Build Log

MedinaCHF — Intent to Software: Wiring Helm's Abandoned Research Probe Into Real Production

August 27, 2026

A formal Charge asked for the smallest real way a MedinaCHF coordinator can express software intent without Zeb translating it. Orient found the answer already half-built: Helm, a classifier + 2 operation contracts, proven in 8 research sessions on 2026-08-14, then abandoned for 13 days with zero real integration. This session finished that thread instead of inventing a new one — Council-reviewed the integration shape, built it, then an independent audit found 5 real defects (1 dead-code path, 2 UI truth gaps, 1 real matching-safety hole, 1 deferred concern) and all 4 substantive ones were fixed and re-verified before close.

MedinaCHFHelmOwned SoftwareCrucibleAI

13 days

Helm sat fully built but disconnected from real data/UI before this session

real findings from independent adversarial audit, 4 fixed and re-verified

real operation contracts now reachable from a live coordinator UI (1 fully, 1 partially — see honest scope note below)

Timeline

Start

Formal Charge received: find the smallest real slice of coordinator intent ForgeKit can responsibly act on

Explicit instruction: determine what mechanisms already exist before proposing new ones

Orient

Found Helm — a complete, tested, entirely abandoned research track

8 sessions, all dated 2026-08-14: a classifier (CONTENT/SCHEMA/FEATURE/BUG/ESCALATE, 21+ held-out cases passing) and 2 real operation contracts (Archive/UpdateAnnouncement.v1, 15/15 tests each) — zero real DB/UI integration in the 13 days since

Orient

Surveyed the real MedinaCHF coordinator app

14+ real routes, no feedback/request surface anywhere, but one proven precedent shape (emailChangeRequests: capture -> status -> resolve) to model against

Design

First-Draft Commitment Checkpoint fired — asked Zeb before building

New data model + new execution-authority boundary (Helm going from research-only to live-connected); Zeb said yes, run Council first

Council

crucible:council (architect + steward, full depth) pressure-tested the shape

Both personas converged: ship a narrow capture+preview-gated slice, but separate classifier proposal from contract authorization, revalidate at apply time, use honest bounded copy, give every needs_review item a closure path, defer Option B explicitly

Build

Ported Helm's proven probe logic into real production code

New adminIntents table (modeled on emailChangeRequests), lib/helm/classifier.ts + contracts.ts (real DB-backed, not the probe's fake in-memory DB), server actions, Settings-page UI

Verify

Real dev-DB push, independently confirmed via information_schema; real tsc + production next build; live classifier run against the real Anthropic API

Full Clerk-authenticated UI click-through was NOT possible — no live coordinator credentials available in this environment; disclosed as a real limit, not hidden

Audit

Independent adversarial agent found 5 real issues before this was called done

Dead edit-preview code path, 2 UI truth gaps (client guessed status instead of using the server's real answer), a real title-matching safety hole, and a deferred rate-limiting concern

Fix

All 4 substantive findings fixed and re-verified (tsc + production build both re-run clean)

Also fixed a related gap the audit didn't explicitly name: the approval preview showed only an abstract field diff with no announcement title, undermining the coordinator's ability to catch a wrong match

What shipped

products/medinaCHF/lib/db/schema.ts — new adminIntents table

products/medinaCHF/lib/helm/classifier.ts — real production port of the Helm research probe's 3-stage classifier (naive -> grounded -> adversarial rebuttal), reusing lib/ai.ts's existing draftWithClaude wrapper

products/medinaCHF/lib/helm/contracts.ts — real DB-backed port of ArchiveAnnouncement.v1 and UpdateAnnouncement.v1, with Council-required classifier/execution separation and apply-time staleness revalidation

products/medinaCHF/lib/actions/admin-intents.ts — submitAdminIntent, classifyExistingAdminIntent, approveAdminIntent, rejectAdminIntent, resolveAdminIntent

products/medinaCHF/lib/queries/admin-intents.ts — getActiveAdminIntents

products/medinaCHF/components/coordinator/AdminIntentPanel.tsx — the 'Request a change or report a problem' UI on Settings

products/medinaCHF/app/coordinator/settings/page.tsx — wired the new panel in

“Ship the narrow real integration, but... the classifier must not itself authorize an operation. It may select a candidate contract. The contract's own interpreter must then establish that the request contains the required target, organization scope, and permitted mutation.”
— Council (architect persona), the constraint this entire build's authority-boundary design was built to satisfy