MILESTONE_BUILD_PIPELINE.md

pipelines/MILESTONE_BUILD_PIPELINE.md

5-Chapter Milestone Build Pipeline — Architecture

Status: architecture proposal, 2026-07-04. Grounds every engine in the existing contracts:

_source/01_Tier_1_Foundation/T1_Build_Pipeline_Contracts [ACTIVE v1.0] (the BPC — ten pipeline

contracts, §1-§10), docs/PIPELINE_ADAPTER.md (Drive→repo access re-pointing), docs/CASCADE_RUNBOOK.md

(the Phase-6 spine procedure), docs/CANON_INTEGRITY_ARCHITECTURE.md (the canon graph + recall.py

the pipeline consumes), docs/BOOK_ACQUISITION.md (the ~158 MUST-ACQUIRE vs deep-research default),

and docs/proposals/CHAPTER_BUILD_TARGET.md (the per-chapter quality bar). It invents no world canon —

where an engine needs a canon fact not yet authored, it consumes it through recall.py or flags

[DECISION NEEDED - JOSH], exactly as the cascade does.

The problem this solves

The BPC sequences the whole game as ten global pipelines run corpus-wide, and the ROADMAP sequences

Phase 6 as ~88 spine sessions front-loaded before any asset engine runs. Both models gate all

downstream progress on all foundation being complete first — every book bought, every registry

populated, every gate green across 79 nodes — before a single playable chapter exists. That is a

years-long unpriced runway with no proof any engine actually produces a shippable chapter, and it

front-loads the entire book/scan/gating cost as one up-front bill.

The milestone model inverts this: **build and prove every engine on a 5-chapter slice, then roll the

same proven loop forward 5 chapters at a time.** Book, scanning, and gating cost staggers by

milestone — you buy only what THIS slice's chapters cite, populate only this slice's registry rows,

and run gates scoped to this slice's nodes. Each milestone is a cost-bounded, independently shippable

vertical slice that exercises the full engine chain end to end.

This is the BPC's own "Phase 6 vertical slice" idea (BPC §0: "First version per pipeline authors during

Flores Island region build at Phase 6 vertical slice") generalized from one region to a repeatable

5-chapter unit, and reconciled with the CASCADE_RUNBOOK's sequential build order.

---

1. The engines and their dependency order

Nine engines, in the dependency order the BPC's cross-pipeline linkages and the CASCADE_RUNBOOK fix.

Each row names the owning contract, what it reads (its canon inputs), what it writes (its output

store), and the recall.py query shape it uses to stay cited and hard-line-safe (§4). "Registry"

means the live CSV layer registries/<name>/<tab>.csv per PIPELINE_ADAPTER, never Drive.

Dependency order (the critical path)

                         E0 book-processing / cultural research
                          │  (per-slice substrate; runs alongside, not before)
                          ▼
      ┌──────────────────E1 chapter build (spine) ──────────────────┐
      │                   │  drafted → critic → Josh sign-off         │
      │                   ▼                                           │
      │            E2 region page ──────────┐                        │
      │                   │                 │                        │
      ▼                   ▼                 ▼                        ▼
 E5 lore            E3 boss/encounter   E4 quest writing      (E3,E4,E5 read E1;
      │                   │                 │                   E4 reads E2+E3)
      └─────────┬─────────┴────────┬────────┘
                ▼                   ▼
          E6 asset/art        E7 music/SFX/voice
          (reads E3+E4+E2)    (reads E1+E2)
                └─────────┬─────────┘
                          ▼
                    E8 UE build  (compiles ALL upstream registry rows into
                                  data tables + Level Sequences → playable slice)

The hard ordering constraints, each from a real linkage:

• E1 spine is the spine of the slice. BPC §9 makes locked spine entries "the only state

downstream pipelines consume" (CASCADE_RUNBOOK §6). Nothing downstream builds against a drafted

chapter. Within the slice, E1 runs sequentially Ch N→N+4 because continuity state accumulates

(CASCADE_RUNBOOK §2 build order — never parallel across chapters).

