# ============================================================================
# company.yaml — CANONICAL model org chart: the standing company structure.
# ----------------------------------------------------------------------------
# Pairs with models.yaml (per-model specs/benchmarks/confidence) and
# executors.yaml (lanes/flags/ladders). This file answers ONE question those
# don't: WHICH MODEL HOLDS WHICH JOB, and what the bench/succession looks like.
#   - /create-company staffs a workspace's company/staffing.yaml from these
#     seats (Step 3 hiring pool), then probes each seat before trusting it.
#   - Rendered to observify reports/org-chart.html (kit-atlas aesthetic),
#     beside models.html the same way models.yaml renders to that page.
#
# Doctrine this chart encodes (kit law — the org is the law made organizational):
#   P2   conductor = judgment, workers = tokens; >=70% of delegated tokens at
#        implementer tier or below.
#   LADDER free-first: ollama-local -> codex-oss-local -> agy -> grok -> codex
#        -> in-family implementer -> conductor -> ceiling. Claude is exhausted
#        LAST (scarcest pool by construction).
#   KB-NO-HOME-FAMILY-BIAS: the auditor sits CROSS-FAMILY from the builder.
#   L0   the human approves; no seat self-approves its own promotion.
#   Empirical over inferred: benchmarks are EXTERNAL leads; kit-MEASURED
#        evidence decides seats. Every promotion below is a pilot + gate, never
#        a benchmark alone.
#
# seat_status: seated (active holder) · bench (available, hire-ticket exists)
#   · pending_clearance (restricted access) · hardware_gated · offboarding
#   (deprecated/retired — do-not-staff, config-grep gate).
version: 1
authored: "2026-07-23"
sources: ["kernel/models.yaml (specs verified 2026-07-23)", "kernel/executors.yaml", "scar log (Observify 2026-07-18 review rounds, terminus 2026-07-18 luna assessment, L127, L5/L146 caps)"]

org_chart:

  executive:
    mandate: "Judgment, sequencing, final accountability. The most expensive tokens in the building — spent on decisions, never on bulk."
    seats:
      - role: "CEO / Conductor"
        model: claude-fable-5
        seat_status: seated
        rationale: >
          The org exists to concentrate judgment in one seat, and Fable 5 is the strongest
          reasoner in the registry by a wide margin — SWE-bench Pro 80.3% (11+ points above every
          other seat), Terminal-bench 2.1 88.0%, HLE-with-tools 64.5% — with always-on adaptive
          thinking and a 1M window. It is also the priciest seat ($10/$50) with its OWN smaller
          rate bucket: exactly the profile you conduct with and never bulk-build with (P2). The
          packet workspace already pins it; the chart makes that law.
      - role: "Chief of Staff / Principal Reviewer & Closer"
        model: claude-opus-4-8
        seat_status: seated
        rationale: >
          The ceiling executor for wrong-is-expensive rounds and the company's closer: measured
          ~4x less likely than Opus 4.7 to let code flaws pass, SWE-bench Verified 88.6%, GPQA
          93.6% — and commit-capable, which the entire builder department is not (L127: codex
          cannot take .git/index.lock; Opus adopt-commits their trees). At $5/$25 it absorbs the
          senior-partner work the CEO's scarcer bucket must not.
      - role: "The Approver (human)"
        model: none — Wolf
        seat_status: seated
        rationale: "L0: no agent self-approves. Charter ratification, promotion sign-off, spend posture, and anything irreversible terminate here."

  engineering:
    mandate: "The build value stream. OpenAI family holds it: the roster's measured BUILDER — structure-solid, detail-audited, every build paired with a cross-family review before ship."
    family_note: "Known family defect (kit-measured): correct-STRUCTURE wrong-DETAIL — unit-scaling bugs pass its own selftests (Hz→GHz ×1000, milli-°C, Gi/Mi regex; Observify 2026-07-18). The Verification department owns that gate. Commit-incapable by default (L127)."
    seats:
      - role: "VP Engineering / Lane Pilot"
        model: gpt-5.6-sol
        seat_status: seated
        rationale: >
          Every new lane is PILOTED by the strongest builder — Sol establishes the procedure and
          the judgment calls, then hands the crank down (kit-measured pattern, terminus 07-18).
          Top of the codex family on every axis: Terminal-bench 2.1 88.8% (91.9% Ultra), GPQA
          94.6%, ARC-AGI-2 92.5%, SWE-bench Pro 64.6%. Ultra mode (4 parallel agents) is its
          org-chart superpower for the hardest tickets — used deliberately, piloted first (L52).
