@alphazede/bearing-lite 0.1.9 → 0.1.11

package/skills/bearing-lite/SKILL.md

@@ -3,47 +3,44 @@ name: bearing-lite
 description: Bearing Lite Router for Journeys. Not for ordinary work, assigned packets, implementation, or publication.
 ---
 
-The Router alone writes Journey planning state and owns owner conversation;
-planning nodes return owner questions. No second start confirmation, `.bearing`,
-or hidden ledger. plugin hosts are partial; skill-copy is skills-only.
+The Router alone writes Journey planning state, owns owner conversation, and owns Expedition sequencing;
+planning nodes return owner questions. Plugin hosts are partial; skill-copy is skills-only.
 
-1. Say `Preparing this Journey.` Inventory visible nonterminal Journeys; acquire or
-   resume a generation-bound checkout lease before any planning write or dispatch.
-   A live same-checkout competitor returns `WAITING_ON` with sanitized competing identity;
-   Distinct explicitly approved compatible worktrees may proceed.
-2. New Journey: recommend Explorer Journey or Expedition with reason; say when
-   the other fits. Ask exactly: `What Journey shall
-   we Embark on—an Explorer Journey or an Expedition?`
-3. On resume, keep the same lease generation and next incomplete stage. Parent-proven
-   same-Journey progress refreshes `candidate_revision` on that generation.
-   Never replay accepted stages or duplicate a dispatch.
-4. If `~/.agents/bearing-lite/default-role-lineup.md` is absent, create a
-   proposed copy from `templates/default-role-lineup.md`; confirm one role at a
-   time. Never infer identity values.
-5. Run one missing stage in order: Repository Fit → Set Bearings → Gather
-   Supplies. The Router holds every owner conversation inline; Gather Supplies
-   is a Router-led interview, never dispatched. Dispatch a fresh session only
-   for bounded mechanical legwork (mapping, drafting) after stage intent is
-   clear, on a cheaper lower-reasoning model than the Router; integrate returns.
-6. Before Map the Route, display each role's primary/fallback, model, reasoning,
-   and active/standby/unused state. Ask `Is this a
-   good lineup for the roles on this Journey?`; never choose. Recommend cadence
-   with a reason plus one cheaper and one more expensive alternative stating
-   what each gives up or buys. Ask `How often would you like an independent
-   review—per slice, per round, or at the end?`
-7. Record route, lineup, and cadence before task mapping; if declined, record the named default explicitly.
-   The recorded snapshot is authoritative for this Journey. Later edits to
-   `~/.agents/bearing-lite/default-role-lineup.md` have no effect on it. Replace
-   only through an explicit owner-confirmed dated visible amendment. Invoke Map the Route with the snapshot.
-8. Every ready node gets a fresh session with lineup identity from the recorded snapshot.
+1. Say `Preparing this Journey.` Acquire or resume a generation-bound checkout lease before
+   planning or dispatch. A live same-checkout competitor returns `WAITING_ON` with sanitized identity.
+2. Resume the next incomplete stage in the same generation; refresh `candidate_revision`.
+   Never replay accepted stages or duplicate dispatch. Invalid leases fail closed.
+3. If `~/.agents/bearing-lite/default-role-lineup.md` is absent, create a proposed copy
+   from `templates/default-role-lineup.md`;
+   never infer identity values. The recorded snapshot is authoritative for this Journey.
+   Later edits to
+   `~/.agents/bearing-lite/default-role-lineup.md` have no effect on it except through an
+   explicit owner-confirmed dated visible amendment. Dispatch uses lineup identity from the recorded snapshot.
+4. Run Repository Fit → Set Bearings → Gather Supplies; unresolved material intent blocks Map the Route.
+5. Invoke Map the Route after settled intent. Do not ask for lineup or route
+   before it; carry owner-supplied lineup and `review_cadence: at-end` as proposals.
+6. On `PLAN_REVIEW_READY`, enforce `references/review-policy.md`: one candidate,
+   unique independent slots, one round and aggregated repair, deterministic PASS,
+   no rereview. Journey snapshots bind slots; validation never dispatches. Show one integrated
+   approval-or-change gate for outcome, design, route, lineup, role states,
+   reasoning, cadence, and plan. Record the approved Journey type and snapshot; regenerate changes.
+   Never add a staged lineup or route-review gate.
+   Dispatch only after approval.
+7. Dispatch from the snapshot. Crewmate and Explorer may continue in-wave unchanged.
+   Validate the lease at wave start, after drift, and before commit; use the visible wave receipt
+   and update implementation and review once per wave.
 
