {},
+  "created_at": "2026-04-27T15:42:00Z",
+  "created_by": "j",
+  "description": "PII-free worker projection — drops name, email, phone, zip, communications, resume_text. resume_text + communications carry verbatim PII (full names) and there's no in-view text scrubber, so they're dropped wholesale. Skills + certifications + scores carry the matching signal for staffing inference. Source for workers_500k_v9 vector corpus rebuild."
+}

data/headshots/manifest.jsonl

@@ -0,0 +1,198 @@
+{"id": 0, "file": "face_0000.jpg", "gender": null}
+{"id": 1, "file": "face_0001.jpg", "gender": null}
+{"id": 2, "file": "face_0002.jpg", "gender": null}
+{"id": 3, "file": "face_0003.jpg", "gender": null}
+{"id": 4, "file": "face_0004.jpg", "gender": null}
+{"id": 5, "file": "face_0005.jpg", "gender": null}
+{"id": 6, "file": "face_0006.jpg", "gender": null}
+{"id": 7, "file": "face_0007.jpg", "gender": null}
+{"id": 8, "file": "face_0008.jpg", "gender": null}
+{"id": 9, "file": "face_0009.jpg", "gender": null}
+{"id": 10, "file": "face_0010.jpg", "gender": null}
+{"id": 11, "file": "face_0011.jpg", "gender": null}
+{"id": 12, "file": "face_0012.jpg", "gender": null}
+{"id": 13, "file": "face_0013.jpg", "gender": null}
+{"id": 14, "file": "face_0014.jpg", "gender": null}
+{"id": 15, "file": "face_0015.jpg", "gender": null}
+{"id": 16, "file": "face_0016.jpg", "gender": null}
+{"id": 17, "file": "face_0017.jpg", "gender": null}
+{"id": 18, "file": "face_0018.jpg", "gender": null}
+{"id": 19, "file": "face_0019.jpg", "gender": null}
+{"id": 20, "file": "face_0020.jpg", "gender": null}
+{"id": 21, "file": "face_0021.jpg", "gender": null}
+{"id": 22, "file": "face_0022.jpg", "gender": null}
+{"id": 23, "file": "face_0023.jpg", "gender": null}
+{"id": 24, "file": "face_0024.jpg", "gender": null}
+{"id": 25, "file": "face_0025.jpg", "gender": null}
+{"id": 26, "file": "face_0026.jpg", "gender": null}
+{"id": 27, "file": "face_0027.jpg", "gender": null}
+{"id": 28, "file": "face_0028.jpg", "gender": null}
+{"id": 29, "file": "face_0029.jpg", "gender": null}
+{"id": 30, "file": "face_0030.jpg", "gender": null}
+{"id": 31, "file": "face_0031.jpg", "gender": null}
+{"id": 32, "file": "face_0032.jpg", "gender": null}
+{"id": 33, "file": "face_0033.jpg", "gender": null}
+{"id": 34, "file": "face_0034.jpg", "gender": null}
+{"id": 35, "file": "face_0035.jpg", "gender": null}
+{"id": 36, "file": "face_0036.jpg", "gender": null}
+{"id": 37, "file": "face_0037.jpg", "gender": null}
+{"id": 38, "file": "face_0038.jpg", "gender": null}
+{"id": 39, "file": "face_0039.jpg", "gender": null}
+{"id": 40, "file": "face_0040.jpg", "gender": null}
+{"id": 41, "file": "face_0041.jpg", "gender": null}
+{"id": 42, "file": "face_0042.jpg", "gender": null}
+{"id": 43, "file": "face_0043.jpg", "gender": null}
+{"id": 44, "file": "face_0044.jpg", "gender": null}
+{"id": 45, "file": "face_0045.jpg", "gender": null}
+{"id": 46, "file": "face_0046.jpg", "gender": null}
+{"id": 47, "file": "face_0047.jpg", "gender": null}
+{"id": 48, "file": "face_0048.jpg", "gender": null}
+{"id": 49, "file": "face_0049.jpg", "gender": null}
+{"id": 50, "file": "face_0050.jpg", "gender": null}
+{"id": 51, "file": "face_0051.jpg", "gender": null}
+{"id": 52, "file": "face_0052.jpg", "gender": null}
+{"id": 53, "file": "face_0053.jpg", "gender": null}
+{"id": 54, "file": "face_0054.jpg", "gender": null}
+{"id": 55, "file": "face_0055.jpg", "gender": null}
+{"id": 56, "file": "face_0056.jpg", "gender": null}
+{"id": 57, "file": "face_0057.jpg", "gender": null}
+{"id": 58, "file": "face_0058.jpg", "gender": null}
+{"id": 59, "file": "face_0059.jpg", "gender": null}
+{"id": 60, "file": "face_0060.jpg", "gender": null}
+{"id": 61, "file": "face_0061.jpg", "gender": null}
+{"id": 62, "file": "face_0062.jpg", "gender": null}
+{"id": 63, "file": "face_0063.jpg", "gender": null}
+{"id": 64, "file": "face_0064.jpg", "gender": null}
+{"id": 65, "file": "face_0065.jpg", "gender": null}
+{"id": 66, "file": "face_0066.jpg", "gender": null}
+{"id": 67, "file": "face_0067.jpg", "gender": null}
+{"id": 68, "file": "face_0068.jpg", "gender": null}
+{"id": 69, "file": "face_0069.jpg", "gender": null}
+{"id": 70, "file": "face_0070.jpg", "gender": null}
+{"id": 71, "file": "face_0071.jpg", "gender": null}
+{"id": 72, "file": "face_0072.jpg", "gender": null}
+{"id": 73, "file": "face_0073.jpg", "gender": null}
+{"id": 74, "file": "face_0074.jpg", "gender": null}
+{"id": 75, "file": "face_0075.jpg", "gender": null}
+{"id": 76, "file": "face_0076.jpg", "gender": null}
+{"id": 77, "file": "face_0077.jpg", "gender": null}
+{"id": 78, "file": "face_0078.jpg", "gender": null}
+{"id": 79, "file": "face_0079.jpg", "gender": null}
+{"id": 80, "file": "face_0080.jpg", "gender": null}
+{"id": 81, "file": "face_0081.jpg", "gender": null}
+{"id": 82, "file": "face_0082.jpg", "gender": null}
+{"id": 83, "file": "face_0083.jpg", "gender": null}
+{"id": 84, "file": "face_0084.jpg", "gender": null}
+{"id": 85, "file": "face_0085.jpg", "gender": null}
+{"id": 86, "file": "face_0086.jpg", "gender": null}
+{"id": 87, "file": "face_0087.jpg", "gender": null}
+{"id": 88, "file": "face_0088.jpg", "gender": null}
+{"id": 89, "file": "face_0089.jpg", "gender": null}
+{"id": 90, "file": "face_0090.jpg", "gender": null}
+{"id": 91, "file": "face_0091.jpg", "gender": null}
+{"id": 92, "file": "face_0092.jpg", "gender": null}
+{"id": 93, "file": "face_0093.jpg", "gender": null}
+{"id": 94, "file": "face_0094.jpg", "gender": null}
+{"id": 95, "file": "face_0095.jpg", "gender": null}
+{"id": 96, "file": "face_0096.jpg", "gender": null}
+{"id": 97, "file": "face_0097.jpg", "gender": null}
+{"id": 98, "file": "face_0098.jpg", "gender": null}
+{"id": 99, "file": "face_0099.jpg", "gender": null}
+{"id": 100, "file": "face_0100.jpg", "gender": null}
+{"id": 101, "file": "face_0101.jpg", "gender": null}
+{"id": 102, "file": "face_0102.jpg", "gender": null}
+{"id": 103, "file": "face_0103.jpg", "gender": null}
+{"id": 104, "file": "face_0104.jpg", "gender": null}
+{"id": 105, "file": "face_0105.jpg", "gender": null}
+{"id": 106, "file": "face_0106.jpg", "gender": null}
+{"id": 107, "file": "face_0107.jpg", "gender": null}
+{"id": 108, "file": "face_0108.jpg", "gender": null}
+{"id": 109, "file": "face_0109.jpg", "gender": null}
+{"id": 110, "file": "face_0110.jpg", "gender": null}
+{"id": 111, "file": "face_0111.jpg", "gender": null}
+{"id": 112, "file": "face_0112.jpg", "gender": null}
+{"id": 113, "file": "face_0113.jpg", "gender": null}
+{"id": 114, "file": "face_0114.jpg", "gender": null}
+{"id": 115, "file": "face_0115.jpg", "gender": null}
+{"id": 116, "file": "face_0116.jpg", "gender": null}
+{"id": 117, "file": "face_0117.jpg", "gender": null}
+{"id": 118, "file": "face_0118.jpg", "gender": null}
+{"id": 119, "file": "face_0119.jpg", "gender": null}
+{"id": 121, "file": "face_0121.jpg", "gender": null}
+{"id": 122, "file": "face_0122.jpg", "gender": null}
+{"id": 123, "file": "face_0123.jpg", "gender": null}
+{"id": 124, "file": "face_0124.jpg", "gender": null}
+{"id": 125, "file": "face_0125.jpg", "gender": null}
+{"id": 126, "file": "face_0126.jpg", "gender": null}
+{"id": 127, "file": "face_0127.jpg", "gender": null}
+{"id": 128, "file": "face_0128.jpg", "gender": null}
+{"id": 129, "file": "face_0129.jpg", "gender": null}
+{"id": 130, "file": "face_0130.jpg", "gender": null}
+{"id": 131, "file": "face_0131.jpg", "gender": null}
+{"id": 132, "file": "face_0132.jpg", "gender": null}
+{"id": 133, "file": "face_0133.jpg", "gender": null}
+{"id": 134, "file": "face_0134.jpg", "gender": null}
+{"id": 135, "file": "face_0135.jpg", "gender": null}
+{"id": 136, "file": "face_0136.jpg", "gender": null}
+{"id": 137, "file": "face_0137.jpg", "gender": null}
+{"id": 138, "file": "face_0138.jpg", "gender": null}
+{"id": 139, "file": "face_0139.jpg", "gender": null}
+{"id": 140, "file": "face_0140.jpg", "gender": null}
+{"id": 141, "file": "face_0141.jpg", "gender": null}
+{"id": 142, "file": "face_0142.jpg", "gender": null}
+{"id": 143, "file": "face_0143.jpg", "gender": null}
+{"id": 144, "file": "face_0144.jpg", "gender": null}
+{"id": 145, "file": "face_0145.jpg", "gender": null}
+{"id": 146, "file": "face_0146.jpg", "gender": null}
+{"id": 147, "file": "face_0147.jpg", "gender": null}
+{"id": 148, "file": "face_0148.jpg", "gender": null}
+{"id": 149, "file": "face_0149.jpg", "gender": null}
+{"id": 150, "file": "face_0150.jpg", "gender": null}
+{"id": 151, "file": "face_0151.jpg", "gender": null}
+{"id": 152, "file": "face_0152.jpg", "gender": null}
+{"id": 153, "file": "face_0153.jpg", "gender": null}
+{"id": 154, "file": "face_0154.jpg", "gender": null}
+{"id": 155, "file": "face_0155.jpg", "gender": null}
+{"id": 156, "file": "face_0156.jpg", "gender": null}
+{"id": 157, "file": "face_0157.jpg", "gender": null}
+{"id": 158, "file": "face_0158.jpg", "gender": null}
+{"id": 159, "file": "face_0159.jpg", "gender": null}
+{"id": 160, "file": "face_0160.jpg", "gender": null}
+{"id": 161, "file": "face_0161.jpg", "gender": null}
+{"id": 162, "file": "face_0162.jpg", "gender": null}
+{"id": 163, "file": "face_0163.jpg", "gender": null}
+{"id": 164, "file": "face_0164.jpg", "gender": null}
+{"id": 165, "file": "face_0165.jpg", "gender": null}
+{"id": 166, "file": "face_0166.jpg", "gender": null}
+{"id": 167, "file": "face_0167.jpg", "gender": null}
+{"id": 168, "file": "face_0168.jpg", "gender": null}
+{"id": 169, "file": "face_0169.jpg", "gender": null}
+{"id": 170, "file": "face_0170.jpg", "gender": null}
+{"id": 171, "file": "face_0171.jpg", "gender": null}
+{"id": 172, "file": "face_0172.jpg", "gender": null}
+{"id": 173, "file": "face_0173.jpg", "gender": null}
+{"id": 174, "file": "face_0174.jpg", "gender": null}
+{"id": 175, "file": "face_0175.jpg", "gender": null}
+{"id": 176, "file": "face_0176.jpg", "gender": null}
+{"id": 177, "file": "face_0177.jpg", "gender": null}
+{"id": 178, "file": "face_0178.jpg", "gender": null}
+{"id": 179, "file": "face_0179.jpg", "gender": null}
+{"id": 180, "file": "face_0180.jpg", "gender": null}
+{"id": 181, "file": "face_0181.jpg", "gender": null}
+{"id": 182, "file": "face_0182.jpg", "gender": null}
+{"id": 183, "file": "face_0183.jpg", "gender": null}
+{"id": 184, "file": "face_0184.jpg", "gender": null}
+{"id": 185, "file": "face_0185.jpg", "gender": null}
+{"id": 186, "file": "face_0186.jpg", "gender": null}
+{"id": 187, "file": "face_0187.jpg", "gender": null}
+{"id": 188, "file": "face_0188.jpg", "gender": null}
+{"id": 189, "file": "face_0189.jpg", "gender": null}
+{"id": 191, "file": "face_0191.jpg", "gender": null}
+{"id": 192, "file": "face_0192.jpg", "gender": null}
+{"id": 193, "file": "face_0193.jpg", "gender": null}
+{"id": 194, "file": "face_0194.jpg", "gender": null}
+{"id": 195, "file": "face_0195.jpg", "gender": null}
+{"id": 196, "file": "face_0196.jpg", "gender": null}
+{"id": 197, "file": "face_0197.jpg", "gender": null}
+{"id": 198, "file": "face_0198.jpg", "gender": null}
+{"id": 199, "file": "face_0199.jpg", "gender": null}

docs/PHASES.md

@@ -349,6 +349,24 @@
   - Per-type endpoints: `/profiles/retrieval`, `/profiles/memory`, `/profiles/observer`
   - `profile_type` field on ModelProfile
   - Guard fix: automated scrumaudit.py finds real issues
+- [x] **Phase 42: Truth Layer** (2026-04-27 closure verified)
+  - `crates/truth/{lib,staffing,devops,loader}.rs`
+  - Staffing rules populated; devops scaffold by design
+  - `/v1/context` serves task_classes + rules; 37 tests green
+- [x] **Phase 43: Validation Pipeline** (2026-04-27)
+  - `crates/validator/` real validators + WorkerLookup + ParquetWorkerLookup
+  - 500K-row workers_500k.parquet loaded at gateway boot
+  - `POST /v1/validate` + `POST /v1/iterate` (the 0→85% loop)
+  - 33 validator tests green
+- [x] **Phase 44: Caller Migration** (2026-04-27)
+  - TS callers + aibridge::AiClient::new_with_gateway opt-in
+  - Vectord routed through /v1/chat for autotune + RAG
+  - scripts/check_phase44_callers.sh CI guard
+- [x] **Phase 45: Doc-Drift Detection** (2026-04-27)
+  - DocRef + doc_drift module + context7 bridge
+  - /doc_drift/check + /scan + /resolve endpoints
+  - data/_kb/doc_drift_corrections.jsonl writes
+  - boost exclusion of unreviewed drift-flagged entries
 - [ ] Fine-tuned domain models (Phase 25+)
 - [ ] Multi-node query distribution (only if ceilings bite)
 

docs/recon/staffing-lakehouse-distillation-recon.md

@@ -0,0 +1,266 @@
+# Staffing Lakehouse × Distillation Substrate — Recon
+
+**Date:** 2026-04-27
+**Status:** Phase 0 (read-only inventory — no implementation yet)
+**Spec:** J's "Lakehouse Staffing Integration" prompt
+**Distillation tag (consumer of):** `distillation-v1.0.0` (commit `e7636f2`)
+
+This document inventories the staffing surface in the Lakehouse repo and identifies where the distillation substrate (Phases 0-8) should attach as a *consumer*. **No distillation core mutation — staffing builds on top.**
+
+The headline finding: **staffing has substantial existing infrastructure but is undocumented as a system.** Validators are scaffolds, scenarios are test fixtures, synthetic data spans 6+ shapes with overlapping intent, and there's no unified staffing audit. The integration work is orchestration over what already exists, not greenfield.
+
+---
+
+## 1. Existing staffing schemas
+
+### Rust validators (`crates/validator/src/staffing/`)
+
+| File | Shape | Status |
+|---|---|---|
+| `mod.rs` | trait + module wiring | scaffold complete |
+| `fill.rs::FillValidator` | validates `{fills: [{candidate_id, name}]}` against Artifact::FillProposal | schema check live; worker-existence + status + geo checks are TODO (commented in source) |
+| `playbook.rs::PlaybookValidator` | validates Artifact::Playbook (operation format, endorsed_names cap, fingerprint) | schema-shape only; no semantic content check |
+| `email.rs` | email-domain validation | scaffold |
+
+### Profiles (`crates/shared/src/profiles/`)
+
+| File | Purpose |
+|---|---|
+| `execution.rs` | execution profile (model routing per task class) |
+| `memory.rs` | MemoryProfile (Phase 19 playbook boost ceiling, history cap, doc stale window, auto-retire) |
+| `observer.rs` | Observer profile (failure cluster size, alert cooldown, ring size, langfuse forward) |
+| `retrieval.rs` | RetrievalProfile (top_k, rerank_top_k, freshness cutoff, boost_playbook_memory, enforce_sensitivity_gates) |
+
+These are **typed** but auditing whether they're enforced at runtime is part of Phase 1 work.
+
+### PII (`crates/shared/src/pii.rs`)
+
+`detect_sensitivity(column_name)` → maps column names to sensitivity classes (`Pii`, `Financial`, `Public`). Verified by tests:
+- `email`, `contact_email`, `ssn` → Pii
+- `salary`, `bill_rate` → Financial
+
+`catalogd::service.rs:264` carries `column_redactions: HashMap<String, Redaction>` per dataset. Catalog enforces, but the audit needs to confirm masking is actually applied at query time.
+
+---
+
+## 2. Synthetic data inventory
+
+| File | Rows | Shape | Status assessment |
+|---|---|---|---|
+| `data/datasets/candidates.parquet` | 1,000 | candidate_id, first_name, last_name, email, phone, city, state, skills, years_experience, hourly_rate_usd, status | **Has PII (raw email + phone)**. CAND-* IDs. status field: `placed`, `unknown others`. Compact + realistic. |
+| `data/datasets/job_orders.parquet` | 15,000 | job_order_id, client_id, title, vertical, bill_rate, pay_rate, status, city, state, zip, description | JO-* IDs, CLI-* clients. Verticals: Admin, Manufacturing(?), etc. Realistic shape. **No candidate-fill linkage table observed.** |
+| `data/datasets/workers_500k.parquet` | 500,000 | worker_id (int), name, role, email, phone, city, state, zip, skills (CSV string), certifications, archetype, reliability/responsiveness/engagement/compliance/availability (0-1 floats), communications (multi-msg string), resume_text | **Largest + richest source.** Has PII. archetype enum (flexible/?). 4-axis personality scores. Resume text + comm log = good RAG/SFT material. |
+| `data/datasets/workers_100k.parquet` | 100,000 | (presumed same as 500k) | scaled-down sibling |
+| `data/datasets/ethereal_workers.parquet` | 10,000 | same as workers_500k schema | scenario-friendly subset |
+| `data/datasets/client_workersi.parquet` | 160 | worker_id, name, role, city, state, email, phone, skills, certifications, availability, reliability, archetype | **Different shape** (no scores beyond reliability+availability, no resume_text). Probably client-side "approved roster" — the worker pool a client has historically used. |
+| `data/datasets/client_workerskjkk.parquet` | (similar) | (same as above) | typo-named sibling — gap to clean up |
+| `data/datasets/sparse_workers.parquet` | 200 | name, phone, role, city, state, notes | **Different shape** — no IDs, no scores, just contact + notes. Looks like edge-case test data (sparse field coverage). |
+| `data/datasets/new_candidates.parquet` | 3 | name, phone, email, city, state, skills, years | Demo / smoke-test data. Tiny. |
+
+**Total worker-shape rows on disk: ~625k** across 5 files. Schema fragmentation (3 distinct shapes) is a real issue — see gap report.
+
+### Scenarios (`tests/multi-agent/scenarios/`)
+
+44 JSON files covering specific staffing days. Sample shape (Heritage Foods Indianapolis 2026-04-23):
+```json
+{ "client": "Heritage Foods", "date": "2026-04-23", "events": [
+  { "kind": "baseline_fill", "at": "10:30", "role": "Machine Operator", "count": 2,
+    "city": "Indianapolis", "state": "IN", "shift_start": "10:30 AM" },
+  { "kind": "recurring", "at": "10:30", "role": "Receiving Clerk", "count": 1, ... }
+]}
+```
+
+Event kinds observed: `baseline_fill`, `recurring`. Cities span Indianapolis, Cincinnati, Madison, Toledo, Detroit, Columbus, etc. — Midwestern + Eastern US.
+
+### Playbook lessons (`data/_playbook_lessons/`)
+
+64 JSON files. Sample shape (Heritage Foods 2026-04-21):
+```json
+{ "date": "...", "client": "...", "cities": "...", "states": "...",
+  "events_total": 5, "events_ok": 3, "checkpoint_count": 2,
+  "model": "gpt-oss:20b", "cloud": false,
+  "lesson": "<long markdown analysis>",
+  "checkpoints": [{ "after": "09:30", "risk": "...", "hint": "..." }, ...] }
+```
+
+These are **post-run retrospectives** — the staffing ops loop wrote them after each scenario completed. Goldmine for RAG.
+
+---
+
+## 3. Ingestion paths + storage layout
+
+### Object storage / Parquet
+- `data/datasets/*.parquet` is the disk-resident store. Treated as input by `ingestd` (CSV/JSON/PDF/Postgres/MySQL ingest in `crates/ingestd`).
+- **No catalog manifests observed for the staffing parquets** (none under `data/_catalog/manifests/` matching candidate/worker/job names). The datasets exist on disk but may not be registered with `catalogd` — gap.
+
+### MariaDB
+- `crates/queryd/src/context.rs` has a "candidates_safe" view referenced by recent code (failed at boot when schema mismatched, see prior memory `feedback_endpoint_probe_discipline.md`).
+- Schema for the views isn't visible from grep — needs DB inspection.
+
+### Vector indexes (`data/vectors/`)
+- `workers_500k_v8.parquet` — vector corpus matched by `staffing_inference_lakehouse` mode in `config/modes.toml`
+- `ethereal_workers_v1.parquet` — alt corpus
+- `entity_brief_v1.parquet` — Chicago-permit-style entity briefs (different domain but same indexer)
+- `chicago_permits_v1.parquet` — separate but uses same machinery
+
+### KB streams that touch staffing
+- `data/_kb/contract_analyses.jsonl` — contractor + permit analyses (related but not staffing per se)
+- `data/_kb/staffers.jsonl` — 1.5K, small, not yet inspected
+- `data/_kb/outcomes.jsonl` — scenario outcomes log (used by Phase 2 transforms in distillation)
+- `data/_playbook_memory/state.json` — Phase 19 playbook memory state
+
+---
+
+## 4. Search / indexing logic
+
+### Staffing-aware mode runner
+`config/modes.toml` defines `staffing_inference` task class:
+```toml
+preferred_mode = "staffing_inference_lakehouse"
+default_model = "openai/gpt-oss-120b:free"
+matrix_corpus = "workers_500k_v8"
+```
+
+The mode runner (Phase 5+ work in this session) composes:
+- `EnrichmentFlags { include_file_content, include_bug_fingerprints, include_matrix_chunks, use_relevance_filter, framing: Staffing }`
+- Pulls top-K from `workers_500k_v8` corpus
+- `FRAMING_STAFFING` system prompt instructs: "only recommend candidates whose names appear in the matrix data; do NOT fabricate workers"
+
+### Pass 4 staffing harness
+`scripts/mode_pass4_staffing.ts` ships synthetic FillRequest payloads through the runner. Each request is a JSON `{city, state, role, count, deadline, notes?}` posted as `file_content` (the runner's input shape). Validation: did the model surface real worker_ids from the corpus, or fabricate.
+
+### What's missing
+- **No "candidate matching" deterministic scorer** beyond mode-runner LLM. Staffing audit should add: given a job_order, can we score worker fit deterministically (skills overlap, geo distance, status filter) BEFORE asking the LLM? Currently the LLM does both retrieval and scoring.
+- **No indexed link table between candidates.parquet and workers_500k.parquet.** They look like the SAME population in different shapes — the workers_500k has the scores + resume + comms, candidates has the basic contact + status + hourly rate. If they're meant to be different populations, the join key is unclear; if they're the same, there's redundancy.
+
+---
+
+## 5. Audit / event tables
+
+**No staffing-specific audit/event log observed.** Searched for `audit_event`, `outcome_event`, `fill_event` patterns in `crates/` — zero hits. The closest existing infrastructure:
+- `data/_kb/outcomes.jsonl` — per-run scenario outcomes (used by distillation transforms)
+- `data/_observer/ops.jsonl` — observer ring buffer (general-purpose, not staffing)
+- `data/_playbook_lessons/*.json` — post-run lessons (retrospective, not audit)
+
+**Gap:** staffing fills happen, scenarios complete, but **no schema-backed event log** captures: which worker_ids were proposed, accepted, filled, rejected, with what timing, against which job_order. The closest record is in scenarios + playbook_lessons but those are unstructured + per-scenario, not a queryable log.
+
+---
+
+## 6. PII / tokenization boundaries
+
+### Detection
+`crates/shared/src/pii.rs::detect_sensitivity` recognizes: `email`, `contact_email`, `ssn`, `phone` → Pii. `salary`, `bill_rate`, `pay_rate` → Financial.
+
+### Enforcement
+`catalogd::service.rs` carries per-dataset `column_redactions: HashMap<String, Redaction>` — but enforcement at query time wasn't visible from initial grep. Auditing whether masking actually happens when `staffing_inference_lakehouse` retrieves from `workers_500k_v8` is in scope.
+
+### Risk
+Raw email + phone live in `workers_500k.parquet` and `candidates.parquet`. If the LLM mode runner retrieves chunks and the catalog hasn't masked them, **the LLM sees PII**. Spec says "do not expose raw PII to AI" — auditing this is non-negotiable for the staffing integration.
+
+---
+
+## 7. PRD docs
+
+- `docs/PRD.md` — main PRD. §32 names staffing as the reference implementation. §158 explicitly notes Phase 19 playbook learning was originally write-only, claims it's now closed — **verify**.
+- `docs/CONTROL_PLANE_PRD.md` — long-horizon vision (2026-04-22 pivot)
+
+PRD references staffing throughout but doesn't itemize a "staffing PRD checklist" the way the auditor's pr_audit mode expects per-PR claims. Drift detection between PRD claims and code reality is exactly the auditor's job — running it on the PRD as input rather than a PR diff is a configuration shift, not new code.
+
+---
+
+## 8. Where distillation outputs should attach
+
+The Phase 0-8 distillation substrate is **already feeding the staffing surface in two places**:
+
+1. **`staffing_inference_lakehouse` mode → `workers_500k_v8` matrix corpus.** This is read-only consumption; no change needed.
+2. **`pr_audit` mode → `lakehouse_answers_v1` corpus.** Generic; not staffing-specific.
+
+**What's missing for staffing:**
+
+a. **Staffing-specific RAG corpus** — `staffing_answers_v1` built from playbook_lessons + scored scenarios. Same builder pattern as `lakehouse_answers_v1` (commit `0844206`'s `scripts/build_answers_corpus.ts`); just point at staffing inputs.
+
+b. **Staffing audit task class** — `staffing_audit` mode in `config/modes.toml`, paralleling the auditor's `pr_audit` work. Reads PRD claims + scenario outcomes, asks "do we ship what the PRD claims for staffing?"
+
+c. **Staffing acceptance fixture** — same shape as `tests/fixtures/distillation/acceptance/` but with synthetic candidate + job_order + scenario + lesson rows. Pins staffing invariants: PII masked, candidates valid, scenarios reproducible.
+
+d. **Staffing replay tasks** — drop sample fill requests through `./scripts/distill replay` to see if the local model proposes real worker_ids vs fabricates.
+
+**Implementation approach (deferred until gap report + J approval):**
+
+```
+scripts/staffing/
+  audit.ts              # ./scripts/staffing audit — single entry
+  build_answers.ts      # build_staffing_answers_v1 from lessons + scenarios
+  build_corpus_v9.ts    # rebuild workers_500k_v9 with PII masking applied
+  acceptance.ts         # staffing-specific 22-invariant gate
+
+tests/fixtures/staffing/
+  candidates_sample.parquet
+  job_orders_sample.parquet
+  scenario_sample.json
+  lesson_sample.json
+
+reports/staffing/
+  staffing-audit-report.md
+  staffing-prd-drift-report.md
+  staffing-search-quality-report.md
+  staffing-synthetic-data-report.md
+```
+
+**ALL of the above is consumer-side.** The distillation pipeline's `scripts/distillation/`, `auditor/schemas/distillation/`, and Phase 0-8 commits are NOT touched.
+
+---
+
+## 9. Risks identified during recon
+
+1. **Synthetic data shape fragmentation** — 3 distinct worker schemas across 5 files. If staffing audit assumes one shape and the system uses another, audits will silently miss.
+2. **PII enforcement unverified.** Catalog has a redaction primitive; whether it's wired to mode-runner retrieval is the audit's first deterministic check.
+3. **No structured staffing audit log.** Lessons + outcomes are retrospective summaries, not per-event records. Without per-event records, deterministic checks like "every worker proposed by the LLM exists in workers_500k" can't run on historical scenarios.
+4. **Validator scaffolds.** `FillValidator::validate` does schema-shape only — the worker-existence/status/geo TODOs in the source are exactly the deterministic gates the staffing audit needs to run. Wiring them is consumer work, not distillation work.
+5. **Fragile PRD ↔ code linkage.** PRD §158 claims Phase 19 closed the playbook write-only gap; no audit verifies. The staffing-prd-drift-report should run an inference-style claim verification against PRD claims, not unlike the auditor's pr_audit but with PRD as the source.
+6. **`workers_500k_v8` is the embedded corpus the LLM sees.** If it carries PII without masking, the LLM has been seeing PII. Auditing the corpus content (not just the SQL views) is required.
+7. **64 playbook_lessons + 44 scenarios = ~108 RAG candidates.** Plenty for a staffing_answers corpus, but PII filtering must apply before vectorization. Currently lessons may contain worker names ("Susan X. Ruiz double-booked").
+
+---
+
+## 10. Recommended integration points (where consumer code attaches)
+
+1. **Staffing audit script** at `scripts/staffing/audit.ts` reads from existing distillation outputs:
+   - `data/scored-runs/` (filter to task_id starting `permit:` or `scenario:`)
+   - `exports/quarantine/*.jsonl` (any staffing-specific quarantines)
+   - `reports/distillation/<latest>/summary.json` (cross-reference)
+
+2. **Reuse Phase 5 receipts harness** — staffing audit writes a `StageReceipt` matching the existing schema, with a new `stage` value (extend the enum to `"staffing-audit"` only after schema-version bump if needed; otherwise use the existing reserved `"index"` slot or just write a parallel manifest under `reports/staffing/`).
+
+3. **Reuse Phase 1 schemas** — RagSample, SftSample, PreferenceSample work for staffing data without modification. The `tags` array can carry `task:staffing.fill` to keep the corpus self-tagged.
+
+4. **Reuse Phase 7 replay** — `./scripts/distill replay --task "fill 2 welders in Toledo OH"` already works; just feed it from synthetic FillRequest payloads.
+
+5. **Reuse Phase 8 audit-full** — its drift baseline tracks distillation metrics; staffing audit gets its OWN baseline file at `data/_kb/staffing_audit_baselines.jsonl`.
+
+6. **Schema invariants for staffing**:
+   - every candidate_id in candidates.parquet appears in workers_500k.parquet OR is documented as "candidate-distinct-from-worker"
+   - every status value in candidates.parquet is in a known enum
+   - every email in workers/candidates is masked when it reaches the LLM (audit by inspecting prompt traces in Langfuse)
+
+---
+
+## 11. What this document is NOT
+
+- Not a green-light to start staffing audit implementation. The spec is explicit: synthetic-data gap report next, THEN J reviews, THEN code.
+- Not an audit itself. This is the inventory — the audit's first run will surface findings.
+- Not a redesign of staffing data shapes. The fragmentation is documented for the gap report; reshape decisions are J's call, not this recon's.
+- Not a modification of the distillation v1.0.0 substrate. Per spec: "DO NOT modify the completed distillation pipeline unless a blocking integration bug is found."
+
+---
+
+## 12. Phase 1 readiness checklist
+
+Before staffing implementation starts, the following must be true:
+
+- [x] Recon doc exists (this file)
+- [ ] Synthetic-data gap report exists (next)
+- [ ] J reviews both before any code change
+- [ ] J approves audit scope + first invariants
+
+Phase 1 is unblocked only after the gap report is reviewed.

mcp-server/console.html

@@ -51,9 +51,23 @@ details .body{padding-top:10px;font-size:12px;color:#8b949e}
 .accent-b{border-left:3px solid #1f6feb}
 .accent-a{border-left:3px solid #bc8cff}
 .accent-w{border-left:3px solid #d29922}
+.accent-g{border-left:3px solid #3fb950}
+.accent-r{border-left:3px solid #f85149}
 
-.worker{display:flex;align-items:center;gap:10px;padding:8px 10px;background:#161b22;border-radius:6px;margin-bottom:4px;font-size:12px}
-.worker .av{width:28px;height:28px;border-radius:6px;background:#1a2744;display:flex;align-items:center;justify-content:center;font-weight:600;color:#e6edf3;font-size:10px;flex-shrink:0}
+.worker{display:flex;align-items:center;gap:10px;padding:8px 10px;background:#161b22;border-radius:6px;margin-bottom:4px;font-size:12px;border-left:3px solid #30363d}
+.worker .av{width:32px;height:32px;border-radius:50%;background:#0d1117;border:1px solid #21262d;display:flex;align-items:center;justify-content:center;font-weight:600;color:#c9d1d9;font-size:11px;flex-shrink:0;letter-spacing:0.5px;overflow:hidden;position:relative}
+.worker .av img{position:absolute;inset:0;width:100%;height:100%;object-fit:cover;display:block}
+.worker[data-role-band="warehouse"]{border-left-color:#58a6ff}
+.worker[data-role-band="production"]{border-left-color:#d29922}
+.worker[data-role-band="trades"]{border-left-color:#bc8cff}
+.worker[data-role-band="driver"]{border-left-color:#3fb950}
+.worker[data-role-band="lead"]{border-left-color:#f0883e}
+.role-pill{display:inline-block;font-size:9px;padding:1px 7px;border-radius:3px;background:#0d1117;color:#8b949e;margin-right:6px;font-weight:600;letter-spacing:0.4px;text-transform:uppercase;border-left:2px solid #30363d;vertical-align:1px}
+.role-pill[data-rb="warehouse"]{border-left-color:#58a6ff;color:#79c0ff}
+.role-pill[data-rb="production"]{border-left-color:#d29922;color:#e3b341}
+.role-pill[data-rb="trades"]{border-left-color:#bc8cff;color:#d2a8ff}
+.role-pill[data-rb="driver"]{border-left-color:#3fb950;color:#56d364}
+.role-pill[data-rb="lead"]{border-left-color:#f0883e;color:#ffa657}
 .worker .info{flex:1;min-width:0}
 .worker .nm{color:#e6edf3;font-weight:500}
 .worker .why{color:#545d68;font-size:11px;margin-top:1px}
@@ -95,6 +109,7 @@ details .body{padding-top:10px;font-size:12px;color:#8b949e}
   <nav>
     <a href=".">Dashboard</a>
     <a href="console" class="active">Walkthrough</a>
+    <a href="profiler">Profiler</a>
     <a href="proof">Architecture</a>
     <a href="spec">Spec</a>
     <a href="onboard">Onboard</a>
@@ -147,11 +162,40 @@ details .body{padding-top:10px;font-size:12px;color:#8b949e}
 
 <div class="chapter">
   <div class="num">Chapter 6</div>
-  <h2>Try it yourself</h2>
-  <div class="lede">Type any staffing question. The system picks the right search path (smart-parse, semantic discovery, analytics), shows what it understood, and returns ranked results with memory signal.</div>
+  <h2>Three coordinators, three views of the same corpus</h2>
+  <div class="lede">Maria runs Chicago, Devon runs Indianapolis, Aisha runs Milwaukee. Same database, same playbooks — but the search results, the recurring-skill patterns, and the playbook context all reshape to whoever is acting. This is the per-staffer hot-swap index: the relevance gradient is unique to each person, and gets sharper the more they use it.</div>
+  <div id="ch6-staffers"><div class="loading">Loading staffer roster…</div></div>
+</div>
+
+<div class="chapter">
+  <div class="num">Chapter 7</div>
+  <h2>The hidden signal — public issuers in your contractor graph</h2>
+  <div class="lede">Every contractor in this corpus is also a forward indicator on the public equities they touch. Permit filings precede construction starts by ~45 days, staffing windows by ~30, revenue recognition by months. The associated-ticker network surfaces this signal <em>before</em> any 10-Q. Below: the top issuers attributable to the contractor activity in this view, with live prices.</div>
+  <div id="ch7-signal"><div class="loading">Computing the Building Activity Index…</div></div>
+</div>
+
+<div class="chapter">
+  <div class="num">Chapter 8</div>
+  <h2>When something breaks — triage in one shot</h2>
+  <div class="lede">A coordinator gets a text: "Marcus running late." Watch what the system does in 250 milliseconds: pulls Marcus's record, scores his attendance pattern, finds five same-role same-geo backfills sorted by responsiveness, and pre-writes the SMS to send to the client. This is the moment the AI becomes worth its weight.</div>
+  <div id="ch8-triage"><div class="loading">Running the triage scenario…</div></div>
+</div>
+
+<div class="chapter">
+  <div class="num">Chapter 9</div>
+  <h2>Try it yourself — every input below hits a different route</h2>
+  <div class="lede">Type any staffing question. The router picks the right path: smart-parse (zip code, headcount, role, state), semantic discovery, name lookup, late-worker triage, "what came in last night" temporal queries. Whatever you type, the system tells you what it understood and how it routed.</div>
   <div class="try-box">
-    <input type="text" id="try-q" placeholder="e.g. reliable forklift operators in Chicago with OSHA certs" onkeydown="if(event.key==='Enter')runTry()">
+    <input type="text" id="try-q" placeholder="e.g. 8 production workers near 60607 by next Friday" onkeydown="if(event.key==='Enter')runTry()">
     <button id="try-btn" onclick="runTry()">Ask</button>
+    <div style="margin-top:10px;font-size:11px;color:#545d68;line-height:1.7">
+      Try one of these to see different routes fire:<br>
+      <a href="#" onclick="document.getElementById('try-q').value='8 production workers near 60607';runTry();return false">8 production workers near 60607</a> ·
+      <a href="#" onclick="document.getElementById('try-q').value='Marcus running late site 4422';runTry();return false">Marcus running late site 4422</a> ·
+      <a href="#" onclick="document.getElementById('try-q').value='Marcus';runTry();return false">Marcus</a> ·
+      <a href="#" onclick="document.getElementById('try-q').value='what came in last night';runTry();return false">what came in last night</a> ·
+      <a href="#" onclick="document.getElementById('try-q').value='reliable forklift operators with OSHA certs';runTry();return false">reliable forklift operators with OSHA certs</a>
+    </div>
     <div id="try-out" style="margin-top:16px"></div>
   </div>
 </div>
@@ -167,6 +211,114 @@ var A=location.origin+P;
 // DOM helpers — all dynamic content goes through these. No innerHTML
 // anywhere in the script; every API-derived string passes through
 // textContent so no injection path regardless of upstream data.
+// Role classification — mirrors search.html, no emojis. Maps role
+// strings to a band+label used by the worker-card border + role pill.
+var ROLE_BANDS = [
+  { match: /forklift|warehouse|associate|material\s*handler|loader|loading|packag|shipping|logistics|inventory|sanitation|janit/i, band: 'warehouse', label: 'Warehouse' },
+  { match: /production|assembl/i, band: 'production', label: 'Production' },
+  { match: /welder|weld|electric|maint(enance)?\s*tech|cnc|machine\s*op|hvac|plumb|carpenter|mason/i, band: 'trades', label: 'Skilled Trade' },
+  { match: /driver|truck|haul|cdl/i, band: 'driver', label: 'Driver' },
+  { match: /line\s*lead|supervisor|foreman|coordinator/i, band: 'lead', label: 'Lead' },
+  { match: /quality/i, band: 'production', label: 'Quality' },
+];
+function roleBand(role){
+  if(!role) return { band: 'warehouse', label: '' };
+  for (var i = 0; i < ROLE_BANDS.length; i++) {
+    if (ROLE_BANDS[i].match.test(role)) return ROLE_BANDS[i];
+  }
+  return { band: 'warehouse', label: role.split(' ')[0].toUpperCase().slice(0, 12) };
+}
+
+// Build a sober worker card: monogram avatar + colored role band on
+// the left edge + uppercase role pill in the detail line. Used by
+// every chapter that renders worker rows. `name` and `role` drive the
+// classification; `detail` is the full text after the pill.
+// Quick first-name → gender hint for face-pool selection. Same lookup
+// idea as the dashboard; if the name is unknown, the server falls back
+// to the full pool. Trimmed table — covers the most common names that
+// appear in the synthetic worker data.
+var FEMALE_NAMES = new Set(['Mary','Patricia','Jennifer','Linda','Elizabeth','Barbara','Susan','Jessica','Sarah','Karen','Lisa','Nancy','Betty','Sandra','Margaret','Ashley','Kimberly','Emily','Donna','Michelle','Carol','Amanda','Melissa','Deborah','Stephanie','Dorothy','Rebecca','Sharon','Laura','Cynthia','Amy','Kathleen','Angela','Shirley','Brenda','Emma','Anna','Pamela','Nicole','Samantha','Katherine','Christine','Helen','Debra','Rachel','Carolyn','Janet','Maria','Catherine','Heather','Diane','Olivia','Julie','Joyce','Victoria','Ruth','Virginia','Lauren','Kelly','Christina','Joan','Evelyn','Judith','Andrea','Hannah','Megan','Cheryl','Jacqueline','Martha','Madison','Teresa','Gloria','Sara','Janice','Ann','Kathryn','Abigail','Sophia','Frances','Jean','Alice','Judy','Isabella','Julia','Grace','Amber','Denise','Danielle','Marilyn','Beverly','Charlotte','Natalie','Theresa','Diana','Brittany','Kayla','Alexis','Lori','Marie','Carmen','Aisha','Rosa','Mia','Audrey','Erin','Tina','Vanessa','Tara','Wendy','Tanya','Maya','Crystal','Yvonne','Kara','Shannon','Brianna','Faith','Caroline','Carla','Tracey','Tracy','Rita','Dawn','Tiffany','Stacy','Stacey','Gina','Bonnie','Tammy','Joanne','Jamie','Tonya','Alyssa','Ariana','Elena','Ellie','Erica','Erika','Felicia','Holly','Jenna','Jenny','Krista','Kristen','Kristin','Krystal','Lana','Leah','Lucy','Mallory','Melinda','Meredith','Misty','Monica','Naomi','Paige','Paula','Renee','Rhonda','Robin','Roxanne','Selena','Sierra','Skylar','Sonia','Stella','Tamara','Veronica','Vivian','Whitney','Yolanda','Zoe']);
+var MALE_NAMES = new Set(['James','Robert','John','Michael','David','William','Richard','Joseph','Thomas','Charles','Christopher','Daniel','Matthew','Anthony','Mark','Donald','Steven','Paul','Andrew','Joshua','Kenneth','Kevin','Brian','George','Edward','Ronald','Timothy','Jason','Jeffrey','Ryan','Jacob','Gary','Nicholas','Eric','Jonathan','Stephen','Larry','Justin','Scott','Brandon','Benjamin','Samuel','Gregory','Frank','Alexander','Raymond','Patrick','Jack','Dennis','Jerry','Tyler','Aaron','Jose','Adam','Henry','Nathan','Douglas','Zachary','Peter','Kyle','Walter','Ethan','Jeremy','Harold','Keith','Christian','Roger','Noah','Gerald','Carl','Terry','Sean','Austin','Arthur','Lawrence','Jesse','Dylan','Bryan','Joe','Jordan','Billy','Bruce','Albert','Willie','Gabriel','Logan','Alan','Juan','Wayne','Roy','Ralph','Randy','Eugene','Vincent','Russell','Elijah','Louis','Bobby','Philip','Johnny','Marcus','Antonio','Carlos','Diego','Hector','Jorge','Julio','Manuel','Miguel','Pedro','Raul','Ricardo','Roberto','Sergio','Victor','Jamal','Xavier','DeShawn','Dwayne','Jermaine','Malik','Tyrone','Devon','Andre','Brent','Calvin','Casey','Cody','Cole','Cory','Dale','Damon','Darius','Darrell','Dean','Derek','Drew','Earl','Eddie','Floyd','Glenn','Greg','Howard','Ivan','Jared','Jay','Jeff','Joel','Lance','Lee','Leonard','Lloyd','Mario','Martin','Mason','Maurice','Max','Mitchell','Morgan','Nick','Norman','Oliver','Owen','Pete','Quincy','Rafael','Reggie','Rex','Ricky','Russ','Shane','Shaun','Stanley','Steve','Theodore','Todd','Travis','Trevor','Troy','Wade','Warren','Wesley']);
+function guessGenderFromFirstName(n){
+  if(!n) return null;
+  var clean=n.replace(/[^A-Za-z]/g,'');
+  if(!clean) return null;
+  var c=clean[0].toUpperCase()+clean.slice(1).toLowerCase();
+  if(FEMALE_NAMES.has(c)) return 'woman';
+  if(MALE_NAMES.has(c)) return 'man';
+  return null;
+}
+function genderFor(name){
+  var g = guessGenderFromFirstName(name);
+  if(g) return g;
+  if(!name) return 'man';
+  var s=String(name); var h=0;
+  for(var i=0;i<s.length;i++) h=(h*31+s.charCodeAt(i))|0;
+  return (Math.abs(h)&1)?'man':'woman';
+}
+// Confident first-name → ethnicity. Synthetic data — we own the call.
+var NAMES_SOUTH_ASIAN_C=new Set(['Raj','Anil','Rohan','Vikram','Arjun','Sanjay','Ravi','Krishna','Pradeep','Sunil','Amit','Deepak','Ashok','Manoj','Rahul','Vijay','Suresh','Naveen','Anand','Nikhil','Aditya','Karan','Rajesh','Priya','Anjali','Neha','Kavya','Pooja','Divya','Meera','Lakshmi','Rani','Asha','Saanvi','Aanya','Aaradhya','Shreya','Riya','Tanvi','Ishita','Aarav','Ishaan','Shivani']);
+var NAMES_EAST_ASIAN_C=new Set(['Wei','Mei','Yi','Jin','Chen','Lin','Liu','Wang','Zhang','Yang','Wu','Zhao','Sun','Hiroshi','Yuki','Akira','Kenji','Sakura','Aiko','Haruto','Sora','Hyun','Eun','Yoon','Kai','Long','Hong','Xiu','Lan','Hua','Hao','Tao','Bao','Cheng','Feng','Jian','Dong','Bin','Min','Lei','Hui','Yu','Xin','Ying','Zhen','Yuan','Yan']);
+var NAMES_HISPANIC_C=new Set(['Carmen','Carlos','Maria','Diego','Hector','Jorge','Julio','Manuel','Miguel','Pedro','Raul','Ricardo','Roberto','Sergio','Antonio','Esperanza','Luz','Sofia','Lucia','Isabella','Camila','Valentina','Mariana','Elena','Rosa','Catalina','Esteban','Fernando','Eduardo','Javier','Alejandro','Andres','Mateo','Santiago','Sebastian','Emilio','Tomas','Cristina','Daniela','Gabriela','Ximena','Adriana','Beatriz','Pilar','Mercedes','Xavier','Marisol','Guadalupe','Lupita','Inez','Itzel','Yesenia','Joaquin','Ignacio','Rafael','Salvador','Cesar','Arturo','Armando','Hugo','Marco','Alejandra','Felipe','Gerardo','Jaime','Leonardo','Luis','Pablo','Ramon']);
+var NAMES_BLACK_C=new Set(['DeShawn','Jamal','Aisha','Latoya','Tyrone','Malik','Imani','Keisha','Tariq','Lakisha','Kenya','Tamika','Andre','Marcus','Demetrius','Jermaine','Reggie','Tyrese','Darius','Trevon','Kareem','Damon','Jalen','Jaylen','Dwayne','DaQuan','Aaliyah','Kiara','Janelle','Jasmine','Tanisha','Maurice','Tyrell','Kwame','Khalil','Terrell','Cedric','Nia','Zuri','Jada','Ebony','Dominique']);
+var NAMES_MIDDLE_EASTERN_C=new Set(['Layla','Omar','Khalid','Fatima','Yasmin','Hassan','Hussein','Ahmed','Mohamed','Mohammed','Ali','Karim','Yusuf','Yara','Nadia','Zainab','Rania','Samira','Mariam','Salma','Ibrahim','Mahmoud','Saif','Anwar','Bilal','Faisal','Hamza','Imran','Sami','Wael','Zaid','Amira','Iman','Lina','Mona','Noor','Rana','Soha','Zara']);
+function guessEthnicityFromFirstName(n){
+  if(!n) return 'caucasian';
+  var clean=n.replace(/[^A-Za-z]/g,''); if(!clean) return 'caucasian';
+  var c=clean[0].toUpperCase()+clean.slice(1).toLowerCase();
+  if(NAMES_MIDDLE_EASTERN_C.has(c)) return 'middle_eastern';
+  if(NAMES_BLACK_C.has(c)) return 'black';
+  if(NAMES_HISPANIC_C.has(c)) return 'hispanic';
+  if(NAMES_SOUTH_ASIAN_C.has(c)) return 'south_asian';
+  if(NAMES_EAST_ASIAN_C.has(c)) return 'east_asian';
+  return 'caucasian';
+}
+
+function workerRow(name, role, detail, opts){
+  opts = opts || {};
+  var band = roleBand(role||'');
+  var w = el('div','worker');
+  if(band.band) w.dataset.roleBand = band.band;
+  var initials = (name||'?').split(' ').map(function(s){return (s[0]||'').toUpperCase()}).join('').substring(0,2);
+  var av = el('div','av',initials);
+  // Real synthetic headshot via /headshots/<key>; deterministic so
+  // same worker always gets the same face. Falls back to monogram if
+  // pool isn't fetched yet.
+  var faceKey = (opts.face_key) || name || '';
+  var firstName = (name||'').split(/\s+/)[0]||'';
+  var gHint = genderFor(firstName);
+  var eHint = guessEthnicityFromFirstName(firstName);
+  if(faceKey){
+    var img=document.createElement('img');
+    img.alt='';
+    img.loading='lazy';
+    img.src = P + '/headshots/' + encodeURIComponent(faceKey) + '?g='+gHint+'&e='+eHint;
+    img.onerror=function(){ this.remove(); };
+    av.appendChild(img);
+  }
+  w.appendChild(av);
+  var info = el('div','info');
+  var nm = el('div','nm', name||'?');
+  if(opts.endorsed){
+    nm.appendChild(el('span','boost-chip',opts.endorsed));
+  }
+  info.appendChild(nm);
+  var why = el('div','why');
+  if(band.label){
+    var pill = document.createElement('span'); pill.className='role-pill';
+    pill.dataset.rb = band.band;
+    pill.textContent = band.label;
+    why.appendChild(pill);
+  }
+  why.appendChild(document.createTextNode(detail||''));
+  info.appendChild(why);
+  w.appendChild(info);
+  if(opts.score){
+    w.appendChild(el('div','score', opts.score));
+  }
+  return w;
+}
+
 function el(tag, cls, text){
   var e=document.createElement(tag);
   if(cls) e.className=cls;
@@ -191,6 +343,9 @@ window.addEventListener('load',function(){
   loadChapter3();
   loadChapter4();
   loadChapter5();
+  loadChapter6();
+  loadChapter7();
+  loadChapter8();
 });
 
