The Depth Chart

Choose your door

• Builder — before reading anything, open a terminal and run ollama list. Whatever you believed was on your machine, the list is what's actually there.
• Architect — three parts, strictly separated: the Seat, the Occupant, and the Shim. See the whole depth chart first.
• Translator — think of a football depth chart: the position is permanent, the player is whoever's name is written on that line this week. Start at the Bridge below.
• Validator — work the Gates at the bottom, one at a time: prove every seat is alive before you trust it.

Translator Bridge

A team doesn't rebuild its playbook when the quarterback changes. The position — its responsibilities, its place in every play — is fixed; the depth chart says who plays it this week. Coaches bench a struggling starter with a pen stroke, not a stadium renovation. Our manifest is that chart: Architect, Drafter, Sandbox are positions; claude-sonnet-5, hermes3:8b, gemini-3.1-flash-lite are this week's starters. The Drafter even plays for free — it lives on our own graphics card, so every snap costs zero dollars.

Builder Track (DO FIRST)

1. Look, don't guess. Inventory the machine: ollama list, check LM Studio. We found: the planned local hire didn't exist anywhere — and the "it's CPU-served" note in our own docs was a myth. The hardware check (one GPU query) showed a 12 GB card sitting idle.
2. Make the local hire real. ollama pull hermes3:8b, then serve it — and here's the trap: the tray app's managed server can be dead while its icon looks healthy. Run ollama serve in the foreground in its own labeled window; it prints its GPU discovery immediately. Confirm residence with ollama ps — you want 100% GPU. You should see: the model answering locally, for free.
3. Verify cloud hires against the LIVE menu — never memory. Model catalogs change faster than any AI's training data. And the full list endpoint truncates, so absence proves nothing: verify each exact slug with the per-model endpoints API. Pin exact slugs; a "latest" alias is an unreviewed hire that can change minds overnight.
4. Write the depth chart. Each manifest seat gets endpoint + exact model string + the NAME of its key variable (never the value). The local seat's key reference is null — nothing secret exists for it to leak. You should see: zero placeholder entries left, and no secrets anywhere in the file.
5. Smoke the whole roster through the one shim the mesh will use. One command per seat: "You are the Drafter. Reply with the single word: READY." We hit two live gotchas: a freshly stored key is invisible to already-open terminal windows (load it in place, don't re-type it), and the local model REFUSED a bare instruction but obeyed instantly once the prompt carried its role. You should see: three READYs — through your pipe, not the provider's chat page.

Architect Track (MODEL FIRST)

Three parts, strictly separated: the Seat (a named role with a job description — Architect, Drafter, Sandbox), the Occupant (whichever model currently holds the seat: a provider, an endpoint URL, one exact model string), and the Shim (one small piece of code that speaks the same OpenAI-style dialect to every seat, resolving secrets only at the moment of the call). The manifest file is the depth chart: it names each seat's occupant. Changing a line changes the starter; nothing else in the system moves.

Why seats instead of hard-coded models: a hard-coded model is a marriage — swapping it means touching code, retesting everything, and hoping nothing else depended on its quirks. A seat is employment at will, and the divorce is a one-line diff that a human reviews like any other change. Hiring policy follows the resource ladder: cheapest capable executor first. The Drafter runs local because its marginal cost is literally zero and its output is CI-gated anyway — a wrong draft costs nothing but electrons; the gate catches it. The Sandbox seat is escalation-only: the first rung for log triage is deterministic filtering (no model at all), and the long-context model is consulted only when filtered context genuinely overflows. The Architect seat stays premium because structure errors are the expensive kind. Note what the shim deliberately does NOT do: no retries, no fallbacks. Retry policy is the circuit breaker's job (next module) — a client that quietly retries is a client that quietly spends, and hidden spending is exactly what the safety layer exists to make impossible. Keys are resolved from the environment at call time, never persisted, never logged, and the error message for a missing key names the variable — not the value.

Validator Gates

Pass each gate before moving on. These are permission to advance, not hazing.

1. Gate 1: The manifest contains zero placeholder entries and zero secret values — and I checked the file, not my memory of it.
2. Gate 2: Every seat answered through the shim itself, not through a provider's website.
3. Gate 3: Every cloud slug was verified against the provider's live catalog this session, pinned, not floating.
4. Gate 4: The local seat is GPU-resident and I proved it (ollama ps), not assumed it.
5. Gate 5: I know the swap move cold: one manifest line, one PR, one human merge.
6. Gate 6 (active recall): In your own words — why is "the Drafter is free" not the same as "the Drafter is trusted"? ______________