# Recipe — dual-model economics: a scarce designer beside an abundant executor

> **Status:** recipe — the full pattern **and** the worked instantiation. Its normative core is the
> **`SEAT` family** ([`../standards/SEATS.md`](../standards/SEATS.md), `SEAT-01..09`, corpus
> v3.5.0): `SEATS.md` is what you cite in a review; **this file wins on any conflict about
> detail**. It also feeds [AG-14](../standards/AGENTS.md#AG-14) / [DOC-18](../standards/DOCUMENTATION.md#DOC-18)
> (propagation) and [AG-13](../standards/AGENTS.md#AG-13) (only the `mgf-common` supervisor changes a library).
> **Origin:** adapted with attribution from the Sooth family's `docs/recipes/dual-model-economics.md`;
> **copy, never a dependency** — see the Provenance note in [`../standards/SEATS.md`](../standards/SEATS.md).
> **Propagation (DOC-18):** the dispatch block lives once, in
> [`../../templates/SEAT_DISPATCH.md`](../../templates/SEAT_DISPATCH.md) (`SEAT-08`) — a repo copies
> it verbatim, never re-words it; §9 explains why the harness layer is what makes any of this
> automatic.

---

## 0. The scenario signature — when this recipe applies

You have **two (or more) AI capability tiers with asymmetric cost**: a top-tier model whose tokens
are a finite block (here: Fable / Mythos-class), and a strong executor whose tokens are effectively
unlimited for your purposes (here: Opus-class). The work is a long-lived engineering program with
real governance — decisions that stick. The question is never "which model is better"; it is
**which decisions are expensive to get wrong**, because that is the only thing worth the scarce
tier. If all your work is reversible and spec'd, you don't need this recipe: use the executor.

## 1. The principle — capability arbitrage rests on model-independent execution

The scarce model's edge is **judgment under irreversibility** — design with unbounded option
spaces, adversarial imagination, cross-repo inference — not throughput. You can only *harvest*
that edge if execution is engineered to not need it: **executable gates as the definition of done,
golden outputs, deterministic double-runs, adversarial review rounds, staged plans**. Every one of
those converts "trust the model" into "check the output" — which is exactly what makes it safe to
hand implementation to the abundant tier. **Build the gates first; the economics follow.**

**In this federation the gates already existed**, which is why the pattern worked on its first
real run rather than needing a pilot: the four green gates ([WF-02](../standards/WORKFLOWS.md#WF-02)
— lint / typecheck / test / import-linter, merge-blocking), `mgf-fed app-doctor` (+ `--standards`),
the tiered test supervisor ([TS-22..TS-28](../standards/TESTING.md)), the byte-identical wire
golden ([OB-10](../standards/OBSERVABILITY.md#OB-10)), and the corpus/registry currency gates
(`gen_rules_index.py --check`, `gen_mgf_libraries.py --check`, `mgf-fed drift-check`). Your forms
will differ; the property must not.

## 2. The three seats

- **The scarce designer** (top tier): produces *contracts* — decision packets, rulings-ready
  analyses, threat models, complexity maps, adversarial verdicts. Its output is text others execute.
- **The abundant executor**: implements against a ruled contract, writes the tests the contract
  names, runs the playbooks, babysits CI, does doc-currency sweeps, sits routine review rounds.
- **The human enactor** (the founder): the only seat that *decides*. Packets end in decision boxes;
  the founder's recorded word turns a recommendation into a ruling. Agents never self-enact
  ([AG-06](../standards/AGENTS.md#AG-06), [AG-13](../standards/AGENTS.md#AG-13)).

The split is enforced socially AND mechanically: the harness dispatch in §9 tells every session
which seat it occupies before it does anything.

