@alphazede/bearing-lite 0.1.8 → 0.1.10

package/README.md

@@ -9,8 +9,9 @@ It ships portable skills, references, templates, and optional client hooks.
 
 An agent cannot certify its own work. The stateful Router owns the planning
 conversation and visible Journey state, then dispatches fresh bounded sessions.
-Independent assurance runs at the owner's selected cadence: per slice, per
-execution/correction round, or once at the end. Owner Authority remains human-only.
+Independent assurance runs once at the owner's selected boundary: after a
+slice, after an integrated round, or at the end. One repair may follow; it is
+verified deterministically without another review. Owner Authority remains human-only.
 
 Bearing Lite was created by William Rumph.
 
@@ -82,7 +83,7 @@ register hooks. That path remains first-class. See
 1. **Ask** whether the Journey is an Explorer Journey or an Expedition.
 2. **Fill only missing planning stages:** Repository Fit → Set Bearings → Gather
    Supplies → Map the Route.
-3. **Confirm** the user-owned primary/fallback lineup and review cadence.
+3. **Confirm** the user-owned primary/fallback lineup and single review boundary.
 4. **Dispatch fresh sessions** with bounded context, authority, and return types.
 5. **Record state visibly** in human-readable Markdown artifacts only.
 
@@ -114,10 +115,9 @@ Bearing Lite Router is the stateful planning controller, not a work role. It
 invokes only missing planning stages in fresh sessions, confirms the owner's
 lineup and cadence, then dispatches an Explorer Journey or Expedition. Explorer
 coordinates proven-independent in-wave lanes without a nested coordinator.
-Validator, Park Ranger,
-and Surveyor appear only when declared and when the selected per-slice,
-per-round, or at-end boundary is reached. Diagrams explain orientation; they
-never authorize a transition.
+Validator, Park Ranger, and Surveyor appear only when declared and when the
+single selected per-slice, per-round, or at-end boundary is reached. Diagrams
+explain orientation; they never authorize a transition.
 
 ## Roles and authority
 
@@ -155,60 +155,30 @@ Normal progress is `PROPOSED` → `READY` → `IN_PROGRESS` → `EVIDENCE_READY`
 optional `VALIDATING` / `REVIEWING` when required, then `ACCEPTANCE` →
 `COMPLETE`. `WAITING_ON` holds for missing prerequisites, checkout-lease
 conflict, or assurance dispatch.
-`CORRECTION_REQUIRED` allows two in-authority repairs; a third failed correction
-escalates to `OWNER_DECISION_REQUIRED`. Diagrams never create state or authorize
-transitions.
+Ordinary execution corrections remain bounded. The assurance gate allows one
+review-directed repair, followed by deterministic coordinator verification and
+no second review. Diagrams never create state or authorize transitions.
 