 // ─── Chapter 1 ────────────────────────────────────────────
@@ -306,6 +461,30 @@ function loadChapter4(){
     addr.style.cssText='color:#8b949e;font-size:12px;margin-top:2px';
     card.appendChild(addr);
 
+    // Contractor names link to the full /contractor profile page —
+    // heat map, project index, history, 12 awaiting public-data
+    // sources. The staffer click-through J asked for.
+    if(p.contact_1_name || p.contact_2_name){
+      var contractors=document.createElement('div');
+      contractors.style.cssText='color:#8b949e;font-size:12px;margin-top:4px';
+      contractors.appendChild(document.createTextNode('Contractors: '));
+      var seen=[];
+      [p.contact_1_name, p.contact_2_name].forEach(function(n,i){
+        if(!n || seen.indexOf(n)>=0) return;
+        seen.push(n);
+        if(seen.length>1) contractors.appendChild(document.createTextNode(' · '));
+        var a=document.createElement('a');
+        a.href=P+'/contractor?name='+encodeURIComponent(n);
+        a.target='_blank';
+        a.rel='noopener';
+        a.style.cssText='color:#58a6ff;text-decoration:none;border-bottom:1px dotted #58a6ff44';
+        a.title='Open full contractor profile';
+        a.textContent=n;
+        contractors.appendChild(a);
+      });
+      card.appendChild(contractors);
+    }
+
     card.appendChild(el('div','step-label','STEP 1 · Derive staffing need'));
     var s1=el('div','step-body');
     s1.appendChild(document.createTextNode('Industry heuristic: ~1 worker per $150K of permit cost, capped 2-8. Resulting contract: '));
@@ -321,21 +500,13 @@ function loadChapter4(){
 
     var list=document.createElement('div');list.style.marginTop='6px';
     (prop.candidates||[]).slice(0,5).forEach(function(cand,i){
-      var w=el('div','worker');
-      var initials=(cand.name||'?').split(' ').map(function(s){return (s[0]||'').toUpperCase()}).join('').substring(0,2);
-      w.appendChild(el('div','av',initials));
-      var info=el('div','info');
-      var nm=el('div','nm',cand.name||cand.doc_id||'?');
-      if((cand.playbook_boost||0)>0){
-        var ncit=(cand.playbook_citations||[]).length;
-        nm.appendChild(el('span','boost-chip','Endorsed · '+ncit+' past fill'+(ncit!==1?'s':'')));
-      }
-      info.appendChild(nm);
-      var why=cand.doc_id+' · '+(cand.playbook_boost>0?'boosted +'+cand.playbook_boost.toFixed(3)+' by memory · ':'')+'semantic score '+(cand.score||0).toFixed(3);
-      info.appendChild(el('div','why',why));
-      w.appendChild(info);
-      w.appendChild(el('div','score','#'+(i+1)));
-      list.appendChild(w);
+      var detail = cand.doc_id+' · '+(cand.playbook_boost>0?'boosted +'+cand.playbook_boost.toFixed(3)+' by memory · ':'')+'semantic score '+(cand.score||0).toFixed(3);
+      var endorsed = (cand.playbook_boost||0) > 0
+        ? 'Endorsed · '+((cand.playbook_citations||[]).length)+' past fill'+((cand.playbook_citations||[]).length!==1?'s':'')
+        : null;
+      list.appendChild(workerRow(cand.name||cand.doc_id||'?', prop.role||'', detail, {
+        endorsed: endorsed, score: '#'+(i+1)
+      }));
     });
     card.appendChild(list);
 
@@ -407,7 +578,182 @@ function loadChapter5(){
   });
 }
 
-// ─── Chapter 6 ────────────────────────────────────────────
+// ─── Chapter 6 — per-staffer hot-swap ─────────────────────
+function loadChapter6(){
+  apiGet('/staffers').then(function(r){
+    var host=document.getElementById('ch6-staffers');host.textContent='';
+    var staffers=(r&&r.staffers)||[];
+    if(!staffers.length){
+      host.appendChild(el('div','err','No staffer roster — /staffers returned empty.'));
+      return;
+    }
+    var grid=document.createElement('div'); grid.className='grid'; grid.style.gridTemplateColumns='repeat(auto-fit,minmax(280px,1fr))';
+    staffers.forEach(function(s){
+      var card=el('div','card accent-b');
+      var name=el('div',null,s.name);
+      name.style.cssText='font-size:18px;font-weight:700;color:#e6edf3;letter-spacing:-0.3px';
+      card.appendChild(name);
+      var role=el('div',null,s.display||'');
+      role.style.cssText='font-size:11px;color:#545d68;text-transform:uppercase;letter-spacing:1.2px;margin-top:2px';
+      card.appendChild(role);
+      var ter=el('div',null,'Territory: '+s.territory.state+' · '+s.territory.cities.slice(0,3).join(', ')+'…');
+      ter.style.cssText='color:#8b949e;font-size:12px;margin-top:8px';
+      card.appendChild(ter);
+      var greet=el('div',null,s.greeting||'');
+      greet.style.cssText='color:#c9d1d9;font-size:11px;margin-top:6px;line-height:1.5;border-top:1px dashed #1f2631;padding-top:6px';
+      card.appendChild(greet);
+      grid.appendChild(card);
+    });
+    host.appendChild(grid);
+    var narr=el('div','narr');
+    narr.appendChild(el('strong',null,'What this means for a staffer. '));
+    narr.appendChild(document.createTextNode('Same query — "forklift operators" — returns 89 Indiana workers when Devon is acting, 16 Wisconsin workers when Aisha is acting, 167 Illinois workers when Maria is acting. The MEMORY panel relabels itself with whoever\'s viewing. The corpus stays intact; the relevance gradient is per coordinator. As they each accumulate fills, their slice of the playbook compounds independently.'));
+    host.appendChild(narr);
+  }).catch(function(e){
+    var h=document.getElementById('ch6-staffers');h.textContent='';h.appendChild(el('div','err','Staffer roster unavailable: '+(e.message||e)));
+  });
+}
+
+// ─── Chapter 7 — Construction Activity Signal Engine ──────
+function loadChapter7(){
+  Promise.all([
+    api('/intelligence/profiler_index',{limit:200}),
+  ]).then(function(rs){
+    var prof=rs[0]||{};
+    var rows=prof.contractors||[];
+    var host=document.getElementById('ch7-signal');host.textContent='';
+    // Aggregate basket
+    var byTicker={};
+    rows.forEach(function(r){
+      var ts=(r.tickers&&r.tickers.direct?r.tickers.direct:[]).concat(r.tickers&&r.tickers.associated?r.tickers.associated:[]);
+      ts.forEach(function(t){
+        if(!t||!t.ticker) return;
+        if(!byTicker[t.ticker]) byTicker[t.ticker]={ticker:t.ticker,count:0,kinds:new Set()};
+        byTicker[t.ticker].count++;
+        byTicker[t.ticker].kinds.add(t.via);
+      });
+    });
+    var basket=Object.values(byTicker).sort(function(a,b){return b.count-a.count});
+    var attribCost=0;
+    rows.forEach(function(r){
+      var ts=(r.tickers&&r.tickers.direct?r.tickers.direct:[]).concat(r.tickers&&r.tickers.associated?r.tickers.associated:[]);
+      if(ts.length>0) attribCost += (r.total_cost||0);
+    });
+    var totalAttrib = basket.reduce(function(s,b){return s+b.count},0);
+    if(!basket.length){
+      host.appendChild(el('div','loading','No public-issuer attributions in this view yet.'));
+      return;
+    }
+    // Top-line metric strip
+    var grid=document.createElement('div');grid.className='grid';
+    var c1=el('div','card accent-g');
+    var b1=el('div',null,basket.length); b1.style.cssText='font-size:30px;font-weight:800;color:#3fb950;line-height:1';
+    c1.appendChild(b1);
+    var l1=el('div',null,'Public issuers in scope'); l1.style.cssText='font-size:10px;color:#545d68;text-transform:uppercase;letter-spacing:1.2px;margin-top:8px;font-weight:600';
+    c1.appendChild(l1);
+    var s1=el('div',null,totalAttrib+' attribution edges across the contractor graph'); s1.style.cssText='font-size:12px;color:#8b949e;margin-top:4px';
+    c1.appendChild(s1);
+    grid.appendChild(c1);
+    var c2=el('div','card accent-b');
+    var bav = attribCost>=1e9?'$'+(attribCost/1e9).toFixed(2)+'B':attribCost>=1e6?'$'+(attribCost/1e6).toFixed(0)+'M':'$'+Math.round(attribCost/1e3)+'K';
+    var b2=el('div',null,bav); b2.style.cssText='font-size:30px;font-weight:800;color:#58a6ff;line-height:1';
+    c2.appendChild(b2);
+    var l2=el('div',null,'Attributed build value'); l2.style.cssText='font-size:10px;color:#545d68;text-transform:uppercase;letter-spacing:1.2px;margin-top:8px;font-weight:600';
+    c2.appendChild(l2);
+    var s2=el('div',null,'Permits with at least one wired public-issuer thread'); s2.style.cssText='font-size:12px;color:#8b949e;margin-top:4px';
+    c2.appendChild(s2);
+    grid.appendChild(c2);
+    var c3=el('div','card accent-l');
+    var b3=el('div',null,rows.length); b3.style.cssText='font-size:30px;font-weight:800;color:#bc8cff;line-height:1';
+    c3.appendChild(b3);
+    var l3=el('div',null,'Contractors indexed'); l3.style.cssText='font-size:10px;color:#545d68;text-transform:uppercase;letter-spacing:1.2px;margin-top:8px;font-weight:600';
+    c3.appendChild(l3);
+    var s3=el('div',null,'Each is also a heat map of where they work'); s3.style.cssText='font-size:12px;color:#8b949e;margin-top:4px';
+    c3.appendChild(s3);
+    grid.appendChild(c3);
+    host.appendChild(grid);
+    // Top issuer table
+    var tHdr=document.createElement('div');tHdr.style.cssText='color:#545d68;font-size:11px;text-transform:uppercase;letter-spacing:1.4px;font-weight:600;margin:14px 0 8px';
+    tHdr.textContent='Top public issuers attributable in this view';
+    host.appendChild(tHdr);
+    basket.slice(0,8).forEach(function(b){
+      var row=el('div','row');
+      var left=document.createElement('div');left.style.flex='1';left.style.minWidth='0';
+      var tk=el('div','title',b.ticker);
+      tk.style.cssText+='font-family:ui-monospace,monospace;color:#3fb950';
+      left.appendChild(tk);
+      var kinds=Array.from(b.kinds);
+      var meta=el('div','meta',b.count+' attribution'+(b.count===1?'':'s')+' · '+kinds.join('+'));
+      left.appendChild(meta);
+      row.appendChild(left);
+      var right=document.createElement('div');right.style.cssText='font-size:11px;color:#58a6ff';
+      var a=document.createElement('a');a.href=P+'/profiler';a.target='_blank';a.style.color='#58a6ff';a.style.textDecoration='none';
+      a.textContent='see in profiler →';
+      right.appendChild(a);
+      row.appendChild(right);
+      host.appendChild(row);
+    });
+    var narr=el('div','narr');
+    narr.appendChild(el('strong',null,'What this means for the business. '));
+    narr.appendChild(document.createTextNode('The data corpus is also a market-signal engine. When a contractor co-files permits with a public company, that contractor inherits the ticker as an associated indicator. Permit volume changes precede earnings calls by months. As we add cities (NYC DOB next, then LA / Houston / Boston) the network compounds — and we own a piece of the signal that nobody else has.'));
+    host.appendChild(narr);
+  }).catch(function(e){
+    var h=document.getElementById('ch7-signal');h.textContent='';h.appendChild(el('div','err','Signal engine unavailable: '+(e.message||e)));
+  });
+}
+
+// ─── Chapter 8 — Triage in one shot ───────────────────────
+function loadChapter8(){
+  api('/intelligence/chat',{message:'Marcus running late site 4422'}).then(function(d){
+    var host=document.getElementById('ch8-triage');host.textContent='';
+    if(d.type!=='triage'){
+      host.appendChild(el('div','err','Triage route did not fire. Got type=' + (d.type||'?')));
+      return;
+    }
+    // Worker card
+    var wc=el('div','card accent-r');
+    var lbl=el('div',null,'⚠ TRIAGE EVENT'); lbl.style.cssText='font-size:10px;color:#f85149;text-transform:uppercase;letter-spacing:1.2px;font-weight:700;margin-bottom:8px';
+    wc.appendChild(lbl);
+    var nm=el('div',null,d.worker.name); nm.style.cssText='font-size:18px;font-weight:700;color:#e6edf3';
+    wc.appendChild(nm);
+    var loc=el('div',null,(d.worker.role||'?')+' · '+(d.worker.city||'')+', '+(d.worker.state||''));
+    loc.style.cssText='font-size:12px;color:#8b949e;margin-top:2px';
+    wc.appendChild(loc);
+    var stats=document.createElement('div');stats.style.cssText='display:flex;gap:14px;font-size:11px;color:#8b949e;margin-top:8px;flex-wrap:wrap';
+    [['Reliability',Math.round((d.worker.rel||0)*100)+'%'],['Responsiveness',Math.round((d.worker.resp||0)*100)+'%'],['Availability',Math.round((d.worker.avail||0)*100)+'%']].forEach(function(p){
+      var s=document.createElement('span');
+      var l=document.createElement('span');l.textContent=p[0]+': ';
+      var b=document.createElement('b');b.style.color='#e6edf3';b.textContent=p[1];
+      s.appendChild(l);s.appendChild(b);stats.appendChild(s);
+    });
+    wc.appendChild(stats);
+    host.appendChild(wc);
+    // Draft SMS
+    var smsLabel=el('div',null,'DRAFT SMS — TO CLIENT'); smsLabel.style.cssText='font-size:10px;color:#d29922;text-transform:uppercase;letter-spacing:1.2px;font-weight:700;margin:14px 0 4px';
+    host.appendChild(smsLabel);
+    var smsBox=el('div',null,d.draft_sms||'');
+    smsBox.style.cssText='background:#0d1117;border:1px solid #21262d;border-radius:6px;padding:10px 12px;font-family:ui-monospace,monospace;font-size:12px;color:#e6edf3;line-height:1.5;white-space:pre-wrap';
+    host.appendChild(smsBox);
+    // Backfills
+    if((d.backfills||[]).length){
+      var bfHdr=document.createElement('div');bfHdr.style.cssText='font-size:11px;color:#3fb950;text-transform:uppercase;letter-spacing:1.2px;font-weight:600;margin:14px 0 8px';
+      bfHdr.textContent='✓ '+d.backfills.length+' local '+(d.worker.role||'workers')+' available — sorted by responsiveness';
+      host.appendChild(bfHdr);
+      d.backfills.slice(0,5).forEach(function(c){
+        var detail=(c.role||'?')+' · '+(c.city||'')+', '+(c.state||'')+' · rel '+Math.round((c.rel||0)*100)+'% · resp '+Math.round((c.resp||0)*100)+'%';
+        host.appendChild(workerRow(c.name||'?', c.role||'', detail));
+      });
+    }
+    var narr=el('div','narr');
+    narr.appendChild(el('strong',null,'What this means for a coordinator. '));
+    narr.appendChild(document.createTextNode('A normal afternoon: text rolls in, coordinator opens 3 tabs to look up the worker, checks the bench by hand, drafts a message. 20 minutes. Here: the system pulled the profile, scored attendance, surfaced 5 same-role same-geo backfills sorted by who actually answers their phone, and pre-wrote the client-facing SMS. The coordinator clicks send. ' + d.duration_ms + 'ms.'));
+    host.appendChild(narr);
+  }).catch(function(e){
+    var h=document.getElementById('ch8-triage');h.textContent='';h.appendChild(el('div','err','Triage demo unavailable: '+(e.message||e)));
+  });
+}
+
+// ─── Chapter 9 (was 6) — Try it yourself ──────────────────
 function runTry(){
   var q=document.getElementById('try-q').value.trim();if(!q)return;
   var btn=document.getElementById('try-btn'),out=document.getElementById('try-out');
@@ -437,23 +783,16 @@ function runTry(){
 
     var workers=d.sql_results||d.vector_results||d.results||[];
     workers.slice(0,5).forEach(function(w,i){
-      var row=el('div','worker');
       var nm=w.name||(w.text||'').split('—')[0].trim()||w.doc_id||'?';
-      var initials=nm.split(' ').map(function(s){return (s[0]||'').toUpperCase()}).join('').substring(0,2);
-      row.appendChild(el('div','av',initials));
-      var info=el('div','info');
-      var n=el('div','nm',nm);
-      if((w.playbook_boost||0)>0){
-        n.appendChild(el('span','boost-chip','Endorsed · '+((w.playbook_citations||[]).length||'?')+' past fill(s)'));
-      }
-      info.appendChild(n);
       var bits=[];
       if(w.role) bits.push(w.role);
       if(w.city&&w.state) bits.push(w.city+', '+w.state);
       if(w.rel!==undefined) bits.push('reliability '+Math.round(w.rel*100)+'%');
       if(w.avail!==undefined) bits.push('availability '+Math.round(w.avail*100)+'%');
-      info.appendChild(el('div','why',bits.join(' · ')||'AI semantic match'));
-      row.appendChild(info);
+      var endorsed = (w.playbook_boost||0) > 0
+        ? 'Endorsed · '+((w.playbook_citations||[]).length||'?')+' past fill(s)'
+        : null;
+      var row = workerRow(nm, w.role||'', bits.join(' · ')||'AI semantic match', { endorsed: endorsed });
       row.appendChild(el('div','score','#'+(i+1)));
       card.appendChild(row);
     });

mcp-server/contractor.html

@@ -0,0 +1,606 @@
+<!DOCTYPE html>
+<html><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Contractor Profile · Staffing Co-Pilot</title>
+<link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css">
+<script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js"></script>
+<style>
+*{margin:0;padding:0;box-sizing:border-box}
+html,body{overflow-x:hidden}
+body{font-family:'Inter',-apple-system,system-ui,sans-serif;background:#090c10;color:#b0b8c4;font-size:14px;line-height:1.6}
+.bar{background:#0d1117;padding:0 24px;height:56px;border-bottom:1px solid #171d27;display:flex;justify-content:space-between;align-items:center}
+.bar h1{font-size:14px;font-weight:600;color:#e6edf3}
+.bar a{color:#545d68;text-decoration:none;font-size:12px;padding:6px 14px;border-radius:6px}
+.bar a:hover{color:#e6edf3;background:#161b22}
+.content{max-width:1100px;margin:0 auto;padding:24px 20px 40px}
+.search-box{background:#0d1117;border:1px solid #21262d;border-radius:10px;padding:16px;margin-bottom:24px;display:flex;gap:10px}
+.search-box input{flex:1;padding:12px 16px;background:#161b22;border:1px solid #21262d;border-radius:8px;color:#e6edf3;font-size:14px;outline:none}
+.search-box input:focus{border-color:#388bfd}
+.search-box button{padding:12px 24px;background:#1f6feb;border:none;border-radius:8px;color:#fff;font-weight:600;cursor:pointer}
+.hero{background:#0d1117;border:1px solid #171d27;border-radius:12px;padding:24px;margin-bottom:16px}
+.hero h2{color:#e6edf3;font-size:22px;font-weight:700;letter-spacing:-0.5px;margin-bottom:6px}
+.hero .ticker-row{display:flex;align-items:center;gap:10px;margin-top:10px;flex-wrap:wrap}
+.hero .ticker{font-family:ui-monospace,SFMono-Regular,monospace;background:#161b22;padding:4px 10px;border-radius:6px;color:#3fb950;border:1px solid #3fb95066;font-weight:600;font-size:12px}
+.hero .meta{font-size:12px;color:#8b949e}
+.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(320px,1fr));gap:14px}
+.card{background:#0d1117;border:1px solid #171d27;border-radius:10px;padding:16px}
+.card h3{font-size:11px;color:#545d68;text-transform:uppercase;letter-spacing:1.2px;margin-bottom:10px;font-weight:600}
+.card .big{font-size:24px;font-weight:700;color:#e6edf3;letter-spacing:-0.5px;margin-bottom:4px}
+.card .sub{font-size:11px;color:#8b949e;line-height:1.5}
+.card a{color:#58a6ff;text-decoration:none;font-size:11px}
+.row{display:flex;justify-content:space-between;align-items:baseline;padding:6px 0;border-bottom:1px dashed #1f2631;font-size:11px}
+.row:last-child{border:none}
+.row .l{color:#8b949e}
+.row .v{color:#e6edf3;font-family:ui-monospace,monospace;font-variant-numeric:tabular-nums}
+.chip{display:inline-block;padding:3px 8px;border-radius:9px;font-size:10px;font-weight:600;margin-right:6px;margin-bottom:4px}
+.ld{color:#3d444d;text-align:center;padding:60px;font-size:13px}
+.empty{color:#545d68;font-size:11px;font-style:italic;line-height:1.5}
+.wide{grid-column:1/-1}
+.heatmap{height:380px;border-radius:8px;border:1px solid #1f2631;overflow:hidden;margin-top:10px}
+.heatmap .leaflet-container{background:#0a0d12}
+.timeline{margin-top:10px;display:flex;align-items:flex-end;gap:2px;height:80px;padding:6px 0;border-bottom:1px solid #1f2631}
+.timeline .tbar{flex:1;background:#1f6feb;min-height:2px;border-radius:2px 2px 0 0;position:relative;cursor:help}
+.timeline .tbar:hover{background:#58a6ff}
+.timeline-axis{display:flex;justify-content:space-between;font-size:10px;color:#545d68;padding-top:4px;font-family:ui-monospace,monospace}
+.placeholder-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:10px;margin-top:14px}
+.ph-card{background:#0a0d12;border:1px dashed #21262d;border-radius:8px;padding:12px 14px;position:relative}
+.ph-card h4{font-size:11px;color:#8b949e;font-weight:600;margin-bottom:4px;display:flex;align-items:center;gap:6px}
+.ph-card h4 .badge{font-size:9px;padding:2px 6px;border-radius:8px;background:#161b22;color:#d29922;border:1px solid #d2992244;font-weight:600;letter-spacing:0.5px;text-transform:uppercase}
+.ph-card .why{font-size:11px;color:#e6edf3;line-height:1.5;margin-bottom:6px}
+.ph-card .would{font-size:10px;color:#545d68;font-family:ui-monospace,monospace;line-height:1.5;border-top:1px dashed #1f2631;padding-top:6px;margin-top:6px}
+.section-label{font-size:10px;color:#545d68;text-transform:uppercase;letter-spacing:1.4px;font-weight:600;margin:24px 0 8px}
+@media(max-width:640px){.bar{padding:0 14px}.content{padding:14px}.hero{padding:16px}.hero h2{font-size:18px}.card{padding:12px}}
+</style>
+</head><body>
+<div class="bar">
+  <h1>Staffing Co-Pilot · Contractor Profile</h1>
+  <a href="/">← Dashboard</a>
+</div>
+<div class="content">
+  <div class="search-box">
+    <input id="q" type="text" placeholder="Type a contractor name (e.g., Turner Construction Company)" onkeydown="if(event.key==='Enter')lookup()">
+    <button onclick="lookup()">Look up</button>
+  </div>
+  <div id="out"><div class="ld">Type a name above to load the full portfolio across every wired data source.</div></div>
+</div>
+<script>
+function $(id){return document.getElementById(id)}
+
+// Path prefix detection — devop.live serves this page under /lakehouse,
+// localhost:3700 serves it at root. URL rewrites must preserve whatever
+// prefix the user reached the page through, otherwise the back-link and
+// browser refresh break.
+var P=location.pathname.indexOf('/lakehouse')>=0?'/lakehouse':'';
+
+// Bootstrap from URL: /contractor?name=Turner+Construction
+window.addEventListener('load', function(){
+  var name = new URLSearchParams(location.search).get('name');
+  if(name){
+    $('q').value = name;
+    lookup();
+  }
+  // Back link respects the prefix too
+  var back=document.querySelector('.bar a');
+  if(back) back.href=P+'/';
+});
+
+function lookup(){
+  var name = $('q').value.trim();
+  if(!name){ $('out').textContent = ''; return; }
+  history.replaceState({}, '', P+'/contractor?name='+encodeURIComponent(name));
+  var out = $('out');
+  out.textContent = '';
+  var ld = document.createElement('div');
+  ld.className = 'ld';
+  ld.textContent = 'Pulling OSHA, SEC, Stooq, Chicago history, USASpending… (~5-10s on cold cache)';
+  out.appendChild(ld);
+  fetch(P+'/intelligence/contractor_profile',{
+    method:'POST',
+    headers:{'Content-Type':'application/json'},
+    body:JSON.stringify({name:name})
+  }).then(function(r){return r.json()}).then(function(d){
+    render(d);
+  }).catch(function(e){
+    out.textContent = '';
+    var err = document.createElement('div');
+    err.className = 'ld';
+    err.style.color = '#f85149';
+    err.textContent = 'profile failed: '+e.message;
+    out.appendChild(err);
+  });
+}
+
+function render(d){
+  var out = $('out');
+  out.textContent = '';
+
+  // ─── Hero — name, ticker, parent ─────────────
+  var hero = document.createElement('div');
+  hero.className = 'hero';
+  var h2 = document.createElement('h2');
+  h2.textContent = d.display_name;
+  hero.appendChild(h2);
+  var sub = document.createElement('div');
+  sub.className = 'meta';
+  sub.textContent = 'Internal ticker: '+(d.ticker||'?')+' · profile generated '+new Date(d.generated_at).toLocaleTimeString();
+  hero.appendChild(sub);
+
+  var trow = document.createElement('div');
+  trow.className = 'ticker-row';
+  // Direct ticker
+  var s = d.stock;
+  if(s && s.status==='ok'){
+    var tk = document.createElement('span');
+    tk.className = 'ticker';
+    tk.textContent = s.ticker;
+    trow.appendChild(tk);
+    var px = document.createElement('span');
+    px.className = 'meta';
+    px.textContent = (s.company_name||'')+(s.exchange?' · '+s.exchange:'')+(s.price?' · $'+s.price.toFixed(2):'');
+    if(s.day_change_pct!=null && !isNaN(s.day_change_pct)){
+      var ch = (s.day_change_pct>=0?'+':'')+s.day_change_pct.toFixed(2)+'%';
+      var chSpan = document.createElement('span');
+      chSpan.style.color = s.day_change_pct>=0?'#3fb950':'#f85149';
+      chSpan.style.marginLeft = '6px';
+      chSpan.textContent = ch;
+      px.appendChild(chSpan);
+    }
+    trow.appendChild(px);
+  } else {
+    var noTk = document.createElement('span');
+    noTk.className = 'meta';
+    noTk.textContent = 'Private — no direct US ticker';
+    trow.appendChild(noTk);
+  }
+  // Parent link
+  var pl = d.parent_link;
+  if(pl && pl.status==='ok'){
+    var arrow = document.createElement('span');
+    arrow.className = 'meta';
+    arrow.style.color = '#545d68';
+    arrow.textContent = ' → parent ';
+    trow.appendChild(arrow);
+    var pTk = document.createElement('span');
+    pTk.className = 'ticker';
+    pTk.style.color = '#d29922';
+    pTk.style.borderColor = '#d2992266';
+    pTk.textContent = pl.parent_ticker || '?';
+    pTk.title = pl.link_source || '';
+    trow.appendChild(pTk);
+    var pName = document.createElement('span');
+    pName.className = 'meta';
+    pName.textContent = pl.parent_name+(pl.parent_exchange?' · '+pl.parent_exchange:'')+(pl.parent_country?' · '+pl.parent_country:'');
+    trow.appendChild(pName);
+  } else if(pl && pl.status==='no_link'){
+    var pp = document.createElement('span');
+    pp.className = 'meta';
+    pp.style.fontStyle = 'italic';
+    pp.textContent = ' · '+(pl.reason||'no public parent identified');
+    trow.appendChild(pp);
+  }
+  hero.appendChild(trow);
+  out.appendChild(hero);
+
+  // ─── Grid of cards ─────────────────────────────
+  var grid = document.createElement('div');
+  grid.className = 'grid';
+
+  // OSHA
+  var oCard = card('OSHA SAFETY HISTORY (NATIONAL)');
+  var osha = d.osha || {};
+  if(osha.status==='ok'){
+    big(oCard, osha.inspection_count + ' inspections', 'most recent '+(osha.most_recent_date||'?'));
+    rowEl(oCard, 'States seen', (osha.states_seen||[]).join(', ') || '?');
+    rowEl(oCard, 'Most recent', osha.most_recent_date||'?');
+    if(osha.recent_inspections && osha.recent_inspections.length){
+      var rep = document.createElement('div');
+      rep.style.marginTop = '8px';
+      rep.style.fontSize = '10px';
+      rep.style.color = '#545d68';
+      rep.textContent = 'Recent inspections:';
+      oCard.appendChild(rep);
+      osha.recent_inspections.slice(0,5).forEach(function(i){
+        var r = document.createElement('div');
+        r.style.fontSize = '10px';
+        r.style.color = '#8b949e';
+        r.style.fontFamily = 'ui-monospace,monospace';
+        r.style.padding = '2px 0';
+        var a = document.createElement('a');
+        a.href = i.detail_url;
+        a.target = '_blank';
+        a.textContent = i.id;
+        r.appendChild(a);
+        r.appendChild(document.createTextNode(' · '+i.date+' · '+i.state+' · '+i.type+' · '+i.scope));
+        oCard.appendChild(r);
+      });
+    }
+  } else if(osha.status==='no_match'){
+    big(oCard, 'No inspections', 'clean record');
+  } else {
+    empty(oCard, 'OSHA fetch error: '+(osha.error||'unknown'));
+  }
+  grid.appendChild(oCard);
+
+  // Chicago history
+  var hCard = card('CHICAGO PERMIT HISTORY (24mo + LIFETIME)');
+  var hist = d.history || {};
+  if(hist.status==='ok'){
+    big(hCard, hist.permits_historical_total+' permits all-time',
+        hist.permits_last_180d+' in last 180d · '+hist.permits_last_24mo+' in 24mo · trend: '+hist.trend);
+    rowEl(hCard, 'Cost (24mo)', hist.total_cost_last_24mo>=1e6 ? '$'+(hist.total_cost_last_24mo/1e6).toFixed(1)+'M' : '$'+Math.round(hist.total_cost_last_24mo/1e3)+'K');
+    if(hist.recent_permits && hist.recent_permits.length){
+      var rh = document.createElement('div');
+      rh.style.marginTop = '8px';
+      rh.style.fontSize = '10px';
+      rh.style.color = '#545d68';
+      rh.textContent = 'Recent Chicago permits:';
+      hCard.appendChild(rh);
+      hist.recent_permits.slice(0,5).forEach(function(p){
+        var r = document.createElement('div');
+        r.style.fontSize = '10px';
+        r.style.color = '#8b949e';
+        r.style.padding = '2px 0';
+        r.textContent = '· '+(p.date||'?')+' · '+p.work_type+' · $'+(p.cost||0).toLocaleString()+' · '+p.address;
+        hCard.appendChild(r);
+      });
+    }
+  } else {
+    empty(hCard, 'Chicago history error');
+  }
+  grid.appendChild(hCard);
+
+  // Federal contracts
+  var fCard = card('FEDERAL CONTRACTS (USASpending.gov)');
+  var fed = d.federal || {};
+  if(fed.status==='ok' && fed.total_awards_count>0){
+    var dollars = fed.total_awards_value>=1e9 ? '$'+(fed.total_awards_value/1e9).toFixed(2)+'B'
+                : fed.total_awards_value>=1e6 ? '$'+(fed.total_awards_value/1e6).toFixed(1)+'M'
+                : '$'+Math.round(fed.total_awards_value/1e3)+'K';
+    big(fCard, dollars, fed.total_awards_count+' awards · most recent '+(fed.most_recent_award_date||'?'));
+    if(fed.top_agencies && fed.top_agencies.length){
+      var ta = document.createElement('div');
+      ta.style.marginTop = '6px';
+      ta.style.fontSize = '10px';
+      ta.style.color = '#545d68';
+      ta.textContent = 'Top awarding agencies:';
+      fCard.appendChild(ta);
+      fed.top_agencies.forEach(function(a){
+        var r = document.createElement('div');
+        r.style.fontSize = '11px';
+        r.style.color = '#8b949e';
+        r.style.padding = '3px 0';
+        var dollars2 = a.value>=1e6 ? '$'+(a.value/1e6).toFixed(1)+'M' : '$'+Math.round(a.value/1e3)+'K';
+        r.textContent = '· '+a.agency+' — '+dollars2;
+        fCard.appendChild(r);
+      });
+    }
+    if(fed.source_url){
+      var lnk = document.createElement('a');
+      lnk.href = fed.source_url;
+      lnk.target = '_blank';
+      lnk.style.display = 'inline-block';
+      lnk.style.marginTop = '8px';
+      lnk.textContent = 'View on usaspending.gov ↗';
+      fCard.appendChild(lnk);
+    }
+  } else if(fed.status==='no_match'){
+    big(fCard, 'No federal contracts', 'on file under this name');
+  } else {
+    empty(fCard, 'usaspending error');
+  }
+  grid.appendChild(fCard);
+
+  // Debarment + NLRB combined
+  var rCard = card('DEBARMENT + LABOR ACTIONS');
+  var deb = d.debarment || {};
+  var nlrb = d.nlrb || {};
+  rowEl(rCard, 'SAM.gov excluded', deb.status==='needs_setup' ? 'awaiting API key' : (deb.sam_excluded?'YES':'no'));
+  rowEl(rCard, 'IDOL debarred', deb.status==='needs_setup' ? 'awaiting scrape' : (deb.idol_debarred?'YES':'no'));
+  rowEl(rCard, 'NLRB cases', nlrb.status==='needs_setup' ? 'awaiting scrape' : (nlrb.total_cases||0));
+  if(deb.status==='needs_setup' || nlrb.status==='needs_setup'){
+    var dn = document.createElement('div');
+    dn.className = 'empty';
+    dn.style.marginTop = '8px';
+    dn.textContent = 'Both sources pending wire-up: '+(deb.reason||nlrb.reason||'');
+    rCard.appendChild(dn);
+  }
+  grid.appendChild(rCard);
+
+  // ILSOS
+  var iCard = card('CORPORATE REGISTRY (Illinois SoS)');
+  var ilsos = d.ilsos || {};
+  if(ilsos.status==='source_unreachable'){
+    rowEl(iCard, 'Status', 'source blocked at our ASN');
+    var en = document.createElement('div');
+    en.className = 'empty';
+    en.style.marginTop = '8px';
+    en.textContent = ilsos.reason||'';
+    iCard.appendChild(en);
+  } else if(ilsos.status==='ok'){
+    rowEl(iCard, 'Entity name', ilsos.entity_name||'?');
+    rowEl(iCard, 'File #', ilsos.file_number||'?');
+    rowEl(iCard, 'Status', ilsos.status_text||'?');
+    rowEl(iCard, 'Formed', ilsos.formation_date||'?');
+    rowEl(iCard, 'Registered agent', ilsos.registered_agent||'?');
+  } else {
+    empty(iCard, 'no ILSOS data');
+  }
+  grid.appendChild(iCard);
+
+  out.appendChild(grid);
+
+  // ─── Project Index summary — the staffer-facing build-signal score ──
+  var pixHeader = document.createElement('div');
+  pixHeader.className = 'section-label';
+  pixHeader.textContent = '◆ Project Index — build-signal score';
+  out.appendChild(pixHeader);
+
+  var pixCard = document.createElement('div');
+  pixCard.className = 'card wide';
+  // Score is a simple weighted blend of the wired signals — designed to
+  // be replaced with a real model once enough placeholders are wired.
+  var hist2 = d.history || {};
+  var pixScore = 0;
+  var pixDrivers = [];
+  if(hist2.permits_last_180d){ pixScore += Math.min(hist2.permits_last_180d * 5, 30); pixDrivers.push(hist2.permits_last_180d+' Chicago permits in 180d (+'+Math.min(hist2.permits_last_180d*5,30)+')'); }
+  if(hist2.trend === 'rising'){ pixScore += 10; pixDrivers.push('permit trend rising (+10)'); }
+  if(d.osha && d.osha.status==='ok' && d.osha.inspection_count>0){ pixScore -= Math.min(d.osha.inspection_count*5, 25); pixDrivers.push(d.osha.inspection_count+' OSHA inspections (-'+Math.min(d.osha.inspection_count*5,25)+')'); }
+  if(d.federal && d.federal.status==='ok' && d.federal.total_awards_count>0){ pixScore += 15; pixDrivers.push('federally-vetted contractor (+15)'); }
+  if(d.debarment && d.debarment.sam_excluded){ pixScore -= 50; pixDrivers.push('SAM.gov excluded (-50)'); }
+  if(d.stock && d.stock.status==='ok'){ pixScore += 5; pixDrivers.push('public ticker (+5)'); }
+  pixScore = Math.max(0, Math.min(100, 50 + pixScore));
+  var pixColor = pixScore >= 70 ? '#3fb950' : pixScore >= 40 ? '#d29922' : '#f85149';
+  var pixHero = document.createElement('div');
+  pixHero.style.cssText = 'display:flex;align-items:baseline;gap:14px;margin-bottom:8px';
+  var pixBig = document.createElement('span');
+  pixBig.style.cssText = 'font-size:42px;font-weight:700;color:'+pixColor+';letter-spacing:-1px';
+  pixBig.textContent = pixScore;
+  pixHero.appendChild(pixBig);
+  var pixLabel = document.createElement('span');
+  pixLabel.style.cssText = 'font-size:12px;color:#8b949e';
+  pixLabel.textContent = pixScore >= 70 ? 'Strong staffing partner — wired signals positive' : pixScore >= 40 ? 'Mixed signals — review drivers below' : 'Caution — wired signals negative';
+  pixHero.appendChild(pixLabel);
+  pixCard.appendChild(pixHero);
+  if(pixDrivers.length){
+    var pixDrv = document.createElement('div');
+    pixDrv.style.cssText = 'font-size:11px;color:#8b949e;line-height:1.7;font-family:ui-monospace,monospace';
+    pixDrv.textContent = pixDrivers.join(' · ');
+    pixCard.appendChild(pixDrv);
+  }
+  var pixFoot = document.createElement('div');
+  pixFoot.style.cssText = 'font-size:10px;color:#545d68;margin-top:8px;font-style:italic;line-height:1.5';
+  pixFoot.textContent = 'Score is a placeholder weighted blend of the 6 wired signals above. Real ML model lands once 12 awaiting sources below ship — that gives the index 18 features instead of 6.';
+  pixCard.appendChild(pixFoot);
+  out.appendChild(pixCard);
+
+  // ─── Heat map — every Chicago permit they're contact_1 or contact_2 on ─
+  var mapHeader = document.createElement('div');
+  mapHeader.className = 'section-label';
+  mapHeader.textContent = '◆ Where they\'ve worked — Chicago permits, last 24 months';
+  out.appendChild(mapHeader);
+  var mapCard = document.createElement('div');
+  mapCard.className = 'card wide';
+  var mapDiv = document.createElement('div');
+  mapDiv.className = 'heatmap';
+  mapDiv.id = 'cmap';
+  mapCard.appendChild(mapDiv);
+  var mapHint = document.createElement('div');
+  mapHint.style.cssText = 'font-size:11px;color:#545d68;margin-top:8px';
+  mapHint.textContent = 'Loading geo from chicago_permits…';
+  mapCard.appendChild(mapHint);
+  out.appendChild(mapCard);
+
+  // Plot the recent_permits embedded in the contractor profile (now
+  // includes lat/lng/permit_id/description per the entity.ts change).
+  // Color by cost: green <$100K, amber $100K-$1M, red ≥$1M.
+  var permits = (hist2.recent_permits||[]).filter(function(p){return p.lat&&p.lng});
+  if(!permits.length){
+    mapHint.textContent = 'No geocoded permits in the contractor history (Socrata may not have lat/lng for these records).';
+  } else {
+    // Construct map only after the div is in the DOM; defer one tick.
+    setTimeout(function(){
+      var map = L.map('cmap', {zoomControl:true, attributionControl:false}).setView([41.88,-87.63], 11);
+      L.tileLayer('https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png',{maxZoom:19}).addTo(map);
+      var bounds = [];
+      var costs = permits.map(function(p){return Number(p.cost)||0});
+      var maxCost = Math.max.apply(null, costs.concat([1]));
+      permits.forEach(function(p){
+        var c = Number(p.cost)||0;
+        var radius = 4 + (c/maxCost)*16;
+        var color = c >= 1000000 ? '#f85149' : c >= 100000 ? '#d29922' : '#3fb950';
+        var marker = L.circleMarker([p.lat,p.lng],{radius:radius, color:color, weight:1, fillOpacity:0.55});
+        // Build popup via DOM (no innerHTML — keeps the XSS hook happy)
+        var pop = document.createElement('div');
+        pop.style.cssText = 'font-family:ui-monospace,monospace;font-size:11px;color:#0a0d12;min-width:160px';
+        var costRow = document.createElement('div');
+        costRow.style.cssText = 'font-weight:700;margin-bottom:4px';
+        costRow.textContent = '$'+c.toLocaleString()+' · '+(p.date||'?');
+        pop.appendChild(costRow);
+        var wt = document.createElement('div');
+        wt.textContent = p.work_type||'?';
+        pop.appendChild(wt);
+        var addr = document.createElement('div');
+        addr.style.color = '#545d68';
+        addr.textContent = p.address||'?';
+        pop.appendChild(addr);
+        if(p.permit_id){
+          var pid = document.createElement('div');
+          pid.style.cssText = 'color:#545d68;margin-top:4px;font-size:10px';
+          pid.textContent = 'permit '+p.permit_id;
+          pop.appendChild(pid);
+        }
+        marker.bindPopup(pop);
+        marker.addTo(map);
+        bounds.push([p.lat, p.lng]);
+      });
+      if(bounds.length>1) map.fitBounds(bounds, {padding:[24,24]});
+      mapHint.textContent = permits.length+' permits plotted · green <$100K, amber $100K-$1M, red ≥$1M · radius: relative cost';
+    }, 50);
+  }
+
+  // ─── History timeline — monthly permit volume + cost trend ─────────
+  if(hist2.recent_permits && hist2.recent_permits.length){
+    var tlHeader = document.createElement('div');
+    tlHeader.className = 'section-label';
+    tlHeader.textContent = '◆ Activity timeline — Chicago permits by month';
+    out.appendChild(tlHeader);
+    var tlCard = document.createElement('div');
+    tlCard.className = 'card wide';
+    // Bucket by year-month
+    var buckets = {};
+    hist2.recent_permits.forEach(function(p){
+      var d = (p.date||'').substring(0,7); // YYYY-MM
+      if(!d) return;
+      buckets[d] = buckets[d] || {count:0, cost:0};
+      buckets[d].count++;
+      buckets[d].cost += Number(p.cost)||0;
+    });
+    var months = Object.keys(buckets).sort();
+    if(months.length){
+      var maxC = Math.max.apply(null, months.map(function(m){return buckets[m].count}));
+      var tl = document.createElement('div'); tl.className='timeline';
+      months.forEach(function(m){
+        var b = buckets[m];
+        var bar = document.createElement('div'); bar.className='tbar';
+        bar.style.height = Math.max(2, Math.round(b.count/maxC*72)) + 'px';
+        bar.title = m+' · '+b.count+' permit'+(b.count===1?'':'s')+' · $'+Math.round(b.cost).toLocaleString();
+        tl.appendChild(bar);
+      });
+      tlCard.appendChild(tl);
+      var ax = document.createElement('div'); ax.className='timeline-axis';
+      var first = document.createElement('span'); first.textContent = months[0];
+      var last = document.createElement('span'); last.textContent = months[months.length-1];
+      ax.appendChild(first); ax.appendChild(last);
+      tlCard.appendChild(ax);
+    }
+    out.appendChild(tlCard);
+  }
+
+  // ─── 12 awaiting-source placeholders ──────────────────────────────
+  // Each one names a real public data source that would feed the
+  // build-signal index, with a one-line "why a staffer cares" framing
+  // and a sample shape of what the panel would show once wired.
+  var phHeader = document.createElement('div');
+  phHeader.className = 'section-label';
+  phHeader.textContent = '◆ 12 awaiting sources — what plugs in next';
+  out.appendChild(phHeader);
+  var phGrid = document.createElement('div');
+  phGrid.className = 'placeholder-grid';
+  PLACEHOLDERS.forEach(function(p){
+    var c = document.createElement('div'); c.className='ph-card';
+    var h = document.createElement('h4');
+    var name = document.createElement('span'); name.textContent = p.name;
+    var badge = document.createElement('span'); badge.className='badge'; badge.textContent='AWAITING';
+    h.appendChild(name); h.appendChild(badge);
+    c.appendChild(h);
+    var why = document.createElement('div'); why.className='why'; why.textContent = p.why;
+    c.appendChild(why);
+    var would = document.createElement('div'); would.className='would';
+    would.textContent = 'Would show: ' + p.would;
+    c.appendChild(would);
+    phGrid.appendChild(c);
+  });
+  out.appendChild(phGrid);
+
+  // Roadmap footer
+  var foot = document.createElement('div');
+  foot.style.marginTop = '20px';
+  foot.style.fontSize = '10px';
+  foot.style.color = '#484f58';
+  foot.style.lineHeight = '1.6';
+  foot.textContent = 'Wired: OSHA Enforcement · SEC EDGAR + Stooq · Chicago Socrata permits (lat/lng) · USASpending.gov · curated parent-ticker map · ILSOS (datacenter ASN blocked). 12 awaiting sources above are real public datasets that would 3× the feature count of the build-signal index — each one labeled with the one-liner the staffer would ask before placing a worker.';
+  out.appendChild(foot);
+}
+
+// Twelve real public data sources, framed in coordinator language.
+// Each is a placeholder; the panel renders them as "AWAITING" with a
+// description of what they'd add once wired. Order is roughly: highest
+// staffing-decision relevance first.
+var PLACEHOLDERS = [
+  {
+    name: 'DOL Wage & Hour (WHD)',
+    why: 'Has this contractor stiffed workers before? WHD posts every back-wage settlement and unpaid-overtime case.',
+    would: 'cases last 24mo · total back wages owed · status by state · most recent settlement date · whether the workers got paid',
+  },
+  {
+    name: 'State Licensure Boards',
+    why: 'Is the contractor legally allowed to do this work today, in this state?',
+    would: 'license # · status (active / expired / suspended) · trade scope · expiration date · disciplinary history',
+  },
+  {
+    name: 'Surety Bond Capacity',
+    why: 'How big a job can this contractor actually take? Bond ceiling = upper bound on what they\'re bonded for.',
+    would: 'bonding company · single-contract ceiling · aggregate cap · current utilization · recent bond denials',
+  },
+  {
+    name: 'EPA ECHO Compliance',
+    why: 'If a worker shows up to a site with hazmat issues, that\'s the staffing company\'s problem too.',
+    would: 'facility-level violations · last enforcement action · pollutants · whether OSHA escalated',
+  },
+  {
+    name: 'DOT/FMCSA Carrier Safety',
+    why: 'For warehouses with on-site driving or carriers we cross-staff: crash rate, driver out-of-service rate, IFTA filings.',
+    would: 'crash rate per million miles · driver OOS % · vehicle OOS % · safety rating · last compliance review',
+  },
+  {
+    name: 'BBB Complaints + Rating',
+    why: 'What do this contractor\'s own employees say happens to them? BBB aggregates complaints from workers and clients.',
+    would: 'rating · complaint count last 36mo · complaint categories (pay, safety, ghosted) · response rate',
+  },
+  {
+    name: 'PACER Civil Suits (Federal)',
+    why: 'Are they being sued for FLSA, discrimination, or wrongful termination? Filings predate enforcement actions.',
+    would: 'open suits · FLSA / Title VII / ADA breakdowns · counterparties · year-over-year filing rate',
+  },
+  {
+    name: 'UCC Lien Filings',
+    why: 'When a contractor stops paying suppliers, mechanics liens hit the public record. Cash-flow distress signal.',
+    would: 'open liens · total face value · filers (suppliers, banks) · last filing · whether resolved',
+  },
+  {
+    name: 'D&B / Credit Bureau',
+    why: 'Will they pay our staffing invoices? D&B PAYDEX score is the standard.',
+    would: 'PAYDEX (1-100) · days-beyond-terms · credit limit recommendation · UCC link · trade payment trend',
+  },
+  {
+    name: 'State UI Employer Claims',
+    why: 'Workforce stability proxy. A spike in unemployment claims at this employer = layoffs or churn we should know about.',
+    would: 'claims filed against this employer last 12mo · approval rate · separation-reason breakdown',
+  },
+  {
+    name: 'MSHA Mine Safety',
+    why: 'For excavation, demolition, materials, aggregate — MSHA owns the citation history.',
+    would: 'citations · S&S violations · most recent fatality / serious injury · pattern-of-violation flag',
+  },
+  {
+    name: 'Registered Apprenticeships (DOL RAPIDS)',
+    why: 'A contractor with active apprenticeship programs has built a workforce pipeline — different staffing partnership story than one without.',
+    would: 'active programs · apprentice count · trades covered · graduation rate · ethnic/gender diversity reported',
+  },
+];
+
+function card(title){
+  var c = document.createElement('div');
+  c.className = 'card';
+  var h = document.createElement('h3');
+  h.textContent = title;
+  c.appendChild(h);
+  return c;
+}
+function big(c, value, sub){
+  var b = document.createElement('div'); b.className='big'; b.textContent=value;
+  var s = document.createElement('div'); s.className='sub'; s.textContent=sub;
+  c.appendChild(b); c.appendChild(s);
+}
+function rowEl(c, label, value){
+  var r = document.createElement('div'); r.className='row';
+  var l = document.createElement('span'); l.className='l'; l.textContent=label;
+  var v = document.createElement('span'); v.className='v'; v.textContent=value||'—';
+  r.appendChild(l); r.appendChild(v); c.appendChild(r);
+}
+function empty(c, msg){
+  var e = document.createElement('div'); e.className='empty'; e.textContent=msg;
+  c.appendChild(e);
+}
+</script>
+</body></html>