• E2 region page precedes E4 quest and E6 asset — quests resolve spatial_requirements_array

against canonical_zones (BPC §1 PCG, §6.5), and asset placement needs the region's zone bounds.

• E3/E4/E5 fan out from E1 and can run parallel *within a chapter* once its spine locks — they read

different facets of the same entry (CHAPTER_BUILD_TARGET §1/§3). E4 additionally waits on E3 (bosses

are quest climaxes) and E2 (zones).

• E6 asset and E7 audio are leaves — they consume entity rows E3/E4/E5 produced. BPC §5 Cinematic's

upstream-readiness checks (mesh_id_ref, voice_signature_ref, music_cue_id_ref, sfx readiness) are

literally reads against the registries E6/E7 wrote.

• E8 UE build is the sink — BPC §1.4 "build-time export" reads every registry, compiles to data

tables, and is "read-only against canonical store at runtime." It is last by construction.

• E0 is not a gate-0 predecessor — it runs *alongside* E1 per the ROADMAP §4 re-sequencing

("Book Processing runs alongside the spine, feeding it per-chapter"). A chapter's substrate is

acquired at its E1 session, not corpus-wide up front. This is the single biggest cost-staggering

lever (§3).

---

2. The 5-chapter milestone model

2.1 The first slice — recommend Ch 2-6

Pick Ch 2-6 as Milestone 1. Grounding, node by node (regions from WGM / boss roster / RCM):

• Ch 2 — Flores Island / Kelimutu (survival-horror open; the roster's Neophyte dodge/strike floor).
• Ch 3 — Manggarai / caci + lingko (first community-structural-resistance beat; parry verb; the

graded exemplar in CHAPTER_BUILD_TARGET).

• Ch 4 — Bali / subak + wayang (strike + perceive; Subak Crisis lead).
• Ch 5 — Borobudur / Srivijaya (strike + decode; 1025 CE anchor).
• Ch 6 — Sri Lanka / Anuradhapura (the perceive verb introduced — seeds the environmental-boss

protocol; False Naga at VRIL L332).

Why this slice, not another:

• It is the canonical build order's own head. CASCADE_RUNBOOK §2 fixes the order as Ch 2 → … → 77.

Milestone 1 = the first five of that sequence. No reordering, no special-casing.

• It is one coherent region cluster (Indonesia→Sri Lanka, Austronesian/Indic substrate), so E0's

book buy and E2's region-page research share sources and reviewers — maximal cost-sharing per slice.

• It has real engine coverage without the hardest edges. It exercises the full verb floor

(dodge→strike→parry→perceive), a community-resistance boss (Ch 3), a decode boss (Ch 5), and the

first environmental-protocol seed (Ch 6 perceive) — so E3 proves both standard and non-standard

boss forms. But it contains zero §17.1 high-care hard-line chapters (the first is Ch 8 Swahili /

Ch 11 Bwiti elevated-care). That means Milestone 1 proves the engine chain before the highest-care

cultural gates test it — the right order to debug a pipeline.

• Its books are bounded and mostly buyable-online (§3): 6 anchors, all in the BOOK_ACQUISITION

Ch 2-15 block, none in the §17.1 high-care must-acquire-all set.

• It sits wholly inside one Range Review window (RR-12 audits CH_02-CH_11; CASCADE_RUNBOOK §7.1),

so Milestone 1 + Milestone 2 (Ch 7-11) together close cleanly at the first RR gate — the milestone

boundary and the review boundary compose instead of fighting.

Note the one special case: Ch 2 has no v2.4 predecessor entry, so E1 derives its start-state from the

Ch 1 canonical framework and flags it (CASCADE_RUNBOOK §6, Ch 2 special case). Milestone 1 carries this

flag; it does not recur in later slices.