-Return `READY`, `WAITING_ON`, `OWNER_DECISION_REQUIRED`, or `COMPLETE`. Fallback
-follows primary unavailability; both failing returns to owner.
-Allow three evidence-changing corrections. `max_assurance_rounds` is 3 per
-candidate lineage; Direct route checks `assurance_rounds`; Navigator is not required. At the
-bound, do not dispatch another review. If a repairable result has a remaining
-`attempts` repair, spend it and close the gate; otherwise return
-`OWNER_DECISION_REQUIRED` naming the candidate and count; new candidate lineage resets;
-release the checkout lease exactly once on `COMPLETE` or `CANCELLED`. Recover by
-explicit recorded generation increment that cannot steal a live lease. Process discovery
-cannot replace the lease. Never implement, self-assure, select models, or publish.
+Return `READY`, `WAITING_ON`, `OWNER_DECISION_REQUIRED`, or `COMPLETE`. Three
+evidence-changing corrections outside assurance.
+`max_assurance_rounds` is 1 per Journey; Direct route checks `assurance_rounds`, never
+dispatch Navigator, and one review may authorize one repair. Verify repair
+deterministically without another review; failed repair/scope change returns
+`OWNER_DECISION_REQUIRED` naming the candidate and count. Only a separately scoped,
+materially changed new Journey resets review allowance. `COMPLETE` ends Bearing assurance.
+Authorized deployment keeps checks without reopening review.
+Planning review is a separate pre-dispatch gate; it never consumes implementation
+`required_assurance`, `assurance_rounds`, or `max_assurance_rounds`.
+Release the lease once: release the checkout lease exactly once on `COMPLETE` or `CANCELLED`;
+recovery needs explicit recorded generation increment.
+Recovery cannot steal a live lease.
+Never implement, self-assure, select models, or publish.

package/skills/bearing-lite/agents/openai.yaml

@@ -1,7 +1,7 @@
 interface:
   display_name: "Bearing Lite"
   short_description: "Route a stateful repository Journey"
-  default_prompt: "Use $bearing-lite to start or resume this Journey, resolve planning one stage at a time, confirm the lineup and review cadence, then dispatch fresh bounded sessions."
+  default_prompt: "Use $bearing-lite to start or resume this Journey, resolve planning one stage at a time, confirm the lineup, record at-end review, then dispatch bounded sessions."
 
 policy:
   allow_implicit_invocation: false

package/skills/bearing-lite/references/peer-synthesis.md

@@ -11,7 +11,7 @@ copy peer text, runtimes, state stores, or authority assumptions.
 | Set Bearings | [Kiro steering](https://kiro.dev/docs/steering/) | durable human-readable workspace context |
 | Gather Supplies | [Matt Pocock grilling](https://github.com/mattpocock/skills/blob/main/skills/productivity/grilling/SKILL.md) | relentless dependency-ordered interview, one recommended question at a time |
 | Map the Route | [Kiro Quick Spec](https://kiro.dev/docs/specs/quick-spec/) and [GitHub Spec Kit](https://github.com/github/spec-kit/blob/main/workflows/speckit/workflow.yml) | staged requirements/design/tasks and explicit gates |
-| Navigator | LangChain subagents | central sequencing, context isolation, and conflict-aware wave integration |
+| Navigator | compatibility diagnostic | unused on new Journeys; Router owns sequencing |
 | Explorer | LangChain subagents | bounded worker dispatch, proven-independent lane coordination, and result integration |
 | Crewmate | Spec Kit implement step | bounded execution after approved planning |
 | Validator | Spec Kit gate | evidence gate on a stable candidate |

package/skills/bearing-lite/references/review-policy.md

@@ -0,0 +1,37 @@
+# Planning review policy
+
+This machine-readable block is the single declarative authority for
+planning-review constraints. `hooks/planning-review.cjs` exports its runtime
+mirror; focused tests require an exact match. Changing these bounds needs
+an explicit owner amendment. This policy records no route, provider, model,
+harness, account, or agent identity.
+
+```json
+{
+  "reviewer_slots_min": 2,
+  "reviewer_slots_max": 2,
+  "independence_required": true,
+  "isolated_findings_until_aggregation": true,
+  "candidate_fields": ["candidate_ref", "candidate_revision", "candidate_digest"],
+  "shared_candidate_required": true,
+  "review_rounds": 1,
+  "aggregated_repairs_max": 1,
+  "post_repair_gate": "deterministic_PASS",
+  "automatic_rereview": "prohibited",
+  "slot_exhaustion_outcome": "FAIL_ROUND",
+  "terminal_outcomes": ["HALT", "OWNER_AMENDMENT_REQUIRED"]
+}
+```
+
+Map the Route writes the separate Journey binding in the approved lineup
+snapshot. It lists unique abstract `slot_id` values, each slot's owner-selected
+`primary_route_ref`, and ordered `fallback_route_refs`. Each receipt records a
+distinct selected route from its slot. All receipts bind to the same non-empty
+candidate ref, revision, and digest. Exhausting any slot
+returns `FAIL_ROUND`. Candidate or independence mismatch, a second round or
+repair, or a missing deterministic PASS after repair returns `HALT`. Automatic
+confirmation or rereview returns `OWNER_AMENDMENT_REQUIRED`.
+
+This gate reviews planning artifacts before dispatch. It never invokes a
+reviewer. Implementation assurance remains governed separately by
+`max_assurance_rounds` and task `required_assurance` / `assurance_rounds`.

