# Frontier Model Root-Cause Console & Clean-Room Orchestration Guardrails

**Date:** 2026-10-18  
**Project:** `borkbork` — Polish Custom Wardrobe Configurator (*Szafa na Wymiar*)  
**Audit Scope:** Why earlier builds shared scaffolds, how each dispatched agent's instructions differed across Waves 1–3, why `yolo` mode still prompted for user approval, what the 5 Frontier Seats (`Claude Opus 5.5`, `GPT-6 Astra Max`, `GPT-6.1 Sol`, `Qwen 3.8 Max`, `Z.ai GLM-5.3`) uncovered in their independent Meta-Audits of our session and proposed 4-Round Championship + Cleanup Pipeline, the **Local LAN (`10.0.0.x`) Primary vs. Tailscale (`100.x.y.z`) Backup Network Topology**, the **`Jev` & `Numbat` Live Probe Receipt**, and the **Happier & OpenHands Subagent Cleanup Receipt**.

---

## 1. Instruction & Workspace Diff Audit Across All Dispatched Agents (Waves 1, 2, and 3)

We ran a cryptographic (`SHA-256`) and transcript-level audit (`cmvcpju1208mfh81frj016uap`, `cmvcpjlqm08jzh81fe6td8oju`, `cmve4wox10otzh81fxgp3vnw5`) across all dispatched worker workspaces on `worker-agent1..5`:

### A. The 4 Core Spec Files (100% Byte-Identical Across All Workspaces)
Every agent across all three waves received the exact same four domain research documents (verified via `sha256sum`):
- `BRIEF.md`: `e9816ac7ff5c4adbe4606cda822871729bd5d441eba99193434a83abad1518c8`
- `POLISH-CARPENTRY-SPINE.md`: `ed6624162caeb6bf88fc52500fbeccc9e5f73b9f41505998fbc5a0129b77dd5d`
- `PERPLEXITY-POLISH-MARKET-DATA.md`: `6d834b053d7215e3ed828e4714d1d7ff54ba90e15d820a628b761ff66e9ec5bd`
- `HARDWARE-PARTS-ENCYCLOPEDIA.md`: `202ca898859da92ed169c54415fa4a0b38cbc4c1342e5bf669067984089e0a98`

