The template bible. How a guest’s real camera roll becomes a cinematic, bookable memory — every clip’s reasoning, every agent’s job, every file path, every token, and the one film that proves it: La Datcha, Svalbard, for Stein.
July 11, 2026 · Reference build: Svalbard · Watch five folded · Nothing pushed
The actual 42.5-second film this document dissects — 13 real clips, the route, the drone farewell. Everything below refers to this artifact.
The engine reads a camera roll — every photo, every clip, capture times, GPS, faces — and writes a single JSON document called an ExperienceSpec: the film’s beats and motion, the book’s chapters, the globe’s route, the share loop’s language. A separate renderer draws that document on screen. The brain never touches pixels; the face never makes decisions. Swap either side without breaking the other.
Around the memory sits the sandwich: the experience that produced the footage, the memory that makes it eternal, and the attribution that routes the next booking back to the operator who earned it. That third layer is why this is a business and not a slideshow.
Every beat below shows the actual frame, what the engine saw, why it earned its slot, what it should make the viewer feel, and the exact motion mathematics. I pulled and looked at every one of these frames before writing a word.
transitionSec 0). The frame breathes from 1.06 to the neutral 1.08 and rests for the final 1.7 seconds — the clip’s own handheld life supplies all the movement.
None of these are style preferences. Every law below exists because a specific failure happened in front of Stein and was corrected into the engine — the correction is cited.
| Law | What it forbids / demands | The correction that created it |
|---|---|---|
| Fail-closed serving | A spec that fails to load shows an honest error card — never another trip’s content. Writes are atomic (temp file + atomic move). | The Monaco incident: Monaco content rendered at the Svalbard URL. Stein: “absolutely unacceptable.” Root cause was a fail-open fallback plus a non-atomic write, both now illegal. |
| Media possession | Only locally-possessed video bytes count as clips. Eviction can never silently turn a video film into stills. | iCloud eviction reduced 160 clips to 15 real files mid-build; the film collapsed to posters without warning. Possession counts are now reported before every emit. |
| Determinism | Same inputs, byte-identical spec, forever. No randomness, no timestamps in the output path. | The trust requirement behind “templatize and scale” — a template that produces different output on re-run is not a template. |
| Video-forward | Interior slots are video-guaranteed; a surviving still gets a real move; the film ends at rest. | Watch three: a 34-second still where footage existed. Watch four: an 8-second frozen still traced to the burst keeper preferring a pretty still over its clip sibling — the keeper is now motion-first. |
| Anti-duplicate | Burst collapse (anchored 180s windows, motion-first keeper); zero film-to-book replays; no photo repeats within a chapter. One exception: the cover is the endcard, by Stein’s override #63. | Watch two: “duplicate shots still — how are you going to know anti-duplicates?” The EXIF capture-time physics of bursts became the collapse mechanism. |
| Honest vision | Tags come from the real pipeline or from a human who looked at the frame. A fabricated tag is a hard rejection. | Stein’s standing law — “truthfully, I just don’t trust you at all” is cured only by receipts. Two Svalbard tags were corrected by eye and noted as corrections in the tags file. |
| Emotion | People clips dwell 1.35× longer; real face positions steer any pan; the rubric is place, people, lifestyle, wildlife, unique, emotion, honest. | Watch one: “the girl’s face cut too short — I want to see her emotion.” A half-second of dwell became a coefficient. |
| The cost receipt | Every emitted memory carries its own finance accounting — actual spend and the cloud projection against the budget — inside provenance.cost. No memory ships unpriceable. | Watch five: “It needs to be tracked… I need to understand the exact cost because it’s going to help project the finance.” |
| The flywheel | Every correction is appended to the corpus with category, mechanism, action — nothing dropped, ever. | All 66 items across two logs; the corpus is the training data and the moat. See §06. |
One deterministic pass inside MemoryEngine.assembleDailyFilm. No model call anywhere in this path.