mcp-server/index.ts

@@ -22,6 +22,58 @@ import { buildPermitBrief } from "./entity.js";
 
 const BASE = process.env.LAKEHOUSE_URL || "http://localhost:3100";
 const PORT = parseInt(process.env.MCP_PORT || "3700");
+
+// ─── Staffer roster — used by the per-staffer hot-swap index (G). ────
+//
+// J's vision: each staffer has their own molded view of the corpus.
+// When Maria searches, the system surfaces *Maria's* prior fills and
+// her territory's playbooks first. When Aisha searches, the same
+// corpus gets re-shaped to her geo and recent activity. This is what
+// generic CRM fast-search can't do: a relevance gradient that
+// compounds with each staffer's own signal.
+//
+// First implementation is geography-based — each staffer has a primary
+// state and a list of cities they recruit for. Playbook queries get
+// scoped to that territory when staffer_id is provided. As the system
+// accumulates per-staffer signal (call_log assignments, email threads,
+// SMS history), the scope expands beyond geography.
+//
+// Adding a staffer: append to this list. The /api/staffers endpoint
+// exposes the public-safe fields to the UI dropdown.
+const STAFFERS: Array<{
+  id: string;
+  name: string;
+  display: string;
+  territory: { state: string; cities: string[] };
+  greeting: string;
+}> = [
+  {
+    id: "maria",
+    name: "Maria",
+    display: "Maria · Chicago coordinator",
+    territory: { state: "IL", cities: ["Chicago", "Joliet", "Rockford", "Peoria", "Springfield", "Decatur"] },
+    greeting: "Maria's territory: Illinois warehouse + manufacturing fills",
+  },
+  {
+    id: "devon",
+    name: "Devon",
+    display: "Devon · Indiana coordinator",
+    territory: { state: "IN", cities: ["Indianapolis", "Fort Wayne", "South Bend", "Evansville", "Bloomington", "Terre Haute"] },
+    greeting: "Devon's territory: Indiana production + assembly fills",
+  },
+  {
+    id: "aisha",
+    name: "Aisha",
+    display: "Aisha · Wisconsin/Michigan coordinator",
+    territory: { state: "WI", cities: ["Milwaukee", "Madison", "Green Bay", "Detroit", "Grand Rapids", "Lansing"] },
+    greeting: "Aisha's territory: Wisconsin + Michigan logistics",
+  },
+];
+
+function lookupStaffer(id: string | undefined): typeof STAFFERS[number] | null {
+  if (!id) return null;
+  return STAFFERS.find((s) => s.id === id) || null;
+}
 const MODE = process.env.MCP_TRANSPORT || "http"; // "stdio" or "http"
 
 // Active trace for the current request — set per-request in the HTTP handler
@@ -824,6 +876,213 @@ async function main() {
           }
         }
 
+        // Batch ticker quotes — used by the profiler page's scrolling
+        // ticker basket. Stooq's HTTP CSV API is single-symbol per call,
+        // so this fans out N tickers in parallel and returns a flat
+        // map. Non-US tickers (HOC.DE, SKA-B.ST, LLC.AX) won't have a
+        // Stooq.us entry; we surface that as null so the UI can render
+        // them with a "—" placeholder.
+        if (url.pathname === "/intelligence/ticker_quotes" && req.method === "POST") {
+          const start = Date.now();
+          const b = await json();
+          const tickers: string[] = Array.isArray(b.tickers) ? b.tickers.map((t: any) => String(t).toUpperCase()).filter(Boolean) : [];
+          if (!tickers.length) return ok({ quotes: {}, duration_ms: 0 });
+          const { fetchStooqQuote } = await import("./entity.js");
+          const dedup = Array.from(new Set(tickers)).slice(0, 50);
+          const results = await Promise.all(dedup.map(async (t) => {
+            // Skip non-US suffixes — Stooq.us won't have them
+            if (t.includes(".")) return [t, null] as const;
+            try {
+              const q = await fetchStooqQuote(t);
+              if (!q || !q.price) return [t, null] as const;
+              const change_pct = q.open && q.open > 0 ? ((q.price - q.open) / q.open) * 100 : null;
+              return [t, {
+                ticker: t,
+                price: q.price,
+                price_date: q.price_date,
+                open: q.open,
+                high: q.high,
+                low: q.low,
+                day_change_pct: change_pct,
+                stooq_url: `https://stooq.com/q/?s=${t.toLowerCase()}.us`,
+              }] as const;
+            } catch {
+              return [t, null] as const;
+            }
+          }));
+          const quotes: Record<string, any> = {};
+          for (const [t, q] of results) quotes[t] = q;
+          return ok({ quotes, count: dedup.length, duration_ms: Date.now() - start });
+        }
+
+        // Profiler index — directory of every contractor that has filed
+        // a Chicago permit recently, ranked by permit count + total
+        // cost. Each name in the response links to the full /contractor
+        // profile page. Answers J's ask: "a profiler index that shows
+        // a history of everyone." Pulled live from Socrata; the
+        // count/cost aggregations let the staffer see who's actually
+        // active vs one-off LLCs.
+        if (url.pathname === "/intelligence/profiler_index" && req.method === "POST") {
+          const start = Date.now();
+          const b = await json();
+          const sinceDate = String(b.since || "2025-06-01");
+          const minCost = Math.max(0, Number(b.min_cost) || 100000);
+          const limit = Math.max(1, Math.min(500, Number(b.limit) || 200));
+          const search = String(b.search || "").trim();
+          const permitUrl = "https://data.cityofchicago.org/resource/ydr8-5enu.json";
+          // Group by contact_1_name AND by contact_2_name in two
+          // queries, then merge — Socrata's GROUP BY only takes one
+          // expression and we want both contractor slots.
+          const buildQuery = (col: string) => {
+            const where = [
+              `reported_cost>${minCost}`,
+              `issue_date>'${sinceDate.replace(/'/g, "")}'`,
+              `${col} IS NOT NULL`,
+            ];
+            if (search) {
+              const s = search.replace(/'/g, "''").toUpperCase();
+              where.push(`upper(${col}) like '%${s}%'`);
+            }
+            return `${permitUrl}?$select=${col} AS name,count(*) as cnt,sum(reported_cost) as total_cost,max(issue_date) as last_filed&`
+              + `$where=${encodeURIComponent(where.join(" AND "))}`
+              + `&$group=${col}&$order=total_cost DESC&$limit=${limit}`;
+          };
+          // Co-occurrence query — pulls the contact_1+contact_2 pairs in
+          // the window so we can attribute tickers across associations
+          // ("Bob's Electric works for Target → show TGT"). Capped 5K
+          // permits, ~200ms cold; resolved tickers are in-memory after.
+          const buildCoQuery = () => {
+            const where = [
+              `reported_cost>${minCost}`,
+              `issue_date>'${sinceDate.replace(/'/g, "")}'`,
+              "contact_1_name IS NOT NULL",
+              "contact_2_name IS NOT NULL",
+            ];
+            if (search) {
+              const s = search.replace(/'/g, "''").toUpperCase();
+              where.push(`(upper(contact_1_name) like '%${s}%' OR upper(contact_2_name) like '%${s}%')`);
+            }
+            return `${permitUrl}?$select=contact_1_name,contact_2_name`
+              + `&$where=${encodeURIComponent(where.join(" AND "))}`
+              + `&$limit=5000`;
+          };
+          try {
+            const [byC1, byC2, coRows] = await Promise.all([
+              fetch(buildQuery("contact_1_name")).then((r) => r.json()).catch(() => []),
+              fetch(buildQuery("contact_2_name")).then((r) => r.json()).catch(() => []),
+              fetch(buildCoQuery()).then((r) => r.json()).catch(() => []),
+            ]);
+            const merged: Record<string, { name: string; permits: number; total_cost: number; last_filed: string; roles: Set<string> }> = {};
+            const consume = (rows: any[], role: string) => {
+              for (const r of rows || []) {
+                const n = (r.name || "").trim();
+                if (!n) continue;
+                const cnt = parseInt(r.cnt, 10) || 0;
+                const cost = parseFloat(r.total_cost || "0") || 0;
+                const last = r.last_filed || "";
+                const key = n.toUpperCase();
+                if (!merged[key]) merged[key] = { name: n, permits: 0, total_cost: 0, last_filed: "", roles: new Set() };
+                merged[key].permits += cnt;
+                merged[key].total_cost += cost;
+                if (last > merged[key].last_filed) merged[key].last_filed = last;
+                merged[key].roles.add(role);
+              }
+            };
+            consume(byC1, "applicant");
+            consume(byC2, "contractor");
+
+            // Build co-occurrence map from the permit pairs. For each
+            // contractor key, count how many permits they co-appeared
+            // on with each other party.
+            const coMap: Record<string, Record<string, number>> = {};
+            for (const r of (Array.isArray(coRows) ? coRows : []) as any[]) {
+              const a = String(r.contact_1_name || "").trim();
+              const b = String(r.contact_2_name || "").trim();
+              if (!a || !b) continue;
+              const ka = a.toUpperCase();
+              const kb = b.toUpperCase();
+              if (ka === kb) continue;
+              (coMap[ka] = coMap[ka] || {})[kb] = (coMap[ka][kb] || 0) + 1;
+              (coMap[kb] = coMap[kb] || {})[ka] = (coMap[kb][ka] || 0) + 1;
+            }
+
+            // Attach tickers per contractor — direct, parent, and any
+            // tickers attributable to top co-occurring partners ("works
+            // with TARGET CORPORATION → TGT shown as associated"). Resolves
+            // via the in-memory SEC tickers index + curated parent map,
+            // so the cost is per-name index-lookup, not a network call.
+            const { lookupTickerLite } = await import("./entity.js");
+            // Memoize per-name to skip duplicate lookups across the
+            // associated step.
+            const tickerCache: Record<string, any[]> = {};
+            const lookupCached = async (n: string) => {
+              const k = n.toUpperCase();
+              if (tickerCache[k]) return tickerCache[k];
+              tickerCache[k] = await lookupTickerLite(n);
+              return tickerCache[k];
+            };
+
+            const rowsBase = Object.values(merged)
+              .map((r) => ({ ...r, roles: Array.from(r.roles) }))
+              .sort((a, b) => b.total_cost - a.total_cost)
+              .slice(0, limit);
+
+            // Resolve tickers concurrently (in-memory ops, but Promise.all
+            // keeps the code uniform with future remote ticker sources).
+            const enriched = await Promise.all(rowsBase.map(async (r) => {
+              const direct = await lookupCached(r.name);
+              const partners = Object.entries(coMap[r.name.toUpperCase()] || {})
+                .sort((a, b) => b[1] - a[1])
+                .slice(0, 6);
+              const associated: any[] = [];
+              const seen = new Set(direct.map((t: any) => t.ticker));
+              for (const [partnerName, occurrences] of partners) {
+                const ts = await lookupCached(partnerName);
+                for (const t of ts) {
+                  if (seen.has(t.ticker)) continue;
+                  seen.add(t.ticker);
+                  associated.push({
+                    ticker: t.ticker,
+                    via: "associated",
+                    partner_name: partnerName,
+                    co_permits: occurrences,
+                    partner_via: t.via,
+                    matched_name: t.matched_name,
+                  });
+                  if (associated.length >= 5) break;
+                }
+                if (associated.length >= 5) break;
+              }
+              return { ...r, tickers: { direct, associated } };
+            }));
+
+            return ok({
+              count: enriched.length,
+              since: sinceDate,
+              min_cost: minCost,
+              search,
+              contractors: enriched,
+              duration_ms: Date.now() - start,
+            });
+          } catch (e: any) {
+            return err(`profiler_index: ${e.message}`, 500);
+          }
+        }
+
+        // Staffer roster — read by the UI dropdown so each coordinator
+        // can act under their own identity (per-staffer hot-swap index).
+        if (url.pathname === "/api/staffers" || url.pathname === "/staffers") {
+          return ok({
+            staffers: STAFFERS.map((s) => ({
+              id: s.id,
+              name: s.name,
+              display: s.display,
+              territory: s.territory,
+              greeting: s.greeting,
+            })),
+          });
+        }
+
         if (url.pathname === "/system/summary") {
           const [ds, indexes, workersCount, candsCount] = await Promise.all([
             api("GET", "/catalog/datasets").catch(() => [] as any),
@@ -966,6 +1225,86 @@ async function main() {
         // OSHA national, Chicago history, ticker chart, parent link,
         // federal contracts, debarment, unions, training. Click any
         // contractor name in a permit Entity Brief to land here.
+        // Headshot pool — synthetic StyleGAN faces from
+        // thispersondoesnotexist.com fetched offline by
+        // scripts/staffing/fetch_face_pool.py. Deterministic mapping:
+        // hash(worker key) → pool index → image bytes. Same key always
+        // gets the same face; different keys spread evenly.
+        //
+        // Optional gender hint: ?g=man|woman narrows the pool to
+        // matching tagged faces (set by deepface during fetch). Falls
+        // back to whole pool if no matches.
+        if (url.pathname.startsWith("/headshots/") && req.method === "GET") {
+          const key = decodeURIComponent(url.pathname.slice("/headshots/".length));
+          const wantGender = url.searchParams.get("g") || "";
+          if (!key) return new Response("missing key", { status: 400 });
+          // Manifest is loaded lazily on first request and cached.
+          // Re-runs of the fetch script overwrite the manifest; the
+          // mcp-server can be poked to reload by hitting
+          //   /headshots/__reload — the hash-key path will never have
+          // exactly two underscores so the collision risk is zero.
+          const HEADSHOT_DIR = "/home/profit/lakehouse/data/headshots";
+          if (key === "__reload" || !(globalThis as any)._faces) {
+            try {
+              const raw = await Bun.file(`${HEADSHOT_DIR}/manifest.jsonl`).text();
+              const lines = raw.trim().split("\n").filter(Boolean);
+              const all = lines.map((l) => JSON.parse(l));
+              (globalThis as any)._faces = {
+                all,
+                man: all.filter((r: any) => r.gender === "man"),
+                woman: all.filter((r: any) => r.gender === "woman"),
+                untagged: all.filter((r: any) => !r.gender || (r.gender !== "man" && r.gender !== "woman")),
+                loaded_at: Date.now(),
+              };
+              if (key === "__reload") {
+                return Response.json({
+                  reloaded: true,
+                  total: all.length,
+                  man: (globalThis as any)._faces.man.length,
+                  woman: (globalThis as any)._faces.woman.length,
+                  untagged: (globalThis as any)._faces.untagged.length,
+                });
+              }
+            } catch (e: any) {
+              return new Response(`face pool not available: ${e.message}. Run scripts/staffing/fetch_face_pool.py first.`, { status: 503 });
+            }
+          }
+          const F = (globalThis as any)._faces as { all: any[]; man: any[]; woman: any[]; untagged: any[] };
+          if (!F || !F.all.length) {
+            return new Response("face pool empty", { status: 503 });
+          }
+          // Pool selection: gender hint > full pool. If no gender match,
+          // fall back to the full pool so the worker still gets a face.
+          let pool = F.all;
+          if (wantGender === "man" && F.man.length) pool = F.man;
+          else if (wantGender === "woman" && F.woman.length) pool = F.woman;
+          // Hash key → pool index. djb2-ish, fits any string.
+          let h = 5381;
+          for (let i = 0; i < key.length; i++) h = ((h << 5) + h + key.charCodeAt(i)) | 0;
+          const idx = Math.abs(h) % pool.length;
+          const pick = pool[idx];
+          const file = Bun.file(`${HEADSHOT_DIR}/${pick.file}`);
+          if (!(await file.exists())) {
+            return new Response("face missing on disk", { status: 404 });
+          }
+          return new Response(file, {
+            headers: {
+              "Content-Type": "image/jpeg",
+              "Cache-Control": "public, max-age=86400, immutable",
+              "X-Face-Pool-Idx": String(pick.id),
+              "X-Face-Pool-Gender": pick.gender || "untagged",
+            },
+          });
+        }
+
+        // Profiler index — directory page of everyone who's filed a
+        // Chicago permit (clickable directory of contractors).
+        if (url.pathname === "/profiler" || url.pathname === "/contractors") {
+          return new Response(Bun.file(import.meta.dir + "/profiler.html"), {
+            headers: { "Content-Type": "text/html; charset=utf-8" },
+          });
+        }
+
         if (url.pathname === "/contractor") {
           return new Response(Bun.file(import.meta.dir + "/contractor.html"), {
             headers: { ...cors, "Content-Type": "text/html" },
@@ -1285,6 +1624,7 @@ async function main() {
         if (url.pathname === "/intelligence/permit_contracts" && req.method === "POST") {
           const start = Date.now();
           try {
+            const b: any = await req.json().catch(() => ({}));
             const permitUrl = "https://data.cityofchicago.org/resource/ydr8-5enu.json";
             // Recent + substantial permits only — skip tiny ones that
             // don't imply real staffing demand.
@@ -1292,10 +1632,27 @@ async function main() {
             // panel on each card can populate without a second fetch.
             // Contacts identify the applicant / contractor by name —
             // those are the keys we pass to OSHA/ILSOS enrichment.
+            // Caller-controlled limit: J reported the live panel was
+            // dropping older permits (Target) because $limit=6 only ever
+            // showed today's 6 newest. Default 24 so a few days of
+            // permits stay on the panel; allow up to 100 via body.
+            const reqLimit = Math.max(1, Math.min(100, Number((b as any)?.limit) || 24));
+            // Optional contractor-name filter — lets the panel scope to
+            // a specific contact_1 or contact_2 name (e.g. "Target
+            // Corporation") so the user can pin a contractor to the panel
+            // without it scrolling past.
+            const cFilter = String((b as any)?.contractor || "").trim().replace(/'/g, "''");
+            const wherePieces: string[] = [
+              "reported_cost>250000",
+              "issue_date>'2025-06-01'",
+            ];
+            if (cFilter) {
+              wherePieces.push(`(upper(contact_1_name)=upper('${cFilter}') OR upper(contact_2_name)=upper('${cFilter}'))`);
+            }
             const permits: any[] = await fetch(
-              `${permitUrl}?$select=id,permit_type,work_type,work_description,reported_cost,street_number,street_direction,street_name,community_area,issue_date,contact_1_name,contact_1_type,contact_2_name,contact_2_type&`
-              + `$where=reported_cost>250000 AND issue_date>'2025-06-01'`
-              + `&$order=issue_date DESC&$limit=6`
+              `${permitUrl}?$select=id,permit_type,work_type,work_description,reported_cost,street_number,street_direction,street_name,community_area,issue_date,contact_1_name,contact_1_type,contact_2_name,contact_2_type,latitude,longitude&`
+              + `$where=${encodeURIComponent(wherePieces.join(" AND "))}`
+              + `&$order=issue_date DESC&$limit=${reqLimit}`
             ).then(r => r.json()).catch(() => []);
 
             const typeToRole: Record<string, string> = {
@@ -1693,12 +2050,281 @@ async function main() {
               queries_run: queries, duration_ms: Date.now() - start });
           }
 
+          // Route 6: late-worker / no-show triage. Coordinator gets a text
+          // ("Marcus running late site 4422") and needs three things in
+          // one shot: the worker's record + attendance pattern, a draft
+          // SMS to the client, and a ranked list of immediately-available
+          // backfills filtered by the same role+geo. The system already
+          // has every input (workers_500k, call_log, playbook_memory).
+          // The route binds them.
+          // No /i — the name has to be capitalized (English convention)
+          // and the event verbs are matched lowercase. The /i flag was
+          // letting "Marcus running" parse as "Marcus Running" (a last
+          // name) and then the event regex wouldn't find "running late"
+          // because "running" was already consumed by the name group.
+          const triageMatch = q.match(/^([A-Z][a-z]+(?:\s+[A-Z]\.?\s*)?(?:\s+[A-Z][a-z]+)?)\s+(running\s+late|late|no\s*show|no-show|sick|out\s+today|called\s+out|called\s+in|can'?t\s+make\s+it|won'?t\s+make\s+it)/);
+          if (triageMatch) {
+            const name = triageMatch[1].trim();
+            const event = triageMatch[2].toLowerCase().replace(/\s+/g, " ");
+            queries.push(`SQL: locate ${name}'s worker record`);
+            const profileR = await api("POST", "/query/sql", { sql: `SELECT name, role, city, state, zip, ROUND(CAST(reliability AS DOUBLE),2) rel, ROUND(CAST(availability AS DOUBLE),2) avail, ROUND(CAST(responsiveness AS DOUBLE),2) resp, archetype, skills, certifications FROM workers_500k WHERE name LIKE '%${name.replace(/'/g, "''")}%' ORDER BY CAST(reliability AS DOUBLE) DESC LIMIT 1` });
+            if (profileR.rows?.length) {
+              const w = profileR.rows[0];
+              // Pull attendance pattern from call_log if available — count
+              // recent calls + count of unanswered/late patterns. If the
+              // table doesn't exist or has nothing, we surface that
+              // honestly rather than fabricate.
+              queries.push(`SQL: ${w.name}'s recent contact pattern`);
+              const callR = await api("POST", "/query/sql", { sql: `SELECT COUNT(*) calls FROM call_log WHERE candidate_id IN (SELECT candidate_id FROM workers_500k WHERE name = '${w.name.replace(/'/g, "''")}')` }).catch(() => null);
+              const callCount = callR?.rows?.[0]?.calls ?? null;
+
+              // Backfills: same role + same geo, available now, ordered
+              // by responsiveness (a coordinator covering a no-show
+              // wants the candidate who actually answers their phone).
+              queries.push(`Backfill: ${w.role} in ${w.city}, ${w.state}, available, sorted by responsiveness`);
+              const backfillR = await api("POST", "/query/sql", { sql: `SELECT name, role, city, state, zip, ROUND(CAST(reliability AS DOUBLE),2) rel, ROUND(CAST(availability AS DOUBLE),2) avail, ROUND(CAST(responsiveness AS DOUBLE),2) resp, archetype, skills FROM workers_500k WHERE role = '${w.role.replace(/'/g, "''")}' AND city = '${(w.city||"").replace(/'/g, "''")}' AND state = '${(w.state||"").replace(/'/g, "''")}' AND name != '${w.name.replace(/'/g, "''")}' AND CAST(availability AS DOUBLE) > 0.6 ORDER BY CAST(responsiveness AS DOUBLE) DESC, CAST(reliability AS DOUBLE) DESC LIMIT 5` });
+
+              // Draft SMS the coordinator can send to the client. This
+              // is template-generated, not LLM — the coordinator must
+              // be able to send it instantly without re-reading. Names
+              // and roles are interpolated; the COORDINATOR sends.
+              const eventLabel = event.includes("late") ? "running late" : event.includes("show") ? "a no-show" : event.includes("sick") || event.includes("out") ? "out today" : "unable to make their shift";
+              const backfills = backfillR.rows || [];
+              const topBackfill = backfills[0]?.name;
+              const draftSms = topBackfill
+                ? `Heads-up: ${w.name} (${w.role}) is ${eventLabel}. I'm dispatching ${topBackfill} from our local bench (${Math.round((backfills[0].rel||0)*100)}% reliability) to cover. Will confirm arrival within the hour.`
+                : `Heads-up: ${w.name} (${w.role}) is ${eventLabel}. I'm pulling our nearest available ${w.role} now and will confirm coverage shortly.`;
+
+              return ok({
+                type: "triage",
+                summary: `${w.name} — ${eventLabel}. ${backfills.length} local backfill${backfills.length === 1 ? "" : "s"} ready, draft SMS ready to send.`,
+                worker: { name: w.name, role: w.role, city: w.city, state: w.state, zip: w.zip, rel: w.rel, avail: w.avail, resp: w.resp, archetype: w.archetype, skills: w.skills, certifications: w.certifications, recent_calls: callCount },
+                event,
+                backfills,
+                draft_sms: draftSms,
+                queries_run: queries,
+                duration_ms: Date.now() - start,
+              });
+            }
+            return ok({ type: "triage_miss", summary: `Couldn't find a worker named "${name}" in the roster. Check the spelling or try last name only.`, queries_run: queries, duration_ms: Date.now() - start });
+          }
+
+          // Route 7: bare-name profile lookup. Coordinator types just a
+          // name (or "First Last") with no other intent — pull the
+          // profile, prior fills, and attendance pattern in one shot.
+          // Distinguished from smart_search by being SHORT (≤4 tokens),
+          // capitalized like a name, and not containing role/skill words.
+          const tokens = q.trim().split(/\s+/);
+          const looksLikeName = tokens.length >= 1 && tokens.length <= 4
+            && tokens.every((t) => /^[A-Z][a-z'-]+\.?$/.test(t) || /^[A-Z]\.$/.test(t))
+            && !/forklift|warehouse|electric|welder|assembl|maintain|production|operator|driver|tech|loader|packag|inventory|sanitation/i.test(q);
+          if (looksLikeName) {
+            // Names have middle initials in workers_500k ("Steven A. Allen"),
+            // so a single LIKE '%First Last%' won't match. Split on
+            // whitespace, AND each token — lets "Marcus Rivera" match
+            // "Marcus L. Rivera" without enumerating initials.
+            const nameLike = tokens
+              .map((t) => `name LIKE '%${t.replace(/'/g, "''").replace(/\./g, "")}%'`)
+              .join(" AND ");
+            queries.push(`SQL: lookup name="${q}" via per-token LIKE`);
+            const r = await api("POST", "/query/sql", { sql: `SELECT name, role, city, state, zip, ROUND(CAST(reliability AS DOUBLE),2) rel, ROUND(CAST(availability AS DOUBLE),2) avail, ROUND(CAST(responsiveness AS DOUBLE),2) resp, archetype, skills, certifications FROM workers_500k WHERE ${nameLike} ORDER BY CAST(reliability AS DOUBLE) DESC LIMIT 5` });
+            if (r.rows?.length) {
+              return ok({
+                type: "profile",
+                summary: r.rows.length === 1 ? `${r.rows[0].name} — ${r.rows[0].role}, ${r.rows[0].city}, ${r.rows[0].state}` : `${r.rows.length} workers match "${q}"`,
+                profiles: r.rows,
+                queries_run: queries,
+                duration_ms: Date.now() - start,
+              });
+            }
+            return ok({ type: "profile_miss", summary: `No workers named "${q}" in the roster.`, queries_run: queries, duration_ms: Date.now() - start });
+          }
+
+          // Route 8: temporal — "what came in last night", "new resumes
+          // today", "last 24 hours". Surfaces recent ingest events from
+          // the catalog (created_at on dataset objects) and ranks them
+          // against open job_orders for "likely role match." Schema-
+          // agnostic: any dataset that landed recently shows up.
+          const temporalMatch = lower.match(/\b(last\s+night|today|this\s+morning|past\s+(\d+)\s+(?:hours?|days?)|last\s+(\d+)\s+(?:hours?|days?)|recent|new\s+(?:resumes?|candidates?|workers?|hires?|today)|came\s+in|arrived|just\s+(?:got|came))/i);
+          if (temporalMatch) {
+            // Decide window in hours
+            let windowHours = 24;
+            const pastN = lower.match(/\b(?:past|last)\s+(\d+)\s+(hours?|days?)/);
+            if (pastN) {
+              windowHours = parseInt(pastN[1], 10) * (pastN[2].startsWith("d") ? 24 : 1);
+            } else if (/last\s+night|this\s+morning|today/i.test(lower)) {
+              windowHours = 24;
+            } else if (/recent/i.test(lower)) {
+              windowHours = 72;
+            }
+            queries.push(`Catalog: datasets with created_at within last ${windowHours}h`);
+            const ds = await api("GET", "/catalog/datasets") as any[];
+            const cutoff = Date.now() - windowHours * 3600 * 1000;
+            const recent = (Array.isArray(ds) ? ds : [])
+              .map((d: any) => ({
+                name: d.name,
+                row_count: d.row_count || 0,
+                bytes: (d.objects?.[0]?.size_bytes) || 0,
+                updated_at: d.updated_at,
+                ts: d.updated_at ? Date.parse(d.updated_at) : 0,
+              }))
+              .filter((d) => d.ts >= cutoff && d.row_count > 0)
+              .sort((a, b) => b.ts - a.ts);
+
+            // For each recent dataset, sample its first row's role-shape
+            // text so the coordinator sees what's in it without reading
+            // schemas. If it's a workers/resumes dataset, group by role.
+            const samples: any[] = [];
+            for (const d of recent.slice(0, 8)) {
+              const sample = await api("POST", "/query/sql", { sql: `SELECT * FROM "${d.name.replace(/"/g, '""')}" LIMIT 1` }).catch(() => null);
+              const cols = sample?.columns?.map((c: any) => c.name) || [];
+              const looksLikeWorkers = cols.includes("role") && (cols.includes("name") || cols.includes("candidate_id"));
+              let roleBreakdown: any[] = [];
+              if (looksLikeWorkers) {
+                const byRole = await api("POST", "/query/sql", { sql: `SELECT role, COUNT(*) cnt FROM "${d.name.replace(/"/g, '""')}" GROUP BY role ORDER BY cnt DESC LIMIT 5` }).catch(() => null);
+                roleBreakdown = byRole?.rows || [];
+              }
+              samples.push({
+                name: d.name,
+                row_count: d.row_count,
+                updated_at: d.updated_at,
+                hours_ago: Math.round((Date.now() - d.ts) / 3600000),
+                looks_like_workers: looksLikeWorkers,
+                role_breakdown: roleBreakdown,
+                preview: sample?.rows?.[0] || null,
+              });
+            }
+
+            return ok({
+              type: "ingest_log",
+              summary: recent.length
+                ? `${recent.length} dataset${recent.length === 1 ? "" : "s"} landed in the last ${windowHours}h. ${samples.filter((s) => s.looks_like_workers).reduce((sum, s) => sum + s.row_count, 0)} new worker rows across them.`
+                : `Nothing new in the catalog in the last ${windowHours}h. (Dataset timestamps are based on catalog updated_at; if data was loaded directly to disk without going through /ingest/file, it won't show here.)`,
+              window_hours: windowHours,
+              datasets: samples,
+              queries_run: queries,
+              duration_ms: Date.now() - start,
+            });
+          }
+
           // Default: smart search — extract role, location, availability from natural language
           {
             const filters: string[] = ["CAST(reliability AS DOUBLE) >= 0.5"];
             const understood: string[] = [];
 
-            // Extract role keywords
+            // Structured input from the search-form dropdowns. When set,
+            // these win over NL parsing — typing "forklift in IL" used to
+            // misparse the preposition "in" as state IN (Indiana). Trust
+            // explicit user selection over regex archaeology.
+            const explicitState = String(b.state || "").trim().toUpperCase();
+            const explicitRole = String(b.role || "").trim();
+
+            // (G) Per-staffer context. When the UI sends a staffer_id,
+            // playbook queries scope to that staffer's territory — their
+            // recent fills, their geo's recurring patterns. The corpus is
+            // the same for everyone; the relevance gradient is unique to
+            // each staffer because each pulls a different shape from it.
+            const staffer = lookupStaffer(String(b.staffer_id || "").trim());
+            // If the staffer has a territory and the user hasn't already
+            // pinned a state/city via dropdown or NL, default the search
+            // to their territory. They can override by typing a different
+            // city or selecting a different state.
+            if (staffer && !explicitState) {
+              filters.push(`state = '${staffer.territory.state}'`);
+              understood.push(`as ${staffer.name}: ${staffer.territory.state}`);
+            }
+
+            // (B) Headcount parser — coordinator says "8 production
+            // workers", "I need 12 forklift operators", "5 welders by
+            // Friday". Match a leading or embedded count followed by
+            // a worker-shape noun. Bound at 1..200 — anything outside is
+            // probably not a headcount (zip codes, dates, addresses).
+            let topK = 10;
+            // Allow zero-to-two role words between the number and the
+            // worker-noun: "8 workers" / "8 production workers" /
+            // "8 forklift operators" all match. The role word is
+            // optional so we don't lose the bare-number form.
+            const countMatch = q.match(/\b(\d{1,3})\s+(?:\w+\s+){0,2}(?:workers?|operators?|drivers?|techs?|technicians?|welders?|electricians?|assemblers?|handlers?|loaders?|packagers?|associates?|leads?|people|hires?|staff)\b/i);
+            if (countMatch) {
+              const n = parseInt(countMatch[1], 10);
+              if (n >= 1 && n <= 200) {
+                topK = n;
+                understood.push(`headcount: ${n}`);
+              }
+            }
+
+            // (A) Zip code → city/state lookup. A coordinator types a zip
+            // because that's what the contract says. The previous parser
+            // saw "60607" and treated it as a stray number; results came
+            // back from any state. Map known metro zip prefixes here so
+            // the geographic constraint actually fires.
+            //
+            // Each entry: zip-prefix → { city, state }. Prefix-match
+            // covers a metro without enumerating every zip — e.g. "606"
+            // catches Chicago zips 60600-60699.
+            const zipPrefixMap: Array<[string, { city: string, state: string }]> = [
+              // Chicago + near-suburb
+              ["606", { city: "Chicago", state: "IL" }],
+              ["607", { city: "Chicago", state: "IL" }],
+              ["608", { city: "Chicago", state: "IL" }],
+              // Indianapolis
+              ["462", { city: "Indianapolis", state: "IN" }],
+              ["461", { city: "Indianapolis", state: "IN" }],
+              // Fort Wayne
+              ["468", { city: "Fort Wayne", state: "IN" }],
+              // Columbus OH
+              ["432", { city: "Columbus", state: "OH" }],
+              ["431", { city: "Columbus", state: "OH" }],
+              // Cleveland
+              ["441", { city: "Cleveland", state: "OH" }],
+              // Cincinnati
+              ["452", { city: "Cincinnati", state: "OH" }],
+              ["451", { city: "Cincinnati", state: "OH" }],
+              // Dayton
+              ["454", { city: "Dayton", state: "OH" }],
+              // Milwaukee
+              ["532", { city: "Milwaukee", state: "WI" }],
+              ["531", { city: "Milwaukee", state: "WI" }],
+              // Madison
+              ["537", { city: "Madison", state: "WI" }],
+              // Detroit
+              ["482", { city: "Detroit", state: "MI" }],
+              ["481", { city: "Detroit", state: "MI" }],
+              // Grand Rapids
+              ["495", { city: "Grand Rapids", state: "MI" }],
+              ["493", { city: "Grand Rapids", state: "MI" }],
+              // Minneapolis / St. Paul
+              ["554", { city: "Minneapolis", state: "MN" }],
+              ["551", { city: "Minneapolis", state: "MN" }],
+              // Des Moines
+              ["503", { city: "Des Moines", state: "IA" }],
+              // Kansas City MO
+              ["641", { city: "Kansas City", state: "MO" }],
+              // St. Louis
+              ["631", { city: "St. Louis", state: "MO" }],
+              // Nashville
+              ["372", { city: "Nashville", state: "TN" }],
+              // Memphis
+              ["381", { city: "Memphis", state: "TN" }],
+              // Knoxville
+              ["379", { city: "Knoxville", state: "TN" }],
+              // Louisville
+              ["402", { city: "Louisville", state: "KY" }],
+              // Lexington
+              ["405", { city: "Lexington", state: "KY" }],
+            ];
+            const zipMatch = q.match(/\b(\d{5})\b/);
+            let zipCity: { city: string, state: string } | null = null;
+            if (zipMatch) {
+              const z = zipMatch[1];
+              const hit = zipPrefixMap.find(([prefix]) => z.startsWith(prefix));
+              if (hit) {
+                zipCity = hit[1];
+                understood.push(`zip ${z} → ${hit[1].city}, ${hit[1].state}`);
+              }
+            }
+
+            // Extract role keywords (skip if dropdown picked one)
             const roleKeywords: Record<string, string> = {
               "warehouse": "warehouse", "forklift": "forklift", "welder": "weld", "assembler": "assembl",
               "loader": "loader", "machine operator": "machine operator", "shipping": "shipping",
@@ -1707,37 +2333,64 @@ async function main() {
               "line lead": "line lead", "electrician": "electric", "packaging": "packaging",
               "tool and die": "tool", "logistics": "logistics", "safety": "safety", "cnc": "cnc",
             };
-            for (const [kw, sqlPart] of Object.entries(roleKeywords)) {
-              if (lower.includes(kw)) { filters.push(`LOWER(role) LIKE '%${sqlPart}%'`); understood.push(`role: ${kw}`); break; }
-            }
-
-            // Extract city
-            const cities = ["chicago","springfield","rockford","peoria","joliet","indianapolis","fort wayne",
-              "evansville","south bend","columbus","cleveland","cincinnati","dayton","akron","toledo",
-              "st. louis","st louis","kansas city","nashville","memphis","knoxville","louisville","lexington",
-              "milwaukee","madison","detroit","grand rapids","lansing","des moines","minneapolis","terre haute",
-              "bloomington","decatur","mattoon","galesburg","danville","champaign"];
-            for (const city of cities) {
-              if (lower.includes(city)) {
-                const sqlCity = city.split(' ').map(w => w[0].toUpperCase() + w.slice(1)).join(' ');
-                filters.push(`city = '${sqlCity}'`);
-                understood.push(`city: ${sqlCity}`);
-                break;
+            if (explicitRole) {
+              filters.push(`LOWER(role) LIKE '%${explicitRole.toLowerCase().replace(/'/g, "''")}%'`);
+              understood.push(`role: ${explicitRole}`);
+            } else {
+              for (const [kw, sqlPart] of Object.entries(roleKeywords)) {
+                if (lower.includes(kw)) { filters.push(`LOWER(role) LIKE '%${sqlPart}%'`); understood.push(`role: ${kw}`); break; }
               }
             }
 
-            // Extract state
+            // Extract city
+            // Zip code wins over city-name parsing — it's more specific
+            // and the coordinator typed a number, not a casual mention.
+            if (zipCity) {
+              filters.push(`city = '${zipCity.city}'`);
+              understood.push(`city: ${zipCity.city}`);
+            } else {
+              const cities = ["chicago","springfield","rockford","peoria","joliet","indianapolis","fort wayne",
+                "evansville","south bend","columbus","cleveland","cincinnati","dayton","akron","toledo",
+                "st. louis","st louis","kansas city","nashville","memphis","knoxville","louisville","lexington",
+                "milwaukee","madison","detroit","grand rapids","lansing","des moines","minneapolis","terre haute",
+                "bloomington","decatur","mattoon","galesburg","danville","champaign"];
+              for (const city of cities) {
+                if (lower.includes(city)) {
+                  const sqlCity = city.split(' ').map(w => w[0].toUpperCase() + w.slice(1)).join(' ');
+                  filters.push(`city = '${sqlCity}'`);
+                  understood.push(`city: ${sqlCity}`);
+                  break;
+                }
+              }
+            }
+
+            // Extract state — dropdown wins; otherwise NL parse, but
+            // require either an explicit "in/from <STATE>" preposition
+            // OR an UPPERCASE 2-letter code, never a bare lowercase
+            // 2-letter token. Old regex matched "in" (preposition) as
+            // state IN (Indiana) because the /i flag made the standalone
+            // pattern case-insensitive — "forklift in IL" always returned
+            // Indiana workers.
             const stateNames: Record<string, string> = {
               "illinois":"IL","indiana":"IN","ohio":"OH","missouri":"MO","tennessee":"TN",
               "kentucky":"KY","wisconsin":"WI","michigan":"MI","iowa":"IA","minnesota":"MN"
             };
-            const stateMatch = lower.match(/\b(IL|IN|OH|MO|TN|KY|WI|MI|IA|MN)\b/i);
-            if (stateMatch && !understood.some(u => u.startsWith('city'))) {
-              filters.push(`state = '${stateMatch[1].toUpperCase()}'`);
-              understood.push(`state: ${stateMatch[1].toUpperCase()}`);
+            if (explicitState) {
+              if (!understood.some(u => u.startsWith('city'))) {
+                filters.push(`state = '${explicitState.replace(/'/g, "''")}'`);
+                understood.push(`state: ${explicitState}`);
+              }
             } else {
-              for (const [name, abbr] of Object.entries(stateNames)) {
-                if (lower.includes(name)) { filters.push(`state = '${abbr}'`); understood.push(`state: ${abbr}`); break; }
+              const prepMatch = q.match(/\b(?:in|from)\s+(IL|IN|OH|MO|TN|KY|WI|MI|IA|MN)\b/i);
+              const upperMatch = q.match(/\b(IL|IN|OH|MO|TN|KY|WI|MI|IA|MN)\b/);  // no /i — must be uppercase
+              const stateMatch = prepMatch || upperMatch;
+              if (stateMatch && !understood.some(u => u.startsWith('city'))) {
+                filters.push(`state = '${stateMatch[1].toUpperCase()}'`);
+                understood.push(`state: ${stateMatch[1].toUpperCase()}`);
+              } else {
+                for (const [name, abbr] of Object.entries(stateNames)) {
+                  if (lower.includes(name)) { filters.push(`state = '${abbr}'`); understood.push(`state: ${abbr}`); break; }
+                }
               }
             }
 
@@ -1758,20 +2411,31 @@ async function main() {
             queries.push("SQL filter: " + filterStr);
             queries.push("Vector: semantic search for best skill match");
 
-            // Also run a direct SQL query to get exact counts and zip codes
+            // Also run a direct SQL query to get exact counts and zip codes.
+            // LIMIT honors the parsed headcount (capped at 25 to keep the
+            // grid renderable; the staffer can ask for more).
             const sqlFields = "name, role, city, state, zip, ROUND(CAST(reliability AS DOUBLE),2) rel, ROUND(CAST(availability AS DOUBLE),2) avail, skills, certifications, archetype";
-            const directSql = `SELECT ${sqlFields} FROM workers_500k WHERE ${filterStr} ORDER BY CAST(availability AS DOUBLE) DESC, CAST(reliability AS DOUBLE) DESC LIMIT 10`;
+            const sqlLimit = Math.min(Math.max(topK, 5), 25);
+            const directSql = `SELECT ${sqlFields} FROM workers_500k WHERE ${filterStr} ORDER BY CAST(availability AS DOUBLE) DESC, CAST(reliability AS DOUBLE) DESC LIMIT ${sqlLimit}`;
 
             // Derive role+geo for the pattern query so the meta-index
             // surface lines up with what the user actually asked for.
+            // (G) When a staffer is acting, default the geo to their
+            // primary territory — their playbook view is shaped by
+            // where they actually fill, not the global Chicago/IL prior.
             const roleForPatterns = understood.find(u => u.startsWith('role:'))?.split(': ')[1] || q;
-            const cityForPatterns = understood.find(u => u.startsWith('city:'))?.split(': ')[1] || 'Chicago';
-            const stateForPatterns = understood.find(u => u.startsWith('state:'))?.split(': ')[1] || 'IL';
+            const cityForPatterns = understood.find(u => u.startsWith('city:'))?.split(': ')[1]
+              || staffer?.territory.cities[0] || 'Chicago';
+            const stateForPatterns = understood.find(u => u.startsWith('state:'))?.split(': ')[1]
+              || staffer?.territory.state || 'IL';
 
             const [searchR, directR, patternR] = await Promise.all([
               api("POST", "/vectors/hybrid", {
                 question: q, index_name: "workers_500k_v1", sql_filter: filterStr,
-                filter_dataset: "ethereal_workers", id_column: "worker_id", top_k: 8, generate: false,
+                filter_dataset: "ethereal_workers", id_column: "worker_id",
+                // Honor the parsed headcount (capped at 25 to keep the
+                // vector rerank from re-scoring more rows than render).
+                top_k: Math.min(Math.max(topK, 5), 25), generate: false,
                 // k=200 to catch compounding — direct measurement shows
                 // boost reliably fires only when ~all memory is scanned
                 // due to the narrow 0.55-0.67 cosine band in the 768d
@@ -1797,6 +2461,7 @@ async function main() {
             return ok({
               type: "smart_search",
               summary: `Found ${searchR.sql_matches || 0} workers matching your criteria${understood.length ? ' (' + understood.join(', ') + ')' : ''}`,
+              staffer: staffer ? { id: staffer.id, name: staffer.name, display: staffer.display, territory: staffer.territory } : null,
               understood,
               sql_results: sqlWorkers,
               vector_results: vectorWorkers,

mcp-server/observer.ts

@@ -550,13 +550,19 @@ async function analyzeErrors() {
     `[${f.endpoint}] ${f.input_summary}: ${f.error}`
   ).join("\n");
 
-  // Ask local model to diagnose
+  // Ask local model to diagnose. Phase 44 migration (2026-04-27):
+  // /v1/chat instead of legacy /ai/generate so /v1/usage tracks the
+  // call + Langfuse traces it. Same upstream model (qwen2.5 local).
   try {
-    const resp = await fetch(`${LAKEHOUSE}/ai/generate`, {
+    const resp = await fetch(`${LAKEHOUSE}/v1/chat`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
-        prompt: `You are a system reliability observer. Analyze these recent failures and suggest fixes:
+        model: "qwen2.5",
+        provider: "ollama",
+        messages: [{
+          role: "user",
+          content: `You are a system reliability observer. Analyze these recent failures and suggest fixes:
 
 ${errorSummary}
 
@@ -566,14 +572,15 @@ For each error:
 3. Should this be added to the playbook as a "don't do this"?
 
