campaign

Campaign Protocol v1.0: Architect-Tier Orchestration

Absorb → Survey → Plan → Orchestrate → Dispatch ⇄ Reconcile → Close

This workflow defines the /campaign execution loop for architect-class (expensive, long-horizon) walkers coordinating heterogeneous model tiers across a multi-workstream goal. The architect's primary output genre is not code — it is boundary conditions for cheaper walks, and judgment on the work that returns.

---

Philosophy

The Hourglass

Expensive tokens belong at the waist, not the edges:

  wide:   cheap tier + human  — boundary refinement (/boundary → IBC*)
  narrow: one architect pass  — exhaustive survey, planning, orchestration
  wide:   cheap tier          — disciplined worker execution (/refine, /core)
          deterministic evaluators between every layer

The architect ingests an approved $\text{IBC}^*$ (manufactured by the boundary loop), saturates its own context through an exhaustive multi-agent survey, and emits a graph of saturated worker IBCs routed to the cheapest capable tier. Error-correction iterations run in cheap space; the architect re-enters only to judge and realign.

The Plan Is a DAG of Boundary Conditions

A campaign plan is not a task list. It is a dependency graph of IBCs whose premises reference world state that sibling executions mutate. When worker P3 lands an unexpected fix, the premises baked into pending prompts P4–P9 may now describe a world that no longer exists. An open-loop dependency graph drifts exactly like an open-loop token walk, only at a coarser timescale. Hence two central invariants that are examined together at every RECONCILE boundary:

Premise Freshness: before dispatching any pending node, re-verify its IBC's premises (S1 tripwires) against current HEAD. A stale premise marks the node INVALIDATED; its IBC is realigned before dispatch.

Goal Supremacy / Mutable DAG: execution yields exponentially more context than planning — the higher-level goal reigns over the pre-specified DAG skeleton, not the reverse. At every RECONCILE boundary the architect MUST reconsider whether the DAG still serves the goal. DAG amendments — adding, editing, or removing nodes — are the norm, not a deviation; staying faithful to an arbitrary initial structure while overlooking what execution revealed is the failure mode this guards against. Each amendment is a new boundary and requires human approval before any affected node is re-dispatched.

Both checks are mechanical and cheap — they SHOULD themselves run on a cheap tier.

The Architect as Final Judge

Workers execute under their assigned discipline workflows, but no worker self-certifies. Every landed changeset returns to the architect's RECONCILE state, which judges it with git-review semantics against the worker's own IBC: acceptance evaluators re-run, coherence checklist applied, commit hygiene verified. The architect is constantly judging whether the campaign has proceeded correctly — that judgment, not code emission, is what the expensive tokens buy.

Working Set vs Flight Recorder

The campaign maintains two stores with different mutability and durability:

Store	Role	Git status
.scratch/<topic>/	Controller's live state — the current boundary conditions, mutable and realigned as the campaign evolves	Ignored, never committed
.ledger/log/	Flight recorder — the trace from which the trajectory is reconstructed	Committed in the .ledger/ subrepo

.scratch/<topic>/
├── REVIEW.md           # Survey report (evidence-grounded findings)
├── PLAN.md             # Mitigation plan: the campaign DAG, living
├── ORCHESTRATION.md    # Routing table: node → tier → discipline
└── prompts/
    ├── P1-<slug>.md    # Worker IBCs per templates/IBC.md
    └── ...

Checkpoint Durability Invariant: at every RECONCILE boundary the sketch records a checkpoint sufficient to regenerate the scratch state — which nodes dispatched/accepted/invalidated, what realignments occurred and why. A crash mid-campaign may cost working files, never the campaign: resume MUST derive from sketch + git alone.

---

Scope

[!IMPORTANT] /campaign is for multi-workstream initiatives where survey, routing, and reconciliation across model tiers pay for themselves. A single well-scoped change goes straight to /core; a single-artifact polish goes to /refine. Do not stand up a campaign for work one disciplined walker can finish — the orchestration overhead is itself a token cost.