## 3. What earns the scarce model — the complexity taxonomy

A task qualifies only if it scores on at least one axis (tags: CX-1..6):

- **CX-1 Irreversible design** — unbounded option space + low reversibility (wire codecs, identity
  schemas, a corpus amendment under [`../../LOCK.md`](../../LOCK.md), a public API's stability
  tier). A mediocre decision outlives every token you saved.
- **CX-2 Adversarial reasoning** — the "looked right, failed adversarially" class: trust-boundary
  crossings, TOCTOU, false-green gates, a state machine that reports a live peer as dead. Depth
  beats redundancy here.
- **CX-3 Global inference** — holding the whole program in one head: fleet drift audits, cross-repo
  invariants, the propagation matrix's blast radius, a 44-member release wave's ordering.
- **CX-4 Verification design** — deciding *what to prove* (mutation-kill targets, negative seeding,
  what-would-fool-the-reviewer). Wrong tests manufacture false confidence; writing tests to a
  decided spec is executor work.
- **CX-5 Emergent dynamics** — naming the property to assert when behaviour arises from
  interaction (threading, cancellation, retry storms). Running the scenario is executor work.
- **CX-6 Hijackable sequences** — long multi-surface operations (a cohort-release wave, a sibling
  rename, a fleet-wide ledger re-baseline) where a mid-sequence error is invisible downstream. The
  scarce model designs the ordered, checkpointed runbook; the executor runs it step-checked.

**Anti-scope (never the scarce model):** implementation against a ruling; doc-currency sweeps; a
`catch-up` run; test-writing to a decided matrix; re-attestation runs; routine review rounds; CI
babysitting; formatting; anything with a playbook, a validator, or a golden to converge on.

## 4. The spend rules (R1–R7)

- **R1 — altitude only.** The scarce model never does what the executor can do against a written
  spec. Mid-session discoveries of playbook-shaped work get *written down as a handoff*, not done.
  (`SEAT-03`)
- **R2 — spawns never inherit.** Every subagent / workflow spawned from a scarce-model session
  pins an explicit cheaper model. Inheritance is the leak: one measured audit spent **~75% of its
  scarce-model budget on two sweep subagents that silently inherited the parent model** — *the
  Sooth family's measured figure, carried here with attribution, not an mgf measurement*. mgf's own
  measured number is the workstation burn ratio in §8, with its caveats. (`SEAT-04`)
- **R3 — session ceiling + re-measure.** Set a per-session output target (≤ ~300k tokens; deep
  design packets ≤ ~500k). Derive "sessions remaining" from *measured* burn (§8), never from
  extrapolation. (`SEAT-09`)
- **R4 — durable output only.** Every scarce session ends with its thinking in a **committed**
  document. Chat-only insight has a one-session half-life. (`SEAT-05`)
- **R5 — one big thing per session.** One tracker item, taken from the top after a re-rank. Sprawl
  is how a 300k session becomes a 1.5M session.
- **R6 — commit as you finish.** Commit + push is the durability boundary; the uncommitted working
  tree is the only crash-loss surface. In this federation it is also the *resumability* boundary —
  see §13's relay-finish. Commits carry the [AG-03](../standards/AGENTS.md#AG-03) trailers.
- **R7 — verify evidence firsthand.** A packet's claims cite repo state the authoring session
  actually read. Where a subagent gathered the evidence, spot-verify the load-bearing pieces
  yourself before designing on them. (The federation's own form of this is
  [AG-05](../standards/AGENTS.md#AG-05): verify a recalled claim before acting on it.)

## 5. The decision-packet pattern (the contract artifact)

The unit of scarce-model output is the **decision packet** — written so the human can rule from the
packet alone and the executor can implement from the ruling alone. Anatomy:

1. **Status header** — what this is; authored-by + date; the evidence base (files read, verified
   firsthand); the governing constraints it may not violate; **the seats it assumes**.
2. **The honest floor (§0)** — what it closes *and what no version of it can close*, stated up
   front so nobody over-claims later. This is the section that makes a packet trustworthy.
3. **The baseline** — measured, dated. Gates green/red, versions, grades. A plan against an
   unmeasured baseline is a wish.
4. **The waves** — ordered work units, each with a status cell, each falsifiable.
5. **Decision boxes (DB-0..N)** — every open decision as a row: the decision, options with costs,
   **ONE recommendation**. The founder rules per-box or adopts all; the ruling is written back into
   the box.
6. **Gate & cost posture** — what this does NOT do (opens no gate, moves no golden, ships no
   release), so enactment can't be mistaken for implementation.
7. **The ledger** — append-only, newest first: every wave close-out, every court verdict, every
   ruling. **Never rewritten.** This is the section a relayed session reads to resume.

