Model-produced annotations: provenance and confidence surfaced in the review loop

[JArmandoAnaya]

Why

Split out of #81 by the 2026-08-07 design session. This is the concrete 0.1.0 piece: the
substrate for model-produced annotations is complete end to end, and no surface reads it.
A reviewer accepting a predicted box today cannot tell it from a drawn one, which makes
"accept" an uninformed act on exactly the annotations that most need judgement.

What exists at HEAD (verified at 904b37a)

• Domain — Annotation carries provenance (human | model | import), model_ref
  and confidence (src/visionset/kernel/domain/annotation.py:45-47), with
  provenance='model' requiring a model_ref, enforced by a validator (:69-71).
• Wire — all three ship on AnnotationOut (src/visionset/server/models.py:1191-1193)
  and on both write models (:1112-1114, :1153-1155). There is no wire gap; the
  additive-exposure contingency this issue was drafted with does not apply.
• Annotator types — mirrored on Annotation at
  frontend/annotator/src/core/types.ts:143-145, and on both projections (:173-175,
  :189-191); parsed and range-checked in core/wire.ts.
• The review round-trip is first-class — the annotator offers annotated → review_pending,
  the review-side moves exist, and the gallery filters by state.
• MCP agents write annotations natively, so model-produced labels can already arrive.
• Nothing displays any of it. A provenance|confidence sweep over frontend/ui-core/src
  and frontend/app/src returns one demo fixture (app/src/demo/benchScene.ts) and nothing
  else.

Scope

1. Model-produced annotations are visually distinct wherever annotations render — the
   annotations side-panel rows and the canvas selection label at minimum. A badge or style
   drawn from DESIGN.md tokens, and never colour alone: class colours are user data, so
   colour is already spoken for, and colour alone is not an accessible distinction in any case.
2. Confidence displays where present. confidence is float | None, and null is an
   ordinary answer — every human-drawn label has one. Absent must read as absent, never as
   zero and never as low.
3. The review surface becomes confidence-aware — the gallery/review flow can sort or filter
   by confidence, so human attention lands where the model doubted rather than in asset order.

Out of scope

• Any model execution, and any ModelProvider adapter — cf. #418.
• Importers and the import provenance value — cf. #411, 0.2.0's external-dataset import.
• Any wire or domain change. Both already carry these fields; if implementation finds one that
  does not, that is a finding to report, not a field to add here.

Acceptance criteria

• A model-produced annotation is identifiable at a glance in the annotations panel and on
  the canvas, by something other than colour alone
• Confidence renders where present and reads as absent where null
• The review flow can order or narrow by confidence
• No wire or domain change was needed to do it

[JArmandoAnaya]

Data point from the #418 Phase 0 spike, relevant to confidence rendering: Grounding DINO
zero-shot scores ranged 0.37–0.78 on an easy off-domain sample — model-provenance
annotations will routinely carry mid-range confidence values, not clustered near 1.0.
The confidence UI should be designed for that distribution. cf. #418.