      - role: "Senior Engineer (features)"
        model: gpt-5.6-terra
        seat_status: seated
        rationale: >
          The everyday workhorse for well-specified feature tickets: −1.2 SWE-bench-Pro and −1.4
          Terminal-bench vs Sol at HALF the cost ($2.50/$15). Bulk feature work lands here so Sol
          stays free to pilot.
      - role: "Line Engineer (the crank)"
        model: gpt-5.6-luna
        seat_status: seated
        rationale: >
          Kit-MEASURED, not inferred: inside a lane Sol established, Luna held +30% throughput at a
          flat error rate (terminus 2026-07-18, 14.2 vs 10.9 responses/min). Cheapest 5.6 tier
          ($1/$6). Two hard limits written into the seat: it does NOT establish lanes, and its
          long-context weakness (MRCR ~41.3%, flagged) keeps its tickets short-context. Drift from
          the piloted shape IS its ceiling — step the work back up.
      - role: "Long-Haul Specialist (autonomous coding sessions)"
        model: gpt-5.3-codex
        seat_status: seated
        rationale: >
          The family's agentic-coding specialist for long unattended sessions — OSWorld-Verified
          64.7%, Terminal-bench 77.3% at a 400K window and $1.75/$14. Holds marathon refactors and
          migration lanes where the 5.6 generalists would be overqualified per token.
      - role: "Staff Engineer (in-family implementer, commit-capable builds)"
        model: claude-sonnet-5
        seat_status: seated
        rationale: >
          The Claude-family implementer for builds that need commits, Claude-strengths, or a
          second opinion of a different lineage: best wired computer-use score in the registry
          (OSWorld-Verified 81.2%), SWE-bench Verified >80%, intro-priced $2/$10 through
          2026-08-31. One explicit exclusion on the seat card: NOT for exploit-class security work
          (0% on the Firefox exploit set — route that to Opus 4.8).
      - role: "Apprentice (free coding floor)"
        model: gpt-oss-20b
        seat_status: seated
        rationale: >
          Zero-quota local coding via `codex --oss` — every bounded, fully-specified ticket tries
          the apprentice BEFORE a paid token (the ladder's whole point). ~o3-mini class (GPQA
          71.5% no-tools, AIME-with-tools 98.7%), fits the Mac's 48GB. Seat conditions: oriented
          (seven levers), num_ctx pinned ≥32768 (the silent-truncation scar), audited at the SAME
          build-failing gates as every paid seat. Doubles as the Mac's glue tier.
      - role: "Junior Engineer (mechanical / chores / docs)"
        model: claude-haiku-4-5-20251001
        seat_status: seated
        rationale: >
          ~90% of Sonnet-4.5's agentic coding at $1/$5 (SWE-bench Verified 73.3%) — the cheap fast
          seat for mechanical edits, doc chores, and light subagent work where the free floor's
          reliability isn't enough but a 5.6 tier would be waste.

  verification_audit:
    mandate: "Standing organ (non-negotiable). Cross-family from Engineering by law — the auditor never shares a family with the builder it audits."
    seats:
      - role: "Chief Auditor (correctness & architecture, READ-ONLY)"
        model: gemini-3.1-pro-preview
        seat_status: seated
        rationale: >
          The kit's MEASURED most-reliable reviewer: clean, line-cited findings — caught 4 real
          unit/logic bugs plus a request-path issue that codex shipped and its own selftests
          missed (Observify 2026-07-18). The 1M window takes a whole monorepo plus external docs
          in one read. Seat is READ-ONLY at the launch posture (`--mode plan`), not by promise —
          given write access it edited the single-writer file it was reviewing (L46 breach).
          Owns the numeric-detail gate that Engineering's family defect requires. GPQA 94.3%,
          SWE-bench Verified 80.6%. Known seat risk: a LIGHT subscription that caps fast — the
          bench below exists because of it.
      - role: "Volume Reviewer (high-throughput passes)"
        model: gemini-3.6-flash
        seat_status: bench
        hire_ticket: "Pilot on one repo A/B'd against the Chief Auditor on the SAME diff set; hire if line-cited precision holds."
        rationale: >
          The registry's FRESHEST knowledge cutoff (2026-03), OSWorld 83.0% (highest anywhere in
          the registry), SWE-bench Pro 58.7%, at half Pro's price with a free tier. The natural
          reviewer for high-volume passes and the first substitution when the Chief Auditor's
          quota caps — which is a WHEN, not an IF (multi-day resets, L146).

