Live defense engine — AI-assisted project defense (AVNI-style)

Why / Context

The teardown's STEAL list validates this as buildable now: Euron's AVNI ships AI-conducted, recorded, evaluated interviews as a paid feature. Our version is the mandatory live defense on Capstone/Flagship (PRD §6.2): the learner defends design decisions to a mentor with AI-assisted follow-up questioning. This is the anti-AI-shortcut integrity signal competitors can't claim ("we verify you can defend your own work") and a headline trust differentiator per teardown §5.3.

Schema already in place — NO migration required

• DefenseSession (scheduling, aiQuestionPlan Json, transcriptAssetId, recordingVideoAssetId, status/verdict) — verdict of record lives on ProjectReview(kind=DEFENSE).decision
• LiveSession(purpose: DEFENSE) + Fermion provider fields; recording lands as VideoAsset
• ProjectInstance.status=DEFENSE_PENDING
• IntegrityFlag(subjectType: DEFENSE) for suspicious sessions
• AiUsageEvent(feature: DEFENSE_QA) for metering
• FeatureFlag defense-engine (seeded, off)

Implementation plan

1. Scheduling UX: when the final milestone is APPROVED on a defenseRequired project, instance → DEFENSE_PENDING; learner picks a slot from mentor availability (MentorProfile.availability), creating DefenseSession + LiveSession(purpose: DEFENSE) via src/lib/fermion.
2. AI question plan generator (src/lib/ai/defense.ts): analyze the learner's milestone submissions + repo diff summary → produce 8–12 probing questions targeting their specific design decisions; store in aiQuestionPlan. Use the Claude API — check current model ids/pricing via the claude-api skill at build time; meter via AiUsageEvent(feature: DEFENSE_QA).
3. Mentor defense console: side-by-side question plan + live session embed + rubric quick-score; mentor can mark questions asked/answered.
4. Recording pipeline: Fermion recording webhook → VideoAsset → link DefenseSession.recordingVideoAssetId; optional transcription (Fermion AI transcription, $0.30/hr) → transcriptAssetId.
5. Verdict flow: mentor completes ProjectReview(kind: DEFENSE) with decision PASS/FAIL; RETRY path schedules a new DefenseSession (status RESCHEDULED lineage preserved).
6. Post-defense AI summary: draft defense summary from transcript for the mentor to edit (feeds issue #5 patterns).
7. Integrity hooks: no-show handling, impersonation suspicion → IntegrityFlag(subjectType: DEFENSE).
8. Gate ProjectInstance.PASSED on defense PASS when defenseRequired; flip defense-engine flag per tier rollout.

Acceptance criteria

• Capstone with defenseRequired cannot reach PASSED without a DEFENSE review decision=PASS
• AI question plan generated from actual submission content (not generic), stored and visible to mentor only
• Defense recorded; recording playable from the instance timeline; transcript attached when enabled
• RETRY verdict schedules a fresh session and preserves the failed attempt's record
• AiUsageEvents logged with token counts for every plan generation

Dependencies / sequencing

• MVP M10 (project engine) + M4 (Fermion live) required
• Feeds issue #2 (Flagship gate) and issue #20 (integrity suite)

Start by reading the existing DefenseSession, LiveSession, ProjectReview, VideoAsset, IntegrityFlag, and AiUsageEvent schema paths, then inspect src/lib/fermion and src/lib/ai/defense.ts plus the defense-engine flag. Trace the M10 project engine and M4 Fermion dependencies before splitting the scheduling, console, recording, verdict, and integrity flows. Done means all listed acceptance criteria pass, including the defense gate, recorded session, retry lineage, mentor-only questions, and usage metering.