fleet: model tier and shape slot belong in the MAP-Elites niche, not the genome

[justrach]

Problem

The fleet evolves exactly one thing: the system prompt. In scoreVariants (src/subagent.zig):

t.fleetEvent("propose", niche, genome, "", pclass, "", 0, overrides[i].?)

genome is promptFingerprint(overrides[i]). The model is carried beside the genome as pclass (frontier/mid/small), and the workflow shape is not represented at all.

Today the archive is clean only by accident: one session = one model, so all variants in a tournament share it and comparisons are fair. The moment child models can vary per persona or per spawn, that invariant breaks - two variants could differ in prompt and model, and the judge's score is attributed wholly to the prompt fingerprint.

Given the score-integrity work in #168, fix this before multi-model fan-out ships, not after.

Fix 1 - model tier and shape slot are niche, not genome

In MAP-Elites terms these are three different things, and two are currently collapsed:

• genome (what mutation produces) = the system prompt. Leave it alone.
• niche / behavior descriptor (the conditions it is specialized for) = today just the agent name.
• fitness = the judge score.

Model tier and shape slot are descriptors, not genes. Widen the cell key:

niche:  "reviewer"  ->  "reviewer/mid/verify"

Genome space unchanged; cell space grows, which is the point.

No protocol change required. niche is already an opaque grouping string, sanitized and capped at 64 chars before signing (sanitizeMetaField(utf8Prefix(niches[i], 64))). "reviewer/mid/verify" is 19 chars. If the collector already groups by (niche, pclass) from #168, the tier axis is half-present and only the shape slot is new.

Sparsity: 4 personas x 3 tiers x ~5 slots = ~60 cells where there were 4, and cells already needed bootstrap seeding. Add hierarchical fallback to pullElites (src/fleet.zig:300):

(reviewer, mid, verify) -> (reviewer, mid, *) -> (reviewer, *, *)

Specific elite when one exists, general otherwise.

Fix 2 - per-variant provider class

scoreVariants computes one pclass for the whole phase:

const pclass = providerClass(childProvider(ctx.provider, ctx.subagent_provider, ctx.subagent_cross_provider).model);

Correct while the child model is session-level; wrong once it is per-persona. Move the computation inside the per-variant loop.

Fix 3 - model-matched tournament guard

Mutate one axis at a time. If the competing variants in a phase do not share a provider class, skip the submit rather than write a confounded row. Cheap check, protects the archive.

Payoff

Once cells span tiers, comparing reviewer/frontier/* against reviewer/mid/* tells you which personas actually need a frontier model. If the elites score equally, reviewers run on the mid tier permanently. No other mechanism produces that number - it falls out of the archive.

Order

Lands before the tier ladder and the per-persona pin, so no confounded rows are ever written.

[justrach]

Dependency order: this lands before #291 (tier ladder) and #292 (per-persona pin) so no confounded rows are ever written to the archive. #293 (shape catalog) supplies the slot component of the composite niche key.

[justrach]

Verification result: the design in this issue does not work as written

An implementation attempt (branch feat/290-niche-tier-slot) builds clean — 357/357 tests, fmt clean, line cap OK — but adversarial verification found a blocker that invalidates the approach, not just the implementation.

Blocker: a composite niche cannot survive the telemetry projection

src/scoring.zig on main:

pub fn telemetryNiche(buf: *[23]u8, value: []const u8) []const u8 {
    const builtins = [_][]const u8{ "reviewer", "researcher", "implementer", "skeptic" };
    for (builtins) |name| if (std.ascii.eqlIgnoreCase(value, name)) return name;
    if (value.len == 0) return "";
    const fp = promptFingerprint(value);
    return std.fmt.bufPrint(buf, "custom-{s}", .{&fp}) catch "";
}

writeOtlp runs every fleet propose/submit niche through this. The allowlist is exactly four builtin names; everything else becomes custom-<16hex>.

So "reviewer/frontier/code-review" ships on the fleet events as custom-3e817aae50ef69ca, while the paired score record (telemetry_score.write) ships the composite verbatim. Before this change both records carried the identical builtin name and joined; now they name two different cells.

Consequences:

• The composite key never reaches the archive as agent/tier/slot.
• The hierarchical fallback is dead code — pullElites can only ever receive bare legacy names or opaque hashes, so the (agent,tier,*) and (agent,*,*) levels are unreachable.
• The propose that exists so a scored cell has a servable genome files the genome under the hashed key while the fitness is filed under the composite — the scored cell has no genome.