Lifecycle: `QUEUED → STAGED (packet at the edge) → RULED (the founder's recorded word) → EXECUTED
(executor, own review cadence) → VERIFIED (court round)`. The tracker row flips at each step with a
pointer — **the tracker is the ledger, the packet is immutable**. The shape is compatible with
[DOC-06](../standards/DOCUMENTATION.md#DOC-06)'s priority tracker; the packet is a tracker that
carries decision boxes.

## 6. The queue mechanics

One file carries the whole system for a given program — a `docs/inprogress/<PROGRAM>.md` tracker in
packet form ([DOC-02](../standards/DOCUMENTATION.md) puts it there; it archives per
[DOC-11](../standards/DOCUMENTATION.md) at closure). It is re-ranked at the top of every scarce
session against **what the founder enacted since** and **what execution surfaced**. Where a
program spans several scarce sessions, keep a companion complexity register: the spend rules, the
CX taxonomy, and a ranked list of upcoming scarce-class work with estimated spend and the executor
handoff named per row.

## 7. The scarce-session protocol (checklist)

1. **Baseline gates** — run the repo's four gates before touching anything; after a crash or a
   relay, run them before trusting the tree.
2. **Census before acting** — read the tracker's ledger and the actual repo state; what did the
   founder enact since, what did execution surface, what is already done that you were about to
   redo. (The relay-proof loop: *never* start from what you remember.)
3. **Re-rank**, then **take ONE item** from the top (R5).
4. **Gather evidence** — spawn pinned-model scouts for inventory and legwork (R2); read the
   load-bearing design inputs yourself (R7).
5. **Produce the packet** — anatomy per §5; stage it to the edge (branch + PR) for the founder to
   rule and merge.
6. **Commit as each artifact finishes** (R6) — never batch to session close.
7. **Close** — update memory ([AG-17](../standards/AGENTS.md#AG-17) in-repo,
   [AG-19](../standards/AGENTS.md#AG-19) runtime), push it, re-measure burn if planning.

## 8. Measurement — the burn loop

Claude Code writes every session transcript as JSONL under `~/.claude/projects/*/`. Total burn by
model, all-time, is one stdlib loop — re-run it whenever you plan spend; cite it dated:

```python
import json, glob, collections

out, msgs = collections.Counter(), collections.Counter()
for f in glob.glob('/home/USER/.claude/projects/*/*.jsonl'):
    with open(f) as fh:
        for line in fh:
            try:
                r = json.loads(line)
            except Exception:
                continue
            m = r.get('message') or {}
            u, mod = m.get('usage'), m.get('model')
            if not u or not mod:
                continue
            out[mod] += u.get('output_tokens', 0) or 0
            msgs[mod] += 1

for fam in ('opus', 'sonnet', 'haiku', 'fable', 'mythos'):
    o = sum(v for k, v in out.items() if fam in k)
    n = sum(v for k, v in msgs.items() if fam in k)
    if n:
        print(f"{fam}: out={o / 1e6:.1f}M msgs={n:,}")
```

Watch three numbers: **output tokens by model family** (the block you're draining), **per-session
sizes** (against the R3 ceiling), and **the share spent by subagents** (the R2 leak — visible as
sessions whose burn dwarfs their deliverable).

**Measured on this workstation, 2026-07-30:** executor-tier **101.9M** output tokens vs scarce-tier
**23.9M** — a **~4.3:1** ratio. Two honest notes on that number. It is *below* the ~9:1 the pattern
sustains at maturity, because the fleet only began dispatching by seat in mid-2026; the ratio is a
trend line to watch, not a trophy. And it is a **workstation-wide** figure across every project on
this machine — cite it as such, never as one program's burn.