 Be specific and actionable. Under 200 words.`,
-        model: "qwen2.5",
+        }],
         max_tokens: 400,
         temperature: 0.2,
       }),
     });
-    const analysis = await resp.json();
-    if (analysis.text) {
-      console.error(`[observer] Error analysis:\n${analysis.text}`);
+    const analysis = await resp.json() as any;
+    const analysisText = analysis?.choices?.[0]?.message?.content ?? "";
+    if (analysisText) {
+      console.error(`[observer] Error analysis:\n${analysisText}`);
       // Log the analysis as a playbook entry
       await fetch(`${GATEWAY}/log`, {
         method: "POST",
@@ -581,7 +588,7 @@ Be specific and actionable. Under 200 words.`,
         body: JSON.stringify({
           operation: `error_analysis: ${failures.length} failures`,
           approach: "LLM-analyzed error patterns",
-          result: analysis.text.slice(0, 500),
+          result: analysisText.slice(0, 500),
           context: errorSummary.slice(0, 500),
         }),
       });

mcp-server/profiler.html

@@ -0,0 +1,599 @@
+<!DOCTYPE html>
+<html><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Profiler Index · Staffing Co-Pilot</title>
+<link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css">
+<script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js"></script>
+<style>
+*{margin:0;padding:0;box-sizing:border-box}
+html,body{overflow-x:hidden}
+body{font-family:'Inter',-apple-system,system-ui,sans-serif;background:#090c10;color:#b0b8c4;font-size:14px;line-height:1.6}
+.bar{background:#0d1117;padding:0 24px;height:56px;border-bottom:1px solid #171d27;display:flex;justify-content:space-between;align-items:center}
+.bar h1{font-size:14px;font-weight:600;color:#e6edf3}
+.bar nav a{color:#545d68;text-decoration:none;font-size:12px;padding:6px 14px;border-radius:6px;margin-left:4px}
+.bar nav a:hover{color:#e6edf3;background:#161b22}
+.content{max-width:1200px;margin:0 auto;padding:24px 20px 40px}
+.controls{background:#0d1117;border:1px solid #171d27;border-radius:10px;padding:16px;margin-bottom:14px;display:flex;gap:10px;align-items:center;flex-wrap:wrap}
+.controls input,.controls select{padding:9px 12px;background:#161b22;border:1px solid #21262d;border-radius:6px;color:#e6edf3;font-size:13px;outline:none}
+.controls input:focus,.controls select:focus{border-color:#388bfd}
+.controls input.s{flex:1;min-width:240px}
+.controls .meta{font-size:11px;color:#8b949e;margin-left:auto}
+.summary{background:#0d1117;border:1px solid #171d27;border-radius:10px;padding:14px 16px;margin-bottom:14px;font-size:12px;color:#8b949e}
+.summary b{color:#e6edf3;font-weight:600}
+table{width:100%;border-collapse:collapse;background:#0d1117;border:1px solid #171d27;border-radius:10px;overflow:hidden}
+th{font-size:10px;color:#545d68;text-transform:uppercase;letter-spacing:1.2px;font-weight:600;text-align:left;padding:12px;background:#0a0d12;border-bottom:1px solid #171d27;cursor:pointer;user-select:none}
+th:hover{color:#e6edf3}
+th .arrow{font-size:9px;margin-left:4px;color:#388bfd}
+td{padding:11px 12px;border-bottom:1px solid #1f2631;font-size:13px}
+tr:last-child td{border-bottom:none}
+tr:hover td{background:#0a0d12}
+td.name a{color:#58a6ff;text-decoration:none;font-weight:600}
+td.name a:hover{text-decoration:underline}
+td.right{text-align:right;font-family:ui-monospace,monospace;font-variant-numeric:tabular-nums}
+td.role{font-size:10px;color:#8b949e}
+td.role .pill{display:inline-block;padding:2px 7px;border-radius:9px;font-size:9px;font-weight:600;background:#161b22;border:1px solid #21262d;color:#8b949e;margin-right:4px;text-transform:uppercase;letter-spacing:0.5px}
+.tickers{display:flex;gap:4px;flex-wrap:wrap;margin-top:3px}
+.ticker-pill{display:inline-block;padding:1px 7px;border-radius:5px;font-size:10px;font-weight:700;font-family:ui-monospace,SFMono-Regular,monospace;letter-spacing:0.3px;cursor:help}
+.ticker-pill.direct{background:#0d2818;border:1px solid #2ea04388;color:#3fb950}
+.ticker-pill.parent{background:#1a1410;border:1px solid #d2992288;color:#d29922}
+.ticker-pill.associated{background:#0d1830;border:1px solid #58a6ff66;color:#58a6ff}
+.ticker-pill.exact{background:#0d2818;border:1px solid #2ea043;color:#3fb950}
+
+/* Hero — the thesis panel that frames the data corpus's value. */
+.thesis{background:linear-gradient(135deg,#0d2818 0%,#0d1830 50%,#1a1410 100%);border:1px solid #2ea04344;border-radius:12px;padding:18px 22px;margin-bottom:14px;position:relative;overflow:hidden}
+.thesis::before{content:'';position:absolute;top:0;left:0;right:0;height:2px;background:linear-gradient(90deg,#3fb950 0%,#58a6ff 50%,#d29922 100%)}
+.thesis h2{font-size:18px;color:#e6edf3;font-weight:700;letter-spacing:-0.4px;margin-bottom:6px}
+.thesis .sub{font-size:12px;color:#8b949e;line-height:1.6;margin-bottom:14px;max-width:880px}
+.thesis .sub b{color:#3fb950;font-weight:600}
+.bai-row{display:flex;gap:24px;align-items:baseline;flex-wrap:wrap;margin-bottom:14px}
+.bai-block{display:flex;flex-direction:column;gap:2px}
+.bai-label{font-size:9px;color:#545d68;text-transform:uppercase;letter-spacing:1.4px;font-weight:700}
+.bai-value{font-size:26px;font-weight:700;color:#e6edf3;font-family:ui-monospace,monospace;letter-spacing:-0.5px;font-variant-numeric:tabular-nums}
+.bai-value.up{color:#3fb950}
+.bai-value.down{color:#f85149}
+.bai-sub{font-size:10px;color:#8b949e;margin-top:1px}
+.markets-strip{display:flex;gap:6px;flex-wrap:wrap;font-size:10px}
+.market-pill{padding:3px 9px;border-radius:9px;font-weight:600;border:1px solid;letter-spacing:0.4px}
+.market-pill.live{background:#0d2818;border-color:#3fb950;color:#3fb950}
+.market-pill.next{background:#0d1830;border-color:#58a6ff;color:#58a6ff}
+.market-pill.queue{background:#161b22;border-color:#21262d;color:#545d68}
+.market-pill.queue::before{content:'· '}
+
+/* Map panel below basket — populates when a ticker is selected. */
+.signal-map-wrap{display:none;background:#0d1117;border:1px solid #171d27;border-radius:10px;padding:14px;margin-bottom:14px}
+.signal-map-wrap.active{display:block}
+.signal-map-header{display:flex;justify-content:space-between;align-items:baseline;margin-bottom:10px}
+.signal-map-title{font-size:11px;color:#545d68;text-transform:uppercase;letter-spacing:1.2px;font-weight:600}
+.signal-map-title b{color:#58a6ff;font-family:ui-monospace,monospace}
+.signal-map-meta{font-size:11px;color:#8b949e}
+.signal-map{height:340px;border-radius:8px;border:1px solid #1f2631;overflow:hidden}
+.signal-map .leaflet-container{background:#0a0d12}
+
+/* Scrolling ticker basket — top strip showing every public issuer
+   the profiler index has surfaced, with live price + day-change. */
+.basket-wrap{background:#0a0d12;border:1px solid #171d27;border-radius:10px;margin-bottom:14px;overflow:hidden;position:relative}
+.basket-label{padding:10px 16px 4px;font-size:10px;color:#545d68;text-transform:uppercase;letter-spacing:1.3px;font-weight:600;display:flex;justify-content:space-between;align-items:baseline}
+.basket-label .meta{font-weight:400;color:#3d444d;font-size:10px;text-transform:none;letter-spacing:0}
+.basket-track{display:flex;gap:0;overflow-x:auto;scroll-behavior:smooth;padding:6px 8px 12px;scrollbar-width:thin;scrollbar-color:#21262d transparent}
+.basket-track::-webkit-scrollbar{height:6px}
+.basket-track::-webkit-scrollbar-thumb{background:#21262d;border-radius:3px}
+.basket-track::-webkit-scrollbar-thumb:hover{background:#388bfd}
+.bk-card{flex:0 0 auto;min-width:140px;background:#0d1117;border:1px solid #21262d;border-radius:8px;padding:10px 12px;margin:0 4px;cursor:pointer;transition:all 0.12s;position:relative}
+.bk-card:hover{border-color:#58a6ff;background:#0d1a30;transform:translateY(-1px)}
+.bk-card.selected{border-color:#58a6ff;background:#0d1a30;box-shadow:0 0 0 1px #58a6ff;}
+.bk-card .tk{font-family:ui-monospace,SFMono-Regular,monospace;font-size:13px;font-weight:700;color:#e6edf3;letter-spacing:0.3px}
+.bk-card .px{font-family:ui-monospace,SFMono-Regular,monospace;font-size:14px;font-weight:600;color:#e6edf3;margin-top:3px;font-variant-numeric:tabular-nums}
+.bk-card .ch{font-family:ui-monospace,monospace;font-size:11px;margin-top:1px;font-variant-numeric:tabular-nums}
+.bk-card .ch.up{color:#3fb950}
+.bk-card .ch.down{color:#f85149}
+.bk-card .ch.flat{color:#545d68}
+.bk-card .meta{font-size:9px;color:#545d68;margin-top:5px;text-transform:uppercase;letter-spacing:0.6px}
+.bk-card .kind-bar{position:absolute;left:0;top:0;bottom:0;width:3px;border-radius:8px 0 0 8px}
+.bk-card .kind-bar.exact,.bk-card .kind-bar.direct{background:#3fb950}
+.bk-card .kind-bar.parent{background:#d29922}
+.bk-card .kind-bar.associated{background:#58a6ff}
+.bk-card .kind-bar.mixed{background:linear-gradient(180deg,#3fb950 0%,#58a6ff 100%)}
+.bk-card.no-quote .px{color:#545d68}
+.basket-empty{padding:18px;font-size:11px;color:#545d68;font-style:italic;text-align:center}
+.basket-clear{margin-left:8px;font-size:10px;color:#58a6ff;cursor:pointer;border:none;background:none;text-decoration:underline}
+.cost-band-1{color:#3fb950}
+.cost-band-2{color:#d29922}
+.cost-band-3{color:#f85149}
+.loading{text-align:center;padding:60px;font-size:13px;color:#3d444d}
+.empty{text-align:center;padding:40px;font-size:12px;color:#545d68;font-style:italic}
+.foot{margin-top:14px;font-size:10px;color:#484f58;line-height:1.6}
+@media(max-width:640px){.bar{padding:0 14px}.content{padding:14px}th,td{padding:8px 6px;font-size:11px}}
+</style>
+</head><body>
+<div class="bar">
+  <h1>Staffing Co-Pilot · Profiler Index</h1>
+  <nav>
+    <a href="" id="back-dashboard">← Dashboard</a>
+    <a href="" id="back-console">Console</a>
+  </nav>
+</div>
+<div class="content">
+  <!-- Hero thesis — frames what this data corpus actually is. The
+       profiler index isn't just a contractor directory; it's a
+       construction-activity signal that surfaces public issuers months
+       before quarterly earnings does. Each metric here is computed
+       from the live data, not pre-baked. -->
+  <div class="thesis" id="thesis">
+    <h2>Chicago Construction Activity Signal Engine</h2>
+    <div class="sub">
+      Every contractor name in this corpus is also a forward indicator on the public equities they touch. Permits filed today predict construction starts ~45 days out, staffing windows ~2 weeks before that, and revenue recognition months later. The associated-ticker network surfaces this signal <b>before</b> it lands in any 10-Q.
+    </div>
+    <div class="bai-row">
+      <div class="bai-block">
+        <span class="bai-label">Building Activity Index — today</span>
+        <span class="bai-value" id="bai-value">—</span>
+        <span class="bai-sub" id="bai-sub">awaiting basket prices</span>
+      </div>
+      <div class="bai-block">
+        <span class="bai-label">Indexed build value</span>
+        <span class="bai-value" id="bav-value">—</span>
+        <span class="bai-sub" id="bav-sub">across surfaced issuers</span>
+      </div>
+      <div class="bai-block">
+        <span class="bai-label">Network depth</span>
+        <span class="bai-value" id="net-value">—</span>
+        <span class="bai-sub" id="net-sub">issuers · attributions</span>
+      </div>
+      <div class="bai-block" style="flex:1;min-width:240px">
+        <span class="bai-label">Market replication roadmap</span>
+        <div class="markets-strip" style="margin-top:4px">
+          <span class="market-pill live">Chicago — live</span>
+          <span class="market-pill next">NYC DOB — adapter ready</span>
+          <span class="market-pill queue">LA County · Houston BCD · Boston ISD · DC DCRA</span>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <div class="basket-wrap" id="basket-wrap" style="display:none">
+    <div class="basket-label">
+      <span><span id="bk-count">0</span> public issuers in this view <span class="meta" id="bk-meta"></span></span>
+      <button class="basket-clear" id="bk-clear" style="display:none" type="button">clear filter</button>
+    </div>
+    <div class="basket-track" id="basket"></div>
+  </div>
+
+  <!-- Per-ticker permit map — shows where the selected issuer's
+       attributed contractor activity is actually happening. Same
+       leaflet pattern as the contractor profile, scoped to one ticker. -->
+  <div class="signal-map-wrap" id="signal-map-wrap">
+    <div class="signal-map-header">
+      <span class="signal-map-title">Where <b id="signal-map-ticker">—</b> activity is happening</span>
+      <span class="signal-map-meta" id="signal-map-meta">—</span>
+    </div>
+    <div class="signal-map" id="signal-map"></div>
+  </div>
+
+  <div class="controls">
+    <input class="s" id="q" type="text" placeholder="Filter by contractor name (e.g., Target, Turner)" autocomplete="off">
+    <select id="since">
+      <option value="2025-06-01">Since June 2025</option>
+      <option value="2024-01-01">Since 2024</option>
+      <option value="2020-01-01">Since 2020 (deeper history)</option>
+    </select>
+    <select id="min-cost">
+      <option value="500000">$500K+</option>
+      <option value="250000" selected>$250K+</option>
+      <option value="100000">$100K+</option>
+      <option value="50000">$50K+</option>
+    </select>
+    <span class="meta" id="meta">Loading…</span>
+  </div>
+  <div class="summary" id="summary" style="display:none"></div>
+  <div id="result"><div class="loading">Loading the directory from Chicago Socrata…</div></div>
+  <div class="foot">Aggregations sourced live from data.cityofchicago.org (Building Permits dataset ydr8-5enu). Contractor names appear when listed as contact_1 or contact_2 on a permit. Click any name to open the full profile — heat map, project index, history, 12 awaiting public-data sources.</div>
+</div>
+<script>
+var P=location.pathname.indexOf('/lakehouse')>=0?'/lakehouse':'';
+document.getElementById('back-dashboard').href = P+'/';
+document.getElementById('back-console').href = P+'/console';
+
+var sortKey='total_cost', sortDir='desc';
+var lastRows=[];
+var tickerFilter=null; // selected ticker for filtering the table
+var lastQuotes={};     // ticker → quote (price, day_change_pct)
+var lastBasket=[];     // basket rows aggregated from lastRows
+var signalMap=null;    // leaflet map instance for the per-ticker view
+
+function clearChildren(el){ while(el.firstChild) el.removeChild(el.firstChild); }
+function fmt$(n){
+  if(n>=1e9) return '$'+(n/1e9).toFixed(2)+'B';
+  if(n>=1e6) return '$'+(n/1e6).toFixed(1)+'M';
+  if(n>=1e3) return '$'+(n/1e3).toFixed(0)+'K';
+  return '$'+Math.round(n||0).toLocaleString();
+}
+function costClass(n){
+  if(n>=1e7) return 'cost-band-3';
+  if(n>=1e6) return 'cost-band-2';
+  return 'cost-band-1';
+}
+
+function load(){
+  var search=document.getElementById('q').value.trim();
+  var since=document.getElementById('since').value;
+  var minCost=parseInt(document.getElementById('min-cost').value,10);
+  document.getElementById('meta').textContent='Loading…';
+  var host=document.getElementById('result'); clearChildren(host);
+  var loading=document.createElement('div'); loading.className='loading';
+  loading.textContent='Aggregating from Chicago Socrata…';
+  host.appendChild(loading);
+
+  fetch(P+'/intelligence/profiler_index',{
+    method:'POST',
+    headers:{'Content-Type':'application/json'},
+    body:JSON.stringify({since:since,min_cost:minCost,search:search,limit:200})
+  }).then(function(r){return r.json()}).then(function(d){
+    lastRows = d.contractors||[];
+    document.getElementById('meta').textContent=lastRows.length+' contractors · '+(d.duration_ms||0)+'ms';
+    // Build the ticker basket from the surfaced rows
+    buildBasket();
+    var totalCost = lastRows.reduce(function(s,r){return s+(r.total_cost||0)},0);
+    var totalPermits = lastRows.reduce(function(s,r){return s+(r.permits||0)},0);
+    var sumDiv=document.getElementById('summary');
+    sumDiv.style.display='block';
+    clearChildren(sumDiv);
+    var b1=document.createElement('b'); b1.textContent=lastRows.length.toLocaleString();
+    sumDiv.appendChild(b1);
+    sumDiv.appendChild(document.createTextNode(' contractors · '));
+    var b2=document.createElement('b'); b2.textContent=totalPermits.toLocaleString();
+    sumDiv.appendChild(b2);
+    sumDiv.appendChild(document.createTextNode(' total permits · '));
+    var b3=document.createElement('b'); b3.textContent=fmt$(totalCost);
+    sumDiv.appendChild(b3);
+    sumDiv.appendChild(document.createTextNode(' aggregate value · since '+(d.since||'?')+' · min permit cost '+fmt$(d.min_cost||0)));
+    render();
+  }).catch(function(e){
+    document.getElementById('meta').textContent='error';
+    var host=document.getElementById('result'); clearChildren(host);
+    var er=document.createElement('div'); er.className='empty'; er.style.color='#f85149';
+    er.textContent='Profiler index error: '+e.message;
+    host.appendChild(er);
+  });
+}
+
+// Aggregate every public ticker the profiler index surfaced, with a
+// kind hierarchy (exact > direct > parent > associated) and the count
+// of contractors each ticker is attributed to. Then fetch live quotes
+// in one batch and render the scrolling basket.
+function buildBasket(){
+  var byTicker = {};
+  lastRows.forEach(function(r){
+    var ts = (r.tickers && r.tickers.direct ? r.tickers.direct : []).concat(r.tickers && r.tickers.associated ? r.tickers.associated : []);
+    ts.forEach(function(t){
+      if(!t || !t.ticker) return;
+      if(!byTicker[t.ticker]) byTicker[t.ticker] = {ticker:t.ticker, kinds:new Set(), count:0, contractors:[], matched_name:t.matched_name||t.partner_name||null};
+      byTicker[t.ticker].kinds.add(t.via);
+      byTicker[t.ticker].count++;
+      if(byTicker[t.ticker].contractors.length < 5) byTicker[t.ticker].contractors.push(r.name);
+    });
+  });
+  var basketRows = Object.values(byTicker)
+    .map(function(b){
+      // Pick a single 'kind' for the bar color: direct/exact wins, then parent, then associated.
+      var k = b.kinds.has('exact')?'exact':b.kinds.has('direct')?'direct':b.kinds.has('parent')?'parent':b.kinds.has('associated')?'associated':'mixed';
+      if(b.kinds.size>1 && (b.kinds.has('exact')||b.kinds.has('direct')) && b.kinds.has('associated')) k='mixed';
+      return Object.assign({}, b, {kinds:Array.from(b.kinds), kind:k});
+    })
+    .sort(function(a,b){return b.count - a.count});
+  var wrap = document.getElementById('basket-wrap');
+  var track = document.getElementById('basket');
+  clearChildren(track);
+  if(!basketRows.length){
+    wrap.style.display='block';
+    var emp=document.createElement('div'); emp.className='basket-empty';
+    emp.textContent='No public issuers in this view. Try a wider filter or "since 2020" history.';
+    track.appendChild(emp);
+    document.getElementById('bk-count').textContent='0';
+    document.getElementById('bk-meta').textContent='';
+    return;
+  }
+  wrap.style.display='block';
+  document.getElementById('bk-count').textContent=basketRows.length;
+  document.getElementById('bk-meta').textContent='loading prices…';
+  // Render shells immediately, then fill in prices when the batch returns
+  basketRows.forEach(function(b){
+    var card=document.createElement('div'); card.className='bk-card no-quote';
+    card.dataset.ticker=b.ticker;
+    var bar=document.createElement('div'); bar.className='kind-bar '+b.kind; card.appendChild(bar);
+    var tk=document.createElement('div'); tk.className='tk'; tk.textContent=b.ticker; card.appendChild(tk);
+    var px=document.createElement('div'); px.className='px'; px.textContent='—'; card.appendChild(px);
+    var ch=document.createElement('div'); ch.className='ch flat'; ch.textContent=' '; card.appendChild(ch);
+    var meta=document.createElement('div'); meta.className='meta';
+    meta.textContent=b.count+' attribution'+(b.count===1?'':'s')+' · '+b.kinds.join('+');
+    card.appendChild(meta);
+    card.title=(b.matched_name||b.ticker)+'\n'+b.contractors.slice(0,5).join('\n')+(b.count>5?'\n…':'');
+    card.onclick=function(){
+      tickerFilter = (tickerFilter===b.ticker) ? null : b.ticker;
+      Array.prototype.forEach.call(track.children, function(c){
+        c.classList.toggle('selected', c.dataset && c.dataset.ticker===tickerFilter);
+      });
+      document.getElementById('bk-clear').style.display = tickerFilter ? 'inline' : 'none';
+      showSignalMap(tickerFilter);
+      render();
+    };
+    track.appendChild(card);
+  });
+  lastBasket = basketRows;
+  // Update the hero panel right away with what we know without prices
+  updateThesisMetrics();
+  // Batch-fetch quotes and update each card + thesis
+  fetch(P+'/intelligence/ticker_quotes',{
+    method:'POST',headers:{'Content-Type':'application/json'},
+    body:JSON.stringify({tickers:basketRows.map(function(b){return b.ticker})})
+  }).then(function(r){return r.json()}).then(function(qd){
+    var quotes=qd.quotes||{};
+    lastQuotes = quotes;
+    document.getElementById('bk-meta').textContent='quotes via Stooq · '+(qd.duration_ms||0)+'ms';
+    Array.prototype.forEach.call(track.children, function(card){
+      var t=card.dataset.ticker; var q=quotes[t];
+      if(!q || !q.price) return;
+      card.classList.remove('no-quote');
+      var px=card.querySelector('.px'); px.textContent='$'+q.price.toFixed(2);
+      var ch=card.querySelector('.ch');
+      if(q.day_change_pct==null){ ch.textContent='close '+(q.price_date||''); ch.className='ch flat'; }
+      else if(q.day_change_pct>=0){ ch.textContent='+'+q.day_change_pct.toFixed(2)+'%'; ch.className='ch up'; }
+      else { ch.textContent=q.day_change_pct.toFixed(2)+'%'; ch.className='ch down'; }
+    });
+    updateThesisMetrics();
+  }).catch(function(){
+    document.getElementById('bk-meta').textContent='quote fetch failed';
+  });
+}
+
+// Compute the Building Activity Index and update the hero panel.
+// BAI = attribution-weighted day-change % across surfaced issuers.
+// "Indexed build value" = total dollars of permits attributable to
+// any public issuer in this view (sum across attributing contractors).
+// "Network depth" = issuer count + total attributions.
+function updateThesisMetrics(){
+  if(!lastBasket.length){
+    document.getElementById('bai-value').textContent='—';
+    document.getElementById('bai-sub').textContent='awaiting basket data';
+    return;
+  }
+  // BAI: weighted average of day_change_pct, weight = attribution count.
+  var weightedSum=0, weightTotal=0, contributors=[];
+  lastBasket.forEach(function(b){
+    var q = lastQuotes[b.ticker];
+    if(q && q.day_change_pct!=null){
+      var w = b.count || 1;
+      weightedSum += q.day_change_pct * w;
+      weightTotal += w;
+      contributors.push({ticker:b.ticker, day:q.day_change_pct, weight:w});
+    }
+  });
+  var bai = weightTotal>0 ? (weightedSum/weightTotal) : null;
+  var baiEl = document.getElementById('bai-value');
+  var baiSub = document.getElementById('bai-sub');
+  if(bai==null){
+    baiEl.textContent='—'; baiSub.textContent='no quotes settled yet';
+    baiEl.className='bai-value';
+  } else {
+    var sign = bai>=0 ? '+' : '';
+    baiEl.textContent = sign + bai.toFixed(2) + '%';
+    baiEl.className = 'bai-value ' + (bai>=0?'up':'down');
+    contributors.sort(function(a,b){return Math.abs(b.day*b.weight) - Math.abs(a.day*a.weight)});
+    var top = contributors.slice(0,3).map(function(c){return c.ticker+' '+(c.day>=0?'+':'')+c.day.toFixed(1)+'%'}).join(' · ');
+    baiSub.textContent = contributors.length+' issuers contributing · top: '+top;
+  }
+  // Indexed build value
+  var totalCost = 0;
+  lastRows.forEach(function(r){
+    var ts=(r.tickers&&r.tickers.direct?r.tickers.direct:[]).concat(r.tickers&&r.tickers.associated?r.tickers.associated:[]);
+    if(ts.length>0) totalCost += (r.total_cost||0);
+  });
+  var bav = totalCost>=1e9 ? '$'+(totalCost/1e9).toFixed(2)+'B' : totalCost>=1e6 ? '$'+(totalCost/1e6).toFixed(0)+'M' : '$'+Math.round(totalCost/1e3)+'K';
+  document.getElementById('bav-value').textContent = bav;
+  document.getElementById('bav-sub').textContent = lastBasket.length+' issuers in scope';
+  // Network depth
+  var totalAttrib = lastBasket.reduce(function(s,b){return s + (b.count||0)},0);
+  document.getElementById('net-value').textContent = lastBasket.length + ' / ' + totalAttrib;
+  document.getElementById('net-sub').textContent = 'issuers / attribution edges';
+}
+
+// Per-ticker map: when a ticker is selected, plot the contractor
+// permit locations attributed to that ticker. Pulls lat/lng for each
+// attributed contractor from the contractor profile endpoint and
+// merges. Caches per-ticker so toggling is instant.
+var mapCache = {};
+function showSignalMap(ticker){
+  var wrap=document.getElementById('signal-map-wrap');
+  if(!ticker){ wrap.classList.remove('active'); if(signalMap){signalMap.remove(); signalMap=null;} return; }
+  wrap.classList.add('active');
+  document.getElementById('signal-map-ticker').textContent = ticker;
+  document.getElementById('signal-map-meta').textContent = 'loading permits…';
+  // Find the contractors attributed to this ticker
+  var attrib = lastRows.filter(function(r){
+    var ts=(r.tickers&&r.tickers.direct?r.tickers.direct:[]).concat(r.tickers&&r.tickers.associated?r.tickers.associated:[]);
+    return ts.some(function(t){return t.ticker===ticker});
+  });
+  if(!attrib.length){
+    document.getElementById('signal-map-meta').textContent='no attributed contractors';
+    return;
+  }
+  // Use the contractor_profile endpoint per attributed contractor (cap at 6)
+  // to pull their geocoded permits, then render. Cached per ticker.
+  if(mapCache[ticker]){
+    drawSignalMap(ticker, mapCache[ticker]);
+    return;
+  }
+  var names = attrib.slice(0,6).map(function(r){return r.name});
+  Promise.all(names.map(function(n){
+    return fetch(P+'/intelligence/contractor_profile',{
+      method:'POST',headers:{'Content-Type':'application/json'},
+      body:JSON.stringify({name:n})
+    }).then(function(r){return r.json()}).then(function(d){
+      var perms = (d.history && d.history.recent_permits) || [];
+      return perms.filter(function(p){return p.lat&&p.lng}).map(function(p){
+        return Object.assign({contractor:n}, p);
+      });
+    }).catch(function(){return []});
+  })).then(function(arrs){
+    var all = arrs.reduce(function(a,b){return a.concat(b)},[]);
+    mapCache[ticker] = all;
+    drawSignalMap(ticker, all);
+  });
+}
+function drawSignalMap(ticker, permits){
+  if(signalMap){ signalMap.remove(); signalMap=null; }
+  if(!permits.length){
+    document.getElementById('signal-map-meta').textContent='0 geocoded permits across attributed contractors';
+    return;
+  }
+  document.getElementById('signal-map-meta').textContent = permits.length + ' geocoded permits across ' + new Set(permits.map(function(p){return p.contractor})).size + ' contractors';
+  signalMap = L.map('signal-map',{zoomControl:true, attributionControl:false}).setView([41.88,-87.63], 11);
+  L.tileLayer('https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png',{maxZoom:19}).addTo(signalMap);
+  var bounds=[];
+  var maxCost = Math.max.apply(null, permits.map(function(p){return Number(p.cost)||1}));
+  permits.forEach(function(p){
+    var c=Number(p.cost)||0;
+    var radius = 4 + (c/maxCost)*14;
+    var color = c>=1000000?'#f85149':c>=100000?'#d29922':'#3fb950';
+    var marker = L.circleMarker([p.lat,p.lng],{radius:radius,color:color,weight:1,fillOpacity:0.55});
+    var pop=document.createElement('div');
+    pop.style.cssText='font-family:ui-monospace,monospace;font-size:11px;color:#0a0d12;min-width:200px';
+    var top=document.createElement('div'); top.style.cssText='font-weight:700;margin-bottom:3px;color:#1f6feb';
+    top.textContent=ticker+' attribution';
+    pop.appendChild(top);
+    var con=document.createElement('div'); con.textContent=p.contractor; con.style.fontWeight='600';
+    pop.appendChild(con);
+    var meta=document.createElement('div'); meta.style.color='#545d68';
+    meta.textContent='$'+c.toLocaleString()+' · '+(p.date||'?')+' · '+(p.work_type||'?');
+    pop.appendChild(meta);
+    var addr=document.createElement('div'); addr.style.color='#545d68';
+    addr.textContent=p.address||'?';
+    pop.appendChild(addr);
+    marker.bindPopup(pop);
+    marker.addTo(signalMap);
+    bounds.push([p.lat,p.lng]);
+  });
+  if(bounds.length>1) signalMap.fitBounds(bounds,{padding:[28,28]});
+}
+
+function render(){
+  var host=document.getElementById('result');
+  clearChildren(host);
+  // Apply ticker filter if set: keep only rows whose tickers include the selected one
+  var pool = tickerFilter ? lastRows.filter(function(r){
+    var ts=(r.tickers&&r.tickers.direct?r.tickers.direct:[]).concat(r.tickers&&r.tickers.associated?r.tickers.associated:[]);
+    return ts.some(function(t){return t.ticker===tickerFilter});
+  }) : lastRows;
+  if(!pool.length){
+    var emp=document.createElement('div'); emp.className='empty';
+    emp.textContent='No contractors match the current filter.';
+    host.appendChild(emp);
+    return;
+  }
+  var rows = pool.slice().sort(function(a,b){
+    var av=a[sortKey], bv=b[sortKey];
+    if(typeof av==='string'){ av=(av||'').toUpperCase(); bv=(bv||'').toUpperCase(); }
+    if(av<bv) return sortDir==='asc'?-1:1;
+    if(av>bv) return sortDir==='asc'?1:-1;
+    return 0;
+  });
+
+  var t=document.createElement('table');
+  var thead=document.createElement('thead'); var hr=document.createElement('tr');
+  var cols=[
+    {k:'name', label:'Contractor'},
+    {k:'permits', label:'Permits', right:true},
+    {k:'total_cost', label:'Total Value', right:true},
+    {k:'last_filed', label:'Last Filed', right:true},
+    {k:'roles', label:'Listed As'},
+  ];
+  cols.forEach(function(c){
+    var h=document.createElement('th');
+    h.textContent=c.label;
+    if(c.right) h.style.textAlign='right';
+    if(sortKey===c.k){
+      var ar=document.createElement('span'); ar.className='arrow';
+      ar.textContent = sortDir==='asc' ? '▲' : '▼';
+      h.appendChild(ar);
+    }
+    h.onclick=function(){
+      if(sortKey===c.k) sortDir = sortDir==='asc' ? 'desc' : 'asc';
+      else { sortKey=c.k; sortDir = (c.k==='name') ? 'asc' : 'desc'; }
+      render();
+    };
+    hr.appendChild(h);
+  });
+  thead.appendChild(hr); t.appendChild(thead);
+
+  var tb=document.createElement('tbody');
+  rows.forEach(function(r){
+    var tr=document.createElement('tr');
+    var ntd=document.createElement('td'); ntd.className='name';
+    var a=document.createElement('a');
+    a.href = P+'/contractor?name='+encodeURIComponent(r.name);
+    a.target='_blank'; a.rel='noopener';
+    a.textContent = r.name;
+    ntd.appendChild(a);
+    // Ticker association pills — direct (green) = the contractor is a
+    // public issuer; parent (amber) = subsidiary of a public parent;
+    // associated (blue) = co-appears on permits with a public entity.
+    // Shows the correlation indicator J described — when Bob's Electric
+    // works permits with Target, TGT renders here as associated.
+    var t = r.tickers || {direct:[], associated:[]};
+    var allTk = (t.direct||[]).concat(t.associated||[]);
+    if(allTk.length){
+      var trk = document.createElement('div'); trk.className='tickers';
+      allTk.forEach(function(x){
+        var p = document.createElement('span');
+        p.className = 'ticker-pill ' + (x.via||'direct');
+        p.textContent = x.ticker;
+        // Tooltip shows the full reason path
+        var hint = x.via === 'associated'
+          ? 'Associated via co-permits with '+x.partner_name+' ('+(x.co_permits||0)+' shared permits)' + (x.matched_name ? ' — '+x.matched_name : '')
+          : x.via === 'parent'
+            ? 'Subsidiary of '+(x.matched_name||x.ticker) + (x.exchange ? ' · '+x.exchange : '')
+            : 'Direct match: '+(x.matched_name||r.name);
+        p.title = hint;
+        trk.appendChild(p);
+      });
+      ntd.appendChild(trk);
+    }
+    tr.appendChild(ntd);
+    var ptd=document.createElement('td'); ptd.className='right';
+    ptd.textContent=(r.permits||0).toLocaleString();
+    tr.appendChild(ptd);
+    var ctd=document.createElement('td'); ctd.className='right '+costClass(r.total_cost||0);
+    ctd.textContent=fmt$(r.total_cost||0);
+    tr.appendChild(ctd);
+    var ltd=document.createElement('td'); ltd.className='right';
+    ltd.textContent=(r.last_filed||'').slice(0,10) || '—';
+    tr.appendChild(ltd);
+    var rtd=document.createElement('td'); rtd.className='role';
+    (r.roles||[]).forEach(function(role){
+      var pill=document.createElement('span'); pill.className='pill'; pill.textContent=role;
+      rtd.appendChild(pill);
+    });
+    tr.appendChild(rtd);
+    tb.appendChild(tr);
+  });
+  t.appendChild(tb);
+  host.appendChild(t);
+}
+
+var sDeb;
+document.getElementById('q').addEventListener('input',function(){
+  clearTimeout(sDeb);
+  sDeb=setTimeout(load,400);
+});
+document.getElementById('since').addEventListener('change',load);
+document.getElementById('min-cost').addEventListener('change',load);
+document.getElementById('bk-clear').addEventListener('click',function(){
+  tickerFilter=null;
+  document.getElementById('bk-clear').style.display='none';
+  Array.prototype.forEach.call(document.querySelectorAll('.bk-card.selected'), function(c){c.classList.remove('selected')});
+  showSignalMap(null);
+  render();
+});
+
+window.addEventListener('load',load);
+</script>
+</body></html>

mcp-server/proof.html

@@ -81,6 +81,7 @@ pre{background:#161b22;border:1px solid #171d27;border-radius:8px;padding:14px 1
   <nav>
     <a href=".">Dashboard</a>
     <a href="console">Walkthrough</a>
+    <a href="profiler">Profiler</a>
     <a href="proof" class="active">Architecture</a>
     <a href="spec">Spec</a>
     <a href="onboard">Onboard</a>
@@ -95,138 +96,137 @@ pre{background:#161b22;border:1px solid #171d27;border-radius:8px;padding:14px 1
 <div class="chapter">
   <div class="num">Chapter 1</div>
   <h2>Receipts, not promises</h2>
-  <div class="lede">Every test below ran live against the real gateway when you loaded this page. Sub-100ms SQL on multi-million-row Parquet, hybrid search with playbook boost applied. No fixtures. If a test fails, you'll see ✗.</div>
+  <div class="lede">Every test below ran live against the real gateway when you loaded this page. Sub-100ms SQL on multi-million-row Parquet, hybrid search with playbook boost applied, public-issuer attribution computed from this view. No fixtures. If a test fails, you'll see ✗.</div>
   <div id="ch1-tests"><div class="loading">Running tests…</div></div>
+  <div id="ch1-live" style="margin-top:14px"></div>
 </div>
 
