## Summary
- Moves the capacity analysis the Rhodes Works fleet runs today into Aerie and Sindri, following the 2026-09-16 capacity handoff (PAP-8718) as written. This PR replicates that process; it does not change the process.
- Trigger: a daily diligence sweep over Data Gathering and Ready for Review sites, matching the Diligence Agent's run loop, plus an operator ask for a single site.
- Flow: Aerie assembles the site's documents, the governing documents, and prior analyses. It dispatches them to the Sindri workflow ([Sindri #205](https://github.com/AI-Builder-Team/Sindri/pull/205)), re-validates CAP-1..7, and owns every DD write.
- Off by default: nothing runs unless CAPACITY_AUTOMATION_ENABLED=true, and publication stays disabled.
## What this replicates
| Handoff | Aerie + Sindri |
| --- | --- |
| §5 Diligence Agent run loop over DG / RfR sites | capacity diligence sweep cron (daily 11:00 UTC). Complete cards are excluded at query time (§4) |
| §4 agents pull the site's documents list | The evidence bundle includes each registered document's metadata, readiness, and extracted text |
| §2 Blueprint 1–7 + alpha-capacity-analysis skill | One Sindri agent with the handoff's skill, reference rulesets, output specs, and pinned §2 Brainlift text |
| §4 CAP-1..7, play gate, room table + labeled floorplan | Aerie re-validates. PARTIAL/FAIL support items and a failed play gate become data-quality flags, as in output spec 01 |
| §4 DD writes, proposal vs. record docs, Complete freeze | Unchanged Aerie publication path: proposal by default, allowlist-gated, never writes Complete cards |
Two operator rules sit on top of the handoff:
- Governing documents Aerie cannot read are skipped, and the pinned §2 Brainlift text is used instead.
- Instant School Plan outputs are not evidence.
## Changes
- Trigger:
- enqueue.ts adds enqueueDiligenceSweep and enqueueCapacityAsk, with at most one run in flight per site and one sweep run per site per UTC day.
- The document-registration trigger is removed; it was never enabled.
- Evidence (evidenceAssembler.ts):
- Site documents travel with their readiness. Only documents still being indexed hold a run.
- A site with no readable floorplan, block plan, CAD, or Matterport document ends unresolved. This is the handoff's C-IN rule.
- Dispatch (runner.ts):
- Document text goes as a gzip, line-wrapped Markdown file input so it fits Sindri's 256 KB start-input cap and the agent can read it in pages.
- Documents are ordered by priority (doctrine, then floorplans and other layout documents, then prior analyses, then caps and scope), and lower-priority ones are dropped only when the site is too large.
- Validation (@bran/contracts):
- CAP-1..7 follow the handoff's definitions. CAP-2 is the NLA sum plus per-level subtotals equal to the scenario total; CAP-3 checks completeness.
- The play gate must be evaluated, and the labeled floorplan artifact is required.
- Structured note entries are kept as JSON strings.
- Docs: docs/capacity-automation/fleet-validation-report.md records the production-data simulation below.
## Local end-to-end results (production data, personal dev, nothing written to production)
Method:
1. Eight production sites and their capacity-relevant documents were copied read-only into personal dev Aerie.
2. Personal dev indexed the documents with production's Drive reader.
3. Each site ran one at a time through Aerie's own path: enqueue, assemble, dispatch to Sindri, reconcile, validate. Publication was disabled.
| Site | Card FO / Max | Run FO / Max | Aerie outcome |
| --- | --- | --- | --- |
| 1964 Gallows Rd | 53 / 54 | 53 / 54 | all gates pass |
| 1762 Prospector Ave | 16 / 18 | 16 / 18 | all gates pass |
| 5000 T-Rex Ave | 55 / 61 | 50 / 74 | all gates pass |
| 35 E 62nd St | 239 / 252 | 239 / 252 (2 runs) | CAP-2: agent's NLA total ≠ its NLA rooms |
| 1200 Davis St | 140 / 330 | 141 / 330 | CAP-2 (agent arithmetic) |
| 2201 Lake Woodlands Dr | 70 / 231 | 70 / 198, then 134 / 158 | CAP-2; play gate omitted once |
| 5310 S Alston Ave | 112 / — | 90 / 90 | CAP-1: Microschool ruleset at 11,695 SF (handoff §7 #5 open question) |
| 4506 S Miami Blvd | 106 / — | 141 / 141 | CAP-2; CAP-4: 7 rooms not traced to a document |
Every remaining failure is a handoff CAP gate catching the agent's own output, not a pipeline error.