## 9. Harness wiring — making the agent aware (the part that makes it automatic)

The pattern only survives if the harness re-teaches it every session. Four hooks:

- **The `docs/claude/CLAUDE.md` dispatch block** (the load-bearing one — project instructions load
  every session, and the system prompt tells each session its own model). **Do not write your own:
  copy [`../../templates/SEAT_DISPATCH.md`](../../templates/SEAT_DISPATCH.md) verbatim** —
  `SEAT-08` requires it, because divergent dispatch text is how two repos come to believe different
  things about one protocol. In this federation it belongs inside the **`mgf-fed catch-up` managed
  auto-block**, the same channel that already keeps [AG-01](../standards/AGENTS.md#AG-01)'s
  `AGENTS.md` and [AG-02](../standards/AGENTS.md#AG-02)'s project-lookup block fleet-current — so
  propagation is `catch-up --apply`, not a paste repeated 44 times.
- **Persistent memory** — one durable entry stating the protocol is in force and linking the
  program tracker ([AG-17](../standards/AGENTS.md#AG-17) in-repo;
  [AG-08](../standards/AGENTS.md#AG-08) keeps it federation-scoped, not a session log), so even a
  session that skims `CLAUDE.md` gets recalled into it.
- **Agent-tool discipline** — the `Agent` / workflow `model` parameter exists precisely for R2. A
  scarce session passes `model: "opus"` (or `haiku` for mechanical sweeps) on every spawn, and uses
  background agents for legwork while it keeps designing.
- **Durability rules as *rules*** — `SEAT-05` and [AG-03](../standards/AGENTS.md#AG-03) put
  commit-as-you-finish in the *standard*, not in lore. They protect exactly the artifacts the
  scarce tier produces.

## 10. Verification placement — the adversarial chair

Reviews are graded by the cost of a wrong verdict, not the prestige of the artifact: **wherever a
wrong CONCUR costs more than a wrong finding** — gate-opening rounds, golden re-blesses,
frozen-evidence changes, a corpus amendment, a release that opens the
[REL-13](../standards/RELEASING.md#REL-13) federation gate — the scarce model sits in the
adversarial chair. Routine wedge and increment rounds: the executor courts fine. A scarce verdict
is cheap next to an irreversible mistake it prevents — this is the one *recurring* scarce-model
expense that is always justified (`SEAT-07`).

## 11. Failure modes (all observed, most measured)

| Failure | Cost seen | Countermeasure |
|---|---|---|
| Subagents inherit the scarce model | ~75% of one audit's scarce spend *(Sooth-measured, carried with attribution)* | R2 / `SEAT-04`: pin `model:` on every spawn |
| Chat-only insight | evaporates in one session | R4 / `SEAT-05`: committed docs only |
| Uncommitted drafts at a crash or an API outage | the whole session's deliverable | R6 + commit-as-each-artifact-finishes (the relay-finish, §13) |
| Designer does executor work | full sessions burned below altitude | R1 + the §3 anti-scope list |
| Session sprawl (many "small" extras) | 300k → 1.5M sessions | R5: one item; write handoffs instead |
| Budget by extrapolation | phantom runway | R3 + §8's measured loop |
| Packet the founder can't rule from | a second scarce session to redo it | §5 anatomy: decision boxes + ONE recommendation |
| Executor redesigns a ruled decision | relitigated governance | §9 dispatch + `SEAT-06`: implement, propose, never re-rule |
| A resumed session redoes finished work | a wave repeated | §7.2 census-before-acting: read the ledger and the tree first |

## 12. Bootstrapping this in a NEW project — the six artifacts

1. **Gates that print PASS** — the definition of done the executor converges on. In the federation
   this is free: the four green gates + `mgf-fed app-doctor` ship with the scaffold.
2. **Determinism or golden outputs** where the domain allows — "check the output" beats "trust the
   model" (byte-identity is the strongest form).
3. **The program tracker in packet form** — `docs/inprogress/<PROGRAM>.md`, §5's anatomy, with an
   append-only ledger.
4. **The `docs/claude/CLAUDE.md` dispatch block** (§9) — copied verbatim from the template, tracker
   path adjusted, nothing else.
5. **A memory entry** declaring the protocol in force and linking 3–4.
6. **The burn loop** (§8) — run it once to baseline, again whenever you plan.

Then run §7 for every scarce session. The founder rules; the executor builds; the gates verify.