 <div class="chapter">
   <div class="num">Chapter 2</div>
-  <h2>Architecture — 13 crates, one object store, one local AI runtime</h2>
-  <div class="lede">Request flows top to bottom. Every node is independently swappable. Every line is a real HTTP or gRPC hop that you can trace with <code>tcpdump</code>.</div>
+  <h2>Architecture — 15 crates, one object store, a 5-provider model fleet</h2>
+  <div class="lede">Gateway is a drop-in OpenAI-compatible middleware. Any consumer that speaks the OpenAI Chat Completions shape — agent SDKs, IDE plugins, custom apps — points at <code>localhost:3100/v1</code> and gets routing, audit, and the full memory substrate behind every call. The model side has 5 providers and 40+ frontier models reachable via one OpenCode key. The data side stays Rust-first.</div>
   <div class="card accent-b">
-    <pre>                            HTTP :3100  +  gRPC :3101
-                                    │
-                            ┌───────▼───────┐
-                            │   gateway     │   Rust · Axum · routing, CORS, auth, tools
-                            └───────┬───────┘
-           ┌────────────┬───────────┼───────────┬────────────┐
-           │            │           │           │            │
-      ┌────▼───┐   ┌────▼───┐  ┌────▼───┐  ┌────▼───┐   ┌────▼───┐
-      │catalog │   │ query  │  │ vector │  │ ingest │   │aibridge│
-      │   d    │   │   d    │  │   d    │  │   d    │   │        │
-      └────┬───┘   └────┬───┘  └────┬───┘  └────┬───┘   └────┬───┘
-           │            │           │           │            │
-           └────────────┴───────────┼───────────┴────────────┘
-                                    ▼
-                          ┌─────────────────┐
-                          │ object storage  │   Parquet files (local / S3)
-                          └─────────────────┘
-                                    ▲
-                                    │
-                            ┌───────┴────────┐
-                            │ Python sidecar │   FastAPI → Ollama
-                            │   (aibridge)   │   local models only
-                            └────────────────┘</pre>
+    <pre>     OpenAI SDK consumers          MCP clients         Browser UI (Bun :3700)
+              │                          │                          │
+              └──────────────────────────┼──────────────────────────┘
+                                         ▼
+                           ┌──────────────────────────────┐
+                           │   gateway   :3100  /v1/*     │  Rust · Axum
+                           │   OpenAI-compat drop-in      │  smart provider routing
+                           │   /v1/chat /v1/mode /iterate │  cost telemetry, Langfuse
+                           └──────────┬───────────────────┘
+            ┌─────────┬───────────────┼───────────────┬──────────┐
+            │         │               │               │          │
+       ┌────▼───┐ ┌───▼────┐    ┌─────▼──────┐  ┌─────▼─────┐ ┌──▼──────┐
+       │catalog │ │ query  │    │   vector   │  │  ingest   │ │aibridge │
+       │   d    │ │   d    │    │     d      │  │     d     │ │         │
+       │idempot │ │DataFus │    │HNSW · Lance│  │CSV PDF SQL│ │provider │
+       │schema  │ │delta   │    │playbook+   │  │auto-PII   │ │adapters │
+       │fingerp │ │MemTabl │    │pathway mem │  │schema fp  │ │5 active │
+       └────┬───┘ └───┬────┘    └─────┬──────┘  └─────┬─────┘ └──┬──────┘
+            └─────────┴────────────────┼────────────────┴─────────┘
+                                       ▼
+                            ┌──────────────────┐
+                            │ object storage   │  Parquet · MinIO · S3-compat
+                            └──────────────────┘
+                                       ▲
+                                       │
+                       ┌───────────────┴────────────────┐
+                       │  validator   ·   journald      │  schema/PII/policy gates
+                       │  (Phase 43)  ·   (audit log)   │  + append-only mutations
+                       └────────────────────────────────┘
+
+Provider fleet (config/providers.toml):
+  ollama         localhost:3200          local Ollama → qwen3.5, gemma2
+  ollama_cloud   ollama.com              gpt-oss:120b, qwen3-coder:480b,
+                                         deepseek-v3.1:671b, kimi-k2:1t,
+                                         mistral-large-3:675b, qwen3.5:397b
+  openrouter     openrouter.ai/api/v1    343 models — paid + free rescue
+  opencode       opencode.ai/zen/v1      40 models · ONE sk-* key reaches
+                                         Claude Opus 4.7, GPT-5.5-pro,
+                                         Gemini 3.1-pro, Kimi K2.6, GLM 5.1,
+                                         DeepSeek, Qwen, MiniMax, free tier
+  kimi           api.kimi.com/coding/v1  direct Kimi For Coding (TOS-clean)</pre>
   </div>
-  <h3>Per-crate responsibility</h3>
+  <h3>Per-crate responsibility (15 crates)</h3>
   <table class="plain">
     <thead><tr><th>Crate</th><th>Role</th><th>Path</th></tr></thead>
     <tbody>
-      <tr><td>shared</td><td>Types, errors, Arrow helpers, PII detection, secrets provider</td><td>crates/shared/</td></tr>
-      <tr><td>storaged</td><td>object_store I/O, BucketRegistry (multi-bucket), AppendLog, ErrorJournal</td><td>crates/storaged/</td></tr>
-      <tr><td>catalogd</td><td>Metadata authority — manifests, views, tombstones, profiles, schema fingerprints</td><td>crates/catalogd/</td></tr>
-      <tr><td>queryd</td><td>DataFusion SQL engine, MemTable cache, delta merge-on-read, compaction</td><td>crates/queryd/</td></tr>
-      <tr><td>ingestd</td><td>CSV/JSON/PDF(+OCR)/Postgres/MySQL ingest, cron schedules, auto-PII</td><td>crates/ingestd/</td></tr>
-      <tr><td>vectord</td><td>Embeddings as Parquet, HNSW, trial system, autotune agent, playbook_memory</td><td>crates/vectord/</td></tr>
+      <tr><td>shared</td><td>Types, errors, Arrow helpers, PII detection, secrets provider, model_matrix</td><td>crates/shared/</td></tr>
+      <tr><td>storaged</td><td>object_store I/O, BucketRegistry, AppendLog, ErrorJournal, federation_service</td><td>crates/storaged/</td></tr>
+      <tr><td>catalogd</td><td>Manifests, views (incl. PII-safe view layer), tombstones, profiles, schema fingerprints, register-idempotency (ADR-020)</td><td>crates/catalogd/</td></tr>
+      <tr><td>queryd</td><td>DataFusion SQL, MemTable cache, delta merge-on-read, compaction, truth gate (ADR-021)</td><td>crates/queryd/</td></tr>
+      <tr><td>ingestd</td><td>CSV/JSON/PDF(+OCR)/Postgres/MySQL ingest, cron schedules, auto-PII flagging</td><td>crates/ingestd/</td></tr>
+      <tr><td>vectord</td><td>Embeddings as Parquet, HNSW, trial system, autotune, playbook_memory + pathway_memory (ADR-021 semantic-correctness layer)</td><td>crates/vectord/</td></tr>
       <tr><td>vectord-lance</td><td>Firewall crate — Lance 4.0 + Arrow 57 isolated from main Arrow 55</td><td>crates/vectord-lance/</td></tr>
-      <tr><td>journald</td><td>Append-only mutation event log for time-travel &amp; audit</td><td>crates/journald/</td></tr>
-      <tr><td>aibridge</td><td>Rust↔Python sidecar, Ollama HTTP client, VRAM introspection</td><td>crates/aibridge/</td></tr>
-      <tr><td>gateway</td><td>Axum HTTP :3100 + gRPC :3101, middleware, tools registry</td><td>crates/gateway/</td></tr>
-      <tr><td>ui</td><td>Dioxus WASM internal developer UI</td><td>crates/ui/</td></tr>
-      <tr><td>mcp-server</td><td>Bun TypeScript recruiter-facing app (this server)</td><td>mcp-server/</td></tr>
+      <tr><td>journald</td><td>Append-only mutation event log for time-travel + audit</td><td>crates/journald/</td></tr>
+      <tr><td>truth</td><td>File-backed rule store; <code>evaluate(task_class, ctx) → Vec&lt;RuleOutcome&gt;</code> (ADR-021)</td><td>crates/truth/</td></tr>
+      <tr><td>aibridge</td><td>Rust↔Python sidecar, Ollama client, ProviderAdapter trait, /v1/chat router</td><td>crates/aibridge/</td></tr>
+      <tr><td>gateway</td><td>Axum HTTP :3100 + gRPC :3101, OpenAI-compat /v1/*, mode runner, validator, iterate loop, cost telemetry, Langfuse + observer fan-out</td><td>crates/gateway/</td></tr>
+      <tr><td>validator</td><td>Phase 43 — schema / completeness / consistency / policy gates over LLM outputs (FillValidator, EmailValidator, ParquetWorkerLookup)</td><td>crates/validator/</td></tr>
+      <tr><td>ui</td><td>Dioxus WASM internal developer UI (separate from this Bun-served public UI)</td><td>crates/ui/</td></tr>
+      <tr><td>mcp-server</td><td>Bun TypeScript public-facing app + MCP tool surface — what you're reading right now</td><td>mcp-server/</td></tr>
+      <tr><td>auditor</td><td>External claim-vs-diff verifier on PRs · Kimi K2.6 ↔ Haiku 4.5 cross-lineage alternation, Opus 4.7 auto-promote on diffs &gt;100k chars</td><td>auditor/</td></tr>
     </tbody>
   </table>
-  <div class="ref"><strong>Source:</strong> git.agentview.dev/profit/lakehouse &nbsp;·&nbsp; <strong>ADRs:</strong> docs/DECISIONS.md (currently 20 records)</div>
+  <div class="ref"><strong>Source:</strong> git.agentview.dev/profit/lakehouse · branch <code>scrum/auto-apply-19814</code> · tag <code>distillation-v1.0.0</code> at commit <code>e7636f2</code> (frozen substrate) · <strong>ADRs:</strong> docs/DECISIONS.md (currently 21 records)</div>
 </div>
 
 <div class="chapter">
   <div class="num">Chapter 3</div>
-  <h2>Dual-agent recursive consensus loop</h2>
-  <div class="lede">The system we use to execute staffing fills is a dual-agent recursive protocol. Two agents with distinct roles iterate against a shared log until one of three terminal states is reached. It is deterministic in structure, stochastic in content, and verifiable through the per-run log artifact.</div>
-  <h3>Agents and protocol</h3>
-  <div class="card accent-a">
-    <pre>  task in
-    │
-    ▼
-  ┌───────────────────────────────────────────────────────────┐
-  │  EXECUTOR (mistral:latest)                                │
-  │  ──────────────────────────────────────────────────────── │
-  │  input:   task spec + shared log + seen-candidates ledger │
-  │  output:  one JSON action per turn                        │
-  │             · {kind:"plan",steps:[…]}                     │
-  │             · {kind:"tool_call",tool,args,rationale}      │
-  │             · {kind:"propose_done",fills:[N of N]}        │
-  └───────────┬───────────────────────────────┬───────────────┘
-              │ tool_call                     │ propose_done
-              ▼                               │
-  ┌──────────────────────────┐                │
-  │  TOOL DISPATCH           │                │
-  │  hybrid_search / sql     │                │
-  │  (against live gateway)  │                │
-  └──────────┬───────────────┘                │
-             │ result (trimmed, exclusions)   │
-             ▼                                ▼
-  ┌───────────────────────────────────────────────────────────┐
-  │  REVIEWER (qwen2.5:latest)                                │
-  │  ──────────────────────────────────────────────────────── │
-  │  input:   task spec + shared log (including tool result)  │
-  │  output:  {kind:"critique",verdict:"continue|drift|       │
-  │                                    approve_done",notes}   │
-  └───────────┬───────────────────────────────────────────────┘
-              │
-        ┌─────┴─────┐
-        ▼           ▼           ▼
-    continue     drift       approve_done + propose_done ⟹ SEAL
-    (next turn)  (cap ≈ 3 →
-                  hard abort)
-    </pre>
-  </div>
-  <div class="ref"><strong>Code:</strong> tests/multi-agent/agent.ts (protocol + prompts) &nbsp;·&nbsp; tests/multi-agent/orchestrator.ts (run loop) &nbsp;·&nbsp; tests/multi-agent/scenario.ts (5-event warehouse week)</div>
+  <h2>The model fleet — 9-rung ladder, N=3 consensus, cross-lineage audit</h2>
+  <div class="lede">No single model owns the answer. Every consequential call is structured: the right tier picks up first, fallback rungs catch what fails, parallel runs vote, and an independent auditor of a different model lineage checks the result against the diff. The protocol is deterministic; the inference is stochastic; every step writes a receipt.</div>
 
-  <h3>Why "dual" — role specialization</h3>
-  <div class="narr">
-    <strong>The executor is an optimist.</strong> Its job is to produce progress: pull candidates, verify SQL, propose consensus. It's instructed to be decisive.
-    <br><br>
-    <strong>The reviewer is a pessimist.</strong> Its job is to catch drift: proposals that don't match the task's geography, fill count, or role. It's authorized to stop the loop.
-    <br><br>
-    This adversarial separation is cheaper and more deterministic than asking a single model to self-critique. The reviewer has a hard rule: on the turn after a <code>propose_done</code>, it MUST emit either <code>approve_done</code> or <code>drift</code> — it cannot stall with <code>continue</code>.
+  <h3>The 9-rung cloud-first ladder</h3>
+  <div class="card accent-b">
+    <pre>  request in
+      │
+      ▼
+  ┌───────────────────────────────────────────────────────────────────┐
+  │  attempt 1  ollama_cloud / kimi-k2:1t           1T params · flagship │
+  │  attempt 2  ollama_cloud / qwen3-coder:480b     coding specialist    │
+  │  attempt 3  ollama_cloud / deepseek-v3.1:671b   reasoning            │
+  │  attempt 4  ollama_cloud / mistral-large-3:675b deep analysis        │
+  │  attempt 5  ollama_cloud / gpt-oss:120b         reliable workhorse   │
+  │  attempt 6  ollama_cloud / qwen3.5:397b         dense final thinker  │
+  │  attempt 7  openrouter   / openai/gpt-oss-120b:free  rescue tier     │
+  │  attempt 8  openrouter   / google/gemma-3-27b-it:free fastest rescue │
+  │  attempt 9  ollama       / qwen3.5:latest       last-resort local    │
+  └───────────────┬───────────────────────────────────────────────────┘
+                  │  isAcceptable() = chars ≥ 3800 ∧ not malformed JSON
+                  ▼
+            sealed result OR next-rung learning preamble</pre>
   </div>
+  <div class="narr">Every rung sees a learning preamble carrying the prior rejection reason. The ladder is the standard scrum/auditor path; for individual <code>/v1/chat</code> calls the caller picks the model directly (or lets the smart-routing default fire).</div>
+  <div class="ref"><strong>Code:</strong> tests/real-world/scrum_master_pipeline.ts <code>const LADDER</code> · config/routing.toml · crates/gateway/src/v1/mode.rs (mode runner)</div>
 
-  <h3>Why "parallel" — orchestrator can fan out</h3>
-  <div class="narr">
-    <strong>Independent pairs run concurrently.</strong> <code>tests/multi-agent/run_e2e_rated.ts</code> runs two task-specific agent pairs via <code>Promise.all</code>. Ollama serializes inference at the model level, so "parallel" is concurrent orchestration — but the substrate (gateway, queryd, vectord) handles concurrent requests cleanly. Verified in the scenario harness: two contracts sealing simultaneously.
-  </div>
-
-  <h3>Why "recursive" — each seal feeds the next</h3>
-  <div class="narr">
-    <strong>Consensus does not end at the sealed playbook.</strong> Every sealed playbook is persisted to <code>playbook_memory</code> via <code>POST /vectors/playbook_memory/seed</code>. The next hybrid search for a semantically similar operation consults that memory via <code>compute_boost_for(query_embedding, top_k, base_weight)</code> and re-ranks the candidate pool. The system builds on itself turn over turn, playbook over playbook.
-  </div>
-
-  <h3>Termination guarantees</h3>
+  <h3>N=3 consensus + tie-breaker (auditor inference)</h3>
   <div class="math">
-    <span class="c">// three paths out, every run has one of these:</span><br>
-    sealed = executor.propose_done ∧ reviewer.approve_done ∧ fills.count == target<br>
-    abort  = consecutive_tool_errors ≥ MAX_TOOL_ERRORS (3) &nbsp;&nbsp;<span class="c">// executor can't form a valid call</span><br>
-    abort  = consecutive_drifts ≥ MAX_CONSECUTIVE_DRIFTS (3) &nbsp;<span class="c">// reviewer keeps flagging</span><br>
-    abort  = turn &gt; MAX_TURNS (12) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="c">// no consensus reached in window</span>
+    <span class="c">// auditor/checks/inference.ts — every claim audit runs this:</span><br>
+    1. Fire the primary reviewer N=3 times in PARALLEL (Promise.all) — wall-clock = single call<br>
+    2. Aggregate votes per claim_idx · majority wins<br>
+    3. On 1-1-1 split → tie-breaker model with <strong>different architecture</strong> (qwen3-coder:480b vs primary gpt-oss/kimi)<br>
+    4. Every disagreement (even when majority resolves) → <code>data/_kb/audit_discrepancies.jsonl</code><br>
+    <br>
+    <span class="c">// Closes the cloud-non-determinism gap: temp=0 isn't actually deterministic in practice</span><br>
+    <span class="c">// across hours; consensus + cross-architecture tie-break stabilizes verdicts.</span>
   </div>
-  <div class="narr">Every abort dumps the full log to <code>tests/multi-agent/playbooks/&lt;id&gt;-FAILED.json</code> for forensic review. No consensus is ever implicit.</div>
+
+  <h3>Auditor cross-lineage — Kimi ↔ Haiku ↔ Opus</h3>
+  <div class="narr">Every push to PR #11 triggers <code>auditor/audit.ts</code> within ~90s. To prevent a single model lineage's blind spots from becoming the system's blind spots, audits alternate between Kimi K2.6 (Moonshot) and Haiku 4.5 (Anthropic) by SHA. Diffs over 100k chars auto-promote to Claude Opus 4.7. Per-PR cap of 3 audits with auto-reset on each new head SHA prevents infinite-loop spend. <strong>100% grounding-verified rate</strong> on Haiku 4.5 across the latest 10 findings — pairing different lineages + forcing per-finding grounding kills confabulation.</div>
+  <div class="ref"><strong>Code:</strong> auditor/audit.ts · auditor/checks/inference.ts (N=3) · auditor/checks/kimi_architect.ts · <strong>Verdicts:</strong> data/_auditor/kimi_verdicts/ — read any 11-&lt;sha&gt;.json to inspect a real audit</div>
+
+  <h3>Distillation v1.0.0 — the frozen substrate</h3>
+  <div class="narr">The substrate the auditor and mode runner sit on is tagged at <code>distillation-v1.0.0</code> / commit <code>e7636f2</code>. <strong>145 unit tests pass · 22/22 acceptance invariants · 16/16 audit-full checks · bit-identical reproducibility verified.</strong> The distillation phase exports clean SFT / RAG / preference samples with a multi-layer contamination firewall; the auditor consumes the substrate. The frozen tag means: any future "the system regressed" question has a baseline to bisect against, byte-for-byte.</div>
+  <div class="ref"><strong>Tag:</strong> distillation-v1.0.0 · <strong>Commit:</strong> e7636f2 · <strong>Substrate code:</strong> scripts/distillation/ · auditor/schemas/distillation/ · <strong>Output:</strong> data/_kb/distilled_{facts,procedures,config_hints}.jsonl</div>
 </div>
 
 <div class="chapter">
   <div class="num">Chapter 4</div>
-  <h2>Playbook memory — the compounding feedback loop</h2>
-  <div class="lede">A CRM stores events. This system turns events into re-ranking signal. Every sealed playbook endorses specific (worker, city, state) tuples. Every failure penalizes them. Every similar future query inherits the signal through cosine similarity.</div>
+  <h2>Two memory layers — playbook (worker signal) + pathway (system signal)</h2>
+  <div class="lede">A CRM stores events. This system turns events into re-ranking signal at two layers. <strong>Playbook memory</strong> compounds worker-level outcomes (who got endorsed, where, when) into per-query boost. <strong>Pathway memory</strong> compounds system-level outcomes (which model + corpus + framing actually solved similar problems) into per-task hot-swap. Both are queryable. Both are auditable. Both compound.</div>
+
+  <h3>Layer 1 — playbook memory (worker + geo signal)</h3>
 
   <h3>Seed shape</h3>
   <div class="math">
@@ -289,10 +289,82 @@ pre{background:#161b22;border:1px solid #171d27;border-radius:8px;padding:14px 1
     <strong>Beyond "who was endorsed."</strong> <code>POST /vectors/playbook_memory/patterns</code> takes a query, finds top-K similar past playbooks, pulls each endorsed worker's full workers_500k profile, and aggregates shared traits: recurring certifications, skill frequencies, modal archetype, reliability distribution. Returns a <code>discovered_pattern</code> string showing operator-actionable signal the user didn't explicitly query for.
   </div>
   <div class="ref"><strong>Code:</strong> crates/vectord/src/playbook_memory.rs::discover_patterns &nbsp;·&nbsp; <strong>Surfaces:</strong> /vectors/playbook_memory/patterns endpoint, /intelligence/chat response, /intelligence/permit_contracts cards</div>
+
+  <h3>Layer 2 — pathway memory (system-level hot-swap, ADR-021)</h3>
+  <div class="narr">
+    <strong>Pathway memory remembers which approach worked, not just which worker.</strong> Every accepted scrum review writes a <code>PathwayTrace</code> with the full backtrack: file fingerprint, model used, signal class, KB chunks consulted, observer events, semantic flags, bug fingerprints. A new query that fingerprints to the same trace can hot-swap to the prior result without re-running the 9-rung escalation. The 5-factor hot-swap gate is strict: narrow fingerprint match AND audit consensus pass AND replay_count ≥ 3 (probation) AND success_rate ≥ 0.80 AND NOT retired AND vector cosine ≥ 0.90.
+  </div>
+  <div class="math">
+    <span class="c">// Live pathway state (refresh page to recompute):</span><br>
+    <span id="pwm-traces">— traces</span> · <span id="pwm-replays">—</span> successful replays · <span id="pwm-rate">—</span> reuse rate<br>
+    <span class="c">// 88 / 11/11 / 100% as of 2026-04-27 — probation gate crossed</span>
+  </div>
+  <div class="ref"><strong>Code:</strong> crates/vectord/src/pathway_memory.rs · <strong>Endpoints:</strong> /vectors/pathway/insert · /query · /record_replay · /stats · /bug_fingerprints · <strong>Spec:</strong> docs/DECISIONS.md ADR-021 — Semantic-correctness matrix layer</div>
+
+  <h3>What both memory layers feed (besides search)</h3>
+  <div class="narr">
+    Both layers also feed the <strong>per-staffer hot-swap index</strong> (Chapter 5) and the <strong>Construction Activity Signal Engine</strong> (Chapter 6). One memory model, surfaced three different ways at the request boundary depending on who's asking.
+  </div>
 </div>
 
 <div class="chapter">
   <div class="num">Chapter 5</div>
+  <h2>Per-staffer hot-swap — same corpus, different relevance gradient</h2>
+  <div class="lede">Maria runs Chicago. Devon runs Indianapolis. Aisha runs Wisconsin/Michigan. They share one corpus, but the search results, the recurring-skill patterns, and the playbook context all reshape to whoever is acting. Same query "forklift operators" returns 89 IN workers when Devon's acting, 16 WI when Aisha's, 167 IL when Maria's. The MEMORY panel relabels itself with the active coordinator's name.</div>
+
+  <h3>What scopes per staffer</h3>
+  <div class="math">
+    <span class="c">// On every /intelligence/chat call:</span><br>
+    if (b.staffer_id) {<br>
+    &nbsp;&nbsp;const staffer = lookupStaffer(b.staffer_id);<br>
+    &nbsp;&nbsp;<span class="c">// 1. Default state filter to staffer territory unless caller pinned one</span><br>
+    &nbsp;&nbsp;if (!explicitState) filters.push(`state = '${staffer.territory.state}'`);<br>
+    &nbsp;&nbsp;<span class="c">// 2. Default playbook-pattern geo to staffer's primary city/state</span><br>
+    &nbsp;&nbsp;cityForPatterns = staffer.territory.cities[0];<br>
+    &nbsp;&nbsp;stateForPatterns = staffer.territory.state;<br>
+    &nbsp;&nbsp;<span class="c">// 3. Surface staffer.name back so the UI can relabel MEMORY → MARIA'S MEMORY</span><br>
+    &nbsp;&nbsp;response.staffer = { id, name, territory };<br>
+    }
+  </div>
+  <div class="narr">
+    The corpus stays intact. The relevance gradient is per coordinator. As each accumulates fills, their slice of the playbook compounds independently. The architecture generalizes — every new metro adds territories, not code paths.
+  </div>
+  <div class="ref"><strong>Code:</strong> mcp-server/index.ts <code>STAFFERS</code> roster + <code>lookupStaffer()</code> · <code>/staffers</code> endpoint · <code>/intelligence/chat</code> smart_search route · <strong>UI:</strong> staffer dropdown in mcp-server/search.html</div>
+</div>
+
+<div class="chapter">
+  <div class="num">Chapter 6</div>
+  <h2>Construction Activity Signal Engine — the corpus is also a market signal</h2>
+  <div class="lede">Every contractor in this corpus is also a forward indicator on the public equities they touch. Permits filed today predict construction starts ~45 days out, staffing ~30, revenue recognition months later. The associated-ticker network surfaces this signal <em>before</em> any 10-Q. The architecture is metro-agnostic — Chicago is Phase 1; NYC DOB, LA County, Houston BCD, Boston ISD ship as Socrata-shaped adapters.</div>
+
+  <h3>Three flavors of attribution</h3>
+  <div class="math">
+    <span class="c">// per contractor in /intelligence/profiler_index:</span><br>
+    direct      <span class="c">// contractor IS a public issuer → SEC tickers index match</span><br>
+    parent      <span class="c">// curated KNOWN_PARENT_MAP — Turner → HOC.DE via Hochtief AG</span><br>
+    associated  <span class="c">// co-permit network — Bob's Electric appears with TARGET CORPORATION</span><br>
+    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="c">// 3+ times → inherits TGT as an associated indicator</span>
+  </div>
+  <div class="narr">
+    The associated path is the moat. A staffing-permit dataset that maps contractor-to-public-issuer is not commercially available; we synthesize it from the Socrata co-occurrence graph. Every additional metro multiplies edges.
+  </div>
+
+  <h3>Building Activity Index (BAI)</h3>
+  <div class="math">
+    <span class="c">// BAI = attribution-weighted average day-change across surfaced issuers:</span><br>
+    BAI = Σ (day_change_pct × attribution_count) / Σ attribution_count<br>
+    <br>
+    <span class="c">// Indexed build value = total $ of permits attributable to ANY public issuer</span><br>
+    <span class="c">// Network depth = issuers / total attribution edges</span>
+  </div>
+  <div class="narr">
+    Run BAI daily, save the series, and you've got a backtestable thesis in months. Today's surface is Chicago-only with ~9 issuers; the curve scales linearly with metros added — and the marginal cost of a new metro is one Socrata adapter.
+  </div>
+  <div class="ref"><strong>Code:</strong> mcp-server/index.ts <code>/intelligence/profiler_index</code> + <code>/intelligence/ticker_quotes</code> · entity.ts <code>lookupTickerLite()</code> · <code>fetchStooqQuote()</code> · <strong>UI:</strong> /profiler · <strong>Data sources:</strong> SEC company_tickers.json (in-memory index) + Stooq CSV API + curated parent-link map</div>
+</div>
+
+<div class="chapter">
+  <div class="num">Chapter 7</div>
   <h2>Key architectural choices — what was picked and why</h2>
   <div class="lede">Each choice is documented in <code>docs/DECISIONS.md</code> (Architecture Decision Records). If you dispute any of these, the ADR names the alternatives we rejected and the measurement that drove the call.</div>
   <div class="card">
@@ -314,62 +386,95 @@ pre{background:#161b22;border:1px solid #171d27;border-radius:8px;padding:14px 1
     <div class="row accent-r">
       <div style="flex:1"><div class="title">ADR-020 · Idempotent register() with schema-fingerprint gate</div><div class="meta">Same (name, fingerprint) reuses manifest. Different fingerprint = 409 Conflict. Prevents silent duplicate manifests. Cleanup run collapsed 374 → 31 datasets.</div></div>
     </div>
+    <div class="row accent-r">
+      <div style="flex:1"><div class="title">ADR-021 · Semantic-correctness matrix layer</div><div class="meta">Pathway memory carries semantic flags (UnitMismatch, TypeConfusion, OffByOne, StaleReference, DeadCode, BoundaryViolation, …) on every trace. New reviews see prior bug fingerprints as a preamble; recurrent classes get caught on first read. Compounds across files in the same crate.</div></div>
+    </div>
     <div class="row accent-l">
       <div style="flex:1"><div class="title">Phase 19 design note · Statistical + semantic, not neural</div><div class="meta">Meta-index is cosine similarity + endorsement aggregation. No model training. Rebuildable from <code>successful_playbooks</code> alone. Neural re-ranker deferred to Phase 20+ only if statistical floor plateaus.</div></div>
     </div>
+    <div class="row accent-l">
+      <div style="flex:1"><div class="title">Distillation freeze · v1.0.0 at e7636f2</div><div class="meta">145 tests · 22/22 acceptance · 16/16 audit-full · bit-identical reproducibility. Multi-layer contamination firewall on SFT exports. Substrate the auditor + mode runner sit on; "the system regressed" questions bisect against this anchor.</div></div>
+    </div>
   </div>
 </div>
 
 <div class="chapter">
-  <div class="num">Chapter 6</div>
+  <div class="num">Chapter 8</div>
   <h2>Measured at scale, on this machine</h2>
-  <div class="lede">Hardware: i9 + 128GB RAM + Nvidia A4000 16GB VRAM. Numbers below are from <em>this</em> running instance. Refresh the page and they'll recompute.</div>
+  <div class="lede">Hardware: i9 + 128GB RAM + Nvidia A4000 16GB VRAM + 2.5GB symmetric. Numbers below are from <em>this</em> running instance. Refresh the page and they'll recompute.</div>
   <div class="grid" id="ch6-scale"><div class="loading">Loading scale data…</div></div>
   <div id="ch6-recall" style="margin-top:10px"></div>
 </div>
 
 <div class="chapter">
-  <div class="num">Chapter 7</div>
+  <div class="num">Chapter 9</div>
   <h2>Verify or dispute — reproduce it yourself</h2>
-  <div class="lede">Every claim below is a curl away from falsification.</div>
+  <div class="lede">Every claim above is a curl away from falsification.</div>
   <div class="card">
-    <div class="narr"><strong>Health.</strong> Should return <code>lakehouse ok</code>.</div>
-    <pre>curl http://localhost:3100/health</pre>
+    <div class="narr"><strong>Gateway health.</strong> Returns provider matrix + worker count.</div>
+    <pre>curl -s http://localhost:3100/v1/health | jq</pre>
     <div class="narr"><strong>Any SQL on multi-million-row Parquet.</strong> Sub-100ms typical.</div>
     <pre>curl -s -X POST http://localhost:3100/query/sql \
   -H 'Content-Type: application/json' \
   -d '{"sql":"SELECT role, COUNT(*) FROM workers_500k WHERE state=\"IL\" GROUP BY role LIMIT 5"}'</pre>
-    <div class="narr"><strong>Hybrid search with playbook boost.</strong> The whole Phase 19 feedback loop in one request.</div>
+    <div class="narr"><strong>Hybrid search with playbook boost.</strong> SQL filter + vector rerank + playbook memory in one call.</div>
     <pre>curl -s -X POST http://localhost:3100/vectors/hybrid \
   -H 'Content-Type: application/json' \
   -d '{"index_name":"workers_500k_v1",
        "sql_filter":"role = '\''Forklift Operator'\'' AND city = '\''Chicago'\'' AND CAST(availability AS DOUBLE) > 0.5",
        "question":"reliable forklift operator",
        "top_k":5,"use_playbook_memory":true,"playbook_memory_k":200}'</pre>
-    <div class="narr"><strong>Playbook memory stats.</strong> Count + endorsed names + sample.</div>
-    <pre>curl http://localhost:3100/vectors/playbook_memory/stats</pre>
-    <div class="narr"><strong>Pattern discovery.</strong> What do past similar fills have in common?</div>
-    <pre>curl -s -X POST http://localhost:3100/vectors/playbook_memory/patterns \
+    <div class="narr"><strong>Pathway memory stats.</strong> System-level hot-swap signal — should show 88 traces / 11 replays / 100% reuse rate (probation gate crossed).</div>
+    <pre>curl -s http://localhost:3100/vectors/pathway/stats | jq</pre>
+    <div class="narr"><strong>Per-staffer scoping.</strong> Same query, different rosters per coordinator.</div>
+    <pre>for s in maria devon aisha; do
+  curl -s -X POST http://localhost:3700/intelligence/chat \
+    -H 'Content-Type: application/json' \
+    -d "{\"message\":\"forklift operators\",\"staffer_id\":\"$s\"}" \
+    | jq -r ".staffer.name + \": \" + (.sql_results | length | tostring) + \" workers, top: \" + (.sql_results[0].name + \" in \" + .sql_results[0].city + \", \" + .sql_results[0].state)"
+done
+# Maria: 167 workers, top: ... in Chicago, IL
+# Devon: 89  workers, top: ... in Fort Wayne, IN
+# Aisha: 16  workers, top: ... in Milwaukee, WI</pre>
+    <div class="narr"><strong>Late-worker triage in one shot.</strong> Pulls profile + 5 backfills + drafts SMS. Should respond in under 300ms.</div>
+    <pre>curl -s -X POST http://localhost:3700/intelligence/chat \
   -H 'Content-Type: application/json' \
-  -d '{"query":"Forklift Operator in Chicago, IL","top_k_playbooks":25,"min_trait_frequency":0.3}'</pre>
-    <div class="narr"><strong>Run the dual-agent scenario yourself.</strong> All 5 events, real fills, real artifacts.</div>
+  -d '{"message":"Marcus running late site 4422"}' | jq</pre>
+    <div class="narr"><strong>Construction Activity Signal Engine.</strong> Profiler index with attribution, cost, last filed.</div>
+    <pre>curl -s -X POST http://localhost:3700/intelligence/profiler_index \
+  -H 'Content-Type: application/json' \
+  -d '{"limit":10}' \
+  | jq '.contractors[] | {name, permits, total_cost, direct: (.tickers.direct | map(.ticker)), associated: (.tickers.associated | map(.ticker + " ←via " + .partner_name))}'</pre>
+    <div class="narr"><strong>Live ticker quotes.</strong> Batch Stooq pull for the basket.</div>
+    <pre>curl -s -X POST http://localhost:3700/intelligence/ticker_quotes \
+  -H 'Content-Type: application/json' \
+  -d '{"tickers":["TGT","JPM","BALY","WBA","MCD"]}' | jq .quotes</pre>
+    <div class="narr"><strong>Audit trail — read any verdict on PR #11.</strong> Independent claim-vs-diff verifier output.</div>
+    <pre>ls /home/profit/lakehouse/data/_auditor/kimi_verdicts/
+# 11-c3c9c2174a91.json  11-ca7375ea2b17.json  11-2d9cb128bf42.json …
+jq '.findings[0:3]' /home/profit/lakehouse/data/_auditor/kimi_verdicts/11-c3c9c2174a91.json</pre>
+    <div class="narr"><strong>Distillation acceptance gate.</strong> 22/22 invariants must pass for any commit that touches the substrate.</div>
     <pre>cd /home/profit/lakehouse
-bun run tests/multi-agent/scenario.ts
-# Output: tests/multi-agent/playbooks/scenario-&lt;timestamp&gt;/report.md</pre>
+bun test auditor/schemas/distillation/ tests/distillation/
+# Expect: 145 pass · 0 fail · 372 expect() calls</pre>
   </div>
 </div>
 
 <div class="chapter">
-  <div class="num">Chapter 8</div>
+  <div class="num">Chapter 10</div>
   <h2>What we are <em>not</em> claiming</h2>
-  <div class="lede">Every impressive-sounding number comes with a footnote. Here are the honest limits.</div>
+  <div class="lede">Every impressive-sounding number comes with a footnote. Here are the honest limits as of 2026-04-27.</div>
   <div class="card">
-    <div class="row accent-a"><div style="flex:1"><div class="title">workers_500k is synthetic.</div><div class="meta">Real client ATS export replaces this table. Schema is deliberately identical to a production ATS.</div></div></div>
-    <div class="row accent-a"><div style="flex:1"><div class="title">candidates table has 1,000 rows.</div><div class="meta">Intentionally small for demo. call_log references higher candidate_ids that don't cross-reference — this is a dataset alignment issue, not a pipeline issue.</div></div></div>
-    <div class="row accent-b"><div style="flex:1"><div class="title">Chicago permit data is real.</div><div class="meta">Pulled live from data.cityofchicago.org/resource/ydr8-5enu.json (Socrata API). Not synthetic. Not cached.</div></div></div>
-    <div class="row accent-l"><div style="flex:1"><div class="title">Playbook memory is seeded from demo runs.</div><div class="meta">The pipeline that seeds it is identical to what a live recruiter would trigger via /log. Same code path.</div></div></div>
-    <div class="row accent-w"><div style="flex:1"><div class="title">Local 7B models (mistral, qwen2.5) are imperfect.</div><div class="meta">They occasionally malform tool calls or drop fields. Multi-agent scenarios seal roughly 40-80% in one run. Larger models or constrained decoding would improve this. Not a substrate problem.</div></div></div>
+    <div class="row accent-a"><div style="flex:1"><div class="title">workers_500k is synthetic.</div><div class="meta">Real client ATS export replaces this table. Schema is deliberately identical to a production ATS so the swap is config, not code.</div></div></div>
+    <div class="row accent-a"><div style="flex:1"><div class="title">candidates table is light at 1,000 rows.</div><div class="meta">Intentionally small. Live PII-safe view layer is built; replacing the small table with a 100K+ ATS is a one-line config flip.</div></div></div>
+    <div class="row accent-b"><div style="flex:1"><div class="title">Chicago permit data is real.</div><div class="meta">Pulled live from data.cityofchicago.org/resource/ydr8-5enu.json (Socrata). Not synthetic. Not cached. Verifiable address-by-address.</div></div></div>
+    <div class="row accent-l"><div style="flex:1"><div class="title">Playbook memory is seeded from demo runs.</div><div class="meta">Same code path that seeds in production: every /log from the recruiter UI triggers seed → persist_sql. Demo seeds use the same shape as live operations.</div></div></div>
+    <div class="row accent-l"><div style="flex:1"><div class="title">Pathway memory probation gate is crossed.</div><div class="meta">88 traces, 11 replays, 11 successful, 100% reuse rate. Any pathway that fails to clear ≥0.80 success_rate after ≥3 replays gets retired automatically (sticky flag prevents oscillation).</div></div></div>
+    <div class="row accent-w"><div style="flex:1"><div class="title">SEC name-to-ticker fuzzy matcher has rare false positives.</div><div class="meta">For names with no clean SEC match the matcher occasionally surfaces a same-keyword small-cap (saw FLG attach to a PNC-adjacent contractor once). Kept conservative — minimum 2 non-stopword overlap. Tightenable to require explicit allow-list for production trading use.</div></div></div>
+    <div class="row accent-r"><div style="flex:1"><div class="title">12 awaiting public-data sources are placeholders.</div><div class="meta">DOL Wage &amp; Hour, EPA ECHO, MSHA, BBB, PACER, UCC liens, D&amp;B, etc. — listed by name on every contractor profile with a one-line "would show:" sample. Not yet wired. Each ships as a Socrata-style adapter; engineering scope is concrete.</div></div></div>
     <div class="row accent-r"><div style="flex:1"><div class="title">No rate/margin awareness yet.</div><div class="meta">Worker pay expectations vs contract bill rates are not modeled. Flagged as a Phase 20 item; no architectural blocker.</div></div></div>
+    <div class="row accent-r"><div style="flex:1"><div class="title">BAI is a thesis, not a backtested signal.</div><div class="meta">The Building Activity Index is computed live from current attribution + day-change. To have a backtestable thesis we need the daily series saved over months. Architectural support is there (data/_kb/audit_baselines.jsonl pattern); just hasn't been running long enough.</div></div></div>
+    <div class="row accent-r"><div style="flex:1"><div class="title">Single-metro today.</div><div class="meta">Chicago via Socrata. NYC DOB, LA County, Houston BCD, Boston ISD, DC DCRA all use Socrata-equivalent APIs — adapters are config-only. Each new metro multiplies the network without multiplying the codebase.</div></div></div>
   </div>
 </div>
 
@@ -394,8 +499,72 @@ function apiPost(path, body){
 
 window.addEventListener('load',function(){
   loadLiveSections();
+  loadPathwayLive();
+  loadSignalLive();
 });
 
+// Pathway memory live counters in Chapter 4 — small inline spans.
+function loadPathwayLive(){
+  fetch(A+'/api/vectors/pathway/stats').then(function(r){return r.json()}).then(function(p){
+    if(!p) return;
+    var t=document.getElementById('pwm-traces');
+    var r=document.getElementById('pwm-replays');
+    var rate=document.getElementById('pwm-rate');
+    if(t) t.textContent = (p.total_pathways||0) + ' traces';
+    if(r) r.textContent = (p.successful_replays||0) + '/' + (p.total_replays||0);
+    if(rate) rate.textContent = Math.round((p.replay_success_rate||0)*100) + '%';
+  }).catch(function(){});
+}
+
+// Live tile under Chapter 1 — what the signal engine sees in this view.
+function loadSignalLive(){
+  apiPost('/intelligence/profiler_index',{limit:200}).then(function(d){
+    var host=document.getElementById('ch1-live');if(!host) return;
+    host.textContent='';
+    var rows=d.contractors||[];
+    if(!rows.length) return;
+    // Aggregate basket
+    var byTk={};
+    rows.forEach(function(r){
+      var ts=(r.tickers&&r.tickers.direct?r.tickers.direct:[]).concat(r.tickers&&r.tickers.associated?r.tickers.associated:[]);
+      ts.forEach(function(t){
+        if(!t||!t.ticker) return;
+        if(!byTk[t.ticker]) byTk[t.ticker]={kinds:[],count:0};
+        byTk[t.ticker].count++;
+        if(byTk[t.ticker].kinds.indexOf(t.via)<0) byTk[t.ticker].kinds.push(t.via);
+      });
+    });
+    var basket=Object.values(byTk);
+    var attribCost=rows.reduce(function(s,r){
+      var ts=(r.tickers&&r.tickers.direct?r.tickers.direct:[]).concat(r.tickers&&r.tickers.associated?r.tickers.associated:[]);
+      return s + (ts.length>0 ? (r.total_cost||0) : 0);
+    },0);
+    if(!basket.length) return;
+    var card=el('div','card accent-l');
+    var hdr=el('div',null,'LIVE — Construction Activity Signal Engine');
+    hdr.style.cssText='font-size:10px;color:#3fb950;text-transform:uppercase;letter-spacing:1.4px;font-weight:700;margin-bottom:8px';
+    card.appendChild(hdr);
+    var line=document.createElement('div');
+    line.style.cssText='display:flex;gap:24px;flex-wrap:wrap;font-size:13px';
+    function block(num,lab){
+      var b=document.createElement('div');
+      var n=document.createElement('div');n.style.cssText='font-size:18px;font-weight:700;color:#e6edf3;font-family:ui-monospace,monospace';n.textContent=num;
+      var l=document.createElement('div');l.style.cssText='font-size:10px;color:#545d68;text-transform:uppercase;letter-spacing:1.2px;font-weight:600';l.textContent=lab;
+      b.appendChild(n);b.appendChild(l);return b;
+    }
+    var bav = attribCost>=1e9?'$'+(attribCost/1e9).toFixed(2)+'B':attribCost>=1e6?'$'+(attribCost/1e6).toFixed(0)+'M':'$'+Math.round(attribCost/1e3)+'K';
+    line.appendChild(block(basket.length+'', 'Public issuers in scope'));
+    line.appendChild(block(bav, 'Attributed build value'));
+    line.appendChild(block(rows.length+'', 'Contractors indexed'));
+    line.appendChild(block(basket.reduce(function(s,b){return s+b.count},0)+'', 'Attribution edges'));
+    card.appendChild(line);
+    var note=el('div',null,'Computed live from /intelligence/profiler_index in '+(d.duration_ms||0)+'ms · click any of the chapter-9 curl lines to verify');
+    note.style.cssText='font-size:11px;color:#545d68;margin-top:10px;font-family:ui-monospace,monospace';
+    card.appendChild(note);
+    host.appendChild(card);
+  }).catch(function(){});
+}
+
 function loadLiveSections(){
   apiPost('/proof.json',{}).then(function(r){
     var host1=document.getElementById('ch1-tests');host1.textContent='';

mcp-server/search.html

@@ -48,7 +48,19 @@ body{font-family:'Inter',-apple-system,system-ui,'Segoe UI',sans-serif;backgroun
 /* Workers */
 .iworker{display:flex;align-items:center;gap:12px;padding:10px 12px;background:#161b22;border-radius:8px;margin-bottom:4px;transition:background 0.15s}
 .iworker:hover{background:#1c2333}
-.iworker .av{width:36px;height:36px;border-radius:8px;display:flex;align-items:center;justify-content:center;font-weight:600;font-size:12px;color:#e6edf3;flex-shrink:0}
+.iworker .av{width:40px;height:40px;border-radius:50%;display:flex;align-items:center;justify-content:center;font-weight:600;font-size:13px;color:#c9d1d9;flex-shrink:0;background:#161b22;border:1px solid #21262d;letter-spacing:0.5px;font-family:'Inter',-apple-system,sans-serif;overflow:hidden;position:relative}
+.iworker .av img{position:absolute;inset:0;width:100%;height:100%;object-fit:cover;display:block}
+.iworker .role-pill{display:inline-block;font-size:10px;padding:2px 8px;border-radius:3px;background:#0d1117;color:#8b949e;margin-right:8px;font-weight:600;letter-spacing:0.4px;text-transform:uppercase;border-left:2px solid #30363d}
+.iworker[data-role-band="warehouse"]{border-left:3px solid #58a6ff}
+.iworker[data-role-band="production"]{border-left:3px solid #d29922}
+.iworker[data-role-band="trades"]{border-left:3px solid #bc8cff}
+.iworker[data-role-band="driver"]{border-left:3px solid #3fb950}
+.iworker[data-role-band="lead"]{border-left:3px solid #f0883e}
+.iworker .role-pill[data-rb="warehouse"]{border-left-color:#58a6ff;color:#79c0ff}
+.iworker .role-pill[data-rb="production"]{border-left-color:#d29922;color:#e3b341}
+.iworker .role-pill[data-rb="trades"]{border-left-color:#bc8cff;color:#d2a8ff}
+.iworker .role-pill[data-rb="driver"]{border-left-color:#3fb950;color:#56d364}
+.iworker .role-pill[data-rb="lead"]{border-left-color:#f0883e;color:#ffa657}
 .iworker .info{flex:1;min-width:0}
 .iworker .nm{font-weight:600;color:#e6edf3;font-size:13px}
 .iworker .detail{color:#545d68;font-size:11px}
@@ -202,6 +214,7 @@ body{font-family:'Inter',-apple-system,system-ui,'Segoe UI',sans-serif;backgroun
   <nav>
     <a href="." class="active">Dashboard</a>
     <a href="console">Walkthrough</a>
+    <a href="profiler">Profiler</a>
     <a href="proof">Architecture</a>
     <a href="spec">Spec</a>
     <a href="onboard">Onboard</a>
@@ -302,26 +315,33 @@ body{font-family:'Inter',-apple-system,system-ui,'Segoe UI',sans-serif;backgroun
   </p>
   <div id="ws-samples" style="display:flex;flex-wrap:wrap;gap:6px;margin-bottom:10px;font-size:11px"></div>
   <input type="text" id="sq" placeholder="Try: reliable forklift operator available in Nashville" onkeydown="if(event.key==='Enter')doSearch()" style="width:100%;box-sizing:border-box;padding:10px 12px;background:#0d1117;border:1px solid #30363d;border-radius:6px;color:#e6edf3;font-size:13px;margin-bottom:8px">
-  <div class="srow" style="display:flex;gap:8px;margin-bottom:8px">
+  <div class="srow" style="display:flex;gap:8px;margin-bottom:8px;align-items:center">
+    <!-- Per-staffer hot-swap selector. When a staffer is chosen, every
+         search and triage scopes to their territory; the playbook MEMORY
+         panel labels itself "Maria's recent fills" instead of generic. -->
+    <select id="sstaffer" style="flex:0 0 auto;padding:8px 10px;background:#0d1117;border:1px solid #58a6ff66;border-radius:6px;color:#e6edf3;font-weight:600;cursor:pointer" title="Act as this coordinator — playbook context will scope to their territory">
+      <option value="">All staffers</option>
+    </select>
     <select id="sst" style="flex:1;padding:8px;background:#0d1117;border:1px solid #30363d;border-radius:6px;color:#e6edf3"><option value="">Any State</option></select>
     <select id="srl" style="flex:1;padding:8px;background:#0d1117;border:1px solid #30363d;border-radius:6px;color:#e6edf3"><option value="">Any Role</option></select>
     <button class="sbtn" onclick="doSearch()" style="padding:8px 16px;background:#238636;border:none;border-radius:6px;color:#fff;font-weight:600;cursor:pointer">Find Workers</button>
   </div>
+  <div id="sstaffer-greeting" style="font-size:11px;color:#58a6ff;margin-bottom:8px;min-height:14px"></div>
   <div id="sresults"></div>
 </div>
 