  security:
    mandate: "Standing organ. Adversarial lens on every sensitive surface; findings are LEADS adjudicated against code, never ship-blockers on their own say-so."
    seats:
      - role: "Red Team Lead (adversarial security lens)"
        model: grok-4.5
        seat_status: seated
        rationale: >
          High-recall / low-precision BY MEASUREMENT, and seated for exactly that shape: across
          four Observify review rounds it produced two all-false-positive rounds, one empty — and
          one round with 2 REAL findings (a TOCTOU and a tail-path arbitrary-read) that the
          builder AND the Chief Auditor both missed. That is what a red team is for. Live web/X
          search gives it fresh-CVE context no other seat has. SuperGrok subscription quota
          OUTLASTS the auditor's — the durable review pool. Every finding is adjudicated (family
          law); AA-Omniscience hallucination 54% (flagged, up from 25% on 4.3) is why.
      - role: "Exploit-Class Escalation"
        model: claude-opus-4-8
        seat_status: seated
        rationale: "Dual-hatted from Executive: the only WIRED model with measured high-end cyber capability for Wolf's authorized engagements. Sonnet 5 is explicitly barred from this desk (0% exploit set); the two true specialists are still in clearance (below)."
      - role: "Security Specialist (safeguards-lifted)"
        model: claude-mythos-5
        seat_status: pending_clearance
        rationale: >
          Same weights as the CEO with safety classifiers removed — the ONLY Claude with cyber
          safeguards lifted, directly relevant to authorized bug-bounty/pentest work. Gate:
          Project Glasswing partnership (~150 orgs, invite-only, no waitlist). Un-wireable today;
          the badge IS the promotion.
      - role: "Vulnerability-Discovery Specialist"
        model: gemini-3.5-flash-cyber
        seat_status: pending_clearance
        rationale: "Gemini fine-tuned for vulnerability discovery & fixing (the CodeMender pilot). Governments + trusted partners only; no public spec sheet. Recruiting target with a named gate — partner access — not a seat."

  research_recon:
    mandate: "Wide reads, deep research, extraction. Cheap breadth so the executive floor never burns its bucket on reconnaissance."
    seats:
      - role: "Deep Research Squad (single-call fan-out)"
        model: grok-4.20-multi-agent-0309
        seat_status: bench
        hire_ticket: "Wire for wide recon where ONE call genuinely beats kit-orchestrated fan-out; measure against a Workflow sweep on the same question."
        rationale: "Native 4-or-16-agent parallel research in a single call, 1M window, $1.25/$2.50. Benched rather than seated because it overlaps what the kit's own fan-out already does well — hire on evidence, not novelty. Low rate ceiling (9 req/s) noted on the card."
      - role: "Corpus Reader (big-context cheap recon)"
        model: grok-4.3
        seat_status: bench
        hire_ticket: "Wire as the cheap 1M-window reader for whole-corpus sweeps when the Chief Auditor's window is needed elsewhere."
        rationale: "Twice grok-4.5's context (1M vs 500K) at ~60% of its price. Also the silent redirect target of every retired grok slug — a seat card that exists partly so billing surprises have a name."
      - role: "Strict Extractor (schema-forced, low-hallucination)"
        model: grok-4.20-reasoning-and-non-reasoning
        seat_status: bench
        hire_ticket: "Pilot the non-reasoning variant on schema-forced extraction; hire if adherence beats the current glue tier on the same feeds."
        rationale: "The non-reasoning variant's lowest-hallucination / strict-prompt-adherence profile is purpose-shaped for extraction pipelines; the reasoning variant is a cheaper 1M-ctx alternate. 'Interesting for schema-forced extraction' is the registry's own note — the ticket makes it testable."

  operations_edge:
    mandate: "The free floor and the estate's edge. Glue, triage, retrieval, and the on-device brain — zero-quota rungs that every job tries before a paid token."
    seats:
      - role: "Edge Officer (Holt's on-device brain, the Pi)"
        model: "qwen3:8b"
        seat_status: seated
        rationale: >
          The Pi's model ceiling (14b times out) and therefore the HONEST exam model: it certifies
          Holt-as-deployed — grading on a bigger Mac model would inflate the grade. Hybrid
          thinking toggle, tool-calling, Apache-2.0, free.
      - role: "Archivist (retrieval / embeddings backbone)"
        model: nomic-embed-text
        seat_status: seated
        rationale: >
          The only non-chat seat: text→vector for RAG/clustering/classification. MTEB 62.28 beats
          ada-002 and text-embedding-3-small; 274MB runs on anything including the Pi. Seat
          discipline on the card: task prefixes REQUIRED (search_document:/search_query:), and
          Ollama's 2K default context raised to the native 8192 for long-doc work.