## Limitations
- Not enabled anywhere. Merging changes no production behavior; production has no CAPACITY_AUTOMATION_ENABLED.
- Governing documents are mostly unreadable. Production's Drive reader can't open 7 of the 10 handoff §1 documents: the BrainLift Directory, Capacity Brainlift, Play Area, Scoring Sites, Space Typology Catalogue, worked example, and Aerie Data Contract. It can open Day in the Life, Real Estate Location (the fixed-rate rulesets the skill already snapshots), and the legacy Microschool beliefs. Runs use the handoff's pinned Brainlift text and the skill's play rules. Access has been requested from JC.
- Agent output quality is the handoff's, not improved. 5 of 8 sites fail a CAP gate on the agent's own arithmetic, traceability, or ruleset choice, and identical inputs drift between runs (Woodlands). Results that fail a gate stay out of publication.
- The sweep and publication are untested on a deployment. The simulation used per-site asks. Record mode and artifact registration have not run anywhere. The 11:00 UTC cadence is our choice; the handoff doesn't specify one.
- Very large sites can lose documents. When a site exceeds Sindri's input cap even compressed, the lowest-priority documents are dropped and the agent lists them in unresolvedInputs.
## Open review findings (intentionally not fixed in this PR)
Mercy's latest review still lists about 20 findings, including one it counts as blocking. We are merging with them open on purpose: each fix round produced a similar number of new edge cases, none of them affect production while the feature is off, and Mercy never approves this PR because it touches a sensitive path. Every open finding is tracked in [AERIE-2356](https://linear.app/builder-team/issue/AERIE-2356/harden-capacity-pipeline-open-mercy-findings-from-aerie-pr-1439), which must be finished before record-mode publication or a wider allowlist.
- Blocking, accepted risk: prompt injection through document text. The agent's job is to read site documents, so their text reaches its context; the Artemis fleet has the same exposure today. Mitigations: document content is fenced by a per-file random marker with one-line metadata, the agent has only Read/Write tools, Aerie re-validates every result against CAP-1..7, and publication is off, proposal-mode, and allowlist-gated.
- Deferred hardening (open checkboxes in AERIE-2356): stale knowledge treated as ready, prior-analysis capacities not projected, silently dropped oversized documents, artifact path and URL validation, play-gate basis, negative numbers, rollback fencing and restore fidelity, retry/scheduler edge cases, and missing failure-path tests.
- Declined because the handoff does it this way (recorded in AERIE-2356): spreadsheets count as geometry (input Mode 1), prior outputs are reviewed as prior analyses (Blueprint 2), unreadable site documents don't block a run, and no CAP-3/CAP-6 rules stricter than the handoff's.
Fixed from review in the last rounds: prior analyses count as CAP-4 evidence, a missing trigger document makes a run unresolved, the attribution note is written once per run (with a retry test), non-string doctrine config is rejected, and a Complete publish status is refused case-insensitively.
## Why merge now
- It's inert until explicitly enabled, so there's no production risk.
- The Aerie-to-Sindri path is proven end to end on real production data. Three sites reproduce the card exactly, and the gates stop the rest from publishing.
- What's left is external (doctrine access) or tracked (open review findings in AERIE-2356, the staging sweep run in AERIE-2265, repeatability in AERIE-2269). Holding the branch longer mostly adds review churn.
## Breaking changes
- None while CAPACITY_AUTOMATION_ENABLED is unset. The capacity crons are new, and the document-registration trigger is removed; it was never enabled.
## Test plan
- @bran/contracts capacity tests (46) and typecheck: passing
- chat capacity Convex suite and config tests (41) and typecheck: passing
- Monitoring cron coverage test: passing
- Production-data simulation above: 8 sites run serially in personal dev
Related: [AERIE-2259](https://linear.app/builder-team/issue/AERIE-2259), [AERIE-2266](https://linear.app/builder-team/issue/AERIE-2266), [AERIE-2267](https://linear.app/builder-team/issue/AERIE-2267), [AERIE-2261](https://linear.app/builder-team/issue/AERIE-2261), [AERIE-2356](https://linear.app/builder-team/issue/AERIE-2356)