package/skills/bearing-lite/references/role-routing.mmd

@@ -1,21 +1,21 @@
 flowchart TD
     O[Owner Authority] <--> R[Stateful Bearing Lite Router]
-    R --> J{Explorer Journey or Expedition?}
     R --> P{Next missing planning stage?}
     P -->|Repository Fit| PF[Fresh Repository Fit]
     P -->|Set Bearings| SB[Fresh Set Bearings]
     P -->|Gather Supplies| GS[Fresh Gather Supplies]
     P -->|Map the Route| MR[Fresh Map the Route]
-    PF & SB & GS & MR -->|typed return| R
-    R --> L[Owner confirms lineup and review cadence]
-    J -->|Explorer Journey: one packet| C[Fresh Crewmate]
-    J -->|Explorer Journey: one wave| E[Fresh Explorer]
-    J -->|Expedition| N[Fresh Navigator]
-    N --> E
+    PF & SB & GS -->|typed return| R
+    R --> MR
+    MR -->|five artifacts with proposed route, lineup, role states, reasoning, cadence| I{One integrated owner review}
+    I -->|change| MR
+    I -->|approve Explorer Journey: one packet| C[Crewmate may continue in-wave]
+    I -->|approve Explorer Journey: one wave| E[Explorer may continue in-wave]
+    I -->|approve Expedition: Router sequences waves| E
     E --> C
-    C --> A{Selected cadence boundary?}
+    C --> A{Final integrated candidate at-end?}
     A -->|Validator declared| V[Fresh Validator]
     A -->|Park Ranger declared| PK[Fresh Park Ranger]
     A -->|Surveyor declared| S[Fresh Surveyor]
     A -->|not yet| E
-    V & PK & S -->|typed verdict| R
+    V & PK & S -->|compact receipt| R

package/skills/bearing-lite/references/task-state.md

@@ -14,7 +14,7 @@ The project's human-readable plan is the only task-state record. Diagrams explai
 | `VALIDATING` | Validator | Evidence sufficiency under validation |
 | `REVIEWING` | Park Ranger when required | Independent defect review active |
 | `ACCEPTANCE` | Surveyor, Owner Authority, or parent coordinator when `required_assurance` is `none` | User-facing acceptance or coordinator completion confirmation is active |
-| `CORRECTION_REQUIRED` | Navigator or nearest parent coordinator | Agent-owned in-authority correction required |
+| `CORRECTION_REQUIRED` | Router or nearest parent coordinator | Agent-owned in-authority correction required |
 | `OWNER_DECISION_REQUIRED` | Owner Authority | Authority, scope, security, or replacement-path judgment required |
 | `COMPLETE` | Parent coordinator after assurance | Outcome and required assurance satisfied |
 | `CANCELLED` | Owner Authority or authorized parent | Task will not proceed |
@@ -27,7 +27,7 @@ The project's human-readable plan is the only task-state record. Diagrams explai
 - `IN_PROGRESS` → `EVIDENCE_READY` with candidate and handoff; → `CORRECTION_REQUIRED` on correctable failure; → `OWNER_DECISION_REQUIRED` on security, authority, or integrity guard.
 - `CORRECTION_REQUIRED` → `READY` on attempt 1 or 2 with a new hypothesis and evidence; → `OWNER_DECISION_REQUIRED` on the third failed correction or out-of-contract amendment.
 - `EVIDENCE_READY` → `VALIDATING` | `REVIEWING` | `ACCEPTANCE` for the next missing required role; → `WAITING_ON` if assurance dispatch is unavailable.
-- After accepted Validator or Park Ranger handoff, return to `EVIDENCE_READY` and select the next missing assurance role in declared order.
+- During the single assurance round, an accepted Validator or Park Ranger handoff returns to `EVIDENCE_READY` to select the next missing assurance role in declared order.
 - `VALIDATING` → `CORRECTION_REQUIRED` when more evidence or repair is needed; otherwise back through `EVIDENCE_READY` for remaining assurance.
 - `REVIEWING` → `CORRECTION_REQUIRED` | `EVIDENCE_READY` | `OWNER_DECISION_REQUIRED` by verdict.
 - `ACCEPTANCE` → `COMPLETE` when every required assurance accepted the same candidate; when `required_assurance` is `none`, parent-coordinator confirmation satisfies the assurance requirement; → `CORRECTION_REQUIRED` on acceptance gap.
@@ -36,10 +36,12 @@ The project's human-readable plan is the only task-state record. Diagrams explai
 ## Ownership rules
 