| # | Stage | What happens |
|---|---|---|
| 1 | Safety | Fail-closed screen — screenshots, menus, documents rejected before anything else sees them. |
| 2 | Understanding | EXIF, GPS, capture time, aspect, duration folded into per-asset signals. |
| 3 | Vision fold | Scene tags, real face positions, spectacle and aerial flags merged from the C3 pipeline (Apple Vision + Photos catalog + drone EXIF). |
| 4 | Consent | Face-bearing media gated per surface; an empty consent ledger means fail-closed, not fail-open. |
| 5 | Pixel floor | Resolution and quality minimums; upright derivatives only — rotation is forbidden downstream. |
| 6 | Cold start | Rolls too thin for a film are refused honestly rather than padded. |
| 7 | Burst collapse | Anchored 180-second windows sharing a scene collapse to one moment; the keeper is motion-first: clip beats still, spectacle beats faces beats quality. |
| 8 | Arc selection | Outro reserved first (aerial + faces + vessel context), then open, build, hero, settle slots filled — interior slots clips-first with a 0.18 preference band. |
| 9 | A-roll interlace | Operator B-roll woven between guest moments where provided. |
| 10 | Motion choreography | The flowing-water pass: positional continuity, ease-out-into-rest, breathing neutral scale, per-beat dissolve and rest times. Gates: continuity delta zero for every pair, no linear easing, no single-beat punch. |
| 11 | Grade | Native color by construction — no teal, no warmth shift, nothing applied. |
| 12 | FilmSpec | Beats, motion, copy, endcard assembled. |
| 13 | Experience assembly | Book (fresh clips only — zero film replays), globe, share loop, provenance; one atomic JSON write. |
Every agent below is built and tested in core/agents/. Each runs a deterministic floor first — a verdict computed by code, testable with no API key — and an optional model ceiling that may add insight but can never lower the floor. Two agents have no model seam at all, by design: the render gate and the commit gate reason through zero model.
When a correction arrives — “too fast,” “the endcard image is wrong” — it walks a three-agent chain where each hop does exactly one thing. Scribe captures: it appends the correction to append-only ledgers and by construction cannot touch taste — it does not even hold a reference to the taste store. Oracle decodes: it names the why behind the words, mapping what was said to what was meant — “too fast” becomes “the cut rhythm outran the emotion,” filed under pacing; “gimmick” becomes “an effect read as a trick, not a feeling,” filed under craft trust. Twelve product-signal buckets, and the mapping is exhaustive — a new correction kind will not compile without a hypothesis. Keeper folds: the decoded correction moves the taste vector one monotonic version forward, guarded so a fold can never rewind a version or shrink a ledger, and gated so an unconsented signal is captured for the record but never learned from. Capture that is never lost, a cause that is correctly named, a fold that only moves forward — that is what compounds, and the labeled corpus it produces is the cornered resource.
| Event | Chain | Purpose |
|---|---|---|
| Correction submitted | Scribe → Oracle → Keeper | The compounding loop above. Each step’s output threads into the next agent’s context, so Oracle’s why reaches Keeper’s fold. |
| Experience assembled | Warden → Perception → Witness → Muse | Consent and safety, perception ranking, provenance truth, and the quiet-luxury language veto — gating before anything renders. |
| Re-gate requested | Adversary → Moatkeeper → Growth → Examiner | Kill-paths enumerated, defensibility evidenced, loop health measured, then the gate-of-gates rules. |
Mesh mechanics: an agent that throws becomes a failed step with a fault finding — never a crash, never a silent skip. A chained agent that does not handle the event is surfaced loudly as a dead edge. A chain result is only green when every step is green.
| Agent | Runtime | Role | How it grades |
|---|---|---|---|
| Scribe | Deterministic | Append-only capture of every run and signal; never folds | No score — capture receipts; rejects any non-increasing sequence number |
| Oracle | Model + floor | Decodes said-vs-meant behind each correction | Exhaustive kind-to-cause map into 12 product-signal buckets |
| Keeper | Hybrid | Folds taste; owns attribution and provenance graph | Append guard: no version rewind, no ledger shrink; consent-gated folds |
| Warden | Hybrid | Surface leak-gate: safety ∩ consent per surface | Safety allow-threshold 0.62; any exclusion fails; empty ledger = all faces unconsented |
| Curator | Hybrid | Authorship gate — cuts the arc, weaves film, globe, book, share | Fails on no-input, assemble-fault, cold-start; format by civil-day count |
| Director | Deterministic | Render gate: native-color transcode, export lifecycle | One-way job machine; missing source is skipped, never black; no model seam |
| Examiner | Deterministic | The commit gate-of-gates | Five probes (Goodhart canary, two-oracle reconcile, append-only ×2, cost SLO); an empty scope is red, not green; no model seam |
| Architect | Model + floor | ExperienceSpec contract reviewer — the brain/face seam | Four slices (film, globe, book, share) + seam fields present, or red |
