The settled architecture: the client approves an inexpensive AI-generated full-page concept mock; from that signature, the pipeline derives, recovers, rebuilds, and verifies a faithful, web-native site with no human gates — and a graceful quality ladder that means it can degrade but never stall.
The business motion this pipeline serves: research a small business, generate one or several full-page design concepts cheaply, let the client approve the one they love, and then deliver a real website that is recognizably that design — built autonomously after the signature. The decision that shapes everything (settled 2026-06-10): the approval artifact is the cheap concept mock itself. We do not pre-build the site to win approval; heavier approval artifacts exist only as escalation options.
Three principles make that promise safe rather than reckless:
1 — Fidelity is not the scarce resource; web-nativeness is. Perfect visual fidelity is always available at the bottom of a fallback ladder: ship the approved pixels themselves as an image. What the bottom rung costs is responsiveness, editability, accessibility, and search visibility. So the engineering program buys web-nativeness without spending fidelity — and a failed step never blocks delivery, it just lands a section one rung lower (§6).
2 — The mock is authored, not received. We control what the client is ever shown: pages composed only from the ten archetypes, display type from the SAFE-font catalog, dense text greeked, painted widgets matching components we actually ship, bleeds declared as explicit elements — all checked by an automated pre-flight lint before a client sees anything. The client cannot approve what we cannot build.
3 — Declare, don't detect. Because we author every prompt, we already know each section's archetype, element inventory, exact copy, fonts, and data bindings. That travels in the manifest. The only things ever read from pixels are the model's design decisions — where it put things, how big, what color — and verification.
One human signature divides the pipeline. Everything before it is cheap to change; everything after it is autonomous and answers to the contract.
| Stage | What happens | Key artifacts | Gate |
|---|---|---|---|
| Research & data | Compile the business's reality: facts, hours, reviews, full menu (with extraction provenance), social themes | findings · menu data · business data | — |
| Asset curation | Collect and describe real photos; record rights, quality, approved uses | asset register | — |
| Product & copy | Positioning, personality, anti-references; then exact per-section copy with case and length budgets | PRODUCT · copy brief + copy.yaml | copy lint + approval |
| Visual identity | Cheap direction probes FIRST (the direction gate), then toolkit lock — full investment only after a direction wins | direction brief · toolkit | direction + toolkit approval |
| Design system | Tokens authored from product + toolkit: palette with computed contrast pairs, type scale, font passports (tier, corrective facts) | DESIGN + tokens.json | token lint |
| Page program | Choose sections from the archetype grammar; declare elements, data bindings, bleeds, proxies, target rungs | page-plan.yaml (manifest skeleton) | plan lint |
| Page mock (U8a) | ONE continuous full-page image from templated prompts; rejection-sampled until it passes the contract lint floor | page mock + manifest@freeze + approval record | lint floor → client approval |
| Autonomous build | Section mocks gated against approved crops → recover (plate/crop/measure) → rebuild at the highest rung → verify per contract → derive mobile/accessibility/performance | U8b set · manifest@build · deviation ledger | machine gates only |
| Ship | Assembled site + the faithfulness report (per-element results, every deviation classed and justified, every fallback flagged) | site · faithfulness report | report = ship gate |
At concept grade the client signs a cheap image, not a built site — so "faithful to the mock" has to be defined in layers. The freeze freezes intent; machines derive the rest and answer for it.
Headline-tier copy correct and legible · body-tier approximately right · dense text greeked · all planned sections present, in order, with recognizable archetype silhouettes · palette within token tolerance · painted widgets match components we actually deliver · and a structured approval record attached (mock fingerprint, manifest version, grade, the disclosure set) so the autonomous gates have something machine-readable to check changes against.
| Grade | Artifact the client approves | When |
|---|---|---|
| concept (the settled default) | The raw page mock, passing the lint floor, with disclosures | Funnel variants and the normal approval; contract = design intent |
| standard | + the composite assembled from the section mocks (full element conformance) | When intent-level contracting isn't enough; approved pixels = recovery sources exactly |
| hardened | + rebuilt renders (real fonts over recovered backgrounds) for the riskiest sections | Demanding clients; sections where font/plate divergence is most visible |
| pre-built | The fully built page | Rare: final pre-launch sign-off |
The grades form a ladder of how much of the downstream build is pulled in front of the freeze. Rule: harden the winner, not the candidates — exploration variants stay concept-grade; only the chosen direction ever pays for more.
| Class | Examples | Autonomous disposition |
|---|---|---|
| 0 — invisible | anti-aliasing, sub-threshold offsets | auto-accept |
| 1 — immaterial | line re-breaks in the same zone, ≤1–2% spacing drift, true-font rendering vs the baked approximation | auto-accept + log |
| 2 — material but necessary | real menu longer than the greeked mock; live map ≠ painted map; contrast raised to the accessibility minimum; mobile reflow | auto-accept only against the disclosures pre-authorized at approval |
| 3 — design-changing | different artwork, palette shift, layout change, missing element | auto-fail → drop a rung. Never silently shipped; a rung-C failure parks the section for async review |
The fidelity budget, spent top-down: what a non-designer client notices in a side-by-side. A working hypothesis the pilot calibrates — it's why a changed hero illustration is a hard failure while a re-broken body line is a logged non-event.