      - role: "Nano Triage (tight-RAM hosts)"
        model: "qwen3:1.7b"
        seat_status: bench
        hire_ticket: "Pull + prove on one classification feed on the Pi-class host before any routing points at it."
        rationale: "1.4GB Pi-class hybrid-thinking tier below gpt-oss-20b for trivial classification/labeling where even the 20B floor is oversized. Not confirmed pulled — the ticket says prove first."
      - role: "Paid Nano Floor (API glue when local is busy)"
        model: gpt-5.4-nano
        seat_status: bench
        hire_ticket: "Wire as overflow glue; route only classification/label/normalize shapes."
        rationale: "The cheapest current GPT text model ($0.20/$1.25, 400K ctx) — the free-adjacent floor for trivial volume when the local rungs are saturated. No public benchmarks: volume-only mandate, never judgment."
      - role: "Cheap Fresh Triage (multimodal, free-tier-eligible)"
        model: gemini-3.5-flash-lite
        seat_status: bench
        hire_ticket: "Wire for high-volume triage needing a FRESH cutoff or multimodal input at floor price."
        rationale: "$0.30/$2.50, ~350 tok/s, 2026-03 cutoff, 1M window, computer-use built in — the strongest spec sheet of any floor-priced tier. Benched only because the free local rungs come first by law."
      - role: "Subagent Fleet Default (candidate)"
        model: gpt-5.4-mini
        seat_status: bench
        hire_ticket: "RESOLVES A FLAGGED AMBIGUITY: the kit's 'mini-class' label names no real 5.6 model (mini lineage stopped at 5.4). Wire gpt-5.4-mini explicitly OR redefine mini-class as luna — decide, then measure vs luna on cost/quality for subagent fan-outs."
        rationale: "OpenAI's own positioning: 'strongest mini model for coding, computer use, subagent deployments' — $0.75/$4.50 at 400K ctx sits exactly in the subagent sweet spot between nano glue and the 5.6 line tiers."

  studio_shared_services:
    mandate: >
      The non-agentic wing: tool models, not employees. Nothing here runs a loop or holds a
      ticket — any staffed agent with the family's key CALLS these desks mid-task (Wolf's rule:
      a subscription/API key makes them agentically reachable). Desks are picked per job by
      cost/quality; the substitution ladders below make the cross-family coverage explicit.
    family_gaps: >
      Two structural gaps shape this wing: Anthropic ships NO non-agentic models (Claude staff
      reach across to OpenAI/Google/xAI or local for every media/embedding tool), and xAI ships
      NO standalone embedder (grok staff borrow OpenAI/Google/local for RAG). The org chart
      routes around both by design.
    seats:
      - role: "Image Desk"
        model: "google · image generation"
        seat_status: seated
        covers: [gemini-3.1-flash-image, gemini-3.1-flash-lite-image, gemini-3-pro-image, "gemini-2.5-flash-image (legacy)"]
        rationale: >
          Nano Banana 2 (gemini-3.1-flash-image) leads the desk on layout/text-in-image strength
          at $0.045-0.151/img, with gemini-3-pro-image for 4K finals. gpt-image-2 is the OpenAI
          alternate (flagship quality, $0.006-0.211 by tier); grok-imagine-image is the budget
          bulk lane ($0.02 flat). ⚠ Imagen 4 shuts down 2026-08-17 — no new work.
      - role: "Video Desk"
        model: "google · video generation (Veo)"
        seat_status: seated
        covers: [veo-3.1-generate-preview, veo-3.1-fast, veo-3.1-lite, "gemini-omni-flash-preview (conversational edit)"]
        rationale: >
          Veo 3.1 holds the desk: NATIVE AUDIO (sora-2 has audio too, but Veo's lite/fast tiers
          give a $0.05-0.30/sec cost ladder in one family). sora-2/sora-2-pro is the OpenAI
          alternate ($0.10-0.70/sec); grok-imagine-video the budget lane ($0.05-0.08/sec).
          Heavy/slow either way — batch it (the registry's own note). ⚠ Veo 2/3 are past
          announced shutdown yet still doc-listed — smoke-test before depending.