The claim "no protocol change required" in this issue was wrong

It was wrong for a specific reason worth recording: the niche field is not an opaque pass-through. It is deliberately projected so that free-form task labels cannot leave the machine, per the contract documented one function up:

"everything else becomes the same 16-hex fingerprint used for prompts, so paths and task labels cannot leave as plaintext even after aggregate telemetry is opted in."

Second, related defect: privacy regression

Because the score record's niche is shipped verbatim (no telemetryNiche projection), appending a slugified free-form workflow phase title to the niche widens plaintext egress. A phase titled "Migrate Acme billing schema" with an implementer task previously emitted niche "implementer"; under this change it emits "implementer/frontier/migrate-acme-billing-sch" — a customer name in cleartext on an opted-in aggregate score record. Pre-change, only tasks with no agent: field leaked the title this way; post-change every scored variant does.

Corrected design

Slot and tier must be structured, allowlisted fields, not slash-joined into the niche string:

• slot — restrict to the closed vocabulary landed in ultracode: fixed catalog of five default orchestration shapes #293 (shapes.canonical_slots: find, verify, synthesize, sweep, variants, build, transform, scope, implement, review) and give it a telemetrySlot() projection that passes those through and drops anything else, exactly mirroring telemetryProviderClass. A canonical slot carries no user data, so it is privacy-safe by construction — which is the whole reason ultracode: fixed catalog of five default orchestration shapes #293's vocabulary is closed.
• tier — see subagents: default worker model tier ladder (sol planner / terra workers / luna mechanical) #291: providerClass() classifies gpt-5.6-sol, gpt-5.6-terra and gpt-5.6-luna all as frontier, so it cannot serve as the tier coordinate. The tier axis needs its own identity derived from the ladder, allowlisted the same way.
• The cell key becomes the tuple (niche, pclass_or_tier, slot) reassembled by the collector, not a joined string on the client.

This is a protocol change (a new allowlisted field). Sizing it accordingly.

Other findings from the attempt (still relevant to the rewrite)

• compositeNiche never escaped the / delimiter it introduced as structural, so keys did not round-trip through parseNiche (a phase titled "Build / Test" parsed back to agent "Build ").
• Per-component caps collided distinct cells: two 24-char slugs "implement-authentication…" mapped to one key.
• slugifyLower could emit a trailing -, contradicting its own doc comment.
• Two parallel ArrayLists in pullElites could desynchronize on a mid-sequence allocation failure, and the multi-object for over them is checked illegal behavior at unequal length.

Branch retained for reference; not merged.

[justrach]

Rewrite landed on feat/290-slot-axis (based on feat/293-ultracode-shapes)

Commit 4333101. Takes the corrected design from the comment above.

Slot is now an allowlisted field, not part of the niche.

• scoring.telemetrySlot() allowlists against shapes.canonical_slots, mirroring telemetryProviderClass instead of the hash-everything-else path. Sound only because that vocabulary is closed. Off-vocabulary → "" (uncelled), never a hash.
• Ships as a 6th component appended to the score record's provenance string, so a collector indexing 0..4 is unaffected. Advisory, like the rest of prov.
• The niche string is unchanged, so existing signatures and joins hold and there is no privacy regression.

Also fixed, both from the review:

• Provider class is now resolved per-variant behind subagent_run.variantProviderClass(ctx, i) — the single seam subagents: per-persona and per-spawn model pin (tier in agent frontmatter) #292 extends, instead of a phase-level constant that silently goes stale.
• Matched-tournament guard: a phase whose surviving variants span provider classes is skipped and traced. Runs before any judge is spawned, so it costs nothing and abandons no future.

Deliberately deferred:

• Folding slot into the signed tuple — needs a collector-first deploy.
• The tier axis entirely, because of subagents: default worker model tier ladder (sol planner / terra workers / luna mechanical) #291: providerClass returns frontier for all of sol/terra/luna, so it cannot separate ladder rungs. The guard is correspondingly blind to a rung-only difference. Documented at the seam; unblocks once subagents: default worker model tier ladder (sol planner / terra workers / luna mechanical) #291 supplies rung identity.

Verification: cold-cache rm -rf .zig-cache && zig build test → 355 → 359, exactly the 4 new blocks, proving they are not dead. zig fmt --check src/ clean, line cap passes (subagent.zig at exactly 600). Tests are in src/scoring_slot_test.zig, wired into main.zig's test {} hook.

Not pushed.

[justrach]

Shipped in v0.0.217: 503130d widened the MAP-Elites niche to agent/tier/slot, and 9e10ef6 landed the slot axis as an allowlist rather than a composite niche. Model tier and shape slot are now archive coordinates, not genome payload; provider_class rides the fleet events as designed.