ADR-0010: Candidate portfolios — explore/exploit search over reviewable candidates

Status: accepted | Date: 2026-06-28

References: ADR-0001, ADR-0004, ADR-0005, ADR-0009, RFC-0001

Context

The loop today (ADR-0004) is a single line of descent: iteration N refines iteration N-1, pure exploit making one approach better. Running the composite P/D rollout-protection goal one-shot showed two things: (1) cold, in one turn, the model found the correct cross-cut architecture from scratch; (2) a single shot is one sample from a wide space — the same goal has architecturally distinct solutions with very different blast radius, and the model "knows" several of them. Betting the whole run on the first one it picks throws away the others, and "which is best" is not an eyeball question. The competing approaches range from metrics-scrape to pod-label to EPP-only derivation to sidecar handshake to generation-affinity to reactive dead-peer detection — these are different families, not refinements of each other, and the frozen gate can actually rank them.

Decision

Generalize the loop from a single line of descent to a candidate portfolio with two explicitly different search modes, ranked by the frozen judge, and surfaced as reviewable PRs. (1) Wide/explore: N independent candidates in parallel, each a different angle via distinct method prompts, each with minimal context in its own sandbox. Goal: discover which families clear the gate. (2) Deep/exploit: take the gate's top-k and iterate them sequentially with full context (prior diff, measured score, what failed). This is ADR-0004's loop applied to a seeded starting point. The default run is wide-then-deep (a tournament with a refinement final). The judge is the ranker (ADR-0001). Candidates are reviewable draft PRs per edited component, cross-linked for composites. Deploy-to-rank (ADR-0005) is the gate to real scores. Propose turns run in parallel (worktree-per-candidate) while measurement serializes on the shared rig. Diversity must be engineered via distinct method prompts, not auto-generated.

Consequences

The loop gains a population and a (wide, deep) schedule; ADR-0004's Segment/Iteration typestate becomes the deep leg, and a new fan-out drives the wide leg over the same diff-capture and PR-publish plumbing. Cost scales with breadth: N wide candidates = N sandboxes (parallel) + N deploys to rank. Diversity must be engineered (distinct method prompts/forced approaches); N identical turns are not a portfolio. "Solved" is still the gate's call, now over the best of a population rather than the end of a single line.

Alternatives Considered

Generalize the loop to a candidate portfolio with two search modes (wide/explore for diverse independent candidates, deep/exploit for sequential refinement of winners), ranked by the frozen judge and surfaced as reviewable PRs (accepted)

• Pros: Discovers which approach families clear the gate; does not bet the run on the first approach, Wide round costs ~one turn of wall-time via parallel sandboxes; deep round refines the winner, Candidates are reviewable PR artifacts, cross-linked for composite domains
• Cons: Cost scales with breadth: N wide candidates = N sandboxes + N deploys to rank, Diversity must be engineered (distinct method prompts/forced approaches), not auto-generated

Single-line sequential refinement only (status quo) (rejected)

• Rejected because: Bets the run on the first approach with no way to compare families — exactly what the one-shot experiment exposed

One turn self-enumerates and implements K approaches (rejected)

• Rejected because: K attempts share one context and one framing so they cluster; weaker diversity for the same review/rank cost