### B. How Instructions Differed Across the 3 Waves (and the 3-Way Range Drift Caught by the Frontier Meta-Audit)

| Wave | Dispatched Models & Sessions | Workspace Files Present | Initial Prompt Instructions | Key Instruction Differences & Findings |
| :--- | :--- | :--- | :--- | :--- |
| **Wave 1** *(Initial 5 Clean-Room Frontier Seats)* | • `Claude Fable 5.1` (`worker-agent1:/home/agent/borkbork-cleanroom`)<br>• `GPT-6 Astra (high)` (`worker-agent2:/home/agent/borkbork-cleanroom`)<br>• `Grok 4.7` (`worker-agent3:/home/agent/borkbork-cleanroom`)<br>• `Gemini 4 Argon High` (`worker-agent4:/home/agent/borkbork-cleanroom`)<br>• `Qwen 3.8 Max` (`worker-agent5:/home/agent/borkbork-cleanroom`, `cmvcn61u5040rh81f66fjch2o`) | 4 Spec Files **+ `MISSION.md`** | Instructed agents to read `MISSION.md` + the 4 spec files and run 3 QA passes (`1440×900` & `390×844`). | **`MISSION.md` vs `BRIEF.md` spec conflict discovered:** `MISSION.md` specified **3.2 mm saw kerf** and narrower ranges (`W 1200–3600`, `H 2000–2800`, `D 450–700`, `2–4 bays`), whereas `BRIEF.md` specified **4.0 mm saw kerf** and `W 1000–4200`, `H 1900–2750`, `D 450–750`, `1–5 bays`. Even sharper: `Opus 5.5` and `Astra Max` caught that our own orchestrator recap drifted a **third time** (`W 800–4500`, `1–6 bays`). |
| **Wave 2** *(4 Additional Models for Full 9-Model Roster)* | • `Claude Opus 5.5` (`worker-agent1:/home/agent/borkbork-opus55`, `cmvcpjlqm08jzh81fe6td8oju`)<br>• `GPT-6.1 Sol` (`worker-agent2:/home/agent/borkbork-gpt61sol`, `cmvcpju1208mfh81frj016uap`)<br>• `Z.ai GLM-5.3` (`worker-agent1:/home/agent/borkbork-glm53`, `cmvd0ad5a0c2zh81f0hhppzxu`)<br>• `MiniMax-M3` (`worker-agent2:/home/agent/borkbork-minimax`, `cmvd0av820c77h81f764px4l3`) | 4 Spec Files *(+ stale `MISSION.md` & `SELF-QA.md` copied via `*.md`)* | Identical prompt across all 4: read **ONLY** the 4 spec files, build `index.html` from scratch, run 3 Chromium QA passes (`1440×900` & `390×844`), save screenshots, write `SELF-QA.md`. | **Clean-room leak caught by `Opus 5.5`:** Seeding Wave 2 folders with `cp borkbork-cleanroom/*.md` copied not only Wave 1's `MISSION.md` (`Fable 5.1` / `Astra`) into Wave 2 directories, but also `Fable 5.1`'s `SELF-QA.md` into `borkbork-glm53/`, which `GLM-5.3` read during its Wave 2 run. Also: `MiniMax-M3` used `8% VAT`, while `GLM-5.3` v1 showed `"Razem (bez VAT)"` (no VAT line at all until v2). |
| **Wave 3** *(Benchmark Expansion: `GPT-6 Astra Max` + `OpenHands ACP`)* | • `GPT-6 Astra Max (effort=max)` (`worker-agent2:/home/agent/borkbork-astramax`, `cmve4wox10otzh81fxgp3vnw5`)<br>• `OpenHands ACP v2` (`worker-agent1:/home/agent/borkbork-openhandsacp`, `cmve62zht0rv1h81f0jlst821`) | **Strictly the 4 Spec Files ONLY** (`0` `MISSION.md` or `SELF-QA.md` files) | Identical Clean-Room + 3-Pass QA + 6-screenshot + `SELF-QA.md` contract, reading only the 4 spec files. | Zero `MISSION.md` or `SELF-QA.md` contamination. `GPT-6 Astra Max` (`effort=max`) scored **90/100** on `Opus 5.5`'s rubric (`91/100` on `GPT-6.1 Sol`'s rubric). `OpenHands ACP` v1 stalled due to `reasoning_effort: "high"` with no `max_output_tokens` cap burning 27.6k/29.4k tokens on reasoning; fixed in `/home/agent/.openhands/agent_settings.json` (`max_output_tokens: 32000`, `reasoning_effort: "medium"`) and relaunched as `cmve62zht0rv1h81f0jlst821` (scored **70/100** on `Opus 5.5` and **48/100** on `Sol`). |

---

## 2. Why Putting Sessions in `YOLO` Mode Still Required Clicking "Accept" (and How We Fixed It)

Even after switching sessions to `yolo` in the Happier UI, permission prompts still appeared for three distinct architectural reasons verified in Happier `0.2.16` and OpenCode `1.19.3`:

1. **Parent Orchestrator Session (`cmvcj6puo000rh81fd3h28izk` on `srv1533069`) Was Not in `yolo` Mode:**
   - Every time the parent Antigravity session on `srv1533069` executed a `run_command` tool call (such as `ssh worker-agent1 ...`), the approval prompt came from the **parent session itself**.
   - **Fix Applied:** Set `permissionMode: "yolo"` on `cmvcj6puo000rh81fd3h28izk` via Happier MCP (`session.permission_mode.set`) AND shifted orchestration to native Happier MCP calls (`session.message.send`, `session.transcript.get`, `session.status.get`, `session.permission_mode.set`) which have `"approval": {"result": "none"}`.
2. **OpenCode 1.19.3 Missing `"permission"` Key in `~/.config/opencode/opencode.json`:**
   - On `worker-agent1` and `worker-agent2`, `/home/agent/.config/opencode/opencode.json` had no `"permission"` block. Under OpenCode 1.19.3's native defaults, `external_directory` (reading `/tmp/peers/...` or peer folders during judging) and `doom_loop` default to `"ask"`.
   - **Fix Applied:** Added top-level `"permission": {"*": "allow", "bash": "allow", "edit": "allow", "read": "allow", "external_directory": "allow", "webfetch": "allow", "doom_loop": "allow"}` to `/home/agent/.config/opencode/opencode.json` on `worker-agent1` and `worker-agent2`.
3. **In-Flight / Claimed Requests & ACP Restart Boundaries When Toggling `yolo` Mid-Session:**
   - In Happier `0.2.16`, toggling a session's permission mode to `yolo` in the Web UI updates timestamped session metadata for future turns, but **already-claimed permission requests bypass automatic retroactive approval**, and ACP child processes (`opencode acp`, `qwen --acp`, `openhands acp`) only receive launch flags (`--approval-mode yolo`, `--always-approve`) at process startup.
   - **Fix Applied:** Always launch sessions with `--permission-mode yolo` (and `--always-approve` for `openhands acp`) at creation time AND lock `session.permission_mode.set` (`permissionMode: "yolo"`) via Happier MCP immediately.