---

Grammar

The controller's session state — the live topic, phase, and context:

# METADATA
TOPIC: "topic-slug"
STATUS: [ABSORB | CLARIFY | SURVEY | PLAN | ORCHESTRATE | DISPATCH | RECONCILE | CLOSE | HALT]

# CONTEXT
CTX:
  IBC_PATH: "path/to/approved/campaign/IBC"  # The boundary this campaign launches from
  GOAL: "Verbatim objective from the IBC"
  MODE: [INTERACTIVE | AUTONOMOUS]
  SCRATCH_PATH: ".scratch/<topic>"

The three persistent campaign artifacts — the findings ledger, the campaign DAG, and the reconcile log — are not redefined here. Their schemas are the locked Nickel contracts under ledger/contracts/, and nickel export over each artifact is the gate that enforces them:

Artifact	Contract	Load-bearing invariant
Findings ledger (SURVEY)	findings.ncl	a resolved finding ('mitigated/'accepted_risk) MUST name the evaluator that closed it
Campaign DAG (PLAN/ORCHESTRATE)	dag.ncl	each node's discipline is one of the enum [| 'core, 'refine, 'doc |]; the graph is acyclic, referentially whole, and concurrent nodes carry disjoint file_surface or a serialize marker
Reconcile log (RECONCILE)	reconcile_log.ncl	an 'accept judgment MUST name the evaluator that justified it

The evaluator field and the discipline enum are the campaign's two load-bearing couplings to these contracts: SURVEY and RECONCILE depend on the Verification Dual being unforgeable (no resolution or acceptance without a named evaluator), and ORCHESTRATE depends on discipline resolving to exactly one surviving worker workflow. Read the contracts directly for field shapes; do not restate them here.

---

State Transitions

ABSORB ──→ CLARIFY      (premise audit fails or ambiguity found)
       └─→ SURVEY       (IBC* premises verified, scratch initialized)

CLARIFY ─→ SURVEY        (resolved; or rejection report returned to /boundary)
        └─→ HALT         (frame rejected; boundary loop must reconsider)

SURVEY ──→ PLAN          (findings ledger complete and evidence-grounded)

PLAN ───→ ORCHESTRATE    (human approves plan in interactive mode)
     └──→ HALT           (goal unreachable within appetite; report)

ORCHESTRATE ─→ DISPATCH  (worker IBCs emitted, routing table approved)

DISPATCH ──→ RECONCILE   (one or more nodes land, or a worker freezes)

RECONCILE ─→ DISPATCH    (accepted; fresh pending nodes remain)
          ├─→ ORCHESTRATE (realignment requires new/revised worker IBCs)
          ├─→ PLAN        (structural fault: the plan itself was wrong)
          ├─→ CLOSE       (all findings MITIGATED or ACCEPTED_RISK; DAG complete)
          └─→ HALT        (reserved predicate tripped, or budget exhausted)

CLOSE ──→ end            (final sweep passes; human accepts the report)
      └─→ RECONCILE      (final sweep finds regressions)

---

States

1. ABSORB

Ingest the approved campaign $\text{IBC}^*$.

• Premise Audit (boundary S2): the architect's first obligation is to verify the IBC's tripwires against primary sources. On contradiction, emit the rejection report and transition to CLARIFY/HALT — rejecting the frame early is a success condition, not a failure.
• Initialize .scratch/<topic>/ and ensure .scratch/ is git-ignored.
• Open the campaign sketch in .ledger/log/ (flight recorder) and commit.

2. CLARIFY

Standard ambiguity gate. Interactive: surface to the human. Autonomous: log a conservative assumption per refine CLARIFY semantics — except premise failures, which always freeze: a campaign MUST NOT proceed from a refuted frame.

3. SURVEY

The expensive waist: saturate the architect's context via exhaustive multi-agent review of the target system.

• Fan out independent subagents in mutually isolated contexts (MBSS semantics from refine) across orthogonal angles spanning the goal's risk surface (correctness, security, proofs/specs, testing, docs-drift, performance — as the goal demands).
• The Grounded Critique Invariant (rules.md §4) applies in full: findings without reproducible evidence are filtered.
• The architect synthesizes REVIEW.md and the FINDINGS ledger. The architect reads primary sources directly (boundary S5) — subagents locate and excerpt; they do not paraphrase on the architect's behalf.

