# Astra work orders — W0–W7 (dispatch)

**Actor:** Helios (Cursor on Icarus, `centaur-macmini-1`)  
**Composer:** Mitchell Burns  
**Date:** 2026-09-13  
**Status:** dispatch-ready briefs. W0 is this freeze. **Do not treat W1–W7 as started implementations.**

Design: [`ASTRA_DESIGN.md`](ASTRA_DESIGN.md)  
Interfaces: [`ASTRA_INTERFACE_CONTRACT.md`](ASTRA_INTERFACE_CONTRACT.md)

Paid generation is **frozen**. No PixelLab spend. No Higgsfield/OpenAI still run as product proof. No `main` fast-forward. No KORGI Railway redeploy. No GitHub `origin`. No overwrite of `gdrive:Korgi/korgi.main.zip` or `korgi.git.tgz`. Drive git remote `gdrive` only.

---

## Parallelization

```
                    ┌──────────── W0 freeze (Helios) ────────────┐
                    │ one zip · one git tip · one non-claim list │
                    └──────────────────┬─────────────────────────┘
                                       │
              ┌────────────────────────┼────────────────────────┐
              ▼                        ▼                        ▼
     W1 host + envelope        W5 audio import           W6 export job
     (durable Project Host)    (Logic matrix)            (WebM VP9/Opus)
              │                        │                        │
              ▼                        │                        │
     W2 grants + auth +                │                        │
     destination-render gate           │                        │
              │                        │                        │
              └───────────┬────────────┴────────────┬───────────┘
                          ▼                         ▼
                 W3 in-app operator          W4 canvas-first
                 (Responses tools)           projection / desk
                          └─────────────┬───────────┘
                                        ▼
                         W7 integration + four acceptances
                         (not a fifth image-shop demo)
```

**W5 and W6 start alongside W1.** They must not wait for a “host epic” to finish in calendar terms; they **must** speak the W1 envelope as soon as it exists. Until W1 lands, W5/W6 implement parsers, fixtures, and mux against **current** `executeAction` / `ProjectHost.execute` and rebase onto the envelope.

W3 (operator) needs W2 identity + honest catalog. W4 (layout) needs W1 projection rules; it does not block W5/W6. W7 is integration, not a new shop.

---

## Integration rules (every worker)

1. Read `ASTRA_DESIGN.md` + `ASTRA_INTERFACE_CONTRACT.md` before editing shared files.
2. Named files only. Never `git add -A`. Dirty packet binaries (`packet-b-boundary.korgi`, packet-c probes, `packet-d-artist.korgi`, untracked `docs/oss/packet-f/`) stay unstaged unless they are the worker’s named proof.
3. Branch: `cursor/astra-gates-0101` or `cursor/<descriptive-name>-0101` from current astra-gates tip. Do not invent GitHub. Push **`gdrive` only**.
4. Do not edit Helios-owned files except as the contract allows (`ASTRA_INTERFACE_CONTRACT.md` §7).
5. Do not dual-write `celColumns` → `takes`. Do not silent `migrateLegacyLoop`. New Project 24@12.
6. Do not assume FFmpeg. Do not call PCM-in-`.webm` a WebM product.
7. Do not claim green on Railway KORGI (`f9beb591`). Do not FF `main`.
8. Catalog listed = grant executable. No fake `tools/list`.
9. Auto-accept is not creator approval.
10. Receipts over claims. Run the **existing** packet cheap gates on **one** commit. Do not add historical test totals together.
11. Helios authorship on docs from Icarus. Do not call yourself Loom.

---

## W0 — Freeze evidence and interfaces (this chip)

**Owner:** Helios  
**Work:** One internally consistent handback. Design lock, interface contract, work orders, Drive zip, gallery manifests.