| Foreman | Hybrid | Build supervisor, phase gates A through E | Advance only to the next phase, only from green |
| Smith | Model + floor | Backend contract checklist | Migration, entity, DTO, test — all present or red |
| Weaver | Model + floor | Renderer parity — is the spec actually renderable | Field-by-field: beats non-empty, coords valid, cover titled, share URL present |
| Steward | Hybrid | Data and migration guardian | Reflects real entities for optimistic locking; scans real migrations for monotonic numbering |
| Wayfinder | Model + floor | Planning and sequencing | Topological sort — a cycle or a missing pre-mortem is red |
| Conductor | Hybrid | Forms the working pod from the registry | Pod capped at five — communication paths grow as n(n−1)/2 |
| Muse | Model + floor | Quiet-luxury language veto | Bans short wistful fragments (“The day, gathered.”); passes date lines and periodless taglines |
| Witness | Model + floor | Truth and provenance gate | An unverified memory may never carry an attestation URL — a fabricated one is nulled and flagged |
| Moatkeeper | Model + floor | Defensibility — the 7 Powers | At least one power evidenced with signals, or no-moat is declared |
| Adversary | Model + floor | Red team — enumerates kill-paths | Five standing kill-paths always checked; any armed path is red |
| Counsel | Model + floor | Economic firewall on the share ladder | Links auto-cap at trust class; the economic class needs explicit authorization — the machine can never pay itself |
| Treasurer | Hybrid | Unit economics | Cost = vision calls × $0.012 + render seconds × $0.0009, against the $0.20 budget |
| Perception | Hybrid | Ranks what matters in the footage | Salience = 100×spectacle + 10×faces + scene arousal; reports, never blocks |
| Intake | Hybrid | Camera-roll front door | Totality invariant: normalized + dropped must equal input — a lost asset is red |
| Growth | Hybrid | The viral loop | k-factor = downstream ÷ sharers; zero sharers is honestly null, never fabricated virality |
| Scale | Hybrid | Render-farm reliability | 99% success budget, backpressure at 10,000 queued, illegal state transitions flagged |
| Sound | Hybrid | Emotional cue map (score scaffold) | Enter, swell, sustain, settle placed by the arc’s crest; playback deliberately deferred |
| Operator | Hybrid | Supply-side relationship health | Dormant, at-risk (credit share below half), healthy |
| Personalization | Hybrid | Recipient-level taste overlay | Global ⊕ operator ⊕ guest — narrowest tier wins each scalar; proves its diff against the house default |
Exact paths on this machine. Nothing lives anywhere else; nothing has been pushed to any remote.
| Bucket | Path | What it holds |
|---|---|---|
| The engine | ~/clio-build/src/main/kotlin/…/core/clio/ | The 13-stage pipeline, arc, choreographer, book and share authors, taste system. Branch feat/clio-memory-engine, 49 commits ahead, never pushed. |
| The agents | ~/clio-build/src/main/kotlin/…/core/agents/ | All 27 agents, the mesh, the registry, the gateway seam. Together with the engine: 11,882 lines of source. |
| The tests | ~/clio-build/src/test/kotlin/… | 10,224 lines — 0.86 lines of test per line of source. Every law in §03 is a named test — 585 green at this build. |
| The corpus | ~/clio-build/reports/SVALBARD_MEMORY_FEEDBACK_LOG_v1.md · _v2 · _v3 | All 74 of Stein’s corrections with category, mechanism, and the action taken. This — not model weights — is the training data. It trains the engine through code changes and the taste ledger, and it compounds with every watch. |
| Taste | TasteLedger → CinematicPrefs (in-engine) · VideoTasteProfileEntity (Postgres) | Append-only folds; monotonic versions; global, operator, and guest tiers resolved narrowest-wins. File-backed today, Postgres row in production. |
| Vision truth | ~/clio-build/data/svalbard/vision_tags.c3.json · vision_tags.svalbard.json | C3 output — 622 assets tagged by Apple’s on-device Vision framework, 348 real face positions from the Photos catalog, aerials detected by drone EXIF — plus the human-verified fixture with corrections noted. |
| The manifest | ~/clio-build/data/svalbard/manifest.svalbard.json | The roll: 671 assets with capture times, GPS, possession state. Deliberately untracked — it carries personal location data and machine paths. |
| The renderer | ~/clio-experience/ | Its own git repository. index.html (canvas film, globe, book, share loop), the spec schema, and the canonical emit experience.svalbard.json. Media directories are gitignored artifacts. |
| The doc set | ~/Desktop/LINX_MEMORY_ENGINE_EXECUTION_KOTLIN_v3.0/ | Eight execution docs plus the watches addendum — the laws as prose, the next-test checklist. |
| The next test | ~/CONTINUATION_PROMPT_LINX_MEMORY_TEST2.md | The zero-context directive for test two: a surprise trip, the template run exactly as written, no improvisation. |
Today: the emit writes experience.svalbard.json atomically into the renderer directory; a local server on port 8890 serves ?spec= requests; the loader is fail-closed — a bad spec shows the error card, never a fallback. In production: GET /api/v1/memories/{id}/experience serves the same envelope from an ExperienceRecipe row, behind consent gates, with the share URL preserving the spec identity end to end.