4. PLAN

Derive the mitigation plan from the findings ledger.

• Decompose into nodes sized for single-discipline worker walks, with explicit DEPENDS_ON edges and MITIGATES mappings back to findings.
• For each node, decide what is meaningful to verify — the acceptance invariants (property statements, metamorphic relations, theorem statements where formal models exist). The architect owns the what of testing; workers implement the minutiae under TDD discipline.
• Write PLAN.md. In INTERACTIVE mode, HALT for human approval of the plan before any orchestration.

5. ORCHESTRATE

Manufacture the worker boundaries.

• Emit one IBC per node into prompts/, using templates/IBC.md. Every worker IBC MUST satisfy the seven sufficiency conditions in boundary — in particular:
  • S7 Discipline Proportion: exactly one disciplining workflow (e.g. /refine for polish nodes, /core for feature nodes), with only the load-bearing rules inlined. A cheap walker under the refine loop is a powerhouse; the same walker under the full ambient rule mass silently drops invariants.
  • S1 Premises: each node's world-state assumptions stated as falsifiable tripwires — these become the freshness keys RECONCILE re-verifies.
  • S4 Evaluators: acceptance criteria carry their evaluator commands so RECONCILE can re-run them without trusting worker claims.
• Write ORCHESTRATION.md: the routing table mapping each node to the cheapest tier whose capability bounds the task, with rationale.
• In INTERACTIVE mode the human approves the routing table and prompt set (the boundary skill's HUMAN_DISPATCH_GATE, applied in batch).

6. DISPATCH

Launch workers on fresh nodes whose dependencies are ACCEPTED. The deterministic team-execution model — the Kahn-derived layer schedule, a worktree per node branched from the layer's start tip, the conflict-free set dispatched in parallel with the rest serialized, each reconciled node merged into the shared branch and the tip advanced per layer — is the orchestration protocol. That protocol is the mechanics; the runnable workflow that drives DISPATCH ⇄ RECONCILE as an automaton is the orchestration skill (skills/orchestration/SKILL.md), which packages the protocol's evaluator commands and exit-code routing into a loop a cheap-tier runner can execute. This skill is built downstream — until it lands, the architect drives the protocol by hand. The narrative:

• Workers run autonomously (e.g. under a /goal-style runner) inside their assigned discipline workflow, committing to the repository per commit-hygiene.
• Parallel dispatch is permitted for nodes with disjoint file surfaces; the DagNoConflict contract proves the parallel set conflict-free, so the partition is a read of the validated DAG, not a fresh judgment. Nodes sharing surfaces carry a serialize marker and run one at a time, each isolated in its own worktree.
• A worker that trips a reserved predicate or rejects its boundary freezes and returns its report — that is the IBC working as designed. A surface-exceed halt and a refuted premise have deterministic resolutions (the surface-exceed protocol; realignment); any other reserved halt escalates to the human.

7. RECONCILE

The architect re-enters as judge. The mechanical form of every step below — its evaluator command and exit-code routing — is the orchestration protocol; that document is what makes RECONCILE drivable by an automaton. For every LANDED node, in a fixed (node-id) order, before merging it and before trusting the next node's premises:

1. Judge the changeset with git-review semantics — PURPOSE: verify node Pn's commits satisfy its IBC's acceptance criteria. Apply the coherence checklist (scope alignment, atomicity, hygiene).
2. Re-run the evaluators named in the node's acceptance criteria (S4). Worker claims are not evidence; evaluator output is.
3. Surface honesty. Derive the node's actual touched set from its diff and reconcile it against its declared file_surface (authorized.py --reconcile-node). An undeclared touch routes through the surface-exceed protocol (collision-check vs concurrent surfaces → authorize-and-widen if disjoint, serialize if not), so the conflict guarantee stays honest rather than trusting a stale declaration.
4. Bidirectional coherence-impact — the per-landing drift gate, explicit: does this landing break an already-landed artifact, or invalidate a pending one? Machine-check it where an evaluator exists — re-run the orphan, link, and contract gates over the affected surface (coherence_impact.sh); for any concern no evaluator covers (meaning-level coherence), dispatch a decorrelated review (the Verification Dual's adversarial path). Breakage is caught at this boundary, not deferred to CLOSE.
5. Verdict:
   • ACCEPT — steps 1–4 clean and any dispatched review converged-pass; merge the node, mark it ACCEPTED and its mitigated findings.
   • REWORK — an evaluator, surface, or coherence check failed: emit a corrective delta IBC (error feedback in cheap space) and re-dispatch; the node returns to PENDING.
   • ESCALATE — the fault is structural (the plan's, not the worker's): return to PLAN or ORCHESTRATE and realign.