2.2 The milestone loop (repeatable unit)

Each milestone runs the same eight-stage loop over its 5 chapters. Stages that are per-chapter run 5×

sequentially where continuity demands (E1) and fan out where it doesn't (E3/E4/E5/E6/E7 within a locked

chapter).

1. Scope the slice. Declare the 5 chapter IDs, their regions, their hard-line flags, their MUST-ACQUIRE

anchors (§3), and the registry rows/columns this slice will touch. This is the milestone's session-identity

block (CASCADE_RUNBOOK §2), one level up from per-chapter.

2. E0 substrate acquisition (staggered). Acquire ONLY this slice's anchors; deep-research the rest;

write corpus/<id>/text.md + Research_Corpus rows. Scoped scanning per §3.

3. E1 spine, sequential Ch N→N+4. Each chapter runs the full 12-step CASCADE_RUNBOOK procedure to

drafted, fresh-context critic, then Josh batch sign-off. v2.4 ENHANCES v1.0 for Ch 2-11.

4. E2 region pages for the slice's distinct regions (parallel once spines lock).

5. E3/E4/E5 canon fan-out per locked chapter — bosses, quests, lore weave to the CHAPTER_BUILD_TARGET

bar (2-4 sub-bosses + 1 main; 12-facet checklist; L1/L2/L3 surfacing).

6. E6/E7 asset + audio generation for the slice's entities (leaves; parallel).

7. E8 UE build — compile the slice's registry rows to data tables, assemble Level Sequences, produce

a playable 5-chapter slice.

8. Milestone exit gate (§2.3). Prove the slice; tag; roll forward.

2.3 The milestone exit gate

A milestone is DONE — and the studio may roll to the next 5 — only when all of the following hold. This

is the machine-and-human definition of "proven," modeled on the CASCADE_RUNBOOK Step-2 "green is defined,

not vibes" discipline, extended across all nine engines.

Machine gates (harness, exit code trusted):

• harness/run_gates.py exits 0 scoped to the slice's nodes — fidelity, FK, topography, lint,

anchors, and (once landed) the graph gate all green for CH_N..CH_N+4, net of the declared baselines.

• recall counts reconciles for the slice — every cardinal the slice touches (bosses/ch, threads

advanced, weapons-to-add, familiar slots) matches canon; no orphan FK; no unresolved non-sentinel edge

(CANON_INTEGRITY_ARCHITECTURE §C G2/G5).

• Every downstream FK resolves at compile — E8's build-time export completes with zero

missing-path halts (BPC §1.5 "missing path resolution halts build pipeline").

• No hard-line tripwire across the slice: recall hardlines --chapter CH_NN clean for all five;

§17.7 retired-name straggler gate green; no cultural-representative-as-boss-target (Grid 8).

Human/critic gates (batched, per the autonomy contract):

• Every spine entry is locked (Josh signed off at the RR boundary or per hard-line chapter;

CASCADE_RUNBOOK §10). No downstream engine consumed a drafted entry.

• The slice's Range Review grids that can run on populated tables PASS (Grids 1-9 as their tables fill;

CASCADE_RUNBOOK §8). Milestone 1 (Ch 2-6) is a sub-window of RR-12 — its grids run at the RR-12 gate

after Milestone 2 completes Ch 7-11.

• The slice is actually playable — E8 produces a build a human can play start-to-finish across the

5 chapters, with L1 action complete on its own (CHAPTER_BUILD_TARGET §"Three-layer surfacing":

"L1 the action-adventure reads complete on its own"). This is the milestone's whole point: a

cost-bounded proof that the engine chain ships a playable unit.

Provenance: one git tag per milestone, milestone/ms-NN (Milestone 1 = milestone/ms-01, covering

Ch 2-6), carrying the slice's spine tags spine/ch-02..ch-06, the registry scatter, the asset-store

manifest, and the build artifact reference. The tag is the record (CASCADE_RUNBOOK §12).