---

## 3. Local LAN (`10.0.0.x`) Primary vs. Tailscale (`100.x.y.z`) Backup Network Topology

Audited live from `worker-agent1` (`Claude Opus 5.5`, `/home/agent/borkbork-v3/LAN-AND-SUBAGENT-AUDIT.md`):

| Node | Proxmox VMID | **Primary Local LAN IP (`10.0.0.x`)** | **Backup Tailscale IP / MagicDNS** | Answering Lab Ports | Notes |
| :--- | :---: | :--- | :--- | :--- | :--- |
| **`worker-agent1`** | `141` | **`10.0.0.141`** | `worker-agent1` (`100.123.193.28`) | `:18881` (HTTP static server)<br>`:18180` (`127.0.0.1` only) | Serves `vFinal` (`borkbork-v3`), `borkbork-opus55`, `borkbork-v3-glm53`, `borkbork-openhandsacp`. |
| **`worker-agent2`** | `142` | **`10.0.0.142`** | `worker-agent2` (`100.116.212.34`) | `:18882` (HTTP static server) | Serves `borkbork-astramax`, `borkbork-gpt61sol`, `borkbork-minimax`. |
| **`worker-agent3`** | `143` | **`10.0.0.143`** | `worker-agent3` (`100.90.105.37`) | *(none active)* | Clean-room host for `Grok 4.7`. |
| **`worker-agent4`** | `144` | **`10.0.0.144`** | `worker-agent4` (`100.111.189.14`) | *(none active)* | Clean-room host for `Gemini 4 Argon High`. |
| **`worker-agent5`** | `145` | **`10.0.0.145`** | `worker-agent5` (`100.72.177.2`) | `:18885` (HTTP static server) | Serves `borkbork-v3-qwen` & `borkbork-cleanroom`. |
| **`agent3`** | — | **`10.0.0.21`** | `agent3` (`100.77.238.76`) | *(Happier daemon)* | `:8091/mcp-lab` not listening on `10.0.0.21`; live `mcp-lab` is on `kvm2:8446/mcp-lab`. |
| **`litellm`** | `1100` | **`10.0.0.40`** | `litellm` (`100.109.75.94`) | `:4000` (LiteLLM proxy) | Reachable directly on `10.0.0.40:4000`. |
| **`srv1533069` (`kvm2`)** | — | *(Remote VPS)* | `srv1533069` (`100.106.124.86`) | `:8446/mcp-lab` (`HTTP 200`) | Hosts Happier control plane, `mcp-lab`, and public showcase. |

### Root Cause of Earlier IP Failures & Mandatory Addressing Rule
- **Why `100.114.21.92` and `100.90.89.38` Failed:** Neither address exists in the current tailnet. When a worker VM re-registers with Tailscale (e.g., `worker-agent1`'s old offline entry `100.91.189.78`), its `100.x.y.z` IP changes, whereas its Proxmox **Local LAN IP (`10.0.0.141`–`10.0.0.145`) is deterministic (`10.0.0.<VMID>`)** and carries all worker-to-worker traffic directly over the local bridge.
- **Hard Rule:** Inside the Lab (`worker-agent1..5`, `agent3`, `litellm`), **always use `10.0.0.141`–`10.0.0.145` (`10.0.0.x` LAN) first**, with Tailscale MagicDNS hostnames (`worker-agent1..5`) strictly as backup — **never hardcode copied `100.x.y.z` Tailscale IPs in prompts**.