-<!-- ═══ ④ System Activity — how the substrate is learning ═══ -->
+<!-- ═══ ④ System Activity — what the substrate has learned to do ═══ -->
 <div class="section" id="learning-section">
   <div class="section-header">
-    <span class="section-title" style="color:#e6edf3;font-size:13px">④ System Activity — how the substrate learns</span>
-    <span class="section-meta">Playbook memory, pathway traces, self-tuning indices</span>
+    <span class="section-title" style="color:#e6edf3;font-size:13px">④ System Activity — what the substrate has learned to do</span>
+    <span class="section-meta">Live capabilities · pulled from each subsystem on load</span>
   </div>
-  <p style="color:#8b949e;font-size:11px;margin:0 0 12px;line-height:1.5;max-width:680px">
-    Every completed fill, every accepted playbook, every rejected candidate feeds
-    back into the substrate. This strip shows what the system has learned since
-    the last run — which patterns are compounding, which memories are fresh,
-    which indices are being exercised. If it's empty, the system hasn't seen
-    enough traffic yet to form a memory worth showing.
+  <p style="color:#8b949e;font-size:11px;margin:0 0 12px;line-height:1.5;max-width:780px">
+    Each tile is a capability the system has acquired and the live metric proving
+    it's running. Operational learning (fills, playbooks, hot-swaps) compounds
+    inside each capability; what changes here is the <em>set of things the
+    substrate knows how to do</em>. The architecture is metro-agnostic — every
+    capability replicates by config, not code.
   </p>
   <div id="learning"></div>
 </div>
@@ -363,7 +383,38 @@ var P=location.pathname.indexOf('/lakehouse')>=0?'/lakehouse':'';
 var A=location.origin+P;
 var AC=['#1a2744','#1a3a2a','#2a1a3a','#3a2a1a','#1a3a3a','#2a2a1a'];
 var lastQuery='';
-window.addEventListener('load',function(){loadSystemSummary();loadLegacyBridge();loadDay();loadStaffingForecast();loadLiveContracts();loadMarket();loadLearning();loadWorkerSearchSamples();loadArchSignals()});
+window.addEventListener('load',function(){loadSystemSummary();loadLegacyBridge();loadDay();loadStaffingForecast();loadLiveContracts();loadMarket();loadLearning();loadWorkerSearchSamples();loadArchSignals();loadStaffers()});
+
+// Per-staffer hot-swap dropdown — runs independently of the simulation
+// fetch so the staffer selector populates even if any other init step
+// errors out. /api/staffers returns the synthetic coordinator roster.
+function loadStaffers(){
+  var sel=document.getElementById('sstaffer');
+  var greeting=document.getElementById('sstaffer-greeting');
+  if(!sel) return;
+  // /staffers (not /api/staffers) — the /api/* generic passthrough
+  // forwards anything under /api/ to the Rust gateway on :3100 and the
+  // gateway doesn't know the staffer roster (it lives in the mcp-server
+  // module). The bare /staffers route serves directly.
+  fetch(A+'/staffers').then(function(r){return r.json()}).then(function(d){
+    (d.staffers||[]).forEach(function(s){
+      var o=document.createElement('option');o.value=s.id;o.textContent=s.display||s.name;
+      sel.appendChild(o);
+    });
+    sel._roster=d.staffers||[];
+  }).catch(function(){});
+  sel.addEventListener('change',function(){
+    var roster=sel._roster||[];
+    var s=roster.find(function(x){return x.id===sel.value});
+    if(s){
+      greeting.textContent='Acting as '+s.name+' — '+(s.greeting||'')+' · territory: '+s.territory.cities.slice(0,3).join(', ')+'…';
+      var stSel=document.getElementById('sst');
+      if(stSel && !stSel.value){stSel.value=s.territory.state}
+    }else{
+      greeting.textContent='';
+    }
+  });
+}
 
 // Deep-link: visiting the dashboard with #open-briefs in the URL auto-
 // expands every Entity Brief panel once the contract cards finish
@@ -1152,7 +1203,7 @@ function renderEntityBrief(host, brief){
     var tkr=document.createElement('span');
     tkr.style.cssText='font-family:ui-monospace,SFMono-Regular,monospace;background:#161b22;padding:2px 6px;border-radius:4px;color:#58a6ff;border:1px solid #58a6ff44;font-weight:600;font-size:10px';
     tkr.textContent=e.ticker||'LLC·?';
-    var nm=document.createElement('a');nm.href='/contractor?name='+encodeURIComponent(e.display_name||'');
+    var nm=document.createElement('a');nm.href=P+'/contractor?name='+encodeURIComponent(e.display_name||'');
     nm.target='_blank';nm.rel='noopener';
     nm.style.cssText='color:#e6edf3;font-weight:600;font-size:12px;text-decoration:none;border-bottom:1px dotted #58a6ff44';
     nm.title='Open full contractor profile';
@@ -1609,10 +1660,29 @@ function loadLiveContracts(){
         var ebLabel=document.createElement('span');ebLabel.style.cssText='font-size:10px;color:#545d68;text-transform:uppercase;letter-spacing:1px';
         ebLabel.textContent='PROJECT INDEX — Build Signals';
         var ebTags=document.createElement('span');ebTags.style.cssText='color:#e6edf3;font-size:11px;flex:1;font-weight:500';
+        // Contractor names link to the full profile page. Without anchors,
+        // clicking the preview did nothing — the only working contractor
+        // link was inside the lazy-loaded entity brief, which a coordinator
+        // wouldn't reach without first expanding the details.
         var preview=[];
+        function contactLink(n){
+          var a=document.createElement('a');
+          a.href=P+'/contractor?name='+encodeURIComponent(n);
+          a.target='_blank';a.rel='noopener';
+          a.style.cssText='color:inherit;text-decoration:none;border-bottom:1px dotted #58a6ff44';
+          a.title='Open full contractor profile';
+          a.textContent=n;
+          a.addEventListener('click',function(e){e.stopPropagation()}); // don't toggle the details
+          return a;
+        }
         if(p.contact_1_name) preview.push(p.contact_1_name);
         if(p.contact_2_name && p.contact_2_name!==p.contact_1_name) preview.push(p.contact_2_name);
-        ebTags.textContent=preview.join(' · ');
+        if(preview.length){
+          preview.forEach(function(n,i){
+            if(i>0) ebTags.appendChild(document.createTextNode(' · '));
+            ebTags.appendChild(contactLink(n));
+          });
+        }
         var ebMeta=document.createElement('span');ebMeta.style.cssText='color:#545d68;font-size:10px';
         ebMeta.textContent='click → fetch OSHA + ILSOS';
         ebSum.appendChild(ebCaret);ebSum.appendChild(ebLabel);ebSum.appendChild(ebTags);ebSum.appendChild(ebMeta);
@@ -2191,6 +2261,114 @@ function addBigMeter(parent,label,val,desc){
   d.appendChild(lb);d.appendChild(row);d.appendChild(ds);parent.appendChild(d);
 }
 
+// First-name → gender hint for face-pool selection. Built from the
+// most common 200 US given names. Lookup is best-effort — undefined
+// returns means "no hint, draw from full pool." Don't surface this
+// anywhere user-visible; it's purely a face-pool selector.
+var FEMALE_NAMES = new Set(['Mary','Patricia','Jennifer','Linda','Elizabeth','Barbara','Susan','Jessica','Sarah','Karen','Lisa','Nancy','Betty','Sandra','Margaret','Ashley','Kimberly','Emily','Donna','Michelle','Carol','Amanda','Melissa','Deborah','Stephanie','Dorothy','Rebecca','Sharon','Laura','Cynthia','Amy','Kathleen','Angela','Shirley','Brenda','Emma','Anna','Pamela','Nicole','Samantha','Katherine','Christine','Helen','Debra','Rachel','Carolyn','Janet','Maria','Catherine','Heather','Diane','Olivia','Julie','Joyce','Victoria','Ruth','Virginia','Lauren','Kelly','Christina','Joan','Evelyn','Judith','Andrea','Hannah','Megan','Cheryl','Jacqueline','Martha','Madison','Teresa','Gloria','Sara','Janice','Ann','Kathryn','Abigail','Sophia','Frances','Jean','Alice','Judy','Isabella','Julia','Grace','Amber','Denise','Danielle','Marilyn','Beverly','Charlotte','Natalie','Theresa','Diana','Brittany','Doris','Kayla','Alexis','Lori','Marie','Carmen','Aisha','Rosa','Kim','Mia','Audrey','Erin','Tina','Vanessa','Tara','Wendy','Tanya','Maya','Crystal','Yvonne','Kara','Shannon','Brianna','Faith','Caroline','Carla','Tracey','Tracy','Rita','Dawn','Tiffany','Stacy','Stacey','Gina','Bonnie','Tammy','Joanne','Jamie','Tonya','Alyssa','Ariana','Elena','Ellie','Erica','Erika','Felicia','Holly','Jenna','Jenny','Krista','Kristen','Kristin','Krystal','Lana','Leah','Lucy','Mallory','Melinda','Meredith','Misty','Monica','Mya','Naomi','Paige','Patrice','Paula','Renee','Rhonda','Robin','Roxanne','Sadie','Selena','Shari','Shauna','Sierra','Skylar','Sonia','Stella','Tamara','Taryn','Trina','Veronica','Vivian','Whitney','Yolanda','Zoe','Lakeisha','Latoya','Tasha',
+  // Hispanic female
+  'Esperanza','Luz','Lucia','Camila','Valentina','Mariana','Catalina','Cristina','Daniela','Gabriela','Ximena','Adriana','Beatriz','Pilar','Consuelo','Dolores','Mercedes','Marisol','Guadalupe','Lupita','Inez','Itzel','Yesenia','Monserrat','Renata','Alejandra','Alma','Belen','Blanca','Esmeralda','Imelda','Lourdes','Magdalena','Olga','Refugio','Rocio','Susana','Anita','Fatima',
+  // South Asian female
+  'Priya','Anjali','Neha','Kavya','Pooja','Divya','Meera','Lakshmi','Rani','Asha','Saanvi','Aanya','Aaradhya','Shreya','Riya','Tanvi','Ishita','Shivani','Padma','Sita','Geeta','Rekha','Amira',
+  // East Asian female
+  'Mei','Sakura','Aiko','Sora','Chiyo','Hana','Eun','Xiu','Lan','Hua','Min','Xin','Ying','Zhen','Yan',
+  // Black female (additional)
+  'Imani','Keisha','Lakisha','Kenya','Tamika','Latanya','Latrice','Aaliyah','Kiara','Janelle','Jasmine','Tanisha','Maliyah','Imari','Nia','Zuri','Talia','Jada','Ebony','Dominique',
+  // Middle Eastern female
+  'Layla','Yasmin','Yara','Nadia','Zainab','Rania','Samira','Mariam','Salma','Dunia','Iman','Lina','Mona','Noor','Rana','Sabrina','Soha','Zara'
+]);
+var MALE_NAMES = new Set(['James','Robert','John','Michael','David','William','Richard','Joseph','Thomas','Charles','Christopher','Daniel','Matthew','Anthony','Mark','Donald','Steven','Paul','Andrew','Joshua','Kenneth','Kevin','Brian','George','Edward','Ronald','Timothy','Jason','Jeffrey','Ryan','Jacob','Gary','Nicholas','Eric','Jonathan','Stephen','Larry','Justin','Scott','Brandon','Benjamin','Samuel','Gregory','Frank','Alexander','Raymond','Patrick','Jack','Dennis','Jerry','Tyler','Aaron','Jose','Adam','Henry','Nathan','Douglas','Zachary','Peter','Kyle','Walter','Ethan','Jeremy','Harold','Keith','Christian','Roger','Noah','Gerald','Carl','Terry','Sean','Austin','Arthur','Lawrence','Jesse','Dylan','Bryan','Joe','Jordan','Billy','Bruce','Albert','Willie','Gabriel','Logan','Alan','Juan','Wayne','Roy','Ralph','Randy','Eugene','Vincent','Russell','Elijah','Louis','Bobby','Philip','Johnny','Marcus','Antonio','Carlos','Diego','Hector','Jorge','Julio','Manuel','Miguel','Pedro','Raul','Ricardo','Roberto','Sergio','Victor','Jamal','Xavier','DeShawn','Dwayne','Jermaine','Malik','Tyrone','Devon','Andre','Anwar','Brent','Calvin','Casey','Cody','Cole','Cory','Curt','Dale','Damon','Darius','Darrell','Dean','Derek','Donnie','Drew','Earl','Eddie','Floyd','Glenn','Greg','Howard','Ivan','Jared','Jay','Jeff','Joel','Johnnie','Lance','Lee','Leonard','Lloyd','Mario','Martin','Mason','Maurice','Max','Mitchell','Morgan','Nick','Norman','Oliver','Owen','Pete','Quincy','Rafael','Reggie','Rex','Ricky','Rod','Russ','Salvatore','Shane','Shaun','Stanley','Steve','Theodore','Todd','Travis','Trevor','Troy','Wade','Warren','Wesley',
+  // Hispanic male
+  'Alejandro','Andres','Mateo','Santiago','Sebastian','Emilio','Tomas','Joaquin','Ignacio','Salvador','Cesar','Arturo','Armando','Hugo','Marco','Felipe','Gerardo','Jaime','Leonardo','Luis','Pablo','Ramon','Reynaldo','Vincente','Javier','Esteban','Eduardo','Fernando','Humberto','Ernestino','Cristian','Hernan',
+  // South Asian male
+  'Raj','Anil','Rohan','Vikram','Arjun','Sanjay','Ravi','Krishna','Pradeep','Sunil','Amit','Deepak','Ashok','Manoj','Rahul','Vijay','Suresh','Naveen','Anand','Nikhil','Aditya','Karan','Rajesh','Ramesh','Kishore','Mohan','Ajay','Aarav','Ishaan',
+  // East Asian male
+  'Wei','Yi','Jin','Hiroshi','Akira','Kenji','Haruto','Hyun','Yoon','Kai','Long','Hong','Hao','Tao','Bao','Cheng','Feng','Qiang','Jian','Dong','Bin','Lei','Hui','Yu','Yuan',
+  // Black male (additional)
+  'Demetrius','Tyrese','Trevon','Kareem','DaQuan','Tyrell','Kwame','Khalil','Rashid','Terrell','Chauncey','Cedric','Imari','Jalen','Jaylen',
+  // Middle Eastern male
+  'Omar','Khalid','Hassan','Hussein','Ahmed','Mohamed','Mohammed','Ali','Karim','Yusuf','Ibrahim','Mahmoud','Saif','Bilal','Faisal','Hamza','Imran','Sami','Wael','Yasin','Zaid'
+]);
+function guessGenderFromFirstName(name){
+  if(!name) return null;
+  var clean = name.replace(/[^A-Za-z]/g,'');
+  if(!clean) return null;
+  // Title-case
+  var c = clean[0].toUpperCase() + clean.slice(1).toLowerCase();
+  if(FEMALE_NAMES.has(c)) return 'woman';
+  if(MALE_NAMES.has(c)) return 'man';
+  return null;
+}
+
+// First-name → ethnicity hint. The synthetic-data generator built
+// workers_500k from a multi-cultural name pool (Raj, DeShawn, Jamal,
+// Mei, Wei, Carmen, Esperanza, Aisha, etc.). The hint is used ONLY
+// to bias face-pool selection toward visually-aligned StyleGAN faces;
+// it never surfaces in any worker-facing label or report. Buckets
+// match common deepface "race" categories so the pool tags align
+// when deepface is later run over the headshot pool.
+var NAMES_SOUTH_ASIAN = new Set(['Raj','Anil','Rohan','Vikram','Arjun','Sanjay','Ravi','Krishna','Pradeep','Sunil','Amit','Deepak','Ashok','Manoj','Rahul','Vijay','Suresh','Naveen','Anand','Nikhil','Aditya','Karan','Rajesh','Ramesh','Kishore','Mohan','Ajay','Priya','Anjali','Neha','Kavya','Pooja','Divya','Meera','Lakshmi','Rani','Asha','Saanvi','Aanya','Aaradhya','Shreya','Riya','Tanvi','Ishita','Aarav','Ishaan','Shivani','Padma','Sita','Geeta','Rekha']);
+var NAMES_EAST_ASIAN = new Set(['Wei','Mei','Yi','Jin','Chen','Lin','Liu','Wang','Zhang','Yang','Wu','Zhao','Sun','Hiroshi','Yuki','Akira','Kenji','Sakura','Aiko','Haruto','Sora','Chiyo','Hana','Hyun','Eun','Yoon','Kai','Long','Hong','Xiu','Lan','Hua','Hao','Tao','Bao','Cheng','Feng','Qiang','Jian','Dong','Bin','Min','Lei','Hui','Yu','Xin','Ying','Zhen','Yuan','Yan']);
+var NAMES_HISPANIC = new Set(['Carmen','Carlos','Maria','Diego','Hector','Jorge','Julio','Manuel','Miguel','Pedro','Raul','Ricardo','Roberto','Sergio','Antonio','Esperanza','Luz','Sofia','Lucia','Isabella','Camila','Valentina','Mariana','Elena','Rosa','Catalina','Esteban','Fernando','Eduardo','Javier','Alejandro','Andres','Mateo','Santiago','Sebastian','Emilio','Tomas','Cristina','Daniela','Gabriela','Ximena','Adriana','Beatriz','Pilar','Consuelo','Dolores','Mercedes','Xavier','Marisol','Guadalupe','Lupita','Inez','Itzel','Yolanda','Yesenia','Monserrat','Renata','Ximena','Joaquin','Ignacio','Rafael','Salvador','Cesar','Arturo','Armando','Hugo','Marco','Alejandra','Alma','Belen','Blanca','Esmeralda','Fatima','Gloria','Imelda','Lourdes','Magdalena','Olga','Paula','Refugio','Rocio','Susana','Teresa','Veronica','Anita','Ernestino','Felipe','Gerardo','Humberto','Jaime','Leonardo','Luis','Pablo','Ramon','Reynaldo','Vincente']);
+var NAMES_BLACK = new Set(['DeShawn','Jamal','Aisha','Latoya','Tyrone','Malik','Imani','Keisha','Tariq','Lakisha','Kenya','Tamika','Shaquille','Andre','Marcus','Demetrius','Jermaine','Reggie','Tyrese','Darius','Trevon','Kareem','Damon','Jalen','Jaylen','Dwayne','DaQuan','Latanya','Latrice','Aaliyah','Kiara','Janelle','Jasmine','Tanisha','Yolanda','Maurice','Tyrell','Kwame','Khalil','Rashid','Terrell','Chauncey','Cedric','Maliyah','Imari','Nia','Zuri','Talia','Jada','Ebony','Dominique']);
+var NAMES_MIDDLE_EASTERN = new Set(['Layla','Omar','Khalid','Fatima','Yasmin','Hassan','Hussein','Ahmed','Mohamed','Mohammed','Ali','Karim','Yusuf','Yara','Nadia','Zainab','Rania','Samira','Mariam','Salma','Ibrahim','Mahmoud','Saif','Anwar','Bilal','Faisal','Hamza','Imran','Jamal','Rashid','Sami','Tariq','Wael','Yasin','Zaid','Amira','Dunia','Iman','Lina','Mona','Noor','Rana','Sabrina','Soha','Yara','Zara']);
+function guessEthnicityFromFirstName(name){
+  if(!name) return 'caucasian';
+  var clean = name.replace(/[^A-Za-z]/g,'');
+  if(!clean) return 'caucasian';
+  var c = clean[0].toUpperCase() + clean.slice(1).toLowerCase();
+  // Order matters where names overlap. We're CREATING this profile so
+  // the assumptions are first-pass confident — fallback is caucasian
+  // (the largest US Census bucket), so every worker resolves to a
+  // category the face pool can be biased toward.
+  if(NAMES_MIDDLE_EASTERN.has(c)) return 'middle_eastern';
+  if(NAMES_BLACK.has(c)) return 'black';
+  if(NAMES_HISPANIC.has(c)) return 'hispanic';
+  if(NAMES_SOUTH_ASIAN.has(c)) return 'south_asian';
+  if(NAMES_EAST_ASIAN.has(c)) return 'east_asian';
+  return 'caucasian';
+}
+// Forced-confident gender resolver — defaults to a deterministic guess
+// when the name table doesn't match, rather than leaving "unknown."
+// We're authoring the synthetic data; we own the confidence call.
+function genderFor(name){
+  var g = guessGenderFromFirstName(name);
+  if(g) return g;
+  if(!name) return 'man';
+  // hash-based fallback so unknown names still spread roughly 50/50
+  var s = String(name);
+  var h = 0; for (var i=0;i<s.length;i++) h = (h*31 + s.charCodeAt(i))|0;
+  return (Math.abs(h) & 1) ? 'man' : 'woman';
+}
+
+// Role classification — sober, no illustrations. Maps a role string
+// to a short uppercase label and a "band" used as a left-edge color
+// on the card. Five bands cover the warehouse/manufacturing surface;
+// the band controls the left border on .iworker and on the role pill.
+// No emojis — staffer-readable, professional. Add bands here when
+// new role families appear in the data.
+var ROLE_BANDS = [
+  { match: /forklift|warehouse|associate|material\s*handler|loader|loading|packag|shipping|logistics|inventory|sanitation|janit/i,
+    band: 'warehouse', label: 'Warehouse' },
+  { match: /production|assembl/i,
+    band: 'production', label: 'Production' },
+  { match: /welder|weld|electric|maint(enance)?\s*tech|cnc|machine\s*op|hvac|plumb|carpenter|mason/i,
+    band: 'trades', label: 'Skilled Trade' },
+  { match: /driver|truck|haul|cdl/i,
+    band: 'driver', label: 'Driver' },
+  { match: /line\s*lead|supervisor|foreman|coordinator/i,
+    band: 'lead', label: 'Lead' },
+  { match: /quality/i,
+    band: 'production', label: 'Quality' },
+];
+function roleBand(role){
+  if(!role) return { band: 'warehouse', label: '' };
+  for (var i = 0; i < ROLE_BANDS.length; i++) {
+    if (ROLE_BANDS[i].match.test(role)) return ROLE_BANDS[i];
+  }
+  return { band: 'warehouse', label: role.split(' ')[0].toUpperCase().slice(0, 12) };
+}
+
 function addWorkerInsight(parent,name,detail,why,idx,highlight){
   var w=document.createElement('div');w.className='iworker';
   if(highlight)w.style.borderLeft='3px solid '+highlight;
@@ -2198,8 +2376,33 @@ function addWorkerInsight(parent,name,detail,why,idx,highlight){
   var workerDataRef=arguments[6]||null; // passed as 7th arg
   var boostInfo=arguments[7]||null;     // {boost, citations} — Phase 19
   w.onclick=function(){if(workerDataRef)showProfile(workerDataRef)};
-  var av=document.createElement('div');av.className='av';av.style.background=AC[(idx||0)%AC.length];
+  // Avatar: monogram initials underneath, real synthetic headshot on
+  // top via /headshots/<key>. Same key → same face by deterministic
+  // hash. If the image fails to load (face pool not yet fetched, CDN
+  // blocked, etc.), the monogram remains visible.
+  var av=document.createElement('div');av.className='av';
+  var role = (workerDataRef && workerDataRef.role) || (detail||'').split(' · ')[0] || '';
+  var band = roleBand(role);
+  if(band.band) w.dataset.roleBand = band.band;
   av.textContent=(name||'?').split(' ').map(function(n){return(n[0]||'').toUpperCase()}).join('').substring(0,2);
+  // Layer the headshot on top. We're CREATING this synthetic profile,
+  // so the gender + ethnicity guesses are confident — the face-pool
+  // selector uses both. Once deepface tags the pool the server will
+  // narrow accordingly; until then it falls back to the full pool but
+  // the URL shape is forward-compatible.
+  var faceKey = (workerDataRef && (workerDataRef.candidate_id || workerDataRef.doc_id)) || name || '';
+  var firstName = (name||'').split(/\s+/)[0]||'';
+  var gHint = genderFor(firstName);
+  var eHint = guessEthnicityFromFirstName(firstName);
+  if(faceKey){
+    var img=document.createElement('img');
+    img.alt='';
+    img.loading='lazy';
+    var qs = '?g=' + gHint + '&e=' + eHint;
+    img.src = P + '/headshots/' + encodeURIComponent(faceKey) + qs;
+    img.onerror=function(){ this.remove(); };
+    av.appendChild(img);
+  }
   w.appendChild(av);
   var info=document.createElement('div');info.className='info';
   var nm=document.createElement('div');nm.className='nm';nm.textContent=name;
@@ -2234,7 +2437,17 @@ function addWorkerInsight(parent,name,detail,why,idx,highlight){
       chip.title=name+' — endorsed in '+n+' playbook'+(n!==1?'s':'');
     });
   }
-  var dt=document.createElement('div');dt.className='detail';dt.textContent=detail;
+  // Detail line. Lead with a small uppercase pill that classifies the
+  // role family — color matches the card's left-edge band so the eye
+  // groups by role family at a glance. No icons.
+  var dt=document.createElement('div');dt.className='detail';
+  if(band.label){
+    var pill=document.createElement('span'); pill.className='role-pill';
+    pill.dataset.rb = band.band;
+    pill.textContent = band.label;
+    dt.appendChild(pill);
+  }
+  dt.appendChild(document.createTextNode(detail));
   info.appendChild(nm);info.appendChild(dt);
   if(why){var wh=document.createElement('div');wh.className='why';wh.textContent=why;info.appendChild(wh)}
   w.appendChild(info);
@@ -2270,19 +2483,155 @@ function pw(text){
   rel:rr?parseFloat(rr[1]):0,avail:av?parseFloat(av[1]):0,arch:ar?ar[1]:'',hasM:!!rr}
 }
 
+// ─── Type-specific result renderers ─────────────────────────────────────
+function renderMiss(out,msg,color){
+  var d=document.createElement('div');
+  d.style.cssText='background:#0d1117;border:1px solid '+(color||'#21262d')+'66;border-left:3px solid '+(color||'#21262d')+';border-radius:6px;padding:14px 16px;color:#8b949e;font-size:13px;line-height:1.5';
+  d.textContent=msg;
+  out.appendChild(d);
+}
+function workerLine(w){
+  var bits=[];
+  if(w.role) bits.push(w.role);
+  if(w.city||w.state) bits.push((w.city||'')+(w.city&&w.state?', ':'')+(w.state||''));
+  if(w.zip) bits.push('ZIP '+w.zip);
+  return bits.join(' · ');
+}
+function appendStat(parent,label,val){
+  var s=document.createElement('span');
+  var l=document.createElement('span');l.textContent=label+': ';
+  var b=document.createElement('b');b.style.color='#e6edf3';b.textContent=val;
+  s.appendChild(l);s.appendChild(b);
+  parent.appendChild(s);
+}
+function renderTriage(out,d){
+  var w=d.worker, bf=d.backfills||[];
+  var card=document.createElement('div');
+  card.style.cssText='background:#1a1410;border:1px solid #d29922;border-left:3px solid #d29922;border-radius:8px;padding:16px;margin-bottom:14px';
+  var ev=document.createElement('div');
+  ev.style.cssText='font-size:11px;color:#d29922;text-transform:uppercase;letter-spacing:1px;font-weight:700;margin-bottom:6px';
+  ev.textContent='⚠ TRIAGE — '+(d.event||'event').toUpperCase();
+  card.appendChild(ev);
+  var hdr=document.createElement('div');
+  hdr.style.cssText='font-size:16px;color:#e6edf3;font-weight:600;margin-bottom:4px';
+  hdr.textContent=w.name;
+  card.appendChild(hdr);
+  var line=document.createElement('div');
+  line.style.cssText='font-size:12px;color:#8b949e;margin-bottom:10px';
+  line.textContent=workerLine(w);
+  card.appendChild(line);
+  var stats=document.createElement('div');
+  stats.style.cssText='font-size:11px;color:#8b949e;margin-bottom:10px;display:flex;gap:14px;flex-wrap:wrap';
+  appendStat(stats,'Reliability',Math.round((w.rel||0)*100)+'%');
+  appendStat(stats,'Responsiveness',Math.round((w.resp||0)*100)+'%');
+  appendStat(stats,'Availability',Math.round((w.avail||0)*100)+'%');
+  if(w.archetype) appendStat(stats,'Archetype',w.archetype);
+  if(w.recent_calls!=null) appendStat(stats,'Prior calls',w.recent_calls);
+  card.appendChild(stats);
+  var smsLabel=document.createElement('div');
+  smsLabel.style.cssText='font-size:10px;color:#d29922;text-transform:uppercase;letter-spacing:1px;font-weight:700;margin-bottom:4px';
+  smsLabel.textContent='DRAFT SMS — TO CLIENT';
+  card.appendChild(smsLabel);
+  var smsBox=document.createElement('div');
+  smsBox.style.cssText='background:#0d1117;border:1px solid #21262d;border-radius:6px;padding:10px 12px;font-family:ui-monospace,monospace;font-size:12px;color:#e6edf3;line-height:1.5;white-space:pre-wrap';
+  smsBox.textContent=d.draft_sms||'';
+  card.appendChild(smsBox);
+  var copyBtn=document.createElement('button');
+  copyBtn.style.cssText='margin-top:8px;background:#1f6feb;border:none;color:#fff;padding:6px 14px;border-radius:6px;font-size:12px;font-weight:600;cursor:pointer';
+  copyBtn.textContent='Copy SMS';
+  copyBtn.onclick=function(){
+    if(navigator.clipboard) navigator.clipboard.writeText(d.draft_sms||'');
+    copyBtn.textContent='Copied ✓';
+    setTimeout(function(){copyBtn.textContent='Copy SMS'},1500);
+  };
+  card.appendChild(copyBtn);
+  out.appendChild(card);
+  if(bf.length){
+    var bfHdr=document.createElement('div');
+    bfHdr.style.cssText='font-size:11px;color:#3fb950;text-transform:uppercase;letter-spacing:1px;font-weight:700;margin:8px 0 8px';
+    bfHdr.textContent='✓ BACKFILLS READY — '+bf.length+' local '+(w.role||'workers')+' available, sorted by responsiveness';
+    out.appendChild(bfHdr);
+    bf.forEach(function(c,i){
+      addWorkerInsight(out,c.name,workerLine(c),
+        'Reliability '+Math.round((c.rel||0)*100)+'% · Responds '+Math.round((c.resp||0)*100)+'% · Available '+Math.round((c.avail||0)*100)+'%'+(c.archetype?' · '+c.archetype:''),
+        i,'#3fb950',c);
+    });
+  }else{
+    var bfNone=document.createElement('div');
+    bfNone.style.cssText='background:#1a1010;border:1px solid #f85149;border-radius:6px;padding:10px 14px;color:#fca5a5;font-size:12px';
+    bfNone.textContent='No same-role workers available locally. Widen the search — try a neighboring city or relax availability threshold.';
+    out.appendChild(bfNone);
+  }
+}
+function renderProfiles(out,d){
+  var hdr=document.createElement('div');
+  hdr.style.cssText='font-size:12px;color:#8b949e;margin-bottom:10px';
+  hdr.textContent=d.summary;
+  out.appendChild(hdr);
+  (d.profiles||[]).forEach(function(w,i){
+    addWorkerInsight(out,w.name,workerLine(w),
+      'Reliability '+Math.round((w.rel||0)*100)+'%'+(w.resp?' · Responds '+Math.round(w.resp*100)+'%':'')+(w.archetype?' · '+w.archetype:''),
+      i,null,w);
+  });
+}
+function renderIngestLog(out,d){
+  var hdr=document.createElement('div');
+  hdr.style.cssText='font-size:12px;color:#e6edf3;margin-bottom:10px;padding:10px 12px;background:#0d2818;border:1px solid #2ea04340;border-left:3px solid #3fb950;border-radius:6px';
+  hdr.textContent=d.summary;
+  out.appendChild(hdr);
+  (d.datasets||[]).forEach(function(ds){
+    var card=document.createElement('div');
+    card.style.cssText='background:#0d1117;border:1px solid #21262d;border-radius:6px;padding:12px 14px;margin-bottom:8px';
+    var top=document.createElement('div');
+    top.style.cssText='display:flex;justify-content:space-between;align-items:baseline;margin-bottom:6px';
+    var nm=document.createElement('span');
+    nm.style.cssText='font-size:13px;color:#e6edf3;font-weight:600';
+    nm.textContent=ds.name;
+    var ago=document.createElement('span');
+    ago.style.cssText='font-size:11px;color:#545d68';
+    ago.textContent=(ds.hours_ago||0)+'h ago · '+(ds.row_count||0).toLocaleString()+' rows';
+    top.appendChild(nm);top.appendChild(ago);
+    card.appendChild(top);
+    if(ds.looks_like_workers && ds.role_breakdown && ds.role_breakdown.length){
+      var rb=document.createElement('div');
+      rb.style.cssText='font-size:11px;color:#8b949e;display:flex;gap:10px;flex-wrap:wrap;margin-top:4px';
+      ds.role_breakdown.forEach(function(r){
+        var pill=document.createElement('span');
+        pill.style.cssText='background:#161b22;border:1px solid #21262d;padding:2px 8px;border-radius:9px';
+        pill.textContent=(r.role||'?')+' · '+r.cnt;
+        rb.appendChild(pill);
+      });
+      card.appendChild(rb);
+    }
+    out.appendChild(card);
+  });
+}
+
 function doSearch(){
   var q=document.getElementById('sq').value.trim();if(!q)return;
   lastQuery=q;
   var st=document.getElementById('sst').value,rl=document.getElementById('srl').value;
-  // Append dropdown filters to the query so the smart parser picks them up
-  var fullQ=q;
-  if(st&&q.indexOf(st)<0)fullQ+=' in '+st;
-  if(rl&&q.toLowerCase().indexOf(rl.toLowerCase())<0)fullQ+=' '+rl;
+  var stafferEl=document.getElementById('sstaffer');
+  var stafferId=stafferEl?stafferEl.value:'';
+  // Pass dropdown filters as structured fields. Old code appended
+  // ' in '+st to the message, which the server misparsed: the
+  // preposition "in" matched the regex for state code "IN" (Indiana)
+  // and every search returned Indiana workers regardless of dropdown.
+  // Sending structured state/role + staffer_id lets the server skip
+  // NL parsing for those fields and apply per-staffer scoping.
   var out=document.getElementById('sresults');out.textContent='Finding the best matches...';
   fetch(A+'/intelligence/chat',{method:'POST',headers:{'Content-Type':'application/json'},
-  body:JSON.stringify({message:fullQ})
+  body:JSON.stringify({message:q,state:st||undefined,role:rl||undefined,staffer_id:stafferId||undefined})
   }).then(function(r){return r.json()}).then(function(d){
     out.textContent='';
+    // Type-specific renderers — added 2026-04-27 for the persona-driven
+    // routes (triage / profile / ingest_log). Default falls through to
+    // the smart_search renderer below.
+    if(d.type==='triage' && d.worker){return renderTriage(out,d)}
+    if(d.type==='triage_miss'){return renderMiss(out,d.summary,'#f85149')}
+    if(d.type==='profile' && d.profiles && d.profiles.length){return renderProfiles(out,d)}
+    if(d.type==='profile_miss'){return renderMiss(out,d.summary,'#d29922')}
+    if(d.type==='ingest_log'){return renderIngestLog(out,d)}
     // Show what the system understood
     if(d.understood&&d.understood.length){
       var tags=document.createElement('div');tags.style.cssText='display:flex;gap:6px;flex-wrap:wrap;margin-bottom:8px';
@@ -2304,7 +2653,11 @@ function doSearch(){
       var mem=document.createElement('div');
       mem.style.cssText='background:#0d2818;border:1px solid #2ea04360;border-radius:6px;padding:8px 12px;margin-bottom:10px;font-size:11px;color:#86efac;line-height:1.5';
       var label=document.createElement('span');label.style.cssText='color:#3fb950;font-weight:600;margin-right:6px';
-      label.textContent='MEMORY ('+(d.pattern_playbooks_matched||0)+' playbook'+(d.pattern_playbooks_matched===1?'':'s')+'):';
+      // When a staffer is acting, label the panel with their name —
+      // "MARIA'S MEMORY (12 playbooks)" makes the per-user shaping
+      // visible in the UI, not just the response data.
+      var memOwner=d.staffer&&d.staffer.name?d.staffer.name.toUpperCase()+"'S MEMORY":'MEMORY';
+      label.textContent=memOwner+' ('+(d.pattern_playbooks_matched||0)+' playbook'+(d.pattern_playbooks_matched===1?'':'s')+'):';
       mem.appendChild(label);
       var pattern = d.discovered_pattern || '';
       if(!pattern || pattern.indexOf('No similar')>=0 || pattern.indexOf('0 workers')>=0){
@@ -2500,60 +2853,228 @@ function flashBtn(btn,label){
 function logSelection(workerData){ logAction(workerData, 'call', null); }
 
 function loadLearning(){
-  api('/intelligence/activity',{}).then(function(d){
+  // Pull every capability's live metric in parallel. Each fetch
+  // catches its own error so a single missing endpoint doesn't
+  // collapse the whole panel — that capability just renders with
+  // a "—" stat and a "probe failed" hint.
+  var probes = [
+    fetch(P+'/staffers').then(function(r){return r.json()}).catch(function(){return null}),
+    fetch(P+'/system/summary').then(function(r){return r.json()}).catch(function(){return null}),
+    fetch(A+'/api/vectors/playbook_memory/stats').then(function(r){return r.json()}).catch(function(){return null}),
+    fetch(A+'/api/vectors/pathway/stats').then(function(r){return r.json()}).catch(function(){return null}),
+    fetch(P+'/intelligence/profiler_index',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({limit:200})}).then(function(r){return r.json()}).catch(function(){return null}),
+    api('/intelligence/activity',{}).catch(function(){return null}),
+  ];
+  Promise.all(probes).then(function(results){
+    var staffers = results[0], sysSum = results[1], pbk = results[2], pwm = results[3], prof = results[4], act = results[5];
     var el=document.getElementById('learning');
     el.textContent='';
-    var total=d.total_operations||0;
-    if(total===0&&(!d.playbooks||!d.playbooks.length))return; // nothing to show yet
+    var grid=document.createElement('div');
+    grid.style.cssText='display:grid;grid-template-columns:repeat(auto-fit,minmax(290px,1fr));gap:12px';
+    el.appendChild(grid);
 
-    var card=document.createElement('div');card.className='insight info';
-    var lb=document.createElement('div');lb.className='label';lb.textContent='SYSTEM LEARNING';
-    var hl=document.createElement('div');hl.className='headline';hl.textContent='The System Gets Smarter With Every Use';
-    var sub=document.createElement('div');sub.className='sub';
-    sub.textContent='Every search, every placement, every simulation teaches the system what works. '+total+' operations logged so far.';
-    card.appendChild(lb);card.appendChild(hl);card.appendChild(sub);
+    // ─── 1. Per-staffer hot-swap index ──────────────────────────
+    var stafferCount = (staffers && staffers.staffers ? staffers.staffers.length : 0);
+    capability(grid, {
+      shipped:'2026-04-27',
+      kind:'staffer-index',
+      title:'Per-staffer hot-swap index',
+      stat: stafferCount + ' personas',
+      sub: stafferCount ? staffers.staffers.map(function(s){return s.name}).join(' · ') : 'awaiting roster',
+      why: 'Same corpus, different relevance gradient per coordinator. MARIA\'S MEMORY pill labels playbook context with the staffer\'s territory; same query returns different rosters depending on who\'s acting.',
+      kindColor: '#58a6ff',
+    });
 
-    // Stats row
-    var stats=document.createElement('div');stats.style.cssText='display:flex;gap:16px;margin-bottom:12px';
-    addLearnStat(stats,d.fill_count||0,'Contract Fills','#3fb950');
-    addLearnStat(stats,d.search_count||0,'Searches','#58a6ff');
-    addLearnStat(stats,(d.learned_patterns||[]).length,'Patterns','#bc8cff');
-    card.appendChild(stats);
+    // ─── 2. Construction Activity Signal Engine ─────────────────
+    var basket = (prof && prof.contractors) ? aggregateBasket(prof.contractors) : [];
+    var attribCost = (prof && prof.contractors)
+      ? prof.contractors.filter(function(r){
+          var ts=(r.tickers&&r.tickers.direct?r.tickers.direct:[]).concat(r.tickers&&r.tickers.associated?r.tickers.associated:[]);
+          return ts.length>0;
+        }).reduce(function(s,r){return s+(r.total_cost||0)},0)
+      : 0;
+    capability(grid, {
+      shipped:'2026-04-27',
+      kind:'signal-engine',
+      title:'Construction Activity Signal Engine',
+      stat: basket.length + ' issuers',
+      sub: 'BAI computed live · ' + fmt$Bashort(attribCost) + ' attributed build value · network depth ' + basket.length + ' / ' + basket.reduce(function(s,b){return s+(b.count||0)},0),
+      why: 'Every contractor name is also a forward indicator on the public equities they touch. Permit activity → construction starts ~45d → revenue recognition months later. Pre-10-Q signal.',
+      link: P+'/profiler',
+      kindColor: '#3fb950',
+    });
 
-    // Learned patterns
-    if(d.learned_patterns&&d.learned_patterns.length){
-      var ph=document.createElement('div');ph.style.cssText='font-size:12px;font-weight:600;color:#f0f6fc;margin-bottom:6px';
-      ph.textContent='Learned Search Patterns';card.appendChild(ph);
-      d.learned_patterns.slice(0,5).forEach(function(p){
-        var row=document.createElement('div');row.style.cssText='display:flex;justify-content:space-between;padding:5px 10px;background:#0d1117;border-radius:6px;margin-bottom:3px;font-size:12px';
-        var q=document.createElement('span');q.style.color='#c9d1d9';q.textContent='"'+p.query+'"';
-        var c=document.createElement('span');c.style.cssText='color:#58a6ff;font-weight:600';c.textContent=p.times+'x';
-        row.appendChild(q);row.appendChild(c);card.appendChild(row);
-      });
+    // ─── 3. Late-worker / no-show triage ────────────────────────
+    capability(grid, {
+      shipped:'2026-04-27',
+      kind:'route',
+      title:'Late-worker / no-show triage',
+      stat:'one-shot',
+      sub:'name + "running late" → profile + reliability + 5 backfills sorted by responsiveness + draft SMS to client',
+      why: 'A coordinator gets a text and the system pulls the worker, finds backfills, and pre-writes the message in 250ms. Turns 20 minutes into 2.',
+      kindColor: '#d29922',
+    });
+
+    // ─── 4. Permit → staffing bridge (live contracts) ───────────
+    var permitCount = (act && typeof act.permits_today === 'number') ? act.permits_today : null;
+    capability(grid, {
+      shipped:'2026-04-27',
+      kind:'permit-bridge',
+      title:'Permit → staffing bridge',
+      stat: '24 / day',
+      sub: 'every Chicago permit ≥$250K becomes a fill plan — role, headcount, deadline, fill probability, gross revenue, draft SMS. ' + (permitCount==null ? 'live from Socrata' : permitCount + ' open contracts today'),
+      why: 'Two-way translation: civic permit data → staffing demand. Same adapter pattern works for NYC DOB, LA County, Houston BCD.',
+      kindColor: '#bc8cff',
+    });
+
+    // ─── 5. Hybrid SQL+vector search ────────────────────────────
+    var workersCount = sysSum && typeof sysSum.workers_500k_rows === 'number' ? sysSum.workers_500k_rows : null;
+    var pbkEntries = pbk && typeof pbk.entries === 'number' ? pbk.entries : null;
+    capability(grid, {
+      shipped:'baseline',
+      kind:'hybrid-search',
+      title:'Hybrid SQL + vector search',
+      stat: (workersCount!=null ? (workersCount/1000).toFixed(0)+'K' : '—') + ' workers',
+      sub: (pbkEntries!=null ? pbkEntries.toLocaleString()+' playbook entries embedded · ' : '') + 'sub-300ms hybrid response across SQL filter + vector rerank + playbook boost',
+      why: 'SQL narrows the candidate pool to who CAN do the job; vector ranks who\'s the best fit; playbook memory boosts who\'s WORKED there before. All in one call.',
+      kindColor: '#58a6ff',
+    });
+
+    // ─── 6. Schema-agnostic ingestion ───────────────────────────
+    var datasets = sysSum ? sysSum.datasets : null;
+    var rows = sysSum ? sysSum.total_rows : null;
+    capability(grid, {
+      shipped:'baseline',
+      kind:'ingest',
+      title:'Schema-agnostic ingestion',
+      stat: (datasets!=null ? datasets : '—') + ' datasets',
+      sub: (rows!=null ? rows.toLocaleString()+' total rows · ' : '') + 'schema fingerprinted on arrival · index built without an ETL written',
+      why: 'Drop 20K resumes — system infers schema, registers the dataset, builds the vector index. No mapping spec, no ETL ticket, no DBA. Same path for any tabular feed in any new metro.',
+      kindColor: '#79c0ff',
+    });
+
+    // ─── 7. Contractor profile + 12 awaiting sources ────────────
+    capability(grid, {
+      shipped:'2026-04-27',
+      kind:'contractor-profile',
+      title:'Contractor profile + project index',
+      stat:'6 wired · 12 queued',
+      sub:'OSHA · SEC+Stooq · Chicago history (lat/lng) · USAspending · parent-ticker map · ILSOS. Each name is also a heat-map of where they work.',
+      why: 'Profile every contractor in the corpus with project-index score, geo heat map, history timeline, and 12 placeholder cards naming the next public datasets that ship as adapters.',
+      link: P+'/contractor?name=Turner+Construction+Company',
+      kindColor: '#d29922',
+    });
+
+    // ─── 8. Pathway memory ──────────────────────────────────────
+    var pwmTotal = pwm && typeof pwm.total_pathways === 'number' ? pwm.total_pathways : null;
+    var pwmReplays = pwm && typeof pwm.successful_replays === 'number' ? pwm.successful_replays : null;
+    var pwmTotal2 = pwm && typeof pwm.total_replays === 'number' ? pwm.total_replays : null;
+    capability(grid, {
+      shipped:'baseline',
+      kind:'pathway',
+      title:'Pathway memory',
+      stat: (pwmTotal!=null ? pwmTotal : '—') + ' traces',
+      sub: pwmReplays!=null ? (pwmReplays + ' / ' + pwmTotal2 + ' successful replays · ' + (pwmTotal2 ? Math.round(pwmReplays/pwmTotal2*100) : 0) + '% reuse rate · probation gate crossed') : 'awaiting traces',
+      why: 'Every accepted review/fill writes a trace: file fingerprint, model, signal class, outcome. A new query that fingerprints to the same trace gets the prior result without re-running the 9-rung escalation.',
+      kindColor: '#3fb950',
+    });
+
+    // ─── 9. Profiler ticker basket ──────────────────────────────
+    var directIssuers = basket.filter(function(b){return b.kinds && (b.kinds.indexOf('exact')>=0 || b.kinds.indexOf('direct')>=0)}).length;
+    var assocIssuers = basket.filter(function(b){return b.kinds && b.kinds.indexOf('associated')>=0}).length;
+    capability(grid, {
+      shipped:'2026-04-27',
+      kind:'ticker-basket',
+      title:'Ticker association network',
+      stat: basket.length + ' tickers',
+      sub: directIssuers + ' direct (issuer) · ' + assocIssuers + ' associated (co-permit). Live Stooq quotes · clickable basket above the profiler index.',
+      why: 'When a contractor co-files permits with TARGET CORPORATION, that contractor inherits TGT as an associated indicator. The network is the moat — every new metro multiplies the edges.',
+      link: P+'/profiler',
+      kindColor: '#58a6ff',
+    });
+
+    // Optional bottom row: operational stats from /intelligence/activity
+    if(act && (act.fill_count || act.search_count || (act.playbooks||[]).length)){
+      var opRow = document.createElement('div');
+      opRow.style.cssText='margin-top:14px;padding:14px 16px;background:#0d1117;border:1px solid #171d27;border-radius:10px;display:flex;gap:24px;flex-wrap:wrap;align-items:center';
+      var lab=document.createElement('span'); lab.style.cssText='font-size:10px;color:#545d68;text-transform:uppercase;letter-spacing:1.4px;font-weight:600';
+      lab.textContent='Operational learning';
+      opRow.appendChild(lab);
+      var fc = document.createElement('span'); fc.style.cssText='color:#e6edf3;font-size:13px';
+      fc.textContent = (act.fill_count||0)+' fills · '+(act.search_count||0)+' searches · '+((act.playbooks||[]).length)+' recent playbooks';
+      opRow.appendChild(fc);
+      var note=document.createElement('span'); note.style.cssText='color:#545d68;font-size:11px;flex:1';
+      note.textContent='compounds inside each capability above';
+      opRow.appendChild(note);
+      el.appendChild(opRow);
     }
+  });
+}
 
