| name | mure-advisor |
| description | Tiered per-turn advisor for main session + WhatsApp. Cheap watcher + heavy escalation. Pure annotation, two surfaces. |
| scope | harness |
| invocation | workflow |
mure-advisor — Per-Turn Watchdog for Main Session + WhatsApp
Purpose
A second pair of eyes on every main-lane response. NOT a self-critique step inside the lane — a structurally independent model that reads the lane's draft + recent context + the user's input, then emits an annotation. Provides adversarial-ally coverage in conversational flow without slowing the main response.
Tiered architecture (mandatory)
Tier 1 — cheap watcher (always-on)
Runs every main-lane turn. Default prime: Sonnet 5. Eligible pool:
anthropic/claude-sonnet-5 (prime)anthropic/claude-haiku-4-5 (recon + cheap research lanes; eligible as watcher when Sonnet 5 is capped)ollama-cloud/deepseek-v4-flash (when subscription active)deepseek-v4-flash:direct (via direct API; subject to daily cap — see §Budget)
Haiku is NOT a heavy-advisor fallback. Per owner (2026-07-09): Haiku's lane is recon + cheap research. Heavy-tier failure never falls through to Haiku; Haiku stays in the cheap / recon lanes.
Output: a per-turn note in the canonical schema (see §Note schema). The watcher LLM-judges escalation; no flag-config file maintained.
Tier 2 — heavy advisor (escalation-only)
Only runs when the watcher escalates. Eligible pool:
anthropic/claude-opus-4-8 (anchor — heaviest)deepseek-v4-pro:direct (Think Max mode; subject to daily cap — see §Budget)zai/glm-5.2 (Z.ai quota pool)minimax-portal/MiniMax-M3 (Minimax Ultra tier; vision-capable cross-modal at 1M ctx)
Heavy-tier fallback chain (binding): Opus 4.8 → DeepSeek V4-Pro Think Max → GLM-5.2 → MiniMax-M3. The dispatcher advances on quota / failure. Haiku is NOT in this chain.
Hard security rule: on security-relevant turns, heavy MUST be Opus 4.8. Sonnet 5 is explicitly disqualified for cybersecurity per model-audit-2026-07-09.md. The dispatcher enforces this; the heavy variant pick for sentinel/adjudicator/architect turns is non-negotiable.
Out of scope for now
- Fable-5 EXCLUDED — limited access until 2026-07-12, then PPT, then unavailable. When access returns, evaluate against the auditor's notes before re-adding.
- GLM-5.2 gated by Z.ai weekly quota — checking on 2026-07-10 reset before relying on it for sustained load.
Budget (binding)
DeepSeek direct API daily cap
Per owner (2026-07-09): max $1.0-1.5 USD per day on DeepSeek direct API (V4-Pro Think Max + V4-Flash combined).
Dispatcher enforcement:
- Track daily spend in
_SYSTEM/state/deepseek-burn.jsonl (one row per dispatch with $amount).
- At 80% of cap: surface a
deepseek-cap-warning to operator via the advisor notes channel (severity: watch).
- At 100% of cap: refuse new DeepSeek dispatches, fall back to the next eligible model in the chain (GLM-5.2 → M3 for heavy; Haiku → M3 for watcher cheap).
- Failed dispatches emit a
deepseek-cap event to the operator dashboard.
Default cap: $1.25/day (mid-band; operator can adjust in _SYSTEM/state/mure-advisor.json). The cap is operator-tunable, hard-stop is non-negotiable.
Per-tier burn reporting
Each tier surfaces daily / weekly / monthly burn totals to the operator dashboard. Tunable thresholds warn at 80%, stop at 100%.
Note schema (binding)
Every emitted note MUST conform. Source of truth: _SYSTEM/research/advisor-note-schema-2026-07-09.md.
{
"id": "<uuid v4>",
"turnId": "<chat turn id>",
"laneId": "<dispatched lane id>",
"model": "<model string>",
"tier": "watcher|heavy",
"severity": "info|watch|warn|block",
"summary": "<one-line, <=140 chars>",
"nextMove": "<concrete action>",
"confidence": 0.0-1.0,
"evidenceRef": [{"kind":"file:line|url|trace","value":"..."}],
"scope": "this-turn|next-turn|both"
}
Notes below injectionFloor (default 0.5) are NOT injected into next-turn context — operator signal hygiene.
Trigger
- Watcher: every turn.
- Heavy: watcher escalates on: logical contradiction, missed branch, protected-path risk, overconfident unverified claim, scope creep, security-sensitive content.
Authority
Pure annotation. Post-hoc. Never blocks delivery. The chat model has already replied; the operator sees the note and the next turn's injection arrives one turn later. Origin: rene-branch-patterns:29-32 (directive-guard.mjs is observe-only, never blocks — same posture at higher fidelity).
Surface (dual)
- Visible annotation in main chat / WhatsApp reply.