2.4 Roll-forward

On exit, the next milestone reuses the *identical* loop with the next 5 IDs. The Translation Docs

(BPC §0), the /spine-chapter skill, the config pins, and the critic rubrics authored in Milestone 1

are now assets every later slice inherits — later milestones are cheaper because the engine tuning is

amortized. Milestone boundaries: Ch 2-6, 7-11, 12-16, … The RR windows (10-wide) close every second

milestone; only two milestones ever build on an audited-but-not-yet-RR'd predecessor, and the

CASCADE_RUNBOOK's "no forward build across an open Range Review" still binds at the RR nodes.

---

3. Cost staggering — books, scanning, gating, per slice

The whole point: no engine's cost is paid corpus-wide up front. Each cost is scoped to the slice

that consumes it.

3.1 Books — buy only THIS slice's anchors

BOOK_ACQUISITION already narrows 922 "needed" rows to ~158 MUST-ACQUIRE and makes deep-research the

default substrate. The milestone model narrows further to per-slice: at E0 you acquire only the

MUST-ACQUIRE anchors whose chapter is in the current slice; everything else is deep-researched at build

time. Milestone 1 (Ch 2-6), filtered from the Ch 2-15 block:

That is ~9 titles for the whole first milestone, versus the ~158 whole-corpus set. **Crucially,

Milestone 1 contains no §17.1 high-care chapter**, so it triggers none of the acquire-ALL cultural

mandates (Sámi Ch 29, Haiti Ch 42, Australia Ch 57, the elevated-care Ch 11/12/13/47/48/50). The

first high-care buy is deferred to the milestone that reaches Ch 8/11.

Online-first, per the Josh 2026-07-03 ruling: even within the slice's anchors, before any purchase

the E0 step verifies online availability (publisher digital, archive.org / HathiTrust / institutional

OA, library e-lending). Physical-buy-and-scan is the last resort, reserved for the slice's anchors whose

plates/apparatus exist nowhere digital. The 0.G availability sweep already binned the ~158; the milestone

just pulls the current slice's rows from that sweep.

Effect on cash flow: instead of one ~158-title bill before Chapter 1, the studio pays ~5-10 titles per

milestone as it reaches them — and most milestones (the non-high-care ones) pay far less because

deep-research covers the surveys. The expensive high-care acquire-ALL clusters land only on the specific

milestones that contain Ch 29/42/57 and the elevated-care set.

3.2 Scanning — scoped to the irreducible per-slice remainder

Scanning labor (Josh's manual effort) is the last-resort tail of §3.1. Per slice it is: only the current

slice's anchors that (a) are MUST-ACQUIRE, (b) failed the online-availability check, and (c) have

load-bearing plates/apparatus. For Milestone 1 this is expected to be near-zero (the Indonesia/Sri Lanka

excavation reports and ethnographies are largely digitally obtainable). The OCR/extraction tooling

(harness/bookproc/, BPC §8 re-pointed) activates ONLY when a slice leaves an irreducible scan remainder —

it is dormant otherwise. No ChromaDB, no vector store: a per-slice corpus is Grep/Read-retrievable

(ROADMAP §4/§8; a ~158-source *whole* corpus doesn't justify embeddings, and a 5-chapter slice's corpus

certainly doesn't).

3.3 Gating — scoped to the slice's nodes

The harness gates run corpus-wide today, but their *scope of enforcement* for a milestone is the slice's

node set. Concretely:

• Registry population is per-slice. You populate only CH_N..CH_N+4 rows and the columns those rows

need (boss rows for 5 chapters, quest rows, region rows, mesh/voice/theme refs). The §9.6 spine columns

instantiate once at Milestone 1 (the Ch 2 session's one-time column add, CASCADE_RUNBOOK §5); later

slices only append rows. Every write declares its divergence in docs/fidelity_baseline.json in the

same commit (the declared-divergence rule) so the gate stays green.

• Topography, lint, anchors, graph gates evaluate the whole file but the milestone's *pass condition*

is the slice's rows. A hotspot in Ch 71-73 does not block Milestone 1; it blocks the milestone that

builds Ch 71-73. The topography baseline already carries Josh-held waivers per node.