 ## Implementation process (explanatory)
 
-Owner-approved multi-phase work follows four phases: Inventory, Foundation,
-Proof and Documentation, and Final Audit. Default slice completion is author
-self-check plus coordinator confirmation when `required_assurance` is `none`.
-Fresh Validator then separate Park Ranger is mandatory only on exact integrated
-phase candidates, not on every packet.
-
-![Bearing Lite implementation process: four phases with default self-check slices, optional owner slice assurance, mandatory integrated phase gates, bounded correction, and final Surveyor acceptance](docs/plans/2026-08-09-bearing-skills-first-architecture/assets/implementation-process.png)
-
-Mermaid source:
-[`docs/plans/2026-08-09-bearing-skills-first-architecture/assets/implementation-process.mmd`](docs/plans/2026-08-09-bearing-skills-first-architecture/assets/implementation-process.mmd).
-
-<details>
-<summary>Diagram source (implementation process)</summary>
+Default packet completion is author self-check plus coordinator confirmation.
+Declared independent assurance runs once at the selected boundary. A repairable
+verdict permits one repair; deterministic coordinator verification then closes
+the gate without another review. Once the Journey is `COMPLETE`, an already
+authorized deployment proceeds with operational checks and rollback readiness,
+not a new assurance round. Source-changing deployment work is separate work.
 
 ```mermaid
-flowchart TD
-    P1[Phase 1 Inventory S1-S4 complete] --> P2[Phase 2 Foundation S4A-S7]
-    P2 --> SLICE[Crewmate then author self-check]
-    SLICE --> CC[Coordinator scope and dependency confirmation]
-    CC --> OPT{Owner slice assurance?}
-    OPT -->|Yes| V[Fresh Validator then optional Park Ranger]
-    OPT -->|No| MORE{More Foundation slices?}
-    V -->|Fail or repair| R[Bounded Correction Attempt]
-    V -->|Pass| MORE
-    R -->|Attempt 1 or 2| SLICE
-    R -->|3rd Failure| O[OWNER_DECISION_REQUIRED]
-    MORE -->|Yes| SLICE
-    MORE -->|No: integrated Foundation| FG[Fresh Validator then separate Park Ranger]
-    FG --> P3[Phase 3 Proof and Documentation S8-S10]
-    P3 --> SLICE3[Crewmate then author self-check]
-    SLICE3 --> CC3[Coordinator confirmation]
-    CC3 --> OPT3{Owner slice assurance?}
-    OPT3 -->|Yes| V3[Fresh Validator then optional Park Ranger]
-    OPT3 -->|No| MORE3{More Proof and Documentation slices?}
-    V3 -->|Fail or repair| R
-    V3 -->|Pass| MORE3
-    MORE3 -->|Yes| SLICE3
-    MORE3 -->|No: integrated Proof and Documentation| PG[Fresh Validator then separate Park Ranger]
-    PG --> P4[Phase 4 Final Audit S11-S12]
-    P4 --> S11[S11 Skill and State Alignment Audit]
-    S11 --> S12[S12 Integrated Acceptance]
-    S12 --> S[Fresh Surveyor Final Acceptance]
-    S -->|Pass| CMP[COMPLETE]
-    O -->|Owner Decision| MORE
+flowchart LR
+    W[Bounded work] --> C[Deterministic checks]
+    C --> R[Single independent review]
+    R -->|Pass| X[COMPLETE]
+    R -->|Repairable| F[One repair]
+    F --> V[Coordinator verification]
+    V --> X
+    X --> D[Authorized deploy and operational verification]
 ```
 
-</details>
-
 ## Package layout
 
 | Path | Purpose |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphazede/bearing-lite",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Skills-first Agent Plugin for planning, routing, bounded execution, and independent review of repository work—without CLI, MCP, server, or hidden runtime state.",
   "keywords": [
     "agent-plugins",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "bearing-lite",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Skills-first portable plugin that routes repository work through the smallest valid planning stages and agent roles, using project Markdown as the only task record.",
   "author": {
     "name": "William Rumph / AlphaZede",

package/skills/bearing-lite/SKILL.md

@@ -29,8 +29,8 @@ or hidden ledger. plugin hosts are partial; skill-copy is skills-only.
    and active/standby/unused state. Ask `Is this a
    good lineup for the roles on this Journey?`; never choose. Recommend cadence
    with a reason plus one cheaper and one more expensive alternative stating
-   what each gives up or buys. Ask `How often would you like an independent
-   review—per slice, per round, or at the end?`
+   what each gives up or buys. Ask `Where should the single independent
+   review run—after a slice, after an integrated round, or at the end?`
 7. Record route, lineup, and cadence before task mapping; if declined, record the named default explicitly.
    The recorded snapshot is authoritative for this Journey. Later edits to
    `~/.agents/bearing-lite/default-role-lineup.md` have no effect on it. Replace
@@ -38,10 +38,16 @@ or hidden ledger. plugin hosts are partial; skill-copy is skills-only.
 8. Every ready node gets a fresh session with lineup identity from the recorded snapshot.
 