---

## 4. Live Probe Receipt: `Jev` (`VM 106:18088`) & `Numbat` (`perplexityai/numbat` v0.2.0)

1. **TypeSafe `Jev` (`VM 106:18088` / n8n `hcF7xPnPmWVblPd6`)**:
   - **What It Is:** TypeSafe AI's non-autoregressive "System 1" structured decision model returning calibrated `Noul` booleans, `Choice` enums, and `Score` ratings in `70–500 ms`.
   - **Live Probe from `worker-agent1`:** `10.0.0.106:18088` has no ping/ARP response on the `10.0.0.0/24` LAN (`VM 106` is currently stopped/offline on Proxmox), and no `jev` node is registered in Tailscale.
   - **Recommendation:** Start `VM 106` (`10.0.0.106:18088`) when running automated `Score(0..100)` / `Noul` gate checks across multi-model builds.
2. **Perplexity `Numbat` (`perplexityai/numbat` v0.2.0) & `sharkdp/numbat`**:
   - **Live Probe on `worker-agent1`:** `~/.local/bin/numbat` is **already installed** on `worker-agent1`, and it is **`perplexityai/numbat v0.2.0`** (Perplexity's Apache-2.0 Go agent security & observability engine with synchronous pre-action CEL rules and OpenTelemetry tracing)! Currently `0/15` agent hooks are active (`numbat status` shows hooks uninstalled and collector daemon stopped).
   - **How It Helps Our Multi-Model Builds:**
     - **`perplexityai/numbat` (`~/.local/bin/numbat`):** Installing its pre-action CEL hooks across `claude`, `codex`, `opencode`, `qwen`, and `kimi` enforces clean-room filesystem isolation (blocking reads outside `/home/agent/borkbork-<seat>/` during Round 1) and streams unified OTLP tool-call telemetry across all seats without breaking `yolo` mode.
     - **`sharkdp/numbat` (Unit-Typed Physical Calculator):** Adding `sharkdp/numbat` as a pre-judging verification step catches dimensional-analysis bugs (Euler-Bernoulli `mm^4` vs `m^4` deflection drift, negative ABS cut widths, and `m^2` sheet pricing) automatically.

---

## 5. Frontier "Second Set of Eyes" Meta-Audit & 8 Hardened Rules for the 4-Round Championship Pipeline

| Flaw Identified by Frontier Seats | Hardened Rule Added to Our Championship Standard |
| :--- | :--- |
| **1. Prose Prompt & Multi-File Spec Drift** *(Opus 5.5, Astra Max)* | **Single Locked `SPEC.lock.json` + Sealed Seed Tarball:** Never restate numeric ranges in orchestrator prose prompts. Seed every workspace from an immutable, `SHA-256`-verified `seed.tar` containing only the 4 spec files + `SPEC.lock.json`. |
| **2. Shared-Filesystem Contamination on Multi-Seat Hosts** *(Opus 5.5, GLM-5.3)* | **Per-Seat Filesystem Isolation + Pre-Flight Manifest Check:** Assert exact file count (`4` files, `0` `MISSION.md`/`SELF-QA.md`) before kickoff, and isolate seats on shared hosts (`worker-agent1`, `worker-agent2`) via separate Linux user/namespace or `perplexityai/numbat` CEL path rules. |
| **3. Live-Directory Mutation & Stale Tailscale IPs** *(Opus 5.5, Qwen 3.8 Max, Sol)* | **Local LAN (`10.0.0.141`–`10.0.0.145`) Primary + Immutable `SHA-256` Snapshots:** Address all Lab workers over `10.0.0.14N` LAN first, wait for an explicit completion barrier before judging, and verify `sha256` hashes + HTTP `200` across all URLs as a hard pre-judging gate. |
| **4. Self-Authored QA & Non-Blinded Competitor Judges** *(Opus 5.5, Astra Max, Qwen 3.8 Max)* | **60/40 Split (Frozen Oracle + Anonymized Blinded Judges):** **60 pts** come from an independent, orchestrator-owned Playwright + physical/numeric boundary oracle (testing negative cut widths, clamping, collisions, `0` sub-44px mobile touch targets, `23% VAT`). **40 pts** come from blinded cross-family judges. |
| **5. Unbounded Cross-Pollination & Cargo-Cult Bug Importing** *(GLM-5.3, Opus 5.5, Astra Max)* | **Defect Ledger (`MUST-FIX` / `MUST-NOT-IMPORT`) + `window.__WARDROBE_STATE__` Contract:** Each Cross-Pollination Packet includes a mandatory Defect Ledger so seats never import a donor's bugs alongside its features, plus a read-only `window.__WARDROBE_STATE__` state contract and rollback gate if a graft degrades any baseline probe. |
| **6. Warm Sessions Retaining Early Prompt Contamination** *(Astra Max)* | **Canonical Contract Re-Pin at Round 3 Start:** When sending the Round 3 (`v3-<seat>`) Cross-Pollination Packet to a warm session, re-pin `SPEC.lock.json` invariants explicitly so any Round 1 drift is overwritten. |
| **7. Single-Run Veto Flakiness & "No Eligible Winner" Rule** *(Qwen 3.8 Max, Astra Max, Opus 5.5)* | **Reproducible Median-of-3 Veto + Bounded Repair Loop:** A Round 4 (`vFinal`) cross-family Verifier veto must attach a reproducible failing Playwright probe (confirmed `2/3` runs) and triggers a bounded repair loop (`max 2` iterations). |
| **8. Unverified `YOLO` Session Archiving & Credential Hygiene** *(Astra Max, Qwen 3.8 Max, Opus 5.5)* | **Two-Step Verified Termination (`active: false` + PID check) & Env-File Secrets:** Stop and archive every finished builder/judge session immediately upon turn completion (`happier session stop <id> && happier session archive <id>`) so finished sessions never sit idle appearing as "waiting for input" in the Happier UI. |

