Fusion contract verifies symbol names, not meaning: two workers shipped the same symbol with opposite field semantics #491

atomic-agent 0.6.3, fusion cloud-orch (claude-opus-5 orchestrator + gemma-4-26b-a4b workers)
Component: tools/fusion/contract.ts, contract-checks.ts, worker-prompt.ts
Type: feature request, with a motivating failure

What happened

A fan-out split a shared physics module between two workers: bodies.js (simulation) and bodies-draw.js (rendering), appended to the same global PHYS. Both sides implement or consume PHYS.corners(b). The name-level contract check passed — the symbol exists — but the two workers gave the returned fields opposite meanings.

bodies.js (producer):

out.push({ w:{x:b.pos.x+x3, y:b.pos.y+y3, z:b.pos.z+z2},   // w = world-space point
           o:{x:x3, y:y3, z:z2} });                        // o = local offset

bodies-draw.js (consumer) — its own fallback documents the opposite convention, and its draw path projects o as world space:

out.push({ w: { x: b.pos.x, ... }, o: { x: x3 + b.pos.x, ... } });
...
proj.push(CAM.project(corners[i].o.x, corners[i].o.y, corners[i].o.z));

Because the producer's corners exists, the consumer's fallback never runs, and every box renders around the origin while its ground shadow (drawn from b.pos directly) sits where the body actually is. Three of five scenes in the build are visually broken — stacked cubes render as one overlapping clump, a 24-brick wall draws as a single brick over a field of orphan shadows.

The part worth attention: the page loads with zero console errors. Every automated gate available to the reviewing orchestrator (page loads, no pageerror, selectors present, symbols found in files) is green. The breakage is only visible to human eyes.

The causal chain is structural, not a model accident: workers cannot see each other by design; at ~5 t/s local throughput the orchestrator reasonably briefed them to write without reading siblings; and the contract had no slot to carry what w and o mean.

Proposal

Two increments, independently useful:

1. Carry semantics in the contract. Let a provides entry optionally take a shape — one line of signature plus return shape, free text — rendered verbatim into the briefs of both the producing task and every task that requires it. Here, a single shared line corners(b) -> [{w: world point, o: local offset} x 8] in both briefs removes the ambiguity at the cost of a few tokens.

2. Smoke-check the boundary. Extend contract.checks so a declared symbol can be invoked once against a small fixture (through the existing verify runner) and its return asserted — presence checks stay as they are, but a w/o swap like this one fails loudly at fan-out review instead of shipping silently.

Full artifacts

The four files involved (producer, consumer, the camera they feed, one consuming scene): https://gist.github.com/sosidudku1/918ff030a2b8791083dacc961c06ecbb
Session trace with the orchestrator's actual briefs for both tasks: https://gist.github.com/sosidudku1/a9dc76c2cb34faaebd1c7363e6087e34