The worry this answers: the build depends on per-section element data that must survive the trip through a generative image model. The resolution: build data never rides the image channel. Prompts carry only what the image needs (strings to paint, style language, composition); everything the build needs rides the manifest, losslessly. The only payload crossing the lossy channel is painted strings + geometry — both verifiable on the far side. Every element gets a stable id (sectionId.role) that is the join key across the whole pipeline:
| Checkpoint | Where | Mechanical check |
|---|---|---|
| born | copy.yaml — exact string, case, role | copy lint (length budgets vs archetype + font) |
| declared | page-plan.yaml — section + archetype + zone | plan lint |
| bound | the prompt, via a versioned template | prompt lint: every declared string appears in the prompt text — completeness by construction |
| painted | the generated mock | conformance gate: each element found, copy matched, exactly once, legible, in its zone — plus an inverse sweep rejecting any text we did NOT declare |
| frozen / measured | the manifest — declared fields at freeze, measured geometry added from accepted section mocks | assembly check |
| built | a DOM node carrying its element id | structural diff: manifest ids ↔ DOM ids |
| reported | the faithfulness report, one row per id | ship gate |
Because the conformance check is closed-set — we know exactly which strings to look for — it is automatable and reliable (our detector ensemble achieved zero role errors precisely because copy was known). And because it's automatic, generation becomes rejection sampling: roll, check, re-roll to a cap; only conforming candidates ever reach a human or a downstream stage. Reliability cost becomes API cost. Honest limits: heavily stylized display lettering degrades the checker (the lint floor bounds how stylized baked text may get), and model-invented non-text additions need a vision-model "anything unexpected?" sweep.
The survey of our prior runs found the pipeline structured at both ends — research data and build specs — but pure prose in the middle, so every hex value and copy string crossed by hand. The fix: each prose document keeps its rationale and gains a small structured twin carrying its values; the manifest is then an assembly of twins, never an authored document. The test: if assembling the manifest requires reading prose, an upstream artifact is missing structure.
| Artifact | Kind | Feeds |
|---|---|---|
| findings · menu · business data · reviews | data layer | copy facts, data-bound sections (menus, hours), testimonial quotes |
| asset register | data layer | real-photo sourcing (galleries, story), rights & approved uses |
| PRODUCT (prose, by design) | prose | voice, personality → prompt language, judgment |
| copy brief + copy.yaml | prose + twin | exact strings/case/budgets → prompts, manifest, build text |
| DESIGN + tokens.json | prose + twin | palette/type/spacing + font passports → prompts, shell CSS, theming, color checks in verify |
| shape brief + page-plan.yaml | prose + twin | the manifest skeleton: archetypes, elements, bindings, bleeds, proxies, target rungs |
| manifest (assembled) | assembly | the machine half of the contract; completed progressively (declared at freeze → measured at build) |
| generation log + kept assets | record | every image's template-version + bindings + conditioning → reproducibility, drift telemetry |
| approval record · deviation ledger · faithfulness report · run state | record | the contract event, every accepted difference with its rule, the ship gate, cross-session continuity |
Prompts are versioned instruments. Prompt structure measurably changes output (describing letterforms beyond the font name worsens fidelity; verbose layout language degrades it; the word "website" conjures fake browser chrome). So template phrasing is frozen and versioned; only typed slots vary, bound from the twins; each run carries a style lexicon settled once at toolkit time and reused verbatim; any phrasing change goes through a matrix-test harness; and the generation log ties outcomes to template versions — every production run quietly extends the eval data.
"Fully autonomous after approval" is a design constraint, not an aspiration: no human gates after the freeze. Two mechanisms make that safe.
The judge. With no human between freeze and ship, the whole-page reviewer is a vision model benchmarked for the job (our tests: Gemini-class models read spatial layout at roughly 0.2% mean error vs roughly 5% for Claude-class). It must pass a human-agreement benchmark before it may gate alone — that calibration is pilot work, not an assumption.