 Return `READY`, `WAITING_ON`, `OWNER_DECISION_REQUIRED`, or `COMPLETE`. Fallback
-follows primary unavailability; both failing returns to owner.
-Allow three evidence-changing corrections. `max_assurance_rounds` is 3 per
-candidate lineage; Direct route checks `assurance_rounds`; Navigator is not required. At the
-bound return `OWNER_DECISION_REQUIRED` naming the candidate and count; new candidate lineage resets;
-release the checkout lease exactly once on `COMPLETE` or `CANCELLED`. Recover by
-explicit recorded generation increment that cannot steal a live lease. Process discovery
-cannot replace the lease. Never implement, self-assure, select models, or publish.
+requires primary unavailability; both failing returns to owner. Allow three
+evidence-changing corrections outside assurance. `max_assurance_rounds` is 1
+per Journey; the sole review may authorize one repair. Direct route checks
+`assurance_rounds`; Navigator is not required. After repair, run deterministic
+coordinator verification and close the gate without another review. Failed repair
+or scope change returns `OWNER_DECISION_REQUIRED` naming the candidate and count.
+Only a separately scoped new Journey resets the review allowance.
+`COMPLETE` ends Bearing assurance: authorized deployment keeps deployment checks
+and rollback readiness without reopening review. Candidate-changing deployment
+work starts a new Journey. release the checkout lease exactly once on `COMPLETE`
+or `CANCELLED`. Recover by explicit recorded generation increment; it cannot steal a live lease.
+Process discovery cannot replace the lease. Never implement,
+self-assure, select models, or publish.

package/skills/bearing-lite/references/task-state.md

@@ -27,7 +27,7 @@ The project's human-readable plan is the only task-state record. Diagrams explai
 - `IN_PROGRESS` → `EVIDENCE_READY` with candidate and handoff; → `CORRECTION_REQUIRED` on correctable failure; → `OWNER_DECISION_REQUIRED` on security, authority, or integrity guard.
 - `CORRECTION_REQUIRED` → `READY` on attempt 1 or 2 with a new hypothesis and evidence; → `OWNER_DECISION_REQUIRED` on the third failed correction or out-of-contract amendment.
 - `EVIDENCE_READY` → `VALIDATING` | `REVIEWING` | `ACCEPTANCE` for the next missing required role; → `WAITING_ON` if assurance dispatch is unavailable.
-- After accepted Validator or Park Ranger handoff, return to `EVIDENCE_READY` and select the next missing assurance role in declared order.
+- During the single assurance round, an accepted Validator or Park Ranger handoff returns to `EVIDENCE_READY` to select the next missing assurance role in declared order.
 - `VALIDATING` → `CORRECTION_REQUIRED` when more evidence or repair is needed; otherwise back through `EVIDENCE_READY` for remaining assurance.
 - `REVIEWING` → `CORRECTION_REQUIRED` | `EVIDENCE_READY` | `OWNER_DECISION_REQUIRED` by verdict.
 - `ACCEPTANCE` → `COMPLETE` when every required assurance accepted the same candidate; when `required_assurance` is `none`, parent-coordinator confirmation satisfies the assurance requirement; → `CORRECTION_REQUIRED` on acceptance gap.
@@ -40,6 +40,8 @@ The project's human-readable plan is the only task-state record. Diagrams explai
 - Workers and assurance roles return handoffs; they do not race plan edits.
 - Candidate authors never provide their own Validator, Park Ranger, or Surveyor verdict.
 - Waiting on a prerequisite consumes no correction attempt. Each task has its own three-attempt correction counter; identical retries without new evidence are invalid.
+- One Journey receives at most one assurance round and one review-directed repair. Replacement candidates do not reset the count. The coordinator verifies that repair deterministically and does not dispatch assurance again.
+- `COMPLETE` is terminal for Bearing assurance. An already authorized deployment keeps operational verification and rollback readiness but does not reopen review; candidate-changing deployment work requires separate scope.
 