      - role: "Voice Desk (TTS + STT)"
        model: "openai · speech-to-text"
        seat_status: seated
        covers: [whisper-1, gpt-4o-transcribe, gpt-4o-mini-transcribe, gpt-4o-transcribe-diarize, "gpt-realtime-whisper (streaming)"]
        rationale: >
          Transcription anchors on whisper-1/gpt-4o-transcribe ($0.006/min; -diarize adds
          speakers; mini at $0.003/min for volume). Voice OUT is per-job: gpt-4o-mini-tts for
          steerable instruction-guided voice, gemini-3.1-flash-tts for 90+ languages/dual-speaker,
          xAI /v1/tts for voice cloning (eve/ara/leo/rex/sal). Music is Google-only (Lyria 3,
          $0.04-0.08/song).
      - role: "Embeddings Desk"
        model: nomic-embed-text
        seat_status: seated
        rationale: >
          The LOCAL floor stays the default (free, MTEB-competitive, already the Archivist).
          Hosted alternates when scale or hosting demands: OpenAI text-embedding-3-small
          ($0.02/1M, the price/perf pick) or 3-large ($0.13/1M, matryoshka dims); Google
          gemini-embedding-2 is the only MULTIMODAL embedder (text/image/audio/video/PDF → one
          vector space) — the pick the moment cross-modal RAG appears. xAI: none (confirmed
          negative).
      - role: "Safety Gate (pre/post-flight moderation)"
        model: "openai · moderation"
        seat_status: seated
        covers: [omni-moderation-latest]
        rationale: >
          omni-moderation-latest is FREE — a zero-cost guard any agent can call before acting on
          or emitting content (harassment/hate/self-harm/sexual/violence, text+image). A free
          build-failing gate is the kit's favorite kind; wire it wherever generated content ships.
      - role: "Realtime Voice Desk"
        model: "google · Live API / realtime voice"
        seat_status: bench
        covers: [gemini-3.1-flash-live-preview, gemini-3.5-live-translate-preview, gemini-2.5-flash-native-audio-preview]
        hire_ticket: "Wire when a product needs live dialogue: bidirectional realtime audio + live speech-to-speech translation. OpenAI's realtime-whisper/translate lane is the alternate."
        rationale: "No current product needs a live-voice loop — benched, not seated. The desk exists so the capability is a lookup, not a re-research."
      - role: "Action Models Desk (computer-use / robotics)"
        model: "google · specialist (computer-use, robotics)"
        seat_status: bench
        covers: [gemini-2.5-computer-use-preview-10-2025, gemini-robotics-er-1.6-preview]
        hire_ticket: "Purpose-built screen-control/embodied models — evaluate against the wired generalists' computer-use (sonnet-5 OSWorld 81.2, gemini-3.6-flash 83.0) before any hire; the generalists may already cover it."
        rationale: "Specialists only earn seats by beating the incumbents' measured scores — the same rule as every other bench ticket."
      - role: "Media Desks (OpenAI/xAI capability cards)"
        model: ["openai · image generation", "openai · video generation (Sora)", "openai · text-to-speech", "openai · embeddings", "xai · image generation", "xai · video generation", "xai · speech (TTS + STT)", "google · text-to-speech & music", "google · embeddings (multimodal)"]
        seat_status: seated
        covers: [gpt-image-2, "gpt-image-1.5 (retires 2026-12-01)", "gpt-image-1-mini (retires 2026-12-01)", sora-2, sora-2-pro,
                 tts-1, tts-1-hd, gpt-4o-mini-tts, text-embedding-3-small, text-embedding-3-large, text-embedding-ada-002,
                 grok-imagine-image, grok-imagine-image-quality, grok-imagine-video, grok-imagine-video-1.5,
                 gemini-3.1-flash-tts-preview, gemini-2.5-flash-preview-tts, gemini-2.5-pro-preview-tts,
                 lyria-3-pro-preview, lyria-3-clip-preview, lyria-realtime-exp, "gemini-embedding-2 (multimodal)", "gemini-embedding-001 (text)"]
        rationale: "The alternate-family desks named in the ladders above — carried as first-class cards so every family's media reach is a lookup. Notable retirements on watch: gpt-image-1.5/-mini retire 2026-12-01; dall-e-2/3 already shut down."
      - role: "(structural gap cards)"
        model: ["anthropic · (text-only family)", "xai · embeddings — NONE"]
        seat_status: seated
        rationale: "Confirmed-negative cards, kept deliberately: they encode WHY the cross-family routing above is mandatory, so no future session re-derives the gap."