Predictability without seeds. The default image model exposes no seed or determinism control (verified against current docs; the one Google model line that had seeds is being retired). What we use instead: pin every exposed parameter (model version, aspect, the newly-found resolution setting — up to 4K, which also solves crop resolution) and log full config per generation · a golden canary battery — a fixed probe suite re-run before big jobs to catch silent provider drift ("same battery → same score distribution" replaces "same seed → same pixels") · conditioning on the approved anchor for composition stability · N-sample statistics everywhere a single roll would lie · and deterministic local operations over generative ones within their envelope — local inpainting handles flat backgrounds, while structured artwork behind text uses an AI-erased plate composited into the original only inside the text-ink masks, keeping every pixel outside the text identical to the approved image by construction.
How each archetype plays out under the contract chain: its recovery→rebuild recipe, the rung it can ship at as of today's capabilities, what most threatens perceived faithfulness, and the skills that move it up the ladder. Definitions: SECTION-TAXONOMY.md.
| Archetype | Contract | Recovery → rebuild | Rung now → target | Top faithfulness risks | Unlocking skills |
|---|---|---|---|---|---|
| S1 overlay canvas | pixel | clean plate + element detect & measure → overlay rebuild in container-relative units | A (proven) → A⁺ | background damage during text removal · busy-background contrast · font metrics | beyond the fixed three elements (headline / body / CTA button) · automated contrast check · fine-position read tolerance (open item) |
| S2 strip band | structure | minimal structure read → tokens + small repeat | → A near-term | ≈ none (flat background, authored copy) | pilot vehicle for the whole gate/ledger machinery |
| S3 split panel | structure (image panel: pixel) | panel boundary + crop → flow text block + image | B → A | crop resolution · image aspect honored (condense copy, don't distort the image) · text re-breaks | crop + resolution path · flow rebuild · panel read |
| S4 card grid | structure | repeat read + per-cell assets → template × N | B → A | cell-asset resolution · template uniformity | repetition inference · asset-first authoring · template rebuild |
| S5 data panel | structure + semantic data | structure read → bind the structured menu data | A by hand → A automated | approved length ≠ real data (expectations, covered by disclosure) | structure read · data binding + length policy |
| S6 gallery & collage | pixel images in structural grid | grid read + crop ×N (freeform: cutouts) → grid CSS + frames | grid ≈ A · freeform B | arrangement match · frame chrome in CSS · overlapping images (freeform) | multi-crop · frame reconstruction · segmentation (late wave) |
| S7 editorial | structure | type-system read → deep flow rebuild | → A | type rhythm & measure fidelity | type-scale extraction |
| S8 interactive proxy | semantic | manifest-declared → component swap | must ship live (cannot ship baked at any rung) | painted widget ≠ shipped component | component library · paint-what-we-ship rule · masked verify |
| S9 chrome | structure | content + token read; logo as asset | → A now | logo crispness (raster vs vector) | conventions template · logo asset path |
| S10 connective | pixel | declared bleeds → baked-cut + transparent-underlap assembly · sticker cutouts | B by design | seam alignment · mobile simplification | bleed authoring rules · seam QC |
Gallery variants referenced above: G1 uniform grid · G2 masonry/asymmetric · G3 framed/styled cells · G4 filmstrip/carousel · G5 freeform overlapping collage. Build-out inventory (27 skills: 5 exist · 8 partial · 14 new; tier 1 = the three structured twins + the lint family + the lock protocol) lives in PIPELINE-AND-ARTIFACTS.md.
Wave 1 pilots the architecture, not a new archetype: one page (hero + bands), concept-grade approval simulated, then a fully autonomous run to a built page — measuring the seven things the concept-grade bet depends on:
| # | Measurement | Why it's load-bearing |
|---|---|---|
| 1 | U8a contract lint floor + conformance on real page mocks | defines what may be client-shown as a contract |
| 2 | Section-mock fidelity gate vs human perceived-sameness | generative ops now run post-freeze with no human backstop — the single most important calibration |
| 3 | Detect/measure envelopes, incl. the fine-position tolerance (currently an open research item) | an autonomous rebuild can't ask a human to eyeball alignment |
| 4 | Rebuild + per-contract verify end-to-end | the proven hero engine, exercised inside the new gate machinery |
| 5 | Perceptual-judge agreement with human client-notice judgments | the judge is the binding reviewer; it must earn that role |
| 6 | Element round-trip integrity (% of manifest elements reaching the DOM through every checkpoint) | the headline number for the whole element thread |
| 7 | Page-mock geometry: aspect × resolution × section count → crop adequacy | sets the U8a spec; 4K output should make section crops genuinely usable anchors |
Then the capability waves proceed as before — split panels, data panels, card grids (the small-business 80%), then galleries and chrome, then editorial and the component library for forms, then the freeform frontier — each wave inheriting the same working definition of "faithful" instead of inventing its own.
The canonical, always-current registry lives in PIPELINE-AND-ARTIFACTS.md §7, alongside tolerance numbers to be set empirically in the pilot.