• The empty flagship registries (Boss/School/Questline/Weapon/Familiar, CASCADE_RUNBOOK §8.3) only

need their *slice rows* before a milestone's grids run — not all 79 chapters' worth. Milestone 1

populates Boss_Encounter for Ch 2-6 (the roster proposal already stages these exact rows), and the

vacuous-pass discipline (empty table = FAIL) applies only to the grids the slice actually runs.

• Gate cost is therefore flat per milestone, not growing — each slice re-runs the gates over the

same file but is only responsible for its own new rows. Regression on prior slices is caught for free

(the gates always run whole-file), but the *authoring* burden is bounded to 5 chapters.

---

4. How recall.py + the canon graph feed each engine

Every generative engine (E1-E8) is a recall.py consumer, so its output is **cited, complete, and

hard-line-safe by construction** — the CANON_INTEGRITY_ARCHITECTURE §D output contract: (a) cited

(source_file:row per field), (b) complete (full binding set, never a sample), (c) no-hallucination

(missing → NOT_POPULATED (declared-empty, Phase-N) or [DECISION NEEDED - JOSH], never fabricated).

The graph (harness/build_canon_graph.py → canon_graph.json) normalizes every ID and records aliases

(§B), the graph gate (harness/lint_canon_graph.py, §C) proves the slice's slice-relevant subgraph is

internally consistent before any engine reads it, and recall.py (§D) is the query surface. Per engine:

• E0 book/research → recall node CH_NN (what substrate the chapter needs) + recall hardlines --topic cultural

(the §17.1 care level, so acquisition honors the acquire-ALL mandates) + corpus rows via

T0_Research_Corpus_Registry (the real 2112 rows, not the 5 Source_Material placeholders —

§D pipeline-consumption note).

• E1 spine → recall node CH_NN is the load-bearing cascade query: the union of every registry

and doc row touching the chapter, cited and alias-normalized, which the graph gate has already proven

consistent. Plus recall open (halt on open-canon so the entry flags instead of inventing) and

recall aliases <realm> (the §17.7 rename-safe guard — reaches still-retired-named rows so a Ch 66-69

chapter never re-propagates a retired name).

• E2 region → recall node <region_id> enrichment + recall open halt + recall aliases guard.
• E3 boss → recall node (the chapter's antagonist canon) + recall band (integrity-band, so

boss difficulty/win-condition matches the protagonist's canonical power state) + recall hardlines

(so no cultural-representative-as-target; Ch 57 no-Velheim absolute; the environmental-protocol form

where canon puts no Council presence).

• E4 quest / E5 lore → recall node enrichment + recall open + recall aliases. E5's L3 field is

the HL_0047 carrier the spine v2.4 brief holds (CASCADE_RUNBOOK closing section).

• E6 art (Meshy) → recall node (the entity's physical substrate) + recall band (the visible

integrity-aesthetic shift) + recall hardlines (cultural-depiction bands — dress/adornment per

culture-era-role).

• E7 music/SFX/voice → recall band + cultural hardlines (no-joik, no-songline, no-Vodou-audio —

the audio equivalents of the §17.1 bans).

• E8 UE build → recall node for coords/biome + the §9.6 scatter write-map (which registry

columns each engine's output lands in) + recall counts (the cardinal reconciliation the exit

gate checks).

The highest-value guarantee, stated in §D and inherited by every engine: the all-canon-for-a-node query

returns a complete, cited, alias-normalized binding set that the graph gate has *already proven

internally consistent* — so an engine that builds from recall node CH_NN cannot silently drift, and any

gap surfaces as a labeled sentinel, never as invented content. This is what makes the milestone loop

safe to run autonomously between Josh's batch sign-off points.