- One-turn-lag injection into chat-model context for the NEXT turn via
additionalContext (precedent: directive-guard.mjs).
The note's scope field controls: this-turn (visible only), next-turn (injected only), both.
Scope (channels)
Main session + WhatsApp only by default. NOT subject to advisor annotation:
- Autonomous cron-triggered tasks
- Dedicated MURE lane dispatches (engineer / scout / etc. run with their own result-packet discipline, not advisor notes)
- Sub-sessions without the operator in the loop
Advisory for sub-session lanes is a future feature (operator-configurable).
Arming
- Watcher lane DISARMED by default. Arm via either:
- Session env:
YURI_ADVISOR=1
- Persistent flag:
touch _SYSTEM/state/mure-advisor.enabled (gitignored)
- Heavy escalation auto-armed when watcher armed.
- Config changes (pool eligibility, schema version, injectionFloor, budget cap) — owner-gated.
Integration with MURE
mure.mjs --advisor-status → live watcher tier + last-N notes + per-tier escalation rate + deepseek-burn today.mure.mjs --variants advisor → current variant picks per tier.- Telemetry: every emission logged to
_SYSTEM/state/advisor-ledger.jsonl with full schema; per-line: turn id, lane, model, tier, severity, confidence, scope.
- The mure-calibrator reads the ledger for Brier scoring; outputs feed the variant matrix's MLP re-ranker (see mure-role-variant-matrix skill).
Reinforcement / calibration
- Watcher and heavy outputs feed
mure-calibrator continuously.
- Tracked over time:
- Watcher escalation rate — target 5-15% of turns.
- Heavy note acceptance rate — operator adopts the
nextMove how often?
- Per-model precision/recall — does the model producing the most notes correlate with rightness?
- Confidence calibration — notes with confidence=0.9 should be right ~90% of the time.
- DeepSeek burn vs cap.
- Outputs route to MLP re-ranker (cheap-tier selection) and to the operator dashboard for trust calibration.
Failure modes
- Watcher over-escalation (> 30% rate): the cheap tier is too cautious; tune the LLM-judge prompt, lower its default escalation threshold.
- Watcher under-escalation (< 3% rate): the cheap tier is rubber-stamping; swap prime or downgrade from Sonnet 5 to a more skeptical model.
- Heavy always-on by accident: DO NOT DO. Apex-blowout. The tiering is the load-bearing architectural choice — disable via the disarm flag if a regression silently lifts the gate.
- Tier-1 model hallucinating heavy escalation signal: confidence < 0.6 on heavy-promote → drop the promotion. Confidence ≥ 0.85 → strong promotion.
- Note injection polluting context: raise
injectionFloor; or for a single noisy model, swap it out of the watcher pool.
- DeepSeek cap exceeded mid-day: dispatcher auto-falls back; operator sees
deepseek-cap-warning first, then deepseek-cap event.
Anti-patterns (in code OR docs)
- Self-critique step in the main lane (no — must be a separate model).
- Heavy advisor running every turn (no — apex blowout; tiering is binding).
- Block-on-severity (no — authority is pure annotation; severity-block is declarative for the record only).
- Flag-config file maintained by hand (no — escalation is LLM-judged).
- Notes without schema compliance (no — silent failures rot the ledger).
- Falling through to Haiku for heavy-advisor failure (no — Haiku is recon only; heavy chain is Opus → DVP → GLM-5.2 → M3).
- DeepSeek spend unbounded (no — daily cap is binding).
Related
- Source schema:
_SYSTEM/research/advisor-note-schema-2026-07-09.md (v1.0.0).
- Recon:
_SYSTEM/research/rene-branch-patterns-2026-07-09.md (precedent: directive-guard.mjs).
- Audit:
_SYSTEM/research/model-audit-2026-07-09.md (model eligibility).
- Adversarial review: invoked against
_SYSTEM/research/adversarial-review-advisor-design-2026-07-09.md (4-fix reconciliation).
- Fleet doctrine: skills/fleet-economy/SKILL.md (apex-reservation rule, ~35% orchestrator budget after the 20→35 update).
- Variant matrix: skills/mure-role-variant-matrix/SKILL.md (the watcher prime + heavy picks are seeds here).
Versioned authority
v1.0.0 — created 2026-07-09. Revision incorporated: DeepSeek daily cap + M3 in Tier 2 + Haiku tier clarification. Pending Skill Workshop approval.
Change log
- 2026-07-09 — initial draft per grill round + Opus 4.8 adversarial review (HV03).
- 2026-07-09 (rev 1) — added MiniMax-M3 to Tier 2 heavy pool; added DeepSeek direct-API daily budget cap ($1.0-1.5/day); clarified Haiku is recon/cheap (NOT heavy fallback); added heavy-tier fallback chain Opus → DVP → GLM-5.2 → M3.