## 13. The worked instantiation (evidence it works, in this federation)

**The hrb-app release arc, 2026-07-29/30.** The protocol ran end-to-end inside mgf before it was
codified — and the artifact it produced is the reference implementation of §5:
`hrb-app/docs/inprogress/RELEASE_MASTERPLAN.md`.

| §5 element | Where it landed in the arc |
|---|---|
| Status header + seats named | The header: *"Written as a decision packet … the queue is the ledger; decision boxes are ruled by the founder, never self-enacted"*, with Designer = Fable, Executor = Opus-class, Enactor = the founder |
| Honest floor | §0 — four named things the plan **cannot** close (a gated upstream release, founder-gated corpus rules, sibling-side asks, real-hardware e2e fidelity), each with its unblock condition |
| Measured baseline | §1, dated 2026-07-29: four gates green, 215 tests / 89.88% line coverage, pins four minors behind roster |
| Waves | §2 — W1..W5, status-celled (`☐ ▶ ✅ 🚫 ⏳`) |
| Decision boxes | §3 — **DB-0..DB-6**, each with ONE recommendation; all seven ruled by the founder in one recorded word and written back per box |
| Gate & cost posture | §4 — *"opens no federation gate; moves no golden"*, plus the seat dispatch for the arc (executors pinned per spawn; the designer chairs gate-opening rounds only) |
| Ledger | §5 — append-only, newest first: each wave close-out and the arc's court verdicts |

**Measured outcome, each figure traced to its recorded source:** 5 waves (§2, all ✅) ·
**14 merged PRs, #10–#23** (the §5 close-out rows) · **at least 10 court rounds**, counted by name
from §5 — W2 ×2, W3 ×5 per §5's own enumeration *"(contract trio, controller, brand, depth,
closing)"*, the W4 wave court, the closing wave court, and the sibling consumer court on
`mgf-uitest-desktop` (§5's summary line asserts 11; ten are individually enumerable, so ten is what
this recipe claims) · suite **215 → 501** (215 at the §1 baseline; 501 at the last measured gate run
before the release cut, recorded in `hrb-app/docs/inprogress/MGF_STANDARDS_CONFORMANCE.md`'s audit
log for 2026-07-30 — §5's summary line's 503 is a post-release docs-only figure, not a gate output)
· branch coverage **92.77%**, the measured branch-aware number recorded six times across the
masterplan, `CHANGELOG.md` and the conformance tracker · **4 dated entries** in
`hrb-app/LESSON_LEARNED.md` · one library founded → published → adopted (`mgf-uitest-desktop`
0.1.0). The arc closed by tagging **hrb-app v0.2.0** — the *consumer app's* version, not a library's
and not a corpus version (annotated tag, devpi live, REL-01/02/05/06/08 + PKG-04/05 satisfied).

**What the courts caught that green suites did not** — the evidence for `SEAT-07`'s "grade the
chair by the cost of a wrong CONCUR": a false-broker-death state machine (reproduced), a
product-honesty defect (a stale device presented as current), a config-error misattribution in the
FINAL wave, a decorative tab-order test, and a vacuous budget bound. Every one of them passed the
four gates.

**The relay-finish — why `SEAT-05` says *as each artifact finishes***. Twice during the arc the
**executor** died mid-wave on server-side API errors — four consecutive failures across the W3 depth
pass (`RELEASE_MASTERPLAN.md:465-470`) — and each time roughly **a thousand lines of implementation
survived in the dead executor's worktree**, because they had been committed as they were produced
rather than held for session close. Recovery was **twice-shaped**: once a **fresh executor** picked
the work up from that worktree plus the written contract; once — when the executor path was fully
down (`:512`, three consecutive API 529/500) — the **designer finished at the bench**.

State the property precisely, because the weaker version is the one that is true: *work committed as
it is produced outlives the session that produced it, and a different seat can pick it up.* It is
**not** true that the program could have been rebuilt from the ledger alone — the worktree carried
the code and the ledger carried the contract, and the recovery needed both. That is still the
property the pattern rests on: a pattern that only works while one session stays alive is not an
operating model, it is a lucky streak.

**The census-before-acting loop** (§7.2) is the discipline that makes a relay safe — and note that
it names *both* inputs for exactly the reason above: the resuming session reads the ledger **and the
working tree** *before* it plans, so it neither redoes finished work
nor builds on a half-landed wave.

---

*On any conflict with a cited repo at HEAD, the repo wins and this recipe takes a correction note.*