Then, for every PENDING node, re-run the explicit premise freshness check against the new HEAD (premise_fresh.sh, cheap tier): re-verify the node's S1 tripwires; a flipped verdict marks the node INVALIDATED and its IBC is realigned before any dispatch. Running this at every boundary — not once up front — is what kills cross-node drift at the boundary instead of letting it accumulate to CLOSE.

Finally: append the RECONCILE_LOG round, write the sketch checkpoint, and commit it in the .ledger/ subrepo. Reserved-predicate breaches and appetite exhaustion route to the human (HALT).

8. CLOSE

When all findings are MITIGATED or human-accepted as ACCEPTED_RISK and the DAG is complete:

1. Run the full deterministic verification surface (complete test suite, linters, proof checkers where present) — the commit-gate scope, not the targeted-loop scope.
2. Run one final adversarial sweep (MBSS) over the campaign's cumulative diff to catch cross-node integration drift no single worker could see.
3. Emit a retrospective to the flight recorder (.ledger/log/) before presenting the report to the human. The retrospective captures the hard-won context that survives context loss and compaction. It MUST include: original goal and what actually landed; execution-model and intellectual-capital lessons (surprises, realignments, what the initial DAG missed); open watch-items or residual risks; a durability map (which artifacts are durable, which scratch is disposable). Commit it in the .ledger/ subrepo tagged log: close <topic> retrospective.
4. Produce the campaign report from REVIEW.md → outcomes: findings table with mitigation evidence, DAG execution trace, reconcile rounds, realignments, residual risks.
5. HALT for human final acceptance. Scratch MAY then be discarded; the sketch and git history carry the durable record.

---

Prime Directives

1. BOUNDARY_SUFFICIENCY: The campaign launches only from a human-approved $\text{IBC}^*$, and every emitted worker IBC satisfies sufficiency conditions S1–S7. An insufficient boundary is not dispatched, ever.
2. PREMISE_FRESHNESS + GOAL_SUPREMACY: At every RECONCILE boundary, re-verify two things: (a) every pending node's premises against current HEAD (stale premise → INVALIDATED); (b) whether the DAG as a whole still serves the goal. DAG amendments are normal and human-approved — open-loop dispatch of a stale or goal-misaligned DAG is a protocol violation.
3. RETROSPECTIVE_AT_CLOSE: Before final human acceptance, emit a retrospective to the flight recorder (.ledger/log/). Every campaign's hard-won context — what landed vs the goal, execution-model lessons, open watch-items, durability map — must survive context loss. The retrospective is a CLOSE step, not an afterthought.
4. ARCHITECT_AS_JUDGE: No worker output is accepted without a RECONCILE judgment grounded in re-run evaluators. Worker self-certification is void.
5. LIVING_PLAN: PLAN.md, ORCHESTRATION.md, and pending prompts are living documents — realignment when reality diverges is mandatory, and every realignment is logged with its why.
6. TIER_ECONOMY: Route every node to the cheapest tier whose capability bounds it. The architect does not emit code for worker-shaped tasks; workers do not make architecture decisions.
7. CHECKPOINT_DURABILITY: .scratch/ is never committed; the sketch checkpoints at every reconcile boundary so resume derives from sketch + git alone.
8. DELEGATED_TDD: The architect specifies the invariants worth verifying; workers implement tests and code under their discipline's closed loop, baseline failure included.