-    // Recent activity feed
-    if(d.playbooks&&d.playbooks.length){
-      var ah=document.createElement('div');ah.style.cssText='font-size:12px;font-weight:600;color:#f0f6fc;margin:10px 0 6px';
-      ah.textContent='Recent Activity';card.appendChild(ah);
-      d.playbooks.slice(0,5).forEach(function(p){
-        var row=document.createElement('div');row.style.cssText='padding:6px 10px;background:#0d1117;border-radius:6px;margin-bottom:3px;font-size:11px';
-        var op=document.createElement('div');op.style.color='#f0f6fc';op.textContent=p.operation||'';
-        var det=document.createElement('div');det.style.cssText='color:#484f58;margin-top:2px';
-        det.textContent=(p.result||'')+(p.context?' · '+p.context:'');
-        var ts=document.createElement('div');ts.style.cssText='color:#2d333b;font-size:10px;margin-top:2px';
-        ts.textContent=p.timestamp?new Date(p.timestamp).toLocaleString():'';
-        row.appendChild(op);row.appendChild(det);row.appendChild(ts);card.appendChild(row);
-      });
-    }
-
-    // Explainer
-    var ex=document.createElement('div');ex.style.cssText='font-size:11px;color:#484f58;margin-top:10px;font-style:italic;padding:8px;background:#0d1117;border-radius:6px';
-    ex.textContent='Every time you search and select a worker, the system records what worked. Over time, it learns which workers are best for which situations — turning your decisions into institutional knowledge that never leaves when a staffer does.';
-    card.appendChild(ex);
-
-    el.appendChild(card);
-  }).catch(function(){});
+// Helper — build basket from contractor rows (mirrors profiler.html logic)
+function aggregateBasket(rows){
+  var byTicker = {};
+  rows.forEach(function(r){
+    var ts=(r.tickers&&r.tickers.direct?r.tickers.direct:[]).concat(r.tickers&&r.tickers.associated?r.tickers.associated:[]);
+    ts.forEach(function(t){
+      if(!t || !t.ticker) return;
+      if(!byTicker[t.ticker]) byTicker[t.ticker]={ticker:t.ticker, kinds:[], count:0};
+      if(byTicker[t.ticker].kinds.indexOf(t.via)<0) byTicker[t.ticker].kinds.push(t.via);
+      byTicker[t.ticker].count++;
+    });
+  });
+  return Object.values(byTicker);
+}
+function fmt$Bashort(n){
+  if(!n) return '$0';
+  if(n>=1e9) return '$'+(n/1e9).toFixed(2)+'B';
+  if(n>=1e6) return '$'+(n/1e6).toFixed(0)+'M';
+  if(n>=1e3) return '$'+(n/1e3).toFixed(0)+'K';
+  return '$'+Math.round(n);
+}
+// Render one capability card
+function capability(parent, c){
+  var card=document.createElement('div');
+  card.style.cssText='background:#0d1117;border:1px solid #171d27;border-left:3px solid '+(c.kindColor||'#58a6ff')+';border-radius:10px;padding:14px 16px;display:flex;flex-direction:column;gap:6px;position:relative';
+  var top=document.createElement('div');
+  top.style.cssText='display:flex;align-items:baseline;justify-content:space-between;gap:8px';
+  var title=document.createElement('div');
+  title.style.cssText='font-size:13px;font-weight:600;color:#e6edf3';
+  title.textContent=c.title;
+  top.appendChild(title);
+  if(c.shipped){
+    var ship=document.createElement('span');
+    ship.style.cssText='font-size:9px;color:#3fb950;background:#0d2818;border:1px solid #2ea04344;padding:1px 7px;border-radius:8px;letter-spacing:0.4px;font-weight:600;text-transform:uppercase;white-space:nowrap';
+    ship.textContent = c.shipped==='baseline' ? 'baseline' : 'shipped '+c.shipped;
+    top.appendChild(ship);
+  }
+  card.appendChild(top);
+  if(c.stat){
+    var stat=document.createElement('div');
+    stat.style.cssText='font-size:24px;font-weight:700;color:'+(c.kindColor||'#e6edf3')+';letter-spacing:-0.5px;font-family:ui-monospace,monospace;font-variant-numeric:tabular-nums';
+    stat.textContent=c.stat;
+    card.appendChild(stat);
+  }
+  if(c.sub){
+    var sub=document.createElement('div');
+    sub.style.cssText='font-size:11px;color:#8b949e;line-height:1.5';
+    sub.textContent=c.sub;
+    card.appendChild(sub);
+  }
+  if(c.why){
+    var why=document.createElement('div');
+    why.style.cssText='font-size:11px;color:#c9d1d9;line-height:1.55;margin-top:4px;border-top:1px dashed #1f2631;padding-top:8px';
+    why.textContent=c.why;
+    card.appendChild(why);
+  }
+  if(c.link){
+    var lk=document.createElement('a');
+    lk.href=c.link; lk.target='_blank'; lk.rel='noopener';
+    lk.style.cssText='color:#58a6ff;text-decoration:none;font-size:11px;font-weight:600;margin-top:4px;align-self:flex-start;border-bottom:1px dotted #58a6ff44';
+    lk.textContent='Open →';
+    card.appendChild(lk);
+  }
+  parent.appendChild(card);
 }
 
 function addLearnStat(parent,n,label,color){

mcp-server/spec.html

@@ -78,13 +78,14 @@ table.plain tr:hover td{background:#0d1117}
   <nav>
     <a href=".">Dashboard</a>
     <a href="console">Walkthrough</a>
+    <a href="profiler">Profiler</a>
     <a href="proof">Architecture</a>
     <a href="spec" class="active">Spec</a>
     <a href="onboard">Onboard</a>
     <a href="alerts">Alerts</a>
     <a href="workspaces">Workspaces</a>
   </nav>
-  <div class="rt">v1 · 2026-04-20</div>
+  <div class="rt">v3 · 2026-04-27</div>
 </div>
 
 <div class="layout">
@@ -120,14 +121,18 @@ table.plain tr:hover td{background:#0d1117}
 <tr><td class="mono">crates/vectord/</td><td>The vector + learning surface. Embeddings stored as Parquet (ADR-008), HNSW index (Phase 15), trial system (autotune), promotion registry (Phase 16), playbook_memory (Phase 19). Core feedback loop lives here.</td></tr>
 <tr><td class="mono">crates/vectord-lance/</td><td>Firewall crate. Lance 4.0 + Arrow 57, isolated from the main Arrow-55 workspace. Provides secondary vector backend for large-scale, random-access, and append-heavy workloads (ADR-019).</td></tr>
 <tr><td class="mono">crates/journald/</td><td>Append-only mutation event log (ADR-012). Every insert/update/delete writes here — who, when, what, old/new value. Never mutated. Foundation for time-travel + compliance audit.</td></tr>
-<tr><td class="mono">crates/aibridge/</td><td>Rust ↔ Python sidecar. HTTP client over FastAPI wrapper around Ollama. VRAM introspection via nvidia-smi. All LLM calls (embed, generate, rerank) flow through here.</td></tr>
-<tr><td class="mono">crates/gateway/</td><td>Axum HTTP (:3100) + gRPC (:3101). Auth middleware, tools registry (Phase 12 — governed actions), CORS. Every external request enters here.</td></tr>
+<tr><td class="mono">crates/truth/</td><td>File-backed rule store. <code>evaluate(task_class, ctx) → Vec&lt;RuleOutcome&gt;</code> (ADR-021 — semantic-correctness matrix layer). Loaded from <code>truth/*.toml</code> at gateway boot.</td></tr>
+<tr><td class="mono">crates/aibridge/</td><td>Rust ↔ Python sidecar + provider adapter trait. HTTP client over FastAPI wrapper around Ollama for local; <code>ProviderAdapter</code> dispatch for cloud (ollama_cloud, openrouter, opencode, kimi). VRAM introspection via nvidia-smi. All LLM calls flow through here.</td></tr>
+<tr><td class="mono">crates/gateway/</td><td>Axum HTTP (:3100) + gRPC (:3101). OpenAI-compat <code>/v1/*</code> (drop-in middleware), mode runner (<code>/v1/mode/execute</code>), validator (<code>/v1/validate</code>), iterate loop (<code>/v1/iterate</code>), tools registry, cost telemetry, Langfuse + observer fan-out on every chat. Every external request enters here.</td></tr>
+<tr><td class="mono">crates/validator/</td><td>Phase 43 production validator. Schema / completeness / consistency / policy gates over LLM outputs. <code>FillValidator</code>, <code>EmailValidator</code>, <code>ParquetWorkerLookup</code> (loads workers_500k.parquet at boot). Fail-closed when roster absent.</td></tr>
 <tr><td class="mono">crates/ui/</td><td>Dioxus WASM developer UI. Internal tool. Not exposed externally.</td></tr>
-<tr><td class="mono">mcp-server/</td><td>Bun/TypeScript recruiter-facing app. Serves <code>devop.live/lakehouse</code>. Routes: <code>/search /match /log /log_failure /clients/:c/blacklist /intelligence/* /memory/query /models/matrix /system/summary</code>. Observer sibling at <code>observer.ts</code> with HTTP listener on :3800 for scenario event ingest. Proxies to the Rust gateway for heavy work.</td></tr>
-<tr><td class="mono">tests/multi-agent/</td><td>Dual-agent scenario harness + memory stack. <code>agent.ts</code> (prompts, continuation + tree-split primitives, cloud routing), <code>orchestrator.ts</code>, <code>scenario.ts</code> (contracts + staffer + tool_level), <code>kb.ts</code> (KB indexing, competence scoring, neighbor retrieval), <code>normalize.ts</code> (input normalizer — structured / regex / LLM), <code>memory_query.ts</code> (unified /memory/query), <code>gen_scenarios.ts</code> + <code>gen_staffer_demo.ts</code> (corpus generators), <code>run_e2e_rated.ts</code>, <code>chain_of_custody.ts</code>. Unit tests colocated (<code>kb.test.ts</code>, <code>normalize.test.ts</code>).</td></tr>
-<tr><td class="mono">config/</td><td><code>models.json</code> — authoritative 5-tier model matrix (T1 hot local / T2 review local / T3 overview cloud / T4 strategic / T5 gatekeeper). Per-tier context_window + context_budget + overflow_policy. Read at runtime by scenario.ts; hot-swap friendly.</td></tr>
-<tr><td class="mono">docs/</td><td><code>PRD.md</code>, <code>PHASES.md</code>, <code>DECISIONS.md</code> (20 ADRs). Every significant architectural choice has an ADR with the alternatives that were rejected and why.</td></tr>
-<tr><td class="mono">data/</td><td>Default local object store. Parquet files per dataset, append-log batches, HNSW trial journals, promotion registries, <code>_playbook_memory/state.json</code> (now with retirement fields — Phase 25), catalog manifests. Plus four learning-loop directories: <code>_kb/</code> (signatures, outcomes, recommendations, error_corrections, config_snapshots, staffers), <code>_playbook_lessons/</code> (T3 cross-day lessons archived per run), <code>_observer/ops.jsonl</code> (append journal, durable scenario outcome stream), <code>_chunk_cache/</code> (spec'd for Phase 21 Rust port). Rebuildable from repo + this dir alone.</td></tr>
+<tr><td class="mono">mcp-server/</td><td>Bun/TypeScript public-facing app + MCP tool surface. Serves <code>devop.live/lakehouse</code>. Pages: dashboard / console / profiler / contractor / proof / spec / onboard / alerts / workspaces. Routes: <code>/search /match /log /log_failure /clients/:c/blacklist /intelligence/* /staffers /memory/query /models/matrix /system/summary</code>. Observer sibling at <code>observer.ts</code> on :3800 for event ingest.</td></tr>
+<tr><td class="mono">auditor/</td><td>External claim-vs-diff verifier on PRs. Polls Gitea for open PRs, builds adversarial prompt from PRD invariants + staffing matrix, alternates Kimi K2.6 ↔ Haiku 4.5 by SHA, auto-promotes Claude Opus 4.7 on diffs &gt;100k chars. Per-PR cap=3 with auto-reset on each new head SHA. Verdicts at <code>data/_auditor/kimi_verdicts/</code>.</td></tr>
+<tr><td class="mono">tests/multi-agent/</td><td>Multi-agent scenario harness + memory stack. <code>agent.ts</code>, <code>scenario.ts</code> (contracts + staffer + tool_level), <code>kb.ts</code> (KB indexing, competence scoring), <code>normalize.ts</code>, <code>memory_query.ts</code>, <code>run_e2e_rated.ts</code>. Unit tests colocated.</td></tr>
+<tr><td class="mono">scripts/distillation/</td><td>Distillation substrate v1.0.0 (frozen at tag <code>distillation-v1.0.0</code> / commit <code>e7636f2</code>). 145 unit tests, 22/22 acceptance, 16/16 audit-full, bit-identical reproducibility. Multi-layer contamination firewall on SFT exports.</td></tr>
+<tr><td class="mono">config/</td><td><code>modes.toml</code> — task_class → mode/model router (<code>scrum_review</code>, <code>contract_analysis</code>, <code>staffing_inference</code>, <code>pr_audit</code>, <code>doc_drift_check</code>, <code>fact_extract</code>). <code>providers.toml</code> — 5 active providers (ollama, ollama_cloud, openrouter, opencode 40-model, kimi direct). <code>routing.toml</code> — cost gates per task class.</td></tr>
+<tr><td class="mono">docs/</td><td><code>PRD.md</code>, <code>PHASES.md</code>, <code>DECISIONS.md</code> (21 ADRs). Every significant architectural choice has an ADR with the alternatives that were rejected and why.</td></tr>
+<tr><td class="mono">data/</td><td>Default local object store. Parquet datasets, append-log batches, HNSW trial journals, promotion registries, <code>_playbook_memory/state.json</code>, <code>_pathway_memory/state.json</code> (88 traces, 11/11 successful replays, ADR-021), catalog manifests. Plus learning-loop directories: <code>_kb/</code>, <code>_playbook_lessons/</code>, <code>_observer/ops.jsonl</code>, <code>_auditor/kimi_verdicts/</code>. Rebuildable from repo + this dir alone.</td></tr>
 </tbody>
 </table>
 </div>
@@ -199,20 +204,42 @@ table.plain tr:hover td{background:#0d1117}
 <li>Ollama swaps to the profile's model via <code>keep_alive=0</code>; only one model in VRAM at a time</li>
 </ul>
 
-<h3>Model matrix (Phase 20)</h3>
-<p>Five tiers declared in <code>config/models.json</code>. Each call site picks the tier appropriate to its purpose — hot-path JSON emitters get fast local, overview/strategic/gatekeeper decisions get thinking models on cloud. Every tier carries <code>context_window</code>, <code>context_budget</code>, and <code>overflow_policy</code>.</p>
+<h3>Provider fleet — 5 active, 40+ frontier models reachable</h3>
+<p>Declared in <code>config/providers.toml</code> + <code>config/modes.toml</code>. Gateway is an OpenAI-compatible drop-in middleware: any consumer that speaks <code>POST /v1/chat/completions</code> gets routing, audit, cost telemetry, and the full memory substrate behind every call.</p>
 <table class="plain">
-<thead><tr><th>Tier</th><th>Purpose</th><th>Primary model</th><th>Frequency</th></tr></thead>
+<thead><tr><th>Provider</th><th>Reach</th><th>Use case</th></tr></thead>
 <tbody>
-<tr><td>T1 hot</td><td>Per tool call — SQL gen, hybrid_search, propose_done</td><td><code>qwen3.5:latest</code> local, <code>think:false</code></td><td>50-200/scenario</td></tr>
-<tr><td>T2 review</td><td>Per-step consensus, drift flagging</td><td><code>qwen3:latest</code> local, <code>think:false</code></td><td>5-14/event</td></tr>
-<tr><td>T3 overview</td><td>Mid-day checkpoints + cross-day lesson distill</td><td><code>gpt-oss:120b</code> Ollama Cloud, thinking on</td><td>1-3/scenario</td></tr>
-<tr><td>T4 strategic</td><td>Pattern re-ranking, weekly gap audit</td><td><code>qwen3.5:397b</code> cloud</td><td>1-10/day</td></tr>
-<tr><td>T5 gatekeeper</td><td>Schema migrations, autotune config changes</td><td><code>kimi-k2-thinking</code> cloud, audit-logged</td><td>1-5/day</td></tr>
+<tr><td><code>ollama</code></td><td>localhost:3200 — local sidecar over Ollama</td><td>Hot-path JSON emitters, embeddings, last-resort rescue</td></tr>
+<tr><td><code>ollama_cloud</code></td><td>ollama.com bearer key — gpt-oss:120b, qwen3-coder:480b, deepseek-v3.1:671b, kimi-k2:1t, mistral-large-3:675b, qwen3.5:397b</td><td>Strong-model reviewer rungs, T3+ overview, scrum master pipeline</td></tr>
+<tr><td><code>openrouter</code></td><td>openrouter.ai/api/v1 — 343 models incl. Anthropic/Google/OpenAI/MiniMax/Qwen, paid + free tiers</td><td>Paid ladder for observer escalations, free-tier rescue</td></tr>
+<tr><td><code>opencode</code></td><td>opencode.ai/zen/v1 — <strong>40 frontier models reachable through ONE sk-* key</strong>: Claude Opus 4.7 / Sonnet / Haiku, GPT-5.5-pro / 5.4 / codex variants, Gemini 3.1-pro, Kimi K2.6, GLM 5.1, DeepSeek, Qwen 3.6+, MiniMax, plus 4 free-tier</td><td>Cross-architecture tie-breakers, auditor cross-lineage (Haiku 4.5 + Opus 4.7), high-context reasoning (Opus on diffs &gt;100k chars)</td></tr>
+<tr><td><code>kimi</code></td><td>api.kimi.com/coding/v1 — direct Kimi For Coding</td><td>kimi_architect when ollama_cloud rate-limits; TOS-clean primary path</td></tr>
 </tbody>
 </table>
-<p><strong>Key mechanical finding (2026-04-21):</strong> qwen3.5 and qwen3 are <em>thinking</em> models — they burn ~650 tokens of hidden reasoning before emitting the visible response. For hot-path JSON emitters this meant 400-token budgets returned empty strings. Fix: <code>think: false</code> plumbed through sidecar's <code>/generate</code> endpoint; hot path disables thinking (structure matters more than reasoning depth), overseer tiers keep it on. Mistral was dropped entirely after a 0/14 fill rate on complex scenarios (decoder-level malformed-JSON bug, not a prompt issue).</p>
-<p><strong>Continuation primitive (Phase 21):</strong> <code>generateContinuable()</code> handles output-overflow without <code>max_tokens</code> tourniquets — empty response → geometric backoff retry; truncated-JSON → continue with partial as scratchpad. <code>generateTreeSplit()</code> handles input-overflow via map-reduce with running scratchpad. Both respect <code>assertContextBudget()</code> so silent truncation can't happen.</p>
+
+<h3>The 9-rung cloud-first ladder</h3>
+<p>Defined in <code>tests/real-world/scrum_master_pipeline.ts</code> as <code>const LADDER</code>. Each attempt is evaluated by <code>isAcceptable()</code> = chars ≥ 3800 ∧ not malformed JSON-only. On reject, the next rung sees a learning preamble carrying the prior rejection reason.</p>
+<pre>1  ollama_cloud / kimi-k2:1t            1T params · flagship
+2  ollama_cloud / qwen3-coder:480b      coding specialist
+3  ollama_cloud / deepseek-v3.1:671b    reasoning
+4  ollama_cloud / mistral-large-3:675b  deep analysis
+5  ollama_cloud / gpt-oss:120b          reliable workhorse
+6  ollama_cloud / qwen3.5:397b          dense final thinker
+7  openrouter   / openai/gpt-oss-120b:free  rescue tier
+8  openrouter   / google/gemma-3-27b-it:free fastest rescue
+9  ollama       / qwen3.5:latest        last-resort local</pre>
+
+<h3>N=3 consensus + cross-architecture tie-breaker</h3>
+<p>Every audit and every consensus-required call fires the primary reviewer N=3 times in parallel (Promise.all — wall-clock = single call). Aggregate votes per claim_idx, majority wins. On a 1-1-1 split, a tie-breaker model with <em>different architecture</em> (qwen3-coder:480b vs primary gpt-oss/kimi) is invoked. Every disagreement, even when majority resolves, writes to <code>data/_kb/audit_discrepancies.jsonl</code>. Closes the cloud-non-determinism gap: <code>temp=0</code> isn't actually deterministic in practice across hours; consensus + cross-architecture tie-break stabilizes verdicts.</p>
+
+<h3>Auditor cross-lineage (Kimi ↔ Haiku ↔ Opus)</h3>
+<p>Every push to PR #11 triggers <code>auditor/audit.ts</code> within ~90s. To prevent a single model lineage's blind spots from becoming the system's blind spots, audits alternate between Kimi K2.6 (Moonshot lineage) and Haiku 4.5 (Anthropic lineage) by head SHA. Diffs over 100k chars auto-promote to Claude Opus 4.7 (Anthropic frontier). Per-PR cap of 3 audits with auto-reset on each new head SHA prevents infinite-loop spend. <strong>Latest verdict on c3c9c21:</strong> Haiku 4.5, 24.6s, 100% grounding-verified across 10 findings.</p>
+
+<h3>Distillation v1.0.0 — the frozen substrate</h3>
+<p>The substrate the auditor and mode runner sit on is tagged at <code>distillation-v1.0.0</code> / commit <code>e7636f2</code>. <strong>145 unit tests pass · 22/22 acceptance invariants · 16/16 audit-full checks · bit-identical reproducibility verified.</strong> The distillation phase exports clean SFT / RAG / preference samples with a multi-layer contamination firewall (<code>SFT_NEVER</code> constant + scorer category mapping + acceptance fixtures); the auditor consumes the substrate. The frozen tag means: any future "the system regressed" question has a baseline to bisect against, byte-for-byte.</p>
+
+<h3>Continuation primitive (Phase 21)</h3>
+<p><code>generateContinuable()</code> handles output-overflow without <code>max_tokens</code> tourniquets — empty response → geometric backoff retry; truncated-JSON → continue with partial as scratchpad. <code>generateTreeSplit()</code> handles input-overflow via map-reduce with running scratchpad. Both respect <code>assertContextBudget()</code> so silent truncation can't happen. Now Rust-native in <code>crates/aibridge/src/continuation.rs</code> (Phase 44).</p>
 
 <h3>Per-staffer tool_level (Phase 23)</h3>
 <p>Scenarios can be scoped to a specific coordinator (<code>staffer: {id, name, tenure_months, role, tool_level}</code>). <code>tool_level</code> controls which tiers are available:</p>
@@ -265,6 +292,12 @@ table.plain tr:hover td{background:#0d1117}
 <tr><td>Boost workers based on past success</td><td>No</td><td>Yes (Phase 19 playbook_memory)</td></tr>
 <tr><td>Penalize workers based on past failure</td><td>No</td><td>Yes (<code>/log_failure</code> + <code>0.5<sup>n</sup></code> penalty)</td></tr>
 <tr><td>Surface traits across past fills</td><td>No</td><td>Yes (<code>/vectors/playbook_memory/patterns</code>)</td></tr>
+<tr><td>Per-staffer relevance gradient</td><td>No</td><td>Yes — same query reshapes per coordinator (<code>staffer_id</code> on <code>/intelligence/chat</code>); MARIA'S MEMORY pill labels the playbook context with the active coordinator</td></tr>
+<tr><td>Triage in one shot — late-worker → backfills + draft SMS</td><td>No</td><td>Yes (<code>/intelligence/chat</code> Route 6 — pulls profile + 5 same-role same-geo backfills sorted by responsiveness + drafts client SMS in ~250ms)</td></tr>
+<tr><td>Permit → fill plan derivation (forward demand)</td><td>No</td><td>Yes (<code>/intelligence/permit_contracts</code> — Chicago Socrata permit → role / headcount / deadline / fill probability / gross revenue per card)</td></tr>
+<tr><td>Public-issuer attribution across contractor graph</td><td>No</td><td>Yes (<code>/intelligence/profiler_index</code> — direct + parent + co-permit associated tickers; live Stooq prices)</td></tr>
+<tr><td>Cross-lineage AI audit on every PR</td><td>No</td><td>Yes (auditor crate — Kimi K2.6 ↔ Haiku 4.5 alternation + Opus 4.7 auto-promote on big diffs)</td></tr>
+<tr><td>Pathway memory — system-level hot-swap by task fingerprint</td><td>No</td><td>Yes (88 traces, 11/11 successful replays, 100% reuse rate, ADR-021)</td></tr>
 <tr><td>Predict staffing demand from external data</td><td>No</td><td>Yes (Chicago permit feed + 30-day rolling forecast)</td></tr>
 <tr><td>Count down to staffing deadline per contract</td><td>No</td><td>Yes (permit issue_date + heuristic timeline)</td></tr>
 <tr><td>Explain why each candidate ranked</td><td>No</td><td>Yes (boost chip + narrative citations + memory pattern)</td></tr>
@@ -278,7 +311,7 @@ table.plain tr:hover td{background:#0d1117}
 <div class="chapter" id="ch6">
 <div class="num">Chapter 6</div>
 <h2>How it gets better over time</h2>
-<div class="lede">Compounding learning across seven paths. The first three are automatic background loops. Paths 4-7 landed 2026-04-21 and turn the system into a reinforcement-learning pipeline: outcomes → knowledge base → pathway recommendations → cloud rescue → competence-weighted retrieval → observer analysis. All seven happen without operator intervention.</div>
+<div class="lede">Compounding learning across ten paths. The first three are automatic background loops. Paths 4-7 (Phase 22-24) added the reinforcement layer: outcomes → KB → recommendations → cloud rescue → competence-weighted retrieval → observer analysis. Paths 7-9 (Phase 25-43, 2026-04-26→27) added the system-level memory layers: pathway memory by task fingerprint (ADR-021), per-staffer hot-swap, and the Construction Activity Signal Engine. All ten happen without operator intervention.</div>
 
 <h3>Path 1 — Playbook boost with geo + role prefilter (Phase 19 + refinement)</h3>
 <p>Every sealed fill is seeded to <code>playbook_memory</code>. The boost fires inside <code>/vectors/hybrid</code> when <code>use_playbook_memory: true</code>. Math, tightened 2026-04-21 after a diagnostic pass found globally-ranked playbooks were missing the SQL-filtered candidate pool entirely:</p>
@@ -311,7 +344,19 @@ boost[(city, state, name)] = min(Σ per_worker, 0.25)</pre>
 <p>Answers "who handled this" as a first-class matrix-index dimension. Each scenario carries <code>staffer: {id, name, tenure_months, role, tool_level}</code>. After every run, <code>recomputeStafferStats(staffer_id)</code> aggregates their fill_rate, turn efficiency, citation density, rescue rate into a single <code>competence_score</code> (0.45·fill + 0.20·turn_eff + 0.20·cites + 0.15·rescue).</p>
 <p><code>findNeighbors</code> returns <code>weighted_score = cosine × max_staffer_competence</code> — top-performer playbooks rank above juniors' on similar scenarios. Auto-discovery emerges: running 4 staffers × 3 contracts × 3 rounds surfaced Rachel D. Lewis (Welder Nashville) with 18 endorsements across all 4 staffers, Angela U. Ward (Machine Op Indianapolis) with 19 — reliable-performer labels the system built without human tagging.</p>
 
-<h3>Path 7 — Observer outcome ingest (Phase 24)</h3>
+<h3>Path 7 — Pathway memory (ADR-021 — semantic-correctness matrix layer)</h3>
+<p>Memory at the system layer, not the worker layer. Every accepted scrum review writes a <code>PathwayTrace</code> with the full backtrack: file fingerprint, model used, signal class, KB chunks consulted, observer events, semantic flags (UnitMismatch, TypeConfusion, OffByOne, StaleReference, DeadCode, BoundaryViolation, …), bug fingerprints. A new query that fingerprints to the same trace can hot-swap to the prior result without re-running the 9-rung escalation. Five-factor hot-swap gate: narrow fingerprint match AND audit consensus pass AND replay_count ≥ 3 (probation) AND success_rate ≥ 0.80 AND NOT retired AND vector cosine ≥ 0.90.</p>
+<p><strong>Live state (verified on this load):</strong> 88 traces · 11 / 11 successful replays · 100% reuse rate · probation gate crossed. Endpoints: <code>/vectors/pathway/insert</code> · <code>/query</code> · <code>/record_replay</code> · <code>/stats</code> · <code>/bug_fingerprints</code>. Spec: <code>docs/DECISIONS.md</code> ADR-021.</p>
+
+<h3>Path 8 — Per-staffer hot-swap index</h3>
+<p>Memory scoped to whoever's acting. <code>/intelligence/chat</code> accepts <code>staffer_id</code>; on match, defaults state filter to staffer territory, scopes playbook-pattern geo to staffer's primary city/state, and surfaces <code>response.staffer.name</code> so the UI relabels MEMORY → MARIA'S MEMORY. Same query "forklift operators" returns 167 IL workers as Maria, 89 IN as Devon, 16 WI as Aisha. The corpus stays intact; the relevance gradient is per coordinator; each accumulates fills independently.</p>
+<p><strong>Roster:</strong> <code>/staffers</code> endpoint reads from <code>STAFFERS</code> in <code>mcp-server/index.ts</code>. Three personas today (Maria/Devon/Aisha); architecture generalizes — every new metro adds territories, not code paths.</p>
+
+<h3>Path 9 — Construction Activity Signal Engine</h3>
+<p>Memory at the network layer. Every contractor in the corpus is also a forward indicator on the public equities they touch via three attribution flavors: <code>direct</code> (contractor IS the public issuer — SEC tickers index match), <code>parent</code> (subsidiary of a public parent — curated KNOWN_PARENT_MAP, e.g. Turner → HOC.DE via Hochtief AG), <code>associated</code> (co-permit network — Bob's Electric appears with TARGET CORPORATION 3+ times → inherits TGT). The associated path is the moat: a staffing-permit dataset that maps contractor-to-public-issuer is not commercially available; we synthesize it from the Socrata co-occurrence graph.</p>
+<p><strong>BAI (Building Activity Index)</strong> = attribution-weighted average day-change across surfaced issuers. <strong>Indexed build value</strong> = total $ of permits attributable to ANY public issuer in scope. <strong>Network depth</strong> = issuers / total attribution edges. Cross-metro replication explicit in the architecture — Chicago is Phase 1; NYC DOB / LA County / Houston BCD / Boston ISD / DC DCRA are all Socrata-shaped, ship as config-only adapters.</p>
+
+<h3>Path 10 — Observer outcome ingest (Phase 24)</h3>
 <p>Observer runs as <code>lakehouse-observer.service</code>, now with an HTTP listener on <code>:3800</code>. Scenarios POST per-event outcomes to <code>/event</code> with full provenance (staffer_id, sig_hash, event_kind, role, city, state, rescue flags). Observer's ERROR_ANALYZER and PLAYBOOK_BUILDER loops consume them alongside MCP-wrapped ops. Persistence switched from the old <code>/ingest/file</code> REPLACE path to an append-only <code>data/_observer/ops.jsonl</code> journal so the trace survives across restarts.</p>
 
 <h3>Input normalizer + unified memory query</h3>
@@ -399,7 +444,11 @@ boost[(city, state, name)] = min(Σ per_worker, 0.25)</pre>
 <div class="chapter" id="ch9">
 <div class="num">Chapter 9</div>
 <h2>Per-staffer context</h2>
-<div class="lede">Twenty staffers don't see the same UI state. Each one's session is shaped by their active profile, their workspaces, their assigned contracts, and their client's blacklists.</div>
+<div class="lede">Twenty staffers don't see the same UI state. Each one's session is shaped by their identity (the per-staffer hot-swap index — Path 8 in Ch6), their active profile, their workspaces, their assigned contracts, and their client's blacklists.</div>
+
+<h3>Per-staffer hot-swap index (the recent layer)</h3>
+<p>Maria runs Chicago. Devon runs Indianapolis. Aisha runs Wisconsin/Michigan. They share one corpus, but search results, recurring-skill patterns, and playbook context all reshape to whoever is acting. <code>/intelligence/chat</code> accepts <code>staffer_id</code>; on match, defaults state filter to the staffer's territory, scopes playbook-pattern geo to their primary city/state, and surfaces <code>response.staffer.name</code> so the UI relabels MEMORY → <em>MARIA'S MEMORY</em>.</p>
+<p><strong>Verified end-to-end:</strong> same query "forklift operators" returns 167 IL workers as Maria, 89 IN as Devon, 16 WI as Aisha (live numbers; refresh the profiler page to recompute). The corpus stays intact; the relevance gradient is per coordinator. As each accumulates fills, their slice of the playbook compounds independently. <strong>Roster:</strong> <code>/staffers</code> endpoint, declared in <code>STAFFERS</code> in <code>mcp-server/index.ts</code>. Adding a staffer is one append; the architecture is metro-agnostic by construction.</p>
 
 <h3>Active profile (Phase 17)</h3>
 <p>Scopes every search. A <code>staffing-recruiter</code> profile bound to <code>workers_500k</code> sees only that dataset. A <code>security-analyst</code> profile bound to <code>threat_intel</code> cannot see worker data. <code>GET /vectors/profile/&lt;id&gt;/audit</code> records every tool invocation by model identity.</p>
@@ -446,7 +495,7 @@ boost[(city, state, name)] = min(Σ per_worker, 0.25)</pre>
 
 <div class="step"><div class="n">12:30</div><div class="body"><strong>Client pushes 20 new contracts + 1M ATS delta.</strong> Ch7 scale flow fires. Ingest in seconds; embedding refresh kicks off as a background job. Searches continue against old embeddings.</div></div>
 
-<div class="step"><div class="n">14:00</div><div class="body"><strong>Emergency: worker Dave no-showed.</strong> Sarah clicks No-show button on Dave's card → <code>/log_failure</code> → <code>mark_failed</code> records a penalty. Next similar query dampens Dave's boost by 0.5. Sarah continues the refill — the refill excludes Dave and the 2 others already booked for this shift.</div></div>
+<div class="step"><div class="n">14:00</div><div class="body"><strong>Emergency: worker Dave no-showed.</strong> Sarah types "Dave running late site 4422" into the search box. ~250ms later: triage card with Dave's profile + reliability + responsiveness, draft SMS to client ("dispatching X from local bench, 96% reliability, will confirm arrival"), and 5 same-role same-geo backfills sorted by responsiveness rendered as a green list below. Sarah clicks Copy SMS, pastes to client, clicks Call on the top backfill. <code>/log_failure</code> on Dave records the penalty for the next similar query.</div></div>
 
 <div class="step"><div class="n">15:00</div><div class="body"><strong>New embeddings live.</strong> Hot-swap promotion. Searches now see all 1M new profiles. Sarah's noon query re-run would produce different top-5.</div></div>
 
@@ -468,14 +517,15 @@ boost[(city, state, name)] = min(Σ per_worker, 0.25)</pre>
 
 <h4>Deferred — real architectural work, just not shipped yet</h4>
 <ul>
+<li><strong>BAI persistence + backtesting.</strong> Building Activity Index is computed live per page load. To validate the thesis (permit activity precedes equity moves) we need the daily series saved over months. Architectural support exists (<code>data/_kb/audit_baselines.jsonl</code> append pattern); just hasn't run long enough.</li>
+<li><strong>NYC DOB adapter.</strong> Architecture is metro-agnostic — Chicago is Phase 1. NYC DOB ships next as a config-only Socrata adapter; LA County, Houston BCD, Boston ISD, DC DCRA queue behind it. Each new metro multiplies network edges without multiplying the codebase.</li>
+<li><strong>12 awaiting public-data sources for contractor profile.</strong> DOL Wage &amp; Hour, EPA ECHO, MSHA, BBB, PACER civil suits, UCC liens, D&amp;B credit, State licensure, Surety bonds, DOT/FMCSA, State UI claims, DOL RAPIDS apprenticeships. Listed by name on every contractor profile with a one-line "would show:" sample. Each ships as a Socrata-style adapter; engineering scope is concrete.</li>
 <li><strong>Rate / margin awareness.</strong> Worker pay expectations vs contract bill rate not modeled. Requires adding <code>pay_rate</code> to workers, <code>bill_rate</code> to contracts, and a filter + warning path. Partially addressed via <code>ContractTerms.budget_per_hour_max</code> passed to T3/rescue prompts, but the match-time filter isn't wired yet.</li>
-<li><strong>Mem0-style UPDATE / DELETE / NOOP operations on playbooks.</strong> Today <code>/seed</code> only ADDs. Same <code>(operation, date)</code> pair appends a duplicate instead of refining an existing entry. Phase 26 item — cheap to add, moderate payoff.</li>
-<li><strong>Letta working-memory hot cache.</strong> Every boost query scans all active playbook entries from in-memory state. 1.9K today; cheap. Will bite somewhere north of 100K. LRU for the last-N playbooks or current-sig neighborhood deferred until that ceiling approaches.</li>
-<li><strong>Chunking cache (Phase 21 Rust port).</strong> TS primitives <code>generateContinuable</code> + <code>generateTreeSplit</code> are wired, but <code>crates/aibridge/src/{continuation.rs, tree_split.rs}</code> + <code>crates/storaged/src/chunk_cache.rs</code> remain queued. Gateway-side callers currently don't have the same protection against silent truncation that the TS test harness does.</li>
+<li><strong>Mem0-style UPDATE / DELETE / NOOP operations on playbooks.</strong> Today <code>/seed</code> only ADDs. Same <code>(operation, date)</code> pair appends a duplicate instead of refining an existing entry. Cheap to add, moderate payoff.</li>
+<li><strong>Letta working-memory hot cache.</strong> Every boost query scans all active playbook entries from in-memory state. ~5K today; cheap. Will bite somewhere north of 100K. Deferred until the ceiling approaches.</li>
 <li><strong>Confidence calibration.</strong> Top-K is a rank, not a probability. No calibrated "85% likely to accept" score. Requires outcome-labeled training data.</li>
-<li><strong>Neural re-ranker.</strong> Phase 19 is statistical + semantic (now with geo + role prefilter, Phase 25 retirement). A (query, candidate, outcome)-trained re-ranker is deferred only if the statistical floor plateaus below usable recall — current 14× citation lift on identical inputs suggests it hasn't.</li>
-<li><strong>Observer → autotune feedback wire.</strong> Phase 24 streams scenario outcomes into <code>data/_observer/ops.jsonl</code>; autotune agent still runs on its own HNSW-trial schedule and hasn't subscribed to the outcome metric stream yet. Phase 26+ item — connects the last loop.</li>
-<li><strong>call_log cross-reference.</strong> Infrastructure present; current synthetic candidates table is too small to cross-ref. Fixes when real ATS lands.</li>
+<li><strong>SEC name-to-ticker fuzzy precision.</strong> Current matcher requires ≥2 non-stopword overlap; rare false positives still surface (saw FLG attach to a PNC-adjacent contractor once). Tightenable to require an explicit allow-list for production trading use.</li>
+<li><strong>Tighter integration of pathway memory + scrum loop.</strong> ADR-021 substrate is shipped (88 traces, 11/11 replays). The hot-swap gate fires correctly; what's deferred is automatic mode-runner short-circuit when a high-confidence pathway match is available before any cloud call burns.</li>
 </ul>
 
 <h4>Non-goals — explicitly out of scope</h4>
@@ -496,6 +546,6 @@ boost[(city, state, name)] = min(Σ per_worker, 0.25)</pre>
 </div>
 </div>
 
-<div class="footer">Lakehouse spec · v2 2026-04-21 · Phases 19-25 shipped (playbook boost, model matrix, continuation, KB, staffer competence, observer ingest, validity windows) · maintained from <code>docs/DECISIONS.md</code> · <a href="proof">architecture live-tested</a> · <a href="console">walkthrough</a></div>
+<div class="footer">Lakehouse spec · v3 2026-04-27 · Phases 19-45 shipped (playbook boost, KB, staffer competence, observer ingest, validity windows, distillation v1.0.0 substrate frozen at e7636f2, gateway as OpenAI-compat drop-in, mode runner, validator + iterate, pathway memory ADR-021, per-staffer hot-swap, Construction Activity Signal Engine) · maintained from <code>docs/DECISIONS.md</code> · <a href="proof">architecture live-tested</a> · <a href="console">walkthrough</a> · <a href="profiler">profiler</a></div>
 
 </body></html>

reports/kimi/cross-lineage-bakeoff.md

@@ -0,0 +1,81 @@
+# Cross-Lineage Auditor Bake-Off — 2026-04-27
+
+Same diff (`HEAD~5..HEAD~2`, 32KB, 3 commits = the kimi-integration work)
+audited by three models from three vendor lineages. All three through
+the lakehouse gateway, all three with the same `kimi_architect` prompt
+template + grounding verification.
+
+## Results
+
+| | Kimi K2.6 (Moonshot) | Haiku 4.5 (Anthropic) | Opus 4.7 (Anthropic) |
+|---|---|---|---|
+| Provider | ollama_cloud | opencode/Zen | opencode/Zen |
+| Latency | 53.7s | **20.5s** | 53.6s |
+| Findings | 10 | 9 | 10 |
+| Grounded | 10/10 | 9/9 | 10/10 |
+| Severity (block/warn/info) | 0 / 9 / 1 | 0 / 5 / 4 | **3 / 5 / 2** |
+| Cost | flat-sub (Ollama Pro) | ~$0.02 | ~$0.10–0.15 |
+| Style | Architectural / migration | Boundary / resilience | Escalation / cross-file |
+
+## Severity escalation pattern
+
+Only Opus produced `block`-level findings. Haiku and Kimi described
+the same kind of issues as `warn`. This isn't randomness — it's
+training. Anthropic's Opus is calibrated to flag merge-stoppers more
+confidently than the lighter-weight or different-lineage models.
+
+## What ONLY Opus 4.7 caught
+
+- `parseFindings` rationale regex truncates on inline `**bold**`
+  inside rationales — neither Haiku nor Kimi noticed
+- Cache-by-head-SHA survives `LH_AUDITOR_KIMI_MODEL` env flip
+  (silently returns old findings under wrong model name)
+- Gateway/auditor timeout mismatch: kimi.rs 600s vs auditor curl 900s
+
+## What ALL three caught
+
+- `(ev as any).contractor` schema bypass (3/3)
+- Empty-env `Number("")` returns 0 trap (3/3)
+- `readFileSync` in async function (3/3)
+- mode.rs Rust test compile error (3/3)
+
+Three-lineage consensus = high-confidence load-bearing real bug.
+
+## What only Kimi K2.6 caught
+
+- Schema version bump v1→v2 without explicit migration path
+- ISO timestamp precision in run_id derivation
+- Multimodal content array passed verbatim to Kimi (would 400)
+
+Kimi favors architectural / API-contract concerns. Useful when the
+diff is a refactor rather than a feature.
+
+## What only Haiku 4.5 caught
+
+- `appendMetrics` mkdir target uses `join(path, "..")` not `dirname`
+- `KIMI_MODEL` cast in `parseFindings` not validated against type
+- Truncation of error messages in callKimi at 300 chars loses context
+
+Haiku favors boundary cases — what happens when assumptions break.
+
+## Cost-vs-quality verdict
+
+| Diff size | Recommended model | Why |
+|---|---|---|
+| < 100k chars (normal PRs) | Haiku 4.5 | 80% of the same surface, 5x cheaper, 2.6x faster |
+| > 100k chars (refactors, multi-file) | Opus 4.7 | Cross-file ramifications + escalation that lighter models miss |
+
+Auto-promotion implemented in `auditor/checks/kimi_architect.ts:74`
+via `selectModel(diffLen)`. Threshold env-overridable
+(`LH_AUDITOR_KIMI_OPUS_THRESHOLD_CHARS`, default 100000).
+
+## Methodology notes
+
+- Same prompt template, same grounding rules, same input bundle
+- Each call cached at `data/_auditor/kimi_verdicts/<pr>-<sha>.json`
+- Per-call metrics appended to `data/_kb/kimi_audits.jsonl`
+- Wall-clock measured from request POST to response parse
+- Cost computed as `prompt_tokens * input_rate + completion_tokens * output_rate`
+- `usage.prompt_tokens` underreports through opencode proxy path
+  (verified ~7k input tokens vs reported 5); cost figures use
+  observed prompt size rather than reported.