  reserves_reproducibility:
    mandate: "Version-pinned fallbacks. Not staffed for new work; exist so a regression or an API-shape need has a named, tested landing spot."
    seats:
      - { role: "Opus pin (if 4.8 regresses)",        model: claude-opus-4-7,   seat_status: bench, rationale: "Same price as 4.8, strictly weaker — its ONLY value is version-pinned reproducibility. Never a capacity hire." }
      - { role: "budget_tokens API shape (Opus)",     model: claude-opus-4-5,   seat_status: bench, rationale: "Last Opus supporting BOTH classic budget_tokens AND effort — the landing spot if a component needs a fixed thinking-token ceiling. 200K ctx." }
      - { role: "budget_tokens API shape (Sonnet)",   model: claude-sonnet-4-5, seat_status: bench, rationale: "Pre-4.6 Sonnet with classic thinking. EARLIEST retirement floor of any Active model (not before 2026-09-29) — plan exits, don't build on it." }
      - { role: "no seat",                            model: claude-sonnet-4-6, seat_status: bench, rationale: "More expensive than Sonnet 5's intro price and weaker — the registry's own verdict: no reason to add. Listed so nobody re-litigates it." }
      - { role: "Gemini Pro fallback",                model: gemini-2.5-pro,    seat_status: bench, rationale: "Older-gen Pro if the 3.x quota exhausts entirely: GPQA 86.4%, classic thinking_budget shape. A brownout seat, not a hire." }
      - { role: "no seat (superseded)",               model: gemini-3.5-flash,  seat_status: bench, rationale: "Strictly dominated by 3.6 Flash (cheaper output, fresher cutoff). Named here so the dominated choice is never made by accident." }
      - { role: "Cheap Coding Pilot (challenger)",    model: grok-build-0.1,    seat_status: bench, rationale: "xAI's dedicated coding tier at $1/$2 — predecessor claimed 70.8% SWE-bench Verified at 190 TPS. The named challenger to the Apprenticeship: pilot 3 bounded tickets vs gpt-oss-20b; hire only on gate evidence." }

  hardware_gated:
    seats:
      - role: "Apprentice, Senior (free coding — bigger box)"
        model: gpt-oss-120b
        seat_status: hardware_gated
        rationale: "~o4-mini class free coding (GPQA 80.1% no-tools) — a strict upgrade to the Apprenticeship the estate cannot host (needs ~80GB; the Mac has 48GB). Promotion is blocked on HARDWARE, not benchmarks: an 80GB+ host joining the estate unlocks it automatically."

  offboarding:
    mandate: "Do-not-staff. Every id here is a live-bug tripwire: grep configs for them at intake."
    seats:
      - { model: claude-opus-4-1,                 seat_status: offboarding, rationale: "RETIRES 2026-08-05 (~2 weeks) at 3x the price of Opus 4.8. Any config hardcoding it is a LIVE BUG about to 404." }
      - { model: claude-haiku-3-5,                seat_status: offboarding, rationale: "Retired on the first-party API 2026-02-19. Listed only so nothing references the dead id." }
      - { model: grok-4-and-grok-3-legacy,        seat_status: offboarding, rationale: "Retired 2026-05-15; slugs SILENTLY redirect to grok-4.3/grok-build-0.1 and bill at successor rates — a billing surprise wearing a familiar name." }
      - { model: gemini-3-pro-preview-and-2.0-legacy, seat_status: offboarding, rationale: "Shut down (2026-03-09 / 2026-06-01). Dead ids fail loudly at least — but migrate any references to 3.1 Pro Preview." }

# ============================================================================
# CHART 2 — substitutions (who covers a seat) and promotions (how seats change)
# ============================================================================
substitutions:
  doctrine: >
    A substitution is a CAP/DEATH response, not a preference: when a seat's quota signature fires
    (L5/L146), sweep every lane on that executor to the ladder below in one move. One retry per
    rung; skipping down is free; stepping UP is the fix for drift. Kit-measured confidence
    outranks benchmarks when they disagree.
  ladders:
    - seat: "CEO / Conductor (claude-fable-5)"
      order: [claude-opus-4-8, claude-sonnet-5]
      notes: "Fable's own bucket caps independently of Opus's. Opus conducts with modest loss (SWE-Pro 69.2 vs 80.3) at half the price; Sonnet 5 is an emergencies-only conductor — fine judgment, thinner ceiling. Never conduct from the builder family (judgment seat stays in-family, KB-family-parity applies to WORKERS)."
    - seat: "Lane Pilot (gpt-5.6-sol)"
      order: [gpt-5.6-terra, claude-sonnet-5]
      notes: "Terra pilots at −1.2 SWE-Pro / −1.4 Terminal-bench for half cost — acceptable for most lanes. If the WHOLE codex family is capped (5h window), the pilot crosses families to Sonnet 5 (commit-capable, so the adopt-commit step disappears too)."