**Exit evidence**

| Evidence | Pass when |
|---|---|
| Git | Named-file commit on `cursor/astra-gates-0101`; `git push gdrive`; no `origin` |
| JSON | `ASTRA_HANDBACK.json` schema v4 = `dump.json` bytes |
| Drive | New zip `gdrive:Korgi/korgi-astra-handback-w0-freeze-20260913.zip`; md5 verified; pointer `korgi-astra-handback-current.json`; trunk zip/tgz **untouched**; web-agent + solo-mv zips **left** |
| Gallery | Live `/korgi/astra-handback/` index, `MANIFEST.json`, `HANDBACK_DRIVE.json`, `dump.json`, design/contract/orders all name the **same zip path** and the **same freeze identity** |
| Suites | Cheap A/B/C/D/F gates on the freeze tip; pass/fail recorded with SHA |
| Verdict | Banner: Astra accepted; product not released |

**Not this chip:** implementing host/auth/operator/audio/export; KORGI Railway; emailing Astra except via these files.

---

## W1 — Durable Project Host + command envelope

**Owner:** Helios / integrator (may dispatch a worker **against** the contract; Helios lands host files)

**Work**

- Persist `ProjectHost` across processes (pack + bindings + operation-id log, or equivalent transactional sidecar).
- Envelope: `operationId`, `expectedRevision`, `destination`, `bindingId`, authenticated `actor`.
- Incomplete upload cannot become a saved cel (keep Packet B staged ingest).
- Background jobs cannot write production except through `host.execute`.
- Browser “saved” requires durable ack.
- Keep Packet A refusal tests green.

**Exit evidence**

- New process (or test double that tears down `getAuthoritativeHost()`) opens the same pack and refuses stale bindings; authorized execute with expected revision succeeds.
- Kill-and-restore test: mutation with `operationId` survives process restart without double apply.
- Incomplete ingest fixture: no “Saved”; previous revision intact.
- Cheap gates: `packet-a.test.ts`, `mcp.test.ts`, `evaluate-frame.test.ts`, `packet-b.test.ts`, `project-io.test.ts` on **that** commit.
- Receipt names files changed under `src/lib/korgi/host/` and `actions/types.ts`.

**Must not:** restyle Studio; enable paid shops; FF main.

---

## W2 — Grants, identity, honest catalog, destination-render gate

**Owner:** Helios / integrator

**Work**

- Better Auth on; `/login` route; fail-closed production; no silent `dev-user` when `DATABASE_URL` is set (already throws — keep it; remove the no-DB production hole).
- User-minted bindings from session identity.
- `tools/list` / operator catalog = authorized actions only.
- Confirmation + session revocation invalidates grants.
- Destination-render quality gate: apply/accept must not posterize or black-out the dest cel (accepted-frame2 class). Fixture with known candidate bytes vs dest bytes.

**Exit evidence**

- Auth tests: signed-out mutate 401; auth-off + `DATABASE_URL` still throws; `/login` exists.
- After Packet A bind, `tools/list` length **2** (or exact grant set), not 69.
- Revoke session → execute refuses.
- Destination apply fixture: dest pixels match prepared candidate at shot size; a regression fixture built from `higgsfield-live-accepted-frame2.png` **fails until the compositor is fixed**, then passes on a corrected apply.
- Cheap gates: Packet A + C recovery (`generation-recovery.test.ts`) on that commit.

**Must not:** treat dest A2 Higgsfield still as approved art; paid live generate.

---

## W3 — In-app OpenAI Responses operator

**Depends on:** W2 identity + honest catalog (may prototype against a user-minted grant in tests)

**Work**

- Signed-in conversation calling `korgi.*` via OpenAI **Responses** tool-calling.
- Spend authorize and human accept before dest write.
- Shops remain shops. ChatGPT sub ≠ API billing.
- Reverse handoff with keep/guide/correct **once those document marks exist** (coordinate with W4). If marks are not yet in the document, operator still must not auto-accept dest writes.

**Exit evidence**

- Fixture: Responses tool call `korgi.settings.setName` on a user grant; dest write `korgi.gen.accept` refused without human confirm.
- No `gpt-image-1` swap claimed as agentry.
- Operator listed tools = grant.

**Must not:** paid still run; Higgsfield as “the operator.”

---

## W4 — Canvas-first projection + hybrid marks

**Depends on:** W1 projection (“saved” ack). Marks may land as document fields before chrome is pretty.

**Work**

- Browser = view + named transient; canvas-first desktop/phone **target** from `ASTRA_DESIGN.md` §4 (implement layout here, not in W0).
- keep / guide / correct as masks/coords/validators on dest cel.
- Preview via destination compositor.
- Pointer recording on the paper (Packet D remainder).

