# Cost-optimal orchestration model — quality held, money cut

_Date: 2026-06-25 · synthesis of: north money verdict (`2026-06-25-north-orchestration-money-verdict.md`), composer-as-reviewer (`2026-06-25-composer-as-reviewer.md`), RESULT 12 (`2026-06-25-north-vs-composer-platform-implementer.md`), seam-reviewer benchmark (platform memory)._

## The principle (BLUF)
Cost is NOT in the coder (≈4% of per-task $). It is in three places: **(1) orchestrator model tier** (opus = 5× sonnet/token), **(2) session/cache tax** (89% of the live north bill was opus `cache_read`), **(3) review routing** (opus review ≈ 96% of per-task cost). Optimize those three. Keep opus ONLY where a miss is catastrophic and nothing else catches it (latent correctness on money/auth/trust-boundary). Make everything else cheap.

## Seat map
| seat | who | why (measured) |
|---|---|---|
| **implementer** | **cursor/composer-2.5 via `ca.sh`**, dispatched | reliable (delivered orders-react when north failed 2/2); flat sub; its tokens land OFF the orchestrator's cached context (cheap on cache). north = opt-in $0 bonus ONLY on its strong classes (mechanical refactor, small described-add) at SHORT paths — never structural/critical, never with an opus babysitter. |
| **orchestrator** | **sonnet** | coordination (sequence waves, dispatch, read STATUS line, run Gate-0, route by risk) is MECHANICAL, not where quality lives. opus-as-orchestrator was the #1 cost driver. |
| **risk router** | **deterministic script**, not a judgment call | grep the diff for money/auth/payment/SQL-write/crypto/concurrency sinks → HIGH-RISK. Mechanical so sonnet can't mis-route the expensive decision. |
| **Gate 0** | deterministic tsc/lint/build/tests | $0, ALWAYS first. Catches the clerical layer (north/composer wart profile) free. RED → composer fixer via `ca.sh`. |
| **review gate** | **risk-routed, single reviewer — do NOT stack** | high-risk → opus (load-bearing latent gate; seam-reviewer benchmark: sonnet AND cursor as reviewers both WORSE than opus). low-risk → composer first-pass (3/3 on surface/spec; ~70% latent — acceptable on a low-consequence diff). |
| **process gate** | `advisor()` / opus spot-check between waves | unchanged. |

## The gate ladder — risk-routed, never double-reviewed
Per diff, after Gate-0 green:
1. **Deterministic risk-route** (script): does the diff touch a money/auth/trust-boundary/SQL-write/crypto/concurrency sink?
2. **HIGH-RISK → opus review** (single pass; `security-guard` too if it's a trust boundary). This is the quality floor — composer's measured 1/3 P0-surfacing makes it unsafe as the SOLE gate here. Do NOT run a composer pre-pass first: opus review is input-dominated (reads the whole file regardless), so pre-filtering saves nothing and just adds a redundant pass.
3. **LOW-RISK → composer first-pass** (k=1; Gate-0 already caught the clerical layer; composer is 3/3 on surface/spec findings). Opus is NOT spent here. The residual ~30% latent miss is on a low-consequence diff = an accepted, bounded risk.
4. **LOC≤LOP:** whoever HOLDS the code (the opus/composer reviewer) fixes a sub-threshold finding inline + commits, instead of emitting a report-only finding for a 1-line change.

**Optional substitution (banks opus $ on a recurring high-risk shape):** once opus (or a human) has identified the suspects on a recurring high-risk class, encode them as a sharp `MUST-verify` checklist and let **composer execute it k≥3** — measured to lift composer's latent recall to 3/3 (the clawback uuid case). Use this to replace "opus reviews every instance" with "opus authors the checklist once, composer runs it" — but only AFTER opus/human has found the suspects; composer does not reliably DISCOVER latent defects cold.

## Session / cache discipline (the 89% lever)
- **One short, scoped session per task/wave.** The live north bill ballooned because a 3-day mega-session re-read 60M tokens of accumulated context at opus cache_read rates. Short sessions = small cached context = small bill.
- **Dispatch heavy build to cursor** so verbose agentic output never enters (and never re-caches in) the orchestrator's context — the orchestrator reads only the diff + STATUS line.
- **Keep orchestrator context lean:** plan + diff + findings, not whole codebases. Use a cheap locate model (haiku Explore) for search, not the orchestrator.

## Why this preserves quality
- The ONE thing measured to be irreplaceable — opus on latent correctness for money/auth — is kept, exactly there.
- Gate-0 (deterministic) catches the entire clerical failure class for free, on every diff.
- Composer is 3/3 on surface/spec, so low-risk diffs lose nothing real.
- Risk routing is deterministic, so the cheap orchestrator can't accidentally route a payment diff away from opus.

## Projected economics (vs the two baselines)
- vs **north-orchestration ($261/run, measured):** drop north-babysitting + opus-orchestrator + failure tax → plausibly **5–10× cheaper**. The free coder was never the saving; removing the machinery it required is.
- vs **opus-orchestrator-reviews-everything (status quo):** orchestrator opus→sonnet (~5× on coordination) + review opus→risk-routed (opus on the high-risk minority, ~⅓ of diffs, instead of all → ~3× on review) + short-session cache discipline (cuts the dominant 89% line). Quality floor unchanged because opus still gates every high-risk diff.
- vs **sonnet-straight ungated ($12–36, the cheapest but UNREVIEWED):** this model lands near it on low-risk tasks and pays opus only on the high-risk minority — buying the quality sonnet-straight lacks, at the lowest cost that buys it.

## What to STOP doing
- Don't drive orchestration with opus. Coordination ≠ judgment.
- Don't run north on the critical path or as the money strategy — it's a 4% line, unreliable, and needs an opus supervisor that costs more than it saves.
- Don't review every diff with opus. Route by risk.
- Don't stack composer-then-opus on the same diff (opus re-scans everything; the pre-pass is wasted).
- Don't let one session accumulate days of context at opus cache rates.

## Caveats
- "Capable enough" assumption for the cheaper coder/orchestrator is the owner's stipulation; the gate is what protects quality if it falls short — at gate cost identical to any flow.
- Risk-router completeness is load-bearing: a money/auth sink it fails to flag skips opus. The router's sink list must be conservative and audited (false-positives just cost an extra opus pass; false-negatives ship bugs).
- composer/sonnet low-risk first-pass accepts a bounded latent miss on low-consequence diffs by design; if a "low-risk" class starts producing real escapes, reclassify it high-risk.