---

5. Boss/combat system + local-LLM layer, per chapter

5.1 Boss/encounter generation (E3), per chapter, to the quality bar

E3 builds each chapter's encounter set to CHAPTER_BUILD_TARGET §1: **2-4 sub-bosses/mini-bosses across

DIFFERENT of the 22 threads, culminating in ONE main chapter boss** — never all from the House-of-Velheim

operation. Every boss obeys Pillar-8 doctrine, drawn straight from the approved roster proposal

(docs/proposals/boss_roster_rows.json):

• Blended, never single-mode; a primary + secondary tested verb; a three-axis

Patterns/Puzzles/Preparation split, never 100/0/0.

• Phase escalation EVOLVES the moveset (tighten/multiply telegraphs, E33 style), never swaps it.
• ≥2 counters per signature attack (≥2 for build variety); a Hades reward on win AND on death.
• Win conditions vary: HP / part-break / pacify / perceive / restraint. Non-standard main bosses are

real playable fights, not cutscenes (the Ch 69 materialized-argument precedent; Ch 3 corrupted-caci

proverb-duel; Ch 6 False Naga perceive→part-break).

• Verb curve is metroidvania retroactive-unlock: new verbs in valleys, tested at the next peak — for

the first slice, dodge (Ch 2) → parry (Ch 3) → strike+perceive (Ch 4) → decode (Ch 5) → perceive-seeds-

the-protocol (Ch 6). No unearned spikes.

Concretely for Milestone 1 the roster already stages: Ch 2 Corrupted Hunter (dodge/strike, HP), Ch 3

Caci Champion (parry/expose, pacify), Ch 4 Coerced Dalang shadow-stage (strike/perceive, pacify), Ch 5

Datu Siahaan (strike/decode, HP-or-pacify), Ch 6 False Naga (perceive/dodge, perceive→part-break). These

rows write to T0_Boss_Encounter_Registry at slice-population time, chapter_id normalized to CH_NN.

Environmental bosses are budgeted as level-design landmarks (the SotC cost lesson — nine full landmarks

corpus-wide; Ch 6's perceive is a seed, not a full landmark, keeping Milestone 1 cheap on E3).

E3 stays hard-line-safe via recall hardlines (§4): at any protected/high-care chapter the §17.1 ban is

on combat against the PROTECTED PEOPLE only — their oppressors (colonizers, slavers, corporate predators)

are canonical combat, and fauna combat is permitted (CHAPTER_BUILD_TARGET §4). Milestone 1 has no §17.1

chapter, so this is exercised but not stress-tested until the Ch 8/11 milestone.

5.2 The local-LLM layer — where it plugs in

The BPC's runtime is UE5, and the design already separates the canonical schema layer (the contracts,

authored offline, cited) from the runtime translation/inference layer (BPC §0: "the Translation Doc

owns the inference layer" for "UE5 spawn density values, dialogue-context inference, scene direction").

The local-LLM layer lives entirely in that runtime inference layer — it never authors canon, it *executes*

canon at play time. It plugs in at three points, all inside E8, all reading the same compiled data tables:

• Runtime NPC dialogue / barks (Blueprints + behavior trees, BPC §1.2). The compiled

T0_Character_Index / T0_Antagonist_Network_Registry rows carry the persona, voice signature, and

thread involvement E1/E5 authored. A local small model (the ROADMAP §6 OSS-local voice/text tier —

Chatterbox/Maya1 for placeholder bulk, a small local text model for improvisational barks) generates

*runtime line variations* within the authored persona and the §17.1 cultural bans, so ambient NPCs feel

alive without a per-line ElevenLabs cost. Hero/cinematic lines stay authored + ElevenLabs v3 (E7). The

boundary is exactly the BPC's: **schema (persona, hard lines, canonical beats) is authored and cited;

runtime phrasing is inferred locally.**

• Encounter/behavior inference (PCG + Combat, BPC §1.2). The boss rows E3 authored carry verbs,

phase-escalation vectors, counters, and axis splits as *canon*. A local model in the runtime tunes

within-encounter reactive behavior (which telegraphed variant fires, spacing, feint timing) against

the player's build — the "screenshot-compare-correct" and reactive-difficulty inference the Translation

Doc owns — never changing the canonical win condition, the verb set, or the fairness guarantees.