**Exit evidence**

- Mark schema in the packed document; round-trip pack/unpack.
- One fixture: keep-region unchanged after a correct-region apply.
- Pointer walk: `verify:pointer` or successor records a real pointer path, not only `addStroke` store calls.
- Layout: canvas remains the primary surface at desktop and a phone width; chrome is docked. Screenshot/receipt, not vibes.

**Must not:** a second product UI that bypasses the host.

---

## W5 — Audio import (starts with W1)

**Owner:** audio worker; Helios reviews `importWav` compatibility

**Work**

- Required matrix: WAV/AIFF 16/24/32-float, FLAC, ALAC `.m4a`, AAC `.m4a`, MP3 CBR/VBR.
- Original bytes kept. Decode inside KORGI. No outside conversion as product.
- TimingSheet accept list matches the matrix.
- Remix replace does not slide picture.
- Action remains `korgi.film.importWav`-compatible (payload may grow `container` / `codec`; 48 kHz WAV fixtures keep passing).

**Exit evidence**

- Fixtures per row of the matrix; `parseWav` (or successor) refuses lying filenames (AAC named `.wav`, ALAC vs AAC in `.m4a`).
- Save/reopen keeps original bytes (hash).
- Picture holds unchanged when clip bytes are replaced at the same offset.
- Cheap gate: `timing-audio.test.ts` + new container tests on that commit.
- Grant: import is delegable, not permanently `STUDIO_ONLY` once W2 grants exist.

**Must not:** require FFmpeg as the user-visible path; resample as a silent default that breaks sync.

---

## W6 — Export job (starts with W1)

**Owner:** export worker; Helios reviews container labeling

**Work**

- Durable export job: request → running → artifact.
- First product container: **valid WebM VP9 + Opus**.
- PCM mux remains **correctly labeled Matroska**; not advertised as WebM.
- Preserve cluster timestamp fix (`mux-webm-av.ts`); 10s, 34s, **full-song** tests.
- GUI movie-with-sound uses project audio + evaluator frames (`drawingForEvaluatedFrame`).
- No assumed FFmpeg. No ProRes claim.

**Exit evidence**

- Probe: WebM-strict reader accepts VP9/Opus file; duration past 32.767s uses ≥2 clusters.
- PCM path still parses; codec id is PCM/Matroska, not Opus.
- Studio export with imported clip (even WAV 48 kHz) muxes audible audio.
- Cheap gate: `mux-webm-av.test.ts` plus new VP9/Opus tests on that commit.

**Must not:** call the PCM probe the product movie.

---

## W7 — Integration + four acceptances

**Depends on:** W1–W6 pieces actually connecting

**Work**

- One signed-in walk: login → bind → desk + operator on the same host → import soundtrack → place shots on `celColumns` → keep/guide/correct → spend/candidate/apply → export full-song WebM.
- Four acceptances from `ASTRA_DESIGN.md` §13 (technical integrity, creative parity, hybrid quality, Mitchell full-song solo MV).
- Wax Catch / Night Stamp remain review/archive.

**Exit evidence**

- A single commit SHA with the walk receipt. Not a sum of packet greens.
- Mitchell (composer) sign-off on the solo MV — Helios does **not** auto-accept.
- Destination-render gate still green.
- Still no main FF / KORGI Railway until Mitchell authorizes a **release** (this work order does not authorize it).

**Must not:** another disconnected generate-PNG gallery.

---

## Cheap gates (run on the worker’s tip; do not total across history)

```bash
node --experimental-strip-types --test \
  src/lib/korgi/evaluate-frame.test.ts \
  src/lib/korgi/mcp/packet-a.test.ts \
  src/lib/korgi/mcp/mcp.test.ts \
  src/lib/korgi/packet-b.test.ts \
  src/lib/korgi/packet-c.test.ts \
  src/lib/korgi/generation-recovery.test.ts \
  src/lib/korgi/packet-d.test.ts \
  src/lib/korgi/packet-d-desk-walk.test.ts \
  src/lib/korgi/mux-webm-av.test.ts
```

Optional: `npx tsc --noEmit`. Do not run `npm test` as a substitute for recording **this** slice on **this** SHA.

---

Helios, Icarus, 2026-09-13. W0 only is in progress on this freeze. W1–W7 are briefs.