method-figure

method-figure

Turn "draw our method figure" from a one-shot gamble into the same audited spiral the framework uses for comics: a blueprint is the source of truth, the image model bakes the look, a cross-model panel + a deterministic diff keep it honest, and the loop converges to a publication-grade figure that is reproducible (re-run the blueprint) and auditable (a trace of every round).

Two things are simultaneously true: (a) gpt-image-2 CAN render a clean Figure-1 with legible labels when conditioned on a labeled blueprint — do not assume it garbles text; (b) on a free prompt it DRIFTS (renames phases, invents nodes, garbles a token, leaves pasted-looking floating labels). The blueprint + blind-transcribe-then-hard-diff loop turns (a) into a reliable result and catches (b) every round.

  system description ─▶ ① BLUEPRINT (JSON content-lock)  ── validate_blueprint.py
                              ▼
                        ② CONDITION (white-bg labeled SVG → PNG) + identity sheet (real chibi, optional)  ── render_condition.py --png
                              ▼
                        ③ BAKE  — agent: mcp__codex__codex(prompt+abs ref paths+out_path, workspace-write, gpt-5.5, config{xhigh}) → gpt-image-2 native PNG  ── pickup_image.py --out-existing (sig+size+dims, mtime-bound, HARD-VETO struct/zlib/PIL/SVG, fail-closed)
                              ▼
                        ④ PANEL — Gemini ‖ Codex BLIND-transcribe → content_diff.py (observed ⊖ blueprint) → Claude structural sign-off
                              ▼
                        ⑤ agent reads the diff + the panel blockers → re-bake re-asserting the locked labels
                              ▼
                   converged? ─ no ─▶ ③   (bounded: max_rounds → escalate to human)
                              │ yes
                              ▼
                        ⑥ APPROVE → figure.png + blueprint.json + trace.jsonl

Constants

• GENERATOR = Codex gpt-5.5, config: {model_reasoning_effort: xhigh, include_image_gen_tool: true} → the native image_generation tool (gpt-image-2). The gpt-5.5 pin is a single hardcoded COMPAT DEFAULT in the bake sidecar payload (run_spiral.py mirrors run_comic.py's canonical bake plan; a config-driven model override is PLANNED, not yet implemented). It pins the BAKE only — the panel's Codex reviewer is un-pinned (see PANEL below). CRITICAL: image_gen is produced ONLY via mcp__codex__codex (the agent tool), NOT codex exec. codex exec / over-specified / forbid-list prompts make Codex hand-draw a code fallback (struct+zlib PNG or SVG/matplotlib) — visually indistinguishable for trivial shapes, useless for a real method-figure. The working invocation is mcp__codex__codex with a dead-simple prompt + sandbox: "workspace-write" (it must WRITE the out_path) + model: "gpt-5.5" + config: {model_reasoning_effort: "xhigh", include_image_gen_tool: true} (the schema has NO top-level effort param; config{xhigh} shorthand below ALWAYS expands to both these keys — without include_image_gen_tool codex won't fire its native image tool, it falls back to descriptive text / an SVG renderer) + cwd: <project>. Reference images are passed by absolute file path inside the prompt (the schema has NO -i); the output path is a deterministic abs path in the prompt. Pick it up with pickup_image.py --out-existing (verifies the EXPLICIT out_path: PNG sig + size + dims, mtime >= request.created_at) which HARD-VETOES struct/zlib/PIL/<svg>/matplotlib markers in the agent transcript (fail-closed; there is no 'native sig wins' override). Honesty caveat: as of Jun 2026 native headless persistence is unreliable, so this fail-closed verifier — not any sandbox setting — is the first guard against a non-native bake. But the HARD-VETO is a BEST-EFFORT denylist against the known codex-exec hand-draw fallback (struct/zlib/PIL/ SVG/matplotlib markers), NOT a complete security boundary — a novel fallback that emits a sig-valid PNG without those markers can slip past it. The load-bearing faithfulness gate is the cross-model blind-transcribe panel + the deterministic content_diff (the pixels are what reviewers transcribe), with this denylist as a cheap upstream filter.
• PANEL (automated blind-transcribe) = the orchestrator SHELLS the gemini + codex CLIs as subprocesses (both must be on PATH; MCP is ONLY the bake seam): Gemini = gemini --model auto-gemini-3; Codex = codex exec -i <png> with NO model pin (it follows the local codex config — currently gpt-5.6-sol) at effort xhigh — so the reviewer model ≠ the bake's pinned gpt-5.5. Plus the deterministic content_diff. Claude (this agent) is the post-pass STRUCTURAL sign-off, not a blind transcriber — the loop converges on Gemini-approve + Codex-approve + empty-diff, then Claude signs off.
• CROSS-MODEL ACQUITTAL — Codex is the generation family, so a Codex approve can only diagnose/veto, never be the sole acquitter. ACCEPT requires Gemini approve + Claude structural approve + the hard-diff empty.
• MAX_ROUNDS = 4, then escalate to human with best-so-far + open blockers.
• LABEL_POLICY = baked only in v0 — the image model renders ALL text; nothing is hand-pasted. (hybrid/overlay — lock structure + vector-overlay the labels for paper zero-tolerance text — are on the v1 roadmap; do NOT use a vector overlay as an ad-hoc patch on a finished bake, it reads as pasted.)
• OUTPUT_DIR = figures/method_figure/<figure_id>/ (figure.png, blueprint.json, condition.svg, trace.jsonl).
• NATIVE-IMAGE FAIL-CLOSED — accept a bake ONLY if a real native PNG exists at the explicit out_path, sha/size/dims check out and mtime >= request.created_at, and the agent transcript shows no struct/zlib/ PIL/<svg>/matplotlib fallback (pickup_image.py --out-existing, HARD-VETO — a clean sig never overrides a fallback marker). This veto is a BEST-EFFORT denylist against the known codex-exec hand-draw fallback, NOT a complete security boundary (a novel marker-free fallback could evade it). The load-bearing faithfulness gate remains the cross-model blind-transcribe panel + the deterministic content_diff; the denylist is a cheap upstream filter that matters because native headless persistence is currently unreliable.
• SERIALIZE BAKES — never run two image generations at once. The default --bake-mode=agent writes each native PNG to its explicit per-round out_path (no shared dir), so concurrent agent bakes still risk a request/status sidecar race — keep one runner per figure. (The global ~/.codex/generated_images dir + newest-after-marker pickup that could cross-pollinate concurrent bakes is a hazard of the LEGACY --bake-mode=exec path ONLY, which is retired for real bakes.)