Three things, honestly named. The corpus: every correction, permanent, categorized. The taste ledger: corrections folded into scalar preferences — motion intensity, dwell bias — that shape every future build. The laws: corrections severe enough to become engine code and named tests. No neural network is trained anywhere in this system; the moat is labeled judgment, accumulated and enforced.
Two different questions with two different answers: what it costs to make a memory, and what it cost to build the machine that makes them.
The right response to “$0.00” is distrust, so as of watch five the number is no longer an assertion — every emitted memory now carries its own cost receipt inside the spec (provenance.cost), computed deterministically from the same inputs that built it. Here is the actual block inside the live Svalbard spec:
Why the actual is honestly zero: the emit path is deterministic Kotlin — verifiable by grepping it for a model call; there is none — the vision pass ran Apple’s on-device framework at no charge, and the render is a local canvas. The number that matters for finance is the projection: the same memory priced at the production cloud path (560 assets cloud-tagged at $0.012 each + 42.5 render-seconds at $0.0009) is $6.76 — thirty-four times the current $0.20 budget. That is not an error; it is the receipt doing its job. It quantifies exactly what Stein flagged in this watch: the budget is under review, and full-roll cloud vision can never be the path — vision stays on-device and content-hash-cached, with the cloud as the exception. The receipt makes every future memory priceable the moment it is emitted.
Measured from this session’s own transcript — 820 API calls in the main conversation — priced at Claude Fable 5 list rates ($10 per million input tokens, $50 output, $12.50 cache write, $1.00 cache read). Stein pays through a subscription, not per token; this is the API-credit equivalence he asked for.
| Main conversation (measured) | Tokens | List cost |
|---|---|---|
| Output generated | 1,001,500 | $50.08 |
| Cache writes (new context committed) | 6,307,357 | $78.84 |
| Cache reads (context re-read per call) | 298,393,413 | $298.39 |
| Uncached input | 1,579 | $0.02 |
| Main loop total | $427.33 |
The same measured session at Claude Opus 4.8 rates — the tier the production engine actually targets — prices to $213.66 (output $25.04, cache writes $39.42, cache reads $149.20). Fable 5 is the build-and-verify instrument; Opus-tier is the run-rate. From the next test onward, every build phase reports its token receipt as it runs — measured live, never reconstructed after the fact.
| Delegated agents (harness-reported) | Tokens |
|---|---|
| The 10-lane verification gate (20 agents: find + adversarial recheck) | 1,798,871 |
| Documentation delta fork (watches addendum, feedback log v2) | 567,915 |
| V3 doc-set fork | 188,437 |
| Recon scouts (codebase ground-truth, pre-plan) | 126,056 |
| Agent-fleet inventory (this document’s §05) | 116,416 |
| Subagent total | 2,797,695 |
Yes — but not the way the question implies. The 49 commits ahead of the base are not 49 alternatives to choose between; they are the linear history of how the engine got here, and the deliverable is a single thing: the tree at 8ad11e6, the newest commit. Check that out and you hold 100% of the current engine. The history behind it is the audit trail — which correction produced which law, in which order — and audit trails are kept, not squashed, while the work is still being verified. When Stein gives the push order, the history can ship as-is or be folded into curated commits; that is a presentation decision for that day, not a correctness question today.
11,882 lines of source, 10,224 of tests. The engine core earns its keep line by line — every law traces to a correction and a named test, and the verification gate hunted this tree with twenty agents. Three parts are honestly scaffolding, kept deliberately and labeled in the source: the agent mesh’s event dispatch (built and tested, awaiting Phase E production wiring), the on-device ONNX vision stub (an explicit not-wired exception, the privacy target), and the refusing gateway default (the no-API-key floor). I will not claim a 22,000-line tree has zero removable lines — no honest engineer would — but nothing in it is dead weight nobody understands: every block is either load-bearing now or a labeled seam for the next phase.
Stated so nothing is oversold. Pans travel only where real faces were found; scene quality depends on per-trip tuning of the class map. Finding the reaction inside a clip — seek-to-moment — is not built; the engine dwells, it does not scrub. The daily/trip two-tier generation is coded and tested but the render is the flat trip format today. Music is a cue map, not playback. The agent mesh is not production-wired. And the final gate is not a machine’s: it is Stein watching, proud-to-share at seven or better.