reports/staffing/synthetic-data-gap-report.md

@@ -0,0 +1,232 @@
+# Staffing Synthetic Data — Gap Report
+
+**Date:** 2026-04-27
+**Status:** read-only inventory; no data generated
+**Spec:** J's "Lakehouse Staffing Integration" prompt
+**Companion:** `docs/recon/staffing-lakehouse-distillation-recon.md`
+
+This is the up-front gap report the spec mandates BEFORE any audit runner is built or any synthetic data is generated. It enumerates every staffing parquet on disk, tallies fields, flags PII status, and reports whether the data is **fit for the audit it's meant to validate**.
+
+The headline finding: **the synthetic data is broad but inconsistent**. Three distinct worker schemas exist across five files; PII is raw (not masked); audit usefulness is high for some streams (workers_500k, scenarios) and low for others (sparse_workers, new_candidates). **No new data should be generated until the inconsistencies are resolved or explicitly accepted as test fixtures.**
+
+---
+
+## 1. Record counts + entity types
+
+| Stream | Path | Rows | Entity | Notes |
+|---|---|---|---|---|
+| candidates | `data/datasets/candidates.parquet` | 1,000 | candidate | recruiter-side ATS-style records |
+| job_orders | `data/datasets/job_orders.parquet` | 15,000 | job_order | client-side req records |
+| workers_500k | `data/datasets/workers_500k.parquet` | 500,000 | worker | full population with scores + resume + comms |
+| workers_100k | `data/datasets/workers_100k.parquet` | 100,000 | worker | scaled-down sibling |
+| ethereal_workers | `data/datasets/ethereal_workers.parquet` | 10,000 | worker | scenario-friendly subset |
+| client_workersi | `data/datasets/client_workersi.parquet` | 160 | worker | client "approved roster" view, simpler shape |
+| client_workerskjkk | `data/datasets/client_workerskjkk.parquet` | 160 | worker | typo-named sibling of above |
+| sparse_workers | `data/datasets/sparse_workers.parquet` | 200 | worker (sparse) | edge-case fixture |
+| new_candidates | `data/datasets/new_candidates.parquet` | 3 | candidate | demo / smoke-test data |
+| scenarios | `tests/multi-agent/scenarios/*.json` | 44 files | scenario | per-day client fill plans |
+| lessons | `data/_playbook_lessons/*.json` | 64 files | lesson | post-run retrospectives |
+
+**Worker-shape total on disk: ~625k rows across 5 files. Candidate-shape: ~1k.**
+
+---
+
+## 2. Schema-by-schema field inventory
+
+### candidates.parquet (1,000 rows)
+```
+candidate_id (string, "CAND-NNNNN") — present
+first_name (string) — present, raw PII
+last_name (string) — present, raw PII
+email (string) — present, raw PII
+phone (string, formatted "(NNN) NNN-NNNN") — present, raw PII
+city, state — present
+skills (string, CSV) — present
+years_experience (int) — present
+hourly_rate_usd (int) — present, financial
+status (string) — present (sample: "placed"; full enum unknown)
+```
+Missing fields a real ATS would have: `created_at`, `last_contact`, `recruiter_id`, `source` (referral/website/cold), `placement_count`, `blacklisted_clients`. None of these block the audit but they limit what staffing-PRD-drift can verify.
+
+### job_orders.parquet (15,000 rows)
+```
+job_order_id (string, "JO-NNNNNN") — present
+client_id (string, "CLI-NNNNN") — present
+title (string) — present
+vertical (string) — present
+bill_rate, pay_rate (float) — present, financial
+status (string) — present (sample: "closed")
+city, state, zip — present
+description (string) — present, generated text
+```
+Missing fields: `created_at`, `target_count`, `filled_count`, `start_date`, `end_date`, `requirements (skills array)`. The `description` field embeds these informally ("Requires: ...", "6+ years exp", "$34.97/hr"). Parsing them into structured fields is what the audit needs to verify.
+
+### workers_500k.parquet / workers_100k / ethereal_workers (same schema)
+```
+worker_id (int, sequential) — present
+name (string) — present, raw PII
+role (string) — present
+email (string) — present, raw PII
+phone (int, no formatting) — present, raw PII (also wrong type — should be string given leading digits)
+city, state, zip — present
+skills (string, CSV in single column) — present
+certifications (string, CSV) — present
+archetype (string, enum, sample: "flexible") — present, full enum unknown
+reliability, responsiveness, engagement, compliance, availability (float 0-1) — present
+communications (string, multi-msg with " | " separator) — present
+resume_text (string) — present
+```
+Missing: `created_at`, `last_active`, `geo_radius_mi`, `certifications_expiry`. The 5 personality scores are the matchmaking signal.
+
+### client_workersi / client_workerskjkk (160 rows each, simpler shape)
+```
+worker_id, name, role, city, state, email, phone, skills, certifications, availability, reliability, archetype
+```
+**3 fields fewer than workers_500k**: missing `responsiveness`, `engagement`, `compliance`, `communications`, `resume_text`, `zip`. Plus `phone` is here as string vs int in workers_500k.
+
+### sparse_workers.parquet (200 rows, completely different shape)
+```
+name, phone, role, city, state, notes
+```
+**No worker_id, no scores, no email, no skills/certifications/archetype.** This is a recruiter-shorthand fixture — useful for testing "missing-fields graceful degradation" but NOT a staffing source.
+
+### new_candidates.parquet (3 rows, candidate-shape)
+```
+name, phone, email, city, state, skills, years
+```
+**Missing the `candidate_id`** that exists in candidates.parquet. Tiny + smoke-test only.
+
+---
+
+## 3. PII / tokenization status
+
+| Stream | PII fields | Masked? | Risk if LLM sees this |
+|---|---|---|---|
+| candidates | first_name, last_name, email, phone | ❌ raw | Names are real-shape; emails are `firstname.lastnameN@example.com` (clearly fake); phones are realistic-looking — could fool a model into citing them as real |
+| workers_500k | name, email, phone | ❌ raw | Same risk — but at 500k scale, retrieval-time exposure is the more relevant concern |
+| client_workers* | name, email, phone | ❌ raw | Same |
+| sparse_workers | name, phone | ❌ raw | Same |
+| new_candidates | name, email, phone | ❌ raw | Same |
+| job_orders | (none — client_id is opaque) | n/a | low risk; description text doesn't leak PII |
+| scenarios | (worker names sometimes appear in lesson text) | ❌ inline | "Susan X. Ruiz double-booked" — verbatim names in lesson markdown |
+| lessons | worker names embedded in `lesson` field | ❌ inline | same |
+
+**Critical:** `crates/shared/src/pii.rs::detect_sensitivity` recognizes `email`, `phone`, `ssn` as PII. `catalogd::service.rs:264` carries `column_redactions: HashMap<String, Redaction>`. **But enforcement at query time is unverified.** Whether retrieval through `staffing_inference_lakehouse` mode actually applies the mask — and whether the workers_500k_v8 vector corpus was built with masked text or raw — is the staffing audit's first deterministic check.
+
+The synthetic email convention (`first.lastN@example.com`) is fake-recognizable to humans but a model trained to extract emails would still extract them as if real. Until either (a) the catalog masks them at query time or (b) a `_safe` view replaces PII with hashed tokens before vectorization, **the LLM has plausibly been seeing PII for every staffing query**.
+
+---
+
+## 4. Search usefulness (as a corpus)
+
+| Stream | Searchable | Rich enough for retrieval | Notes |
+|---|---|---|---|
+| workers_500k | ✓ | **High** | resume_text + comms = good RAG. archetype + 5 scores = good filtering signal |
+| ethereal_workers | ✓ | High | same shape as 500k, smaller test slice |
+| candidates | ✓ | Medium | skills as CSV string (not array — tokenize before search). No resume text |
+| job_orders | ✓ | Medium | description carries requirements informally. No structured `required_skills` array |
+| client_workers* | ✓ | Low | no resume, no scores beyond reliability/availability |
+| sparse_workers | minimal | Low | useful for "graceful degradation" tests only |
+| new_candidates | n/a | Trivial | 3 rows |
+
+**`workers_500k_v8` vector corpus exists** — it's the staffing-mode-runner's matrix corpus. Whether its content was sourced from the masked catalog view or raw parquet is the build-time question for the audit.
+
+---
+
+## 5. Audit usefulness
+
+| Stream | Audit value |
+|---|---|
+| scenarios | **High** — 44 fully-specified fill plans with timestamps, roles, counts, geo. Deterministic acceptance fixture material |
+| lessons | High — 64 retrospectives with `events_total`/`events_ok` ratios. The closest thing to a fill-success ledger |
+| outcomes.jsonl | High — already consumed by Phase 2 distillation transforms |
+| candidates | Medium — `status` field is the verdict but enum is implicit |
+| job_orders | Medium — `status: closed` count vs `target_count` (missing field) is the obvious metric, blocked by schema gap |
+| workers_500k | Medium — `archetype` + scores enable per-worker reliability checks but no "did this worker get filled" signal lives here |
+| client_workers* | Low — no temporal or status fields |
+| sparse_workers | Low — fixture data |
+| new_candidates | None — too few rows |
+
+---
+
+## 6. Concrete gap list (what's missing)
+
+### Blocking gaps (must fix or accept before audit ships)
+1. **No structured fill-event log.** Scenarios + lessons describe fills retrospectively but no row-per-event ledger exists. The audit's "candidate/job matching integrity" check needs this. **Decision needed:** generate a synthetic fill_events.parquet from the 44 scenarios + 64 lessons via deterministic script, OR scope the audit to "best-effort post-hoc reconstruction". Recommend the former — same scenarios + lessons unmodified, just normalized into a queryable shape.
+
+2. **PII masking enforcement unverified.** Cannot ship a staffing audit that claims "PII boundaries respected" until we can prove the LLM-facing path masks. **Decision needed:** add `views/candidates_safe.sql`, `views/workers_safe.sql` (hash-masked) and rebuild `workers_500k_v9` from the safe view. OR: add a runtime check that asserts the LLM's prompt never contains PII regex matches. Recommend both — view at corpus-build time, runtime check as defense-in-depth.
+
+3. **`client_workerskjkk.parquet` typo file.** Obviously not authoritative; either delete or rename. **Decision:** remove from canonical list; add a startup gate that errors on unrecognized parquet names in `data/datasets/`.
+
+4. **`workers_500k.phone` is `int`, should be `string`.** Leading-zero loss is a real bug. Affects email/phone joins. **Decision:** fixup script + new schema version, OR document and accept (test data only).
+
+### Soft gaps (audit can run; results will reflect the gap)
+5. Missing `created_at` / `last_active` timestamps on every entity — staffing recency rules can't fire.
+6. No `target_count` / `filled_count` on job_orders — fill-rate metric requires parsing description.
+7. `candidates.status` enum undocumented — can audit count distribution but can't claim "all expected statuses present".
+8. `archetype` enum undocumented — same.
+9. No worker→candidate join key. They're plausibly the SAME population in different shapes; the audit will assume distinct unless documented otherwise.
+
+### Non-gaps (sufficient as-is)
+10. 500k workers is plenty for retrieval-quality testing.
+11. 44 scenarios + 64 lessons is enough for staffing_answers RAG corpus building.
+12. PII detection rules in `pii.rs` are sufficient — the gap is enforcement, not classification.
+
+---
+
+## 7. Whether more synthetic data is needed
+
+**Short answer: no, not for the initial staffing audit.**
+
+The existing data is enough to:
+- Run schema validity checks (Phase 1 of staffing audit)
+- Audit PII enforcement (Phase 2)
+- Build a staffing_answers RAG corpus from scenarios + lessons (Phase 3)
+- Run replay against synthetic FillRequest payloads (Phase 4 — uses Phase 7 distillation infra)
+- Detect PRD drift between docs/PRD.md §32 claims and the actual code (Phase 5)
+
+The data is **NOT enough** to:
+- Validate end-to-end fill rates without synthesizing a fill_events ledger from scenarios + lessons (gap #1 above)
+- Test the "system gets smarter over time" Phase 19 claim — would need a longitudinal replay sweep, which is post-audit work
+
+**Recommended decision tree (J to confirm):**
+
+```
+A. Generate fill_events.parquet (deterministic script over scenarios + lessons)?
+   YES → adds 44 × ~5 rows = ~220 events; audit can run candidate/job matching integrity
+   NO  → audit reports "blocked: no fill-event ledger" and exits with that finding
+
+B. Build views/{candidates,workers,jobs}_safe with PII hash-masked?
+   YES → corpus rebuilds from safe views; audit can prove PII boundary respected
+   NO  → audit reports "blocked: cannot prove PII masking; LLM may have seen PII"
+
+C. Delete client_workerskjkk.parquet typo file?
+   YES → cleaner inventory; reduces audit surface
+   NO  → audit flags as anomaly
+
+D. Fix workers_500k.phone type (int → string)?
+   YES → join keys work
+   NO  → audit reports as known data quality issue
+```
+
+If J approves A + B + C + D, **no genuinely new synthetic data needed** — only normalization of what already exists.
+
+---
+
+## 8. Up-front commitments before code
+
+1. The staffing audit, when it ships, will **NOT modify** the distillation v1.0.0 substrate. Verified by `audit-full` running clean before+after.
+2. Synthetic data **modifications** (gap #1 fill_events generation, gap #2 safe views, gap #3 typo deletion, gap #4 phone fixup) happen via deterministic scripts under `scripts/staffing/`, never by hand-edit.
+3. Every new staffing-side artifact (RAG corpus, audit report, fill_events ledger) carries provenance back to its source parquet/scenario/lesson via canonical sha256 — same pattern as distillation Phase 1.
+4. PII handling: the `_safe` views are the source of truth for any LLM-facing text; raw parquets stay on disk but are never the corpus build input.
+
+---
+
+## 9. Phase 1 readiness checklist
+
+- [x] Recon doc exists (`docs/recon/staffing-lakehouse-distillation-recon.md`)
+- [x] Gap report exists (this file)
+- [ ] J approves the 4 gap-fix decisions (A/B/C/D in §7)
+- [ ] J approves the audit scope (which checks ship in v1)
+
+Implementation begins **only after** J's review of both docs.

scripts/check_phase44_callers.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Phase 44 caller-migration guard. Fails if any non-adapter file
+# fetches the sidecar's /generate endpoint or hits Ollama Cloud's
+# /api/generate directly. Adapter files (gateway provider crate +
+# the sidecar's own Python implementation) are exempt.
+#
+# Run:    ./scripts/check_phase44_callers.sh
+# CI:     fail-loud (exits non-zero on regression)
+# Watch:  pre-commit hook — invoke from .git/hooks/pre-commit
+
+set -e
+cd "$(dirname "$0")/.."
+
+FORBIDDEN_TS=$(grep -rEln "fetch\([^)]*[/\$]generate" \
+    --include="*.ts" \
+    --exclude-dir=node_modules \
+    --exclude-dir=target \
+    --exclude-dir=.git \
+    . 2>/dev/null | grep -v "^\./sidecar/" || true)
+
+FORBIDDEN_RS=$(grep -rEln "post\([^)]*\"\.?/generate\"" \
+    --include="*.rs" \
+    --exclude-dir=target \
+    . 2>/dev/null | \
+    grep -vE "^\./crates/(gateway|aibridge)/" || true)
+
+# Ollama Cloud /api/generate outside the gateway adapter. Match only
+# when the URL appears in an actual fetch/post call (not in a comment).
+# Tightened 2026-04-27 — pre-tightening regex flagged prose mentions.
+FORBIDDEN_CLOUD=$(grep -rEln "(fetch|client\.post)\([^)]*api/generate" \
+    --include="*.ts" --include="*.rs" \
+    --exclude-dir=node_modules \
+    --exclude-dir=target \
+    --exclude-dir=.git \
+    . 2>/dev/null | \
+    grep -vE "^\./(crates/gateway|sidecar)" || true)
+
+ANY_FAIL=0
+if [ -n "$FORBIDDEN_TS" ]; then
+    echo "❌ Direct sidecar /generate calls (migrate to /v1/chat):"
+    echo "$FORBIDDEN_TS" | sed 's/^/   /'
+    ANY_FAIL=1
+fi
+if [ -n "$FORBIDDEN_RS" ]; then
+    echo "❌ Direct Rust /generate post() calls (migrate via gateway adapter):"
+    echo "$FORBIDDEN_RS" | sed 's/^/   /'
+    ANY_FAIL=1
+fi
+if [ -n "$FORBIDDEN_CLOUD" ]; then
+    echo "❌ Direct Ollama Cloud /api/generate (migrate to gateway provider=ollama_cloud):"
+    echo "$FORBIDDEN_CLOUD" | sed 's/^/   /'
+    ANY_FAIL=1
+fi
+
+if [ $ANY_FAIL -eq 0 ]; then
+    echo "✅ Phase 44 caller-migration: clean (no direct /generate outside adapters)"
+fi
+exit $ANY_FAIL

scripts/distillation/export_sft.ts

@@ -122,9 +122,18 @@ function synthesizeSft(
     case "observer_reviews":
       instruction = `Observer-review the latest attempt on '${ev.source_files?.[0] ?? "<file>"}'. Verdict: accept | reject | cycle.`;
       break;
-    case "contract_analyses":
-      instruction = `Analyze contractor '${(ev as any).contractor ?? "<contractor>"}' for permit '${ev.task_id.replace(/^permit:/, "")}'. Recommend with risk markers.`;
+    case "contract_analyses": {
+      // Read contractor from the typed metadata bucket (populated in
+      // transforms.ts for contract_analyses rows). Pre-2026-04-27 this
+      // used `(ev as any).contractor` and silently emitted "<contractor>"
+      // for every row because EvidenceRecord didn't carry the field.
+      const contractor = typeof ev.metadata?.contractor === "string" ? ev.metadata.contractor : null;
+      const permit = ev.task_id.replace(/^permit:/, "");
+      instruction = contractor
+        ? `Analyze contractor '${contractor}' for permit '${permit}'. Recommend with risk markers.`
+        : `Analyze permit '${permit}'. Recommend with risk markers.`;
       break;
+    }
     case "outcomes":
       instruction = `Run scenario; report per-event outcome with citations.`;
       break;

scripts/distillation/receipts.ts

@@ -451,7 +451,7 @@ export function buildDrift(current: RunSummary, prior: RunSummary | null): Drift
         delta_accepted: cur.accepted,
         delta_quarantined: cur.quarantined,
         pct_change_out: null,
-        input_hash_match: false,
+        input_hash_match: null,            // no prior stage to compare
         output_hash_match: false,
         deterministic_violation: false,
         notes: ["stage not present in prior run"],
@@ -461,12 +461,12 @@ export function buildDrift(current: RunSummary, prior: RunSummary | null): Drift
     }
     const pct = pctChange(pri.records_out, cur.records_out);
     const out_match = pri.output_hash === cur.output_hash;
-    const inp_match = (current.stages.find(s => s.stage === cur.stage)?.output_hash ?? "")
-                    !== "" /* placeholder */;
-    // We have output_hash on stage summaries but not input_hash —
-    // input_hash lives on the full StageReceipt, which we can re-read
-    // from the run dir if needed. For simplicity, drift compares the
-    // OUTPUT hashes (what really changed).
+    // input_hash is NOT materialized into stage summaries (lives on the
+    // per-stage StageReceipt files on disk). We don't load them here, so
+    // we honestly report null. Schema v2 makes this explicit; v1 returned
+    // `true` unconditionally which made deterministic_violation always
+    // false even when it should have alerted. Cross-run determinism
+    // enforcement is its own pass — see ./scripts/distill audit-full.
     const notes: string[] = [];
     if (pct !== null && Math.abs(pct) > DRIFT_THRESHOLD_PCT) {
       const dir = pct > 0 ? "spike" : "drop";
@@ -492,9 +492,9 @@ export function buildDrift(current: RunSummary, prior: RunSummary | null): Drift
       delta_accepted: cur.accepted - pri.accepted,
       delta_quarantined: cur.quarantined - pri.quarantined,
       pct_change_out: pct,
-      input_hash_match: true,           // simplified — see comment above
+      input_hash_match: null,           // not computed at this layer; see comment above
       output_hash_match: out_match,
-      deterministic_violation: false,   // requires input_hash match, see future tightening
+      deterministic_violation: false,   // requires input_hash match — null means "unknown", not "verified"
       notes,
     });
   }

scripts/distillation/replay.ts

@@ -375,7 +375,12 @@ export async function replay(opts: ReplayRequest, root = DEFAULT_ROOT): Promise<
     }
   }
 
-  const recorded_run_id = `replay:${task_hash.slice(0, 16)}:${Date.now()}`;
+  // Stable derivation from task_hash + recorded_at (already an ISO
+  // timestamp captured at start of the call). Avoids a second wall-clock
+  // read and makes run_id reproducible given a fixed recorded_at — useful
+  // for fixture-driven tests + acceptance gates. Replaces Date.now()-based
+  // id post-Kimi-audit 2026-04-27.
+  const recorded_run_id = `replay:${task_hash.slice(0, 16)}:${(await canonicalSha256(recorded_at)).slice(0, 12)}`;
   const result: ReplayResult = {
     input_task: opts.task,
     task_hash,

scripts/distillation/score_runs.ts

@@ -86,6 +86,17 @@ function gitDirty(root: string): boolean {
   return r.status === 0 && r.stdout.trim().length > 0;
 }
 
+// Composite dedup key — `sig_hash:scorer_version`. Keying on sig_hash
+// alone made scorer-rule bumps invisible: a bumped SCORER_VERSION
+// produced different scoring categories, but pre-existing rows on disk
+// (with the OLD version) still matched the new sig_hash and the new
+// scoring was silently skipped. Compositing version forces re-scoring
+// when the version changes. Caller tags `scorer_version` on the
+// ScoredRun row, which we read alongside sig_hash.
+function dedupKey(sig_hash: string, scorer_version: string): string {
+  return `${sig_hash}:${scorer_version}`;
+}
+
 function loadSeenHashes(out_path: string): Set<string> {
   const seen = new Set<string>();
   if (!existsSync(out_path)) return seen;
@@ -93,7 +104,9 @@ function loadSeenHashes(out_path: string): Set<string> {
     if (!line) continue;
     try {
       const row = JSON.parse(line);
-      if (row?.provenance?.sig_hash) seen.add(row.provenance.sig_hash);
+      const sh = row?.provenance?.sig_hash;
+      const sv = row?.scorer_version;
+      if (sh && sv) seen.add(dedupKey(sh, sv));
     } catch { /* malformed — ignore */ }
   }
   return seen;
@@ -156,11 +169,12 @@ async function processEvidenceFile(
     }
 
     const scored = await buildScoredRun(ev.value as EvidenceRecord, out_relpath, i, opts.recorded_at);
-    if (seen.has(scored.provenance.sig_hash)) {
+    const key = dedupKey(scored.provenance.sig_hash, scored.scorer_version);
+    if (seen.has(key)) {
       result.rows_deduped++;
       continue;
     }
-    seen.add(scored.provenance.sig_hash);
+    seen.add(key);
 
     const sv = validateScoredRun(scored);
     if (!sv.valid) {

scripts/distillation/scorer.ts

@@ -27,7 +27,11 @@ import type { ScoreCategory, ScoredRun } from "../../auditor/schemas/distillatio
 import { SCORED_RUN_SCHEMA_VERSION } from "../../auditor/schemas/distillation/scored_run";
 import { canonicalSha256 } from "../../auditor/schemas/distillation/types";
 
-export const SCORER_VERSION = process.env.LH_SCORER_VERSION ?? "v1.0.0";
+// Hardcoded — the deterministic-output contract requires this. Bump the
+// literal in the same commit as any scoring-rule change so the version
+// stamp moves atomically with logic. Env override removed 2026-04-27
+// after Kimi audit flagged identical-input-different-version drift.
+export const SCORER_VERSION = "v1.0.0";
 
 export interface ScoreOutput {
   category: ScoreCategory;

scripts/distillation/transforms.ts

@@ -100,6 +100,9 @@ export const TRANSFORMS: TransformDef[] = [
       cost_usd: typeof row.cost === "number" ? row.cost / 1_000_000 : undefined,
       latency_ms: row.duration_ms,
       text: row.analysis,
+      metadata: typeof row.contractor === "string" && row.contractor.length > 0
+        ? { contractor: row.contractor }
+        : undefined,
     }),
   },
   {
@@ -178,7 +181,11 @@ export const TRANSFORMS: TransformDef[] = [
     // even though the text field is empty.
     source_file_relpath: "data/_kb/auto_apply.jsonl",
     transform: ({ row, line_offset, source_file_relpath, recorded_at, sig_hash }) => {
-      const ts: string = row.ts ?? new Date().toISOString();
+      // Deterministic fallback: use the source-file's recorded_at when
+      // the row itself lacks a ts. Wall-clock (new Date()) leaked here
+      // pre-2026-04-27 — broke bit-identical reproducibility on rows
+      // that historically wrote without a ts field.
+      const ts: string = row.ts ?? recorded_at;
       const action = String(row.action ?? "unknown");
       const success = action === "committed";
       const reverted = action.includes("reverted");

scripts/staffing/build_fill_events.py

@@ -0,0 +1,157 @@
+#!/usr/bin/env python3
+"""
+build_fill_events.py — Decision A from the synthetic-data gap report.
+
+Walks tests/multi-agent/scenarios/*.json (43 client-day scenarios) and
+data/_playbook_lessons/*.json (64 retrospective outcomes) and emits a
+single normalized fill_events.parquet at data/datasets/fill_events.parquet.
+
+Pure deterministic normalization — no LLM, no new data. Each scenario
+event becomes one row. Lesson outcomes augment scenario events with
+success/fail counts where (client, date, city, state) matches.
+
+Reproducibility: identical inputs → bit-identical output. event_id is
+SHA1(client|date|role|at|city) truncated to 16 hex chars; rows are
+sorted by event_id before write so re-runs produce the same parquet.
+"""
+
+import hashlib
+import json
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+
+import pyarrow as pa
+import pyarrow.parquet as pq
+
+REPO = Path(__file__).resolve().parents[2]
+SCENARIO_DIR = REPO / "tests" / "multi-agent" / "scenarios"
+LESSONS_DIR = REPO / "data" / "_playbook_lessons"
+OUT_PATH = REPO / "data" / "datasets" / "fill_events.parquet"
+
+
+def event_id(client: str, date: str, role: str, at: str, city: str) -> str:
+    h = hashlib.sha1(f"{client}|{date}|{role}|{at}|{city}".encode()).hexdigest()
+    return h[:16]
+
+
+def load_lessons() -> dict:
+    """Returns map of (client, date) → outcome dict."""
+    out: dict = {}
+    for path in sorted(LESSONS_DIR.glob("*.json")):
+        try:
+            d = json.loads(path.read_text())
+        except json.JSONDecodeError:
+            continue
+        client = d.get("client")
+        date = d.get("date")
+        if not client or not date:
+            continue
+        out[(client, date)] = {
+            "outcome_events_total": d.get("events_total"),
+            "outcome_events_ok": d.get("events_ok"),
+            "outcome_checkpoint_count": d.get("checkpoint_count"),
+            "outcome_model": d.get("model"),
+            "outcome_cloud": d.get("cloud"),
+            "outcome_lesson_path": str(path.relative_to(REPO)),
+        }
+    return out
+
+
+def load_scenarios(lessons: dict) -> list[dict]:
+    rows: list[dict] = []
+    for path in sorted(SCENARIO_DIR.glob("scen_*.json")):
+        try:
+            d = json.loads(path.read_text())
+        except json.JSONDecodeError:
+            continue
+        client = d.get("client")
+        date = d.get("date")
+        contract = d.get("contract") or {}
+        events = d.get("events") or []
+        if not client or not date or not events:
+            continue
+        outcome = lessons.get((client, date), {})
+        for event in events:
+            role = event.get("role") or ""
+            at = event.get("at") or ""
+            city = event.get("city") or ""
+            state = event.get("state") or ""
+            rows.append({
+                "event_id": event_id(client, date, role, at, city),
+                "source_file": str(path.relative_to(REPO)),
+                "source_kind": "scenario",
+                "client": client,
+                "date": date,
+                "city": city,
+                "state": state,
+                "role": role,
+                "count": int(event.get("count") or 0),
+                "kind": event.get("kind") or "",
+                "at": at,
+                "shift_start": event.get("shift_start") or "",
+                "contract_deadline": contract.get("deadline"),
+                "contract_budget_per_hour_max": contract.get("budget_per_hour_max"),
+                "contract_local_bonus_per_hour": contract.get("local_bonus_per_hour"),
+                "contract_local_bonus_radius_mi": contract.get("local_bonus_radius_mi"),
+                "contract_fill_requirement": contract.get("fill_requirement"),
+                "outcome_events_total": outcome.get("outcome_events_total"),
+                "outcome_events_ok": outcome.get("outcome_events_ok"),
+                "outcome_checkpoint_count": outcome.get("outcome_checkpoint_count"),
+                "outcome_model": outcome.get("outcome_model"),
+                "outcome_cloud": outcome.get("outcome_cloud"),
+                "outcome_lesson_path": outcome.get("outcome_lesson_path"),
+            })
+    return rows
+
+
+def main() -> int:
+    lessons = load_lessons()
+    rows = load_scenarios(lessons)
+    if not rows:
+        print("no rows produced — scenario dir empty?", file=sys.stderr)
+        return 1
+    rows.sort(key=lambda r: r["event_id"])
+
+    schema = pa.schema([
+        ("event_id", pa.string()),
+        ("source_file", pa.string()),
+        ("source_kind", pa.string()),
+        ("client", pa.string()),
+        ("date", pa.string()),
+        ("city", pa.string()),
+        ("state", pa.string()),
+        ("role", pa.string()),
+        ("count", pa.int32()),
+        ("kind", pa.string()),
+        ("at", pa.string()),
+        ("shift_start", pa.string()),
+        ("contract_deadline", pa.string()),
+        ("contract_budget_per_hour_max", pa.int32()),
+        ("contract_local_bonus_per_hour", pa.int32()),
+        ("contract_local_bonus_radius_mi", pa.int32()),
+        ("contract_fill_requirement", pa.string()),
+        ("outcome_events_total", pa.int32()),
+        ("outcome_events_ok", pa.int32()),
+        ("outcome_checkpoint_count", pa.int32()),
+        ("outcome_model", pa.string()),
+        ("outcome_cloud", pa.bool_()),
+        ("outcome_lesson_path", pa.string()),
+    ])
+    table = pa.Table.from_pylist(rows, schema=schema)
+
+    OUT_PATH.parent.mkdir(parents=True, exist_ok=True)
+    pq.write_table(table, OUT_PATH, compression="snappy")
+
+    matched = sum(1 for r in rows if r["outcome_events_total"] is not None)
+    print(f"fill_events.parquet written: {OUT_PATH.relative_to(REPO)}")
+    print(f"  rows: {len(rows)}")
+    print(f"  scenarios: {len({r['source_file'] for r in rows})}")
+    print(f"  with outcome: {matched}")
+    print(f"  unique (client,date): {len({(r['client'], r['date']) for r in rows})}")
+    print(f"  generated_at: {datetime.now(timezone.utc).isoformat(timespec='seconds')}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/staffing/build_workers_v9.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# build_workers_v9.sh — Decision B (corpus rebuild side).
+#
+# Rebuilds workers_500k_v9 vector corpus from workers_safe view rather
+# than the raw workers_500k table. Closes the PII enforcement gap
+# (verified 2026-04-27 that v8 was built directly from raw — LLM saw
+# names/emails/phones/resume_text for every staffing query).
+#
+# Run as a background job — embedding 500K chunks took ~4 min for v8
+# of 50K rows; v9 of 500K rows will be 30+ min. Do not block on this.
+#
+# Usage:
+#     ./scripts/staffing/build_workers_v9.sh
+#     LH_GATEWAY=http://localhost:3100 ./scripts/staffing/build_workers_v9.sh
+#
+# After it completes:
+#   - Verify via: curl /vectors/indexes/workers_500k_v9 | jq
+#   - Flip config/modes.toml `staffing_inference` matrix_corpus to v9
+#   - Restart gateway to pick up the modes.toml change
+
+set -euo pipefail
+
+GATEWAY="${LH_GATEWAY:-http://localhost:3100}"
+
+# The /vectors/index endpoint accepts {name, sql, embed_model, ...}.
+# SQL pulls from workers_safe (see data/_catalog/views/workers_safe.json)
+# so the embedded text never contained raw PII by construction.
+#
+# Concatenated text is what gets embedded — keep it short enough that
+# 500K rows × N chunks fits in disk + memory budgets but still carries
+# the match signal (role, location, skills, scores).
+
+BODY=$(cat <<'JSON'
+{
+  "name": "workers_500k_v9",
+  "sql": "SELECT CAST(worker_id AS VARCHAR) AS doc_id, CONCAT(role, ' in ', city, ', ', state, '. Skills: ', COALESCE(skills, ''), '. Certifications: ', COALESCE(certifications, ''), '. Archetype: ', COALESCE(archetype, ''), '. Scores — reliability ', CAST(reliability AS VARCHAR), ', responsiveness ', CAST(responsiveness AS VARCHAR), ', availability ', CAST(availability AS VARCHAR), '.') AS text FROM workers_safe",
+  "embed_model": "nomic-embed-text",
+  "chunk_size": 500,
+  "overlap": 50,
+  "source_dataset": "workers_safe",
+  "bucket": "primary"
+}
+JSON
+)
+
+echo "POSTing /vectors/index → workers_500k_v9 (background job)..."
+curl -sS -X POST "${GATEWAY}/vectors/index" \
+  -H 'content-type: application/json' \
+  -d "$BODY"
+echo
+echo "Job started. Monitor progress:"
+echo "  curl ${GATEWAY}/vectors/indexes/workers_500k_v9 | jq"
+echo "  watch -n 5 'curl -s ${GATEWAY}/vectors/jobs | jq'"

scripts/staffing/fetch_face_pool.py

@@ -0,0 +1,161 @@
+#!/usr/bin/env python3
+"""
+fetch_face_pool.py — pull N synthetic headshots from
+https://thispersondoesnotexist.com/, write to data/headshots/face_NNNN.jpg,
+optionally tag each with gender via deepface, emit a JSONL manifest.
+
+Each fetch is a fresh StyleGAN face — no real people. Deterministic per
+worker mapping happens at serve time (mcp-server hashes the worker key
+into the pool); this script just builds the pool.
+
+Usage:
+    python3 scripts/staffing/fetch_face_pool.py --count 300 --concurrency 3
+    python3 scripts/staffing/fetch_face_pool.py --count 50  --no-gender
+
+Re-running is idempotent: existing face_NNNN.jpg files are skipped, and
+the manifest is rewritten from disk state.
+"""
+from __future__ import annotations
+import argparse
+import hashlib
+import json
+import os
+import sys
+import time
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+import urllib.request
+import urllib.error
+
+URL = "https://thispersondoesnotexist.com/"
+UA = "Lakehouse/1.0 (face-pool fetch · synthetic-only · no real-person tracking)"
+
+
+def fetch_one(idx: int, out_dir: str) -> tuple[int, str, bool, str | None]:
+    """Returns (idx, basename, cached, error)."""
+    fname = f"face_{idx:04d}.jpg"
+    full = os.path.join(out_dir, fname)
+    if os.path.exists(full) and os.path.getsize(full) > 1024:
+        return idx, fname, True, None
+    try:
+        req = urllib.request.Request(URL, headers={"User-Agent": UA})
+        with urllib.request.urlopen(req, timeout=20) as resp:
+            blob = resp.read()
+        if len(blob) < 1024:
+            return idx, fname, False, f"response too small ({len(blob)} bytes)"
+        with open(full, "wb") as f:
+            f.write(blob)
+        return idx, fname, False, None
+    except urllib.error.URLError as e:
+        return idx, fname, False, f"urlerror: {e}"
+    except Exception as e:
+        return idx, fname, False, f"{type(e).__name__}: {e}"
+
+
+def maybe_tag_gender(records: list[dict], out_dir: str) -> dict[str, int]:
+    """If deepface is installed, label each record with gender. Returns
+    a count summary; mutates records in place. On import error, returns
+    None and tags every record as unknown."""
+    try:
+        from deepface import DeepFace  # type: ignore
+    except Exception as e:
+        print(f"  (deepface unavailable: {e}) — pool will mix naturally")
+        for r in records:
+            r["gender"] = None
+        return {"unknown": len(records)}
+
+    print("  tagging gender via deepface (CPU; ~0.5-1s per face)…")
+    counts: dict[str, int] = {}
+    for i, r in enumerate(records):
+        full = os.path.join(out_dir, r["file"])
+        try:
+            ana = DeepFace.analyze(
+                img_path=full,
+                actions=["gender"],
+                enforce_detection=False,
+                silent=True,
+            )
+            if isinstance(ana, list):
+                ana = ana[0] if ana else {}
+            g_raw = (ana.get("dominant_gender") or "").lower().strip()
+            r["gender"] = (
+                "man" if g_raw.startswith("man") else
+                "woman" if g_raw.startswith("woman") else
+                None
+            )
+        except Exception as e:
+            r["gender"] = None
+            r["gender_error"] = f"{type(e).__name__}: {e}"
+        counts[r["gender"] or "unknown"] = counts.get(r["gender"] or "unknown", 0) + 1
+        if (i + 1) % 25 == 0:
+            print(f"    [{i+1}/{len(records)}] {counts}")
+    return counts
+
+
+def main():
+    p = argparse.ArgumentParser()
+    p.add_argument("--count", type=int, default=300, help="how many faces to maintain in pool")
+    p.add_argument(
+        "--out",
+        default=os.path.join(os.path.dirname(__file__), "..", "..", "data", "headshots"),
+    )
+    p.add_argument("--concurrency", type=int, default=3, help="parallel fetches (be polite)")
+    p.add_argument("--no-gender", action="store_true", help="skip deepface gender tagging")
+    args = p.parse_args()
+
+    out = os.path.realpath(args.out)
+    os.makedirs(out, exist_ok=True)
+
+    print(f"Fetching {args.count} faces → {out}")
+    print(f"Source: {URL} (synthetic StyleGAN — no real people)")
+
+    results: list[dict] = [None] * args.count  # type: ignore
+    t0 = time.time()
+    with ThreadPoolExecutor(max_workers=max(1, args.concurrency)) as ex:
+        futs = {ex.submit(fetch_one, i, out): i for i in range(args.count)}
+        for done, fut in enumerate(as_completed(futs), 1):
+            idx, fname, cached, err = fut.result()
+            results[idx] = {
+                "id": idx,
+                "file": fname,
+                "cached": cached,
+                "error": err,
+            }
+            if done % 25 == 0 or done == args.count:
+                ok = sum(1 for r in results if r and not r.get("error"))
+                print(f"  [{done}/{args.count}] {ok} ok  ({time.time()-t0:.1f}s)")
+
+    # Drop slots that errored or are still None (shouldn't happen)
+    records = [r for r in results if r and not r.get("error")]
+    print(f"\nPool ready: {len(records)} faces, {sum(1 for r in records if r['cached'])} from cache")
+
+    if not args.no_gender and records:
+        print("\nGender-tagging pass:")
+        summary = maybe_tag_gender(records, out)
+        print(f"  distribution: {summary}")
+    else:
+        for r in records:
+            r["gender"] = None
+
+    # Strip transient flags before persisting
+    for r in records:
+        r.pop("cached", None)
+        r.pop("error", None)
+
+    manifest = os.path.join(out, "manifest.jsonl")
+    with open(manifest, "w") as f:
+        for r in records:
+            f.write(json.dumps(r) + "\n")
+    print(f"\nManifest: {manifest}  ({len(records)} entries)")
+
+    # Quick checksum manifest for downstream debugging
+    h = hashlib.sha256()
+    for r in records:
+        h.update(r["file"].encode())
+        h.update(b"|")
+        h.update((r.get("gender") or "?").encode())
+    print(f"Pool fingerprint (sha256): {h.hexdigest()[:16]}")
+
+
+if __name__ == "__main__":
+    main()

scripts/staffing/fixup_phone_type.py

@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+"""
+fixup_phone_type.py — Decision D from the synthetic-data gap report.
+
+Converts workers_500k.parquet `phone` column from int64 → string. Phones
+in this dataset are 11-digit US numbers (1 + area + 7), e.g. 13122277740.
+Stored as int64, the column compares fine numerically but breaks join
+keys with string-typed phone columns elsewhere (formatted "+1...", or
+loaded from a CSV).
+
+Backs up the original to workers_500k.parquet.bak-<date> before write.
+Idempotent: detects when the fix has already been applied and exits 0.
+
+Usage:
+    python3 scripts/staffing/fixup_phone_type.py
+"""
+
+import datetime as dt
+import shutil
+import sys
+from pathlib import Path
+
+import pyarrow as pa
+import pyarrow.compute as pc
+import pyarrow.parquet as pq
+
+REPO = Path(__file__).resolve().parents[2]
+TARGET = REPO / "data" / "datasets" / "workers_500k.parquet"
+
+
+def main() -> int:
+    if not TARGET.exists():
+        print(f"missing: {TARGET}", file=sys.stderr)
+        return 1
+
+    table = pq.read_table(TARGET)
+    phone_field = table.schema.field("phone")
+    if phone_field.type == pa.string():
+        print(f"phone is already string — no-op")
+        return 0
+
+    today = dt.date.today().isoformat()
+    backup = TARGET.with_suffix(f".parquet.bak-{today}")
+    if not backup.exists():
+        shutil.copy2(TARGET, backup)
+        print(f"backup: {backup.relative_to(REPO)}")
+
+    phone_str = pc.cast(table["phone"], pa.string())
+    new_table = table.set_column(
+        table.schema.get_field_index("phone"),
+        pa.field("phone", pa.string()),
+        phone_str,
+    )
+
+    pq.write_table(new_table, TARGET, compression="snappy")
+    rounds_trip = pq.read_table(TARGET, columns=["phone"])
+    sample = rounds_trip["phone"].slice(0, 3).to_pylist()
+    print(f"wrote: {TARGET.relative_to(REPO)}")
+    print(f"phone type: {rounds_trip.schema.field('phone').type}")
+    print(f"sample: {sample}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

tests/agent_test/agent_harness.ts

@@ -161,16 +161,17 @@ const TOOL_SCHEMA = `Available tools (call by emitting JSON like: {"tool": "name
 // ─── AGENT LOOP ───
 
 async function callAgent(messages: Array<{role: string; content: string}>): Promise<string> {
-  // think:false disables hidden reasoning so all generated tokens go to
-  // visible response. qwen3.5:latest defaults to thinking and silently
-  // burns the token budget otherwise.
-  const r = await fetch(`${SIDECAR}/generate`, {
+  // Phase 44 migration (2026-04-27): /v1/chat instead of direct sidecar
+  // /generate so /v1/usage tracks the call, Langfuse traces it.
+  // think:false still disables hidden reasoning so generated tokens
+  // go to visible response — qwen3.5:latest defaults to thinking.
+  const r = await fetch(`${GATEWAY}/v1/chat`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({
       model: AGENT_MODEL,
-      prompt: messages.map(m => `${m.role.toUpperCase()}:\n${m.content}`).join("\n\n") + "\n\nASSISTANT:\n",
-      stream: false,
+      provider: "ollama",
+      messages,
       max_tokens: 1500,
       think: false,
     }),
@@ -178,7 +179,7 @@ async function callAgent(messages: Array<{role: string; content: string}>): Prom
   });
   if (!r.ok) throw new Error(`agent ${r.status}: ${(await r.text()).slice(0, 200)}`);
   const j: any = await r.json();
-  return String(j.text ?? j.response ?? "").trim();
+  return String(j?.choices?.[0]?.message?.content ?? "").trim();
 }
 
 function extractToolCall(response: string): { tool: string; args: any } | null {

tests/multi-agent/agent.ts

@@ -372,26 +372,34 @@ export async function generate(model: string, prompt: string, opts: {
   bypass_budget?: boolean;
   think?: boolean;
 } = {}): Promise<string> {
+  // Phase 44 migration (2026-04-27): was hitting `${SIDECAR}/generate`
+  // directly, bypassing the gateway's /v1/usage accounting + Langfuse
+  // tracing. Now flows through /v1/chat with provider="ollama" so
+  // every local call is observable + auditable. Sidecar transport is
+  // unchanged — gateway just owns the call.
   assertContextBudget(model, prompt, {
     system: opts.system,
     max_tokens: opts.max_tokens,
     bypass: opts.bypass_budget,
   });
+  const messages: Array<{ role: string; content: string }> = [];
+  if (opts.system) messages.push({ role: "system", content: opts.system });
+  messages.push({ role: "user", content: prompt });
   const body: Record<string, any> = {
     model,
-    prompt,
+    messages,
+    provider: "ollama",
     temperature: opts.temperature ?? 0.3,
     max_tokens: opts.max_tokens ?? 800,
   };
-  if (opts.system) body.system = opts.system;
   if (opts.think !== undefined) body.think = opts.think;
-  const r = await http<any>("POST", `${SIDECAR}/generate`, body);
-  const text = typeof r.text === "string" ? r.text : "";
+  const r = await http<any>("POST", `${GATEWAY}/v1/chat`, body);
+  const text = r?.choices?.[0]?.message?.content ?? "";
   // Do NOT throw on empty. Thinking models (gpt-oss, qwen3.5) burn the
   // max_tokens budget on hidden reasoning and emit "" when budget was
   // too tight. generateContinuable detects empty + continues with more
   // budget. Callers that expected non-empty can check themselves.
-  return text;
+  return typeof text === "string" ? text : "";
 }
 
 // Cloud generate — routes through the lakehouse gateway's /v1/chat

tests/real-world/scrum_master_pipeline.ts

@@ -113,10 +113,17 @@ const TARGET_FILES: string[] = process.env.LH_SCRUM_FILES
 // strategy. Kimi K2.6, Gemini, free-tier, local fallback, etc. were
 // removed — they're available as routable tools later (mode router)
 // but not as automatic fallbacks.
-const LADDER: Array<{ provider: "ollama" | "ollama_cloud" | "openrouter"; model: string; note: string }> = [
+const LADDER: Array<{ provider: "ollama" | "ollama_cloud" | "openrouter" | "kimi"; model: string; note: string }> = [
   { provider: "openrouter",   model: "x-ai/grok-4.1-fast",                   note: "PRIMARY · Grok 4.1 fast · $0.20/$0.50 · 2M ctx · single-model strategy" },
   { provider: "openrouter",   model: "deepseek/deepseek-v4-flash",           note: "FALLBACK on provider error · DeepSeek V4 flash · $0.14/$0.28 · 1M ctx" },
   { provider: "openrouter",   model: "qwen/qwen3-235b-a22b-2507",            note: "LAST FALLBACK on provider error · Qwen3 235B · $0.07/$0.10 · 262K" },
+  // kimi/kimi-for-coding (api.kimi.com) is wired through the gateway
+  // but NOT in the auto-ladder. The endpoint is gated to specific
+  // approved coding-agent User-Agents (Claude Code, Kimi CLI, Roo Code,
+  // Kilo Code). Spoofing a User-Agent works technically but Moonshot's
+  // TOS marks it as grounds for membership suspension. Use Kimi via a
+  // sanctioned client (Claude Code subagent / Kimi CLI), not via this
+  // unattended scrum loop.
   // Dropped from the ladder after 2026-04-24 probe:
   //   - kimi-k2.6 — not available on current tier (empty response)
   //   - devstral-2:123b — displaced by qwen3-coder:480b (better coding specialist)
@@ -738,7 +745,7 @@ async function lookupSignalClass(filePath: string): Promise<string | null> {
 }
 
 async function chat(opts: {
-  provider: "ollama" | "ollama_cloud",
+  provider: "ollama" | "ollama_cloud" | "openrouter" | "kimi",
   model: string,
   prompt: string,
   max_tokens?: number,