---

## 6. Happier & OpenHands Subagent Audit & Cleanup Receipt

Audited and cleaned up by `GPT-6.1 Sol` (`cmvcpju1208mfh81frj016uap`) and `Claude Opus 5.5` (`cmvcpjlqm08jzh81fe6td8oju`):
- **Batch Inactive Cleanup:** `328` historical inactive sessions archived.
- **Completed `borkbork` Benchmark Sessions Stopped & Archived:**
  - `cmvd0av820c77h81f764px4l3` (`MiniMax-M3` on `worker-agent2`) — stopped & archived.
  - `cmve52dyb0poth81fmiyyfr00` (`OpenHands ACP v1` on `worker-agent1`) — stopped & archived.
  - `cmve62zht0rv1h81f0jlst821` (`OpenHands ACP v2` on `worker-agent1`) — stopped & archived after judging; leftover OpenHands `tmux` server (`PID 108107`) killed (`0` remaining OpenHands processes).
  - `cmvd0ad5a0c2zh81f0hhppzxu` (`GLM-5.3` on `worker-agent1`) — stopped & archived after `v3-glm53` scoring.
  - `cmvcn61u5040rh81f66fjch2o` (`Qwen 3.8 Max` on `worker-agent5`) — stopped & archived after `v3-qwen` scoring.
  - `cmvcpju1208mfh81frj016uap` (`GPT-6.1 Sol` on `worker-agent2`) — stopped & archived after Championship judging.
- **Remaining Active Sessions Across Happier Server:**
  - `cmvcj6puo000rh81fd3h28izk` (`srv1533069`) — this parent `borkbork` orchestrator session.
  - `cmvcpjlqm08jzh81fe6td8oju` (`worker-agent1`) — `Claude Opus 5.5` (`vFinal` lead synthesizer).
  - `cmve4wox10otzh81fxgp3vnw5` (`worker-agent2`) — `GPT-6 Astra Max` (Cross-Family Veto verifier).
  - **Non-Lab / Separate Project Sessions on `srv1533069`:**
    - `cmve86zpi0xafh81fa9ca0w63` (*"Fix Claude & Codex CLI sessions on delta"*) — **Note:** This separate `sysadmin` session on `srv1533069` is currently waiting for your multiple-choice answer on whether to install `gemini` and `copilot` on `delta-amd` or leave its 7 verified CLIs as-is.
    - `cmva51drr093oh8xe3fecyyyp` (*"Delta OS P0 + P1"*) — protected long-running service session.
    - `cmva57aho09d4h8xel42wgxh6` (*"Review HolmesGPT Installation"*) — protected long-running service session.