 ## Checkout lease
 

package/skills/bearing-lite/templates/task.md

@@ -13,11 +13,12 @@ Record these plan-level choices once, above the task blocks:
 - lineup_snapshot: <named active, standby, and unused role instances>
 ```
 
-`review_cadence` controls independent review frequency, not task-level tests or
-author self-checks. Never infer it from `required_assurance` on an individual
-task. `per-round` means after each integrated execution or correction round;
-`at-end` means one review of the final integrated candidate. The Router asks the
-owner to confirm both the applicable lineup and cadence before implementation.
+`review_cadence` selects where the Journey's single independent review runs,
+not task-level tests or author self-checks. Never infer it from
+`required_assurance` on an individual task. `per-slice` and `per-round` select
+one declared boundary; `at-end` selects the final integrated candidate. The
+Router asks the owner to confirm both the applicable lineup and boundary before
+implementation.
 `lineup_snapshot` is authoritative for this Journey after recording. Later
 edits to `~/.agents/bearing-lite/default-role-lineup.md` have no effect.
 Replace it only through an explicit owner-confirmed dated visible amendment.
@@ -87,15 +88,17 @@ Field rules:
 ```markdown
 - candidate_ref: <strongest native revision or changed-path reference available>
 - evidence: <commands run, results observed, and inferences labeled separately>
-- assurance_rounds: <0-3 completed assurance rounds for this candidate lineage>
+- assurance_rounds: <0-1 completed assurance rounds for this Journey>
 ```
 
 `candidate_ref` must not claim stronger provenance than the client can prove.
-`assurance_rounds` counts each candidate version submitted to required assurance
-in one candidate lineage against Bearing Lite `max_assurance_rounds`. A repair
-of the same work stays in the lineage. A new candidate lineage resets the count
-to 0. The parent coordinator writes the count and checks it before redispatched
-assurance.
+`assurance_rounds` counts the Journey's single submission to required assurance
+against Bearing Lite `max_assurance_rounds`. A repair or replacement candidate
+does not reset it; only a separately scoped new Journey starts at 0. The parent
+coordinator writes the count before dispatch. If the review permits correction, spend at
+most one remaining `attempts` repair, run deterministic coordinator verification,
+and close the gate without another review. A failed repair or scope change
+returns `OWNER_DECISION_REQUIRED`.
 
 ## Waiting or correcting only
 
@@ -106,6 +109,10 @@ assurance.
 
 Omit `blocker` and `attempts` when the task is not waiting or correcting. Waiting does not consume correction attempts.
 
+`COMPLETE` ends Bearing assurance. An already authorized deployment keeps its
+own operational checks and rollback evidence but does not reopen independent
+review. Any source or candidate change during deployment is separately scoped.
+
 ## Single-writer reminder
 
 Only the parent coordinator updates this block after rereading it. Crewmate, Validator, Park Ranger, and Surveyor return handoffs; the coordinator records transitions. Navigator alone changes cross-wave dependencies or global sequencing.

package/skills/explorer/SKILL.md

@@ -40,13 +40,15 @@ Wave authority. Coordinates more and implements less than Crewmate.
 3. Give every node a fresh bounded session. Never pass raw conversation history.
 4. Inspect returns against write sets and acceptance; integrate evidence without
    implementing missing packet work.
-5. Dispatch declared assurance at `per-slice` or after each integrated execution
-   or correction round at `per-round`. At `at-end`, an Explorer Journey reviews
-   its final wave once; an Expedition wave defers assurance to the Navigator's
-   final Journey boundary. Deterministic checks always run. Before redispatched
-   assurance, honor `max_assurance_rounds` from visible `assurance_rounds`. At
-   the bound, return `OWNER_DECISION_REQUIRED` with candidate and count; do not
-   dispatch another repair or review. A new candidate lineage resets the count.