    - seat: "Feature seat (gpt-5.6-terra)"
      order: [gpt-5.6-luna, gpt-5.3-codex, gpt-oss-20b]
      notes: "Luna substitutes UP-conditional: only in lanes already piloted; drift = step back up. gpt-oss-20b takes only the fully-specified residue."
    - seat: "Crank (gpt-5.6-luna)"
      order: [gpt-5.6-terra, gpt-oss-20b]
      notes: "The crank substitutes UPWARD by default (Terra) — the seat's failure mode is drift, and the fix is capability, not a cheaper twin. The free floor covers only bounded checklist passes."
    - seat: "Chief Auditor (gemini-3.1-pro-preview)"
      order: [gemini-3.6-flash, claude-opus-4-8]
      notes: "The auditor's quota caps FAST (light subscription, multi-day reset) — this ladder fires often. 3.6 Flash first (in-family, fresher cutoff, unmeasured precision — pair its first rounds with spot-checks). Opus second: cross-family from the builder holds (Claude audits OpenAI builds). grok-4.5 is NEVER sole auditor — measured precision too low; it stays the second lens."
    - seat: "Red Team (grok-4.5)"
      order: [claude-opus-4-8, gemini-3.1-pro-preview]
      notes: "SuperGrok quota is the durable pool (outlasts agy) — this ladder fires RARELY. When it does: Opus for exploit-class depth, the Chief Auditor for a security-flavored correctness pass. Both are precision lenses, not recall lenses — expect fewer, truer leads while the seat is empty. Pending clearances (mythos-5, flash-cyber) slot here the day their badges land."
    - seat: "Free floor (gpt-oss-20b)"
      order: ["qwen3:1.7b", gpt-5.4-nano, gemini-3.5-flash-lite]
      notes: "Ollama down = worker_death, restart serve first. Then: nano-local for trivial shapes, the paid nano floors for volume. All floor substitutions keep the same build-failing gates — a cheaper seat never buys a cheaper gate."
    - seat: "Edge Officer (qwen3:8b, Pi)"
      order: []
      notes: "NO substitute by design: the seat certifies Holt-as-deployed, and any bigger stand-in falsifies the certification (the honest-exam rule). If the Pi is down, the exam waits."
    - seat: "Archivist (nomic-embed-text)"
      order: []
      notes: "No wired substitute; embeddings are cheap and local. If it ever fails, re-embedding with a different backbone is a MIGRATION (vectors don't mix across models), not a substitution — plan it as one."
    - seat: "Image Desk (Nano Banana 2)"
      order: ["openai · image generation (gpt-image-2)", "xai · image generation (grok-imagine, budget)"]
      notes: "Per-JOB choice more than failover: Google for layout/text-in-image, OpenAI for flagship quality tiers, xAI for $0.02 bulk. All three live behind keys the staff already hold."
    - seat: "Video Desk (Veo 3.1)"
      order: ["openai · video generation (sora-2/-pro)", "xai · video generation (grok-imagine-video)"]
      notes: "Cost ladders inside each family (lite/fast/pro tiers); batch everything — the desk is slow by nature."
    - seat: "Voice Desk (whisper/gpt-4o-transcribe)"
      order: ["xai · speech (STT $0.10/hr + cloning TTS)", "google · text-to-speech & music (90+ langs, Lyria music)"]
      notes: "STT failover is real failover; TTS is per-job (steerable voice = OpenAI, languages/dual-speaker = Google, cloning = xAI, music = Google only)."
    - seat: "Embeddings Desk (nomic local)"
      order: ["openai · embeddings (3-small $0.02/1M)", "google · embeddings (multimodal)"]
      notes: "Same migration caveat as the Archivist: switching embedders re-embeds the corpus. Choose ONCE per corpus; the ladder is for NEW corpora, not mid-life swaps. xAI has no embedder (confirmed)."
    - seat: "Safety Gate (omni-moderation)"
      order: []
      notes: "FREE and unique — no substitute needed; if it's down, the gate fails CLOSED (hold the publish), never open."