• Build-time authoring assist (UE 5.8 MCP Server plugin, ROADMAP §6). During E8 construction (not at

play time), Claude Code drives the editor via the MCP plugin — Blueprint authoring, Niagara config,

Sequencer assembly, MetaHuman brief application — reading the slice's compiled canon and iterating

screenshot-compare-correct (BPC §1.4.1), escalating to Josh on §17 hard-line risk or ambiguous spec.

Guardrails, so the local layer can never drift canon:

• It reads compiled data tables only (BPC §1.4 runtime read pattern; no network, no canon write-back).

Player/runtime state "is not canon and never syncs back" (BPC §1.1).

• Its inputs are the cited recall bindings baked into the tables — persona, band, hard lines — so a

local generation that would violate a §17.1 ban or contradict a canonical beat has no valid path: the

hard-line fields are constraints in the prompt/behavior-tree, and cultural-audio/dialogue bans are

enforced the same way E7 enforces them.

• Milestone-scoped: Milestone 1 stands up the local-LLM layer for its 5 chapters' NPCs and 5 bosses

only — proving the schema-vs-inference boundary on a small, no-high-care slice before the high-care

milestones (Ch 8/11/29/42/57) test the cultural-ban enforcement at scale.

---

6. Why this is repeatable and cost-bounded

• One loop, run N/5 times. The eight-stage loop (§2.2) and the exit gate (§2.3) are identical every

milestone. The studio's mental model is "run the slice, prove the slice, roll forward" — not a

bespoke plan per chapter.

• Cost staggers three ways (§3): books bought per-slice (~5-10 titles, most milestones far cheaper via

deep-research; the expensive high-care acquire-ALL clusters isolated to their slices), scanning scoped to

the irreducible per-slice remainder, gating authored per-slice-row (flat per-milestone burden, free

regression coverage).

• Every engine is proven before the hard cases. Milestone 1 (Ch 2-6) exercises all nine engines with

zero §17.1 high-care chapters — you debug the pipeline where a mistake is cheap, then the high-care

milestones inherit a proven, tuned chain.

• It composes with the existing contracts, inventing nothing. The build order is the CASCADE_RUNBOOK's;

the engines and linkages are the BPC's; the substrate policy is BOOK_ACQUISITION's; the citation/hard-line

safety is CANON_INTEGRITY_ARCHITECTURE's recall.py; the per-chapter bar is CHAPTER_BUILD_TARGET's. The

milestone model is the wrapper that turns them into a repeatable 5-chapter unit.

Open decisions surfaced (for Josh)

• [DECISION NEEDED - JOSH] Slice size 5 vs the RR-10 window. The milestone is 5, the Range Review

window is 10 (CASCADE_RUNBOOK §7.1). Recommend keeping milestone=5 and letting two milestones compose

into each RR window (Ch 2-6 + 7-11 → RR-12), so the playable-proof cadence is twice as frequent as the

audit cadence. Alternative: milestone=10 to align 1:1 with RR windows (fewer playable proofs, larger

each). Recommend 5.

• [DECISION NEEDED - JOSH] Milestone 1 chapter set. Recommend Ch 2-6 (§2.1). The only alternative worth

noting is a "hardest-first" slice (build a high-care chapter early to stress the cultural gates sooner) —

not recommended, because debugging every engine simultaneously against the highest-care gate is the

costliest possible first slice.

• [DECISION NEEDED - JOSH] Local-LLM runtime model pin. §5.2 places the local layer in the runtime

inference tier; the specific local model (text barks) is unpinned. Recommend pinning at Milestone 1's E8

from the ROADMAP §6 OSS-local tier, config-file-backed, per the PIPELINE_ADAPTER pin-when-load-bearing

policy — not decided ahead of the first UE build that consumes it.

Generated by harness/site/structure_site.py — the URL path is the repo path. review root