+5. Dispatch declared assurance once at the owner-confirmed `per-slice`,
+   `per-round`, or `at-end` boundary. At `at-end`, an Explorer Journey reviews
+   its final wave; an Expedition wave defers assurance to the Navigator's final
+   Journey boundary. Deterministic checks always run. Honor
+   `max_assurance_rounds` of 1 from visible `assurance_rounds`. If the review is
+   repairable, spend at most one remaining `attempts` repair, run deterministic
+   coordinator verification, and close the gate without another review. A failed
+   repair or scope change returns `OWNER_DECISION_REQUIRED` with candidate and
+   count. After Journey `COMPLETE`, deployment checks do not reopen assurance.
 
 ## Return and recovery
 

package/skills/navigator/SKILL.md

@@ -38,12 +38,13 @@ Highest execution authority below Router; performs the least hands-on execution.
    here; never add a nested multi-wave controller.
 3. Integrate typed wave returns and correct only sequencing/coverage gaps inside
    approved authority; never perform implementation.
-4. Dispatch independent assurance at the confirmed cadence: every slice, every
-   integrated execution/correction round, or only the final integrated outcome.
-   Before redispatched assurance, honor `max_assurance_rounds` from visible
-   `assurance_rounds`. At the bound, return `OWNER_DECISION_REQUIRED` with
-   candidate and count; do not dispatch another repair or review. A new
-   candidate lineage resets the count.
+4. Dispatch independent assurance once at the confirmed `per-slice`,
+   `per-round`, or final integrated boundary. Honor `max_assurance_rounds` of 1
+   from visible `assurance_rounds`. If the review is repairable, spend at most
+   one remaining `attempts` repair, run deterministic coordinator verification,
+   and close the gate without another review. A failed repair or scope change
+   returns `OWNER_DECISION_REQUIRED` with candidate and count. After Journey
+   `COMPLETE`, deployment checks do not reopen assurance.
 5. Return to the Router after the bounded Expedition outcome; do not silently
    continue into another Journey or protected action.
 

package/skills/park-ranger/SKILL.md

@@ -37,7 +37,9 @@ candidate ref, findings, evidence, verdict, blocker, next action, and receiver.
 `ACCEPT`, `ACCEPT_WITH_FINDINGS`, and `BLOCK` are terminal. `REPAIR_REQUIRED`
 permits bounded correction. `ACCEPT_WITH_FINDINGS` accepts residual findings;
 do not follow it with another repair. Coordinators enforce
-`max_assurance_rounds`. Review again only after candidate-changing repairs
-when rounds remain.
+`max_assurance_rounds` of 1. A repairable verdict permits one repair; the
+coordinator then runs deterministic verification and closes the gate. Do not
+review or repair that Journey again. A failed repair or scope change
+returns to Owner Authority.
 
 Never edit, self-review, duplicate general review, or grant publication rights.

package/skills/surveyor/SKILL.md

@@ -35,6 +35,7 @@ Independent outcome assurance, outside the mutation-authority ladder.
 
 Return `ACCEPT`, `GAPS`, or `OWNER_DECISION_REQUIRED` with candidate ref,
 requirement coverage, evidence, gaps, blocker, next action, and receiver.
-Reassess only a new integrated candidate, at most three rounds.
+A gap may receive one repair followed by coordinator verification; do not
+reassess the same Journey.
 
 Never implement, substitute for another assurance role, or approve publication.

package/skills/validator/SKILL.md

@@ -35,8 +35,8 @@ Independent assurance responsibility, outside the mutation-authority ladder.
 Return `PASS`, `NEEDS_MORE_EVIDENCE`, or `FAIL` with candidate ref, criteria,
 evidence, findings, blocker, next action, and receiver. `PASS` is terminal.
 `NEEDS_MORE_EVIDENCE` and `FAIL` permit bounded correction. Coordinators
-enforce `max_assurance_rounds`; this role does not redispatch. Re-evaluate only
-a new candidate or materially new evidence.
+enforce `max_assurance_rounds` of 1; this role does not redispatch or re-evaluate
+the Journey's repair. The coordinator verifies it deterministically.
 
 Never implement, repeat unchanged review, replace Park Ranger/Surveyor, or
 grant owner-only approval.