promotions:
  doctrine: >
    Benchmarks NOMINATE; pilots + gates PROMOTE; the human ratifies (L0). Every promotion below is
    a ticket with a measurable trigger — when it fires, run the pilot, show the gate evidence,
    record the outcome in models.yaml confidence.kit, and re-render this chart. Demotions use the
    same mechanism in reverse; a flagged benchmark regression opens a review, never an automatic
    bench.
  board:
    - id: PROMO-1
      candidate: gpt-5.6-luna
      from: "Line Engineer (crank)"
      to: "Senior Engineer (features) — piloted lanes only"
      trigger: "Terminus-style evidence already exists (+30% throughput, flat errors). Promote per-LANE: after any lane where Luna holds N=3 consecutive feature tickets with zero step-ups, it keeps that lane at Terra's tier."
      benchmark_basis: "SWE-Pro 62.7 within 0.7 of Terra; the gap that matters (MRCR long-context) is avoidable by lane design."
    - id: PROMO-2
      candidate: gemini-3.6-flash
      from: "bench (Volume Reviewer)"
      to: "co-Auditor"
      trigger: "A/B on the SAME diff set as the Chief Auditor: hire if line-cited precision is within tolerance; promote to co-equal if it also catches something Pro missed (its 14-month-fresher cutoff makes that plausible on new-API surfaces)."
      benchmark_basis: "OSWorld 83.0 (registry-best), SWE-Pro 58.7, cutoff 2026-03 vs Pro's 2025-01."
    - id: PROMO-3
      candidate: grok-build-0.1
      from: "bench (challenger)"
      to: "Apprentice co-seat (paid-cheap coding floor)"
      trigger: "3 bounded tickets vs gpt-oss-20b, same gates: promote if gate-pass rate strictly beats the free floor AND cost/ticket stays under the Junior Engineer's."
      benchmark_basis: "Predecessor's 70.8% SWE-bench Verified at 190 TPS (vendor claim, old slug — hence pilot, not trust)."
    - id: PROMO-4
      candidate: gpt-5.4-mini
      from: "bench"
      to: "Subagent Fleet Default"
      trigger: "Resolve the flagged mini-class ambiguity (models.yaml): wire it explicitly, run one fan-out A/B vs luna; promote on cost-per-accepted-output."
      benchmark_basis: "Vendor positioning only (no public numbers) — which is precisely why the ticket demands a measured A/B."
    - id: PROMO-5
      candidate: gpt-oss-120b
      from: "hardware_gated"
      to: "Apprentice, Senior"
      trigger: "HARDWARE, not benchmarks: an 80GB+ host joins the estate. Then prove on one low-stakes unit like any floor hire."
      benchmark_basis: "GPQA 80.1 vs 20b's 71.5 (no-tools) — a whole tier of free capability waiting on RAM."
    - id: PROMO-6
      candidate: [claude-mythos-5, gemini-3.5-flash-cyber]
      from: "pending_clearance"
      to: "Security Specialists"
      trigger: "Access grants (Glasswing partnership / CodeMender pilot). The paperwork IS the promotion; capability is already established by lineage."
      benchmark_basis: "Mythos-5 = Fable-5 weights (SWE-Pro 80.3 lineage); flash-cyber has no public sheet — clearance-gated evaluation on arrival."
    - id: DEMO-1
      candidate: grok-4.5
      watch: "AA-Omniscience hallucination 54% (flagged, was 25% on 4.3). The seat TOLERATES low precision by design, but if adjudication cost (false-positive burden per real find) doubles from the 07-18 baseline, demote the seat to grok-4.3 and re-measure."
    - id: DEMO-2
      candidate: claude-sonnet-5
      watch: "Price cliff 2026-09-01 ($2/$10 → $3/$15): re-run the Staff Engineer seat-cost math then. Also standing: the exploit-desk bar (0% Firefox set) — any routing that drifts security work here is a config bug."
    - id: DEMO-3
      candidate: gpt-5.3-codex
      watch: "⚠ verify current ChatGPT gating (was Pro-gated at launch per secondary sources). If the lane's access changes, the Long-Haul seat falls back to terra until re-verified."
    - id: WATCH-1
      candidate: gemini-3.1-pro-preview
      watch: "Still 'Preview' (3.5 Pro delayed) — a GA replacement or a silent repoint is a reproducibility risk; pin ids, re-probe at intake, and treat a Pro-GA release as an automatic review of the Chief Auditor seat."
    - id: WATCH-2
      candidate: "studio retirement calendar"
      watch: "Imagen 4 shuts down 2026-08-17; gpt-image-1.5 and gpt-image-1-mini retire 2026-12-01; dall-e-2/3 and grok-2-image already gone; Veo 2/3 past announced shutdown but still doc-listed (smoke-test). Grep any media pipeline for these ids at intake — the same live-bug tripwire rule as the offboarding department."