 - One parent coordinator writes each task block and its transitions.
-- Navigator alone writes cross-wave dependencies and Expedition-wide sequencing.
+- Router alone writes cross-wave dependencies and Expedition-wide sequencing.
 - Workers and assurance roles return handoffs; they do not race plan edits.
 - Candidate authors never provide their own Validator, Park Ranger, or Surveyor verdict.
 - Waiting on a prerequisite consumes no correction attempt. Each task has its own three-attempt correction counter; identical retries without new evidence are invalid.
+- One Journey receives at most one assurance round and one review-directed repair. Replacement candidates do not reset the count. The coordinator verifies that repair deterministically and does not dispatch assurance again.
+- `COMPLETE` is terminal for Bearing assurance. An already authorized deployment keeps operational verification and rollback readiness but does not reopen review; candidate-changing deployment work requires separate scope.
 
 ## Checkout lease
 

package/skills/bearing-lite/templates/default-role-lineup.md

@@ -6,12 +6,11 @@ implementation and asks whether it is good for the current Journey. Never fill
 agent, model, or reasoning values on the user's behalf.
 
 ```markdown
-review_cadence: <per-slice | per-round | at-end>
+review_cadence: at-end
 
 | Role | Primary agent/harness | Primary model | Primary reasoning | Fallback agent/harness | Fallback model | Fallback reasoning |
 | --- | --- | --- | --- | --- | --- | --- |
 | Router | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET |
-| Navigator | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET |
 | Explorer | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET |
 | Crewmate | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET |
 | Validator | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET |
@@ -19,6 +18,9 @@ review_cadence: <per-slice | per-round | at-end>
 | Surveyor | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET | OWNER_TO_SET |
 ```
 
+Navigator is not a normal lineup role. Existing plans that still assign it use
+the Navigator compatibility diagnostic; treat the assignment as unused.
+
 Journey artifacts copy the confirmed values and mark named instances active,
 standby, or unused. Only verified primary unavailability activates its approved
 fallback. If both are unavailable, return `OWNER_DECISION_REQUIRED`.

package/skills/bearing-lite/templates/task.md

@@ -2,28 +2,53 @@
 
 Use one compact Markdown block per task in the project's existing plan or progress document. Omit unused conditional fields. Prefer the project's format; add only missing fields. Do not create a Bearing-owned state file or hidden ledger.
 
-## Journey settings (record before task mapping)
+## Journey settings
 
-Record these plan-level choices once, above the task blocks:
+Map the Route records these plan-level proposals above the task blocks in the
+complete five-artifact package. The integrated owner review approves or changes
+the journey, lineup, role states, reasoning, cadence, and plan together; no
+pre-Map lineup or route-review gate is allowed.
 
 ```markdown
 - journey: <Explorer Journey | Expedition>
-- review_cadence: <per-slice | per-round | at-end>
-- choice_basis: <owner-confirmed recommendation and reason>
-- lineup_snapshot: <named active, standby, and unused role instances>
+- review_cadence: at-end
+- choice_basis: <proposed recommendation and reason; owner-approved at integrated review>
+- lineup_snapshot: <named implementation/assurance instances plus the planning_review binding below>
+- planning_review:
+  - policy_ref: skills/bearing-lite/references/review-policy.md
+  - candidate_ref: <shared planning-package reference>
+  - candidate_revision: <shared planning-package revision>
+  - candidate_digest: <shared planning-package digest>
+  - reviewer_slots:
+    - slot_id: <abstract unique slot>
+      primary_route_ref: <owner-selected lineup route reference>
+      fallback_route_refs: [<ordered owner-selected route references>]
+  - round_number: 1
+  - completed_rounds: <0-1>
+  - receipts: <one isolated receipt per slot, including the distinct selected_route_ref>
+  - aggregated_repairs: <0-1>
+  - deterministic_gate: <PASS after repair; otherwise omitted>
 ```
 
-`review_cadence` controls independent review frequency, not task-level tests or
-author self-checks. Never infer it from `required_assurance` on an individual
-task. `per-round` means after each integrated execution or correction round;
-`at-end` means one review of the final integrated candidate. The Router asks the
-owner to confirm both the applicable lineup and cadence before implementation.
-`lineup_snapshot` is authoritative for this Journey after recording. Later
+`review_cadence` is `at-end` only. The single independent review runs on the
+final integrated candidate, not at a slice or round boundary, and not as
+task-level tests or author self-checks. Never infer it from
+`required_assurance` on an individual task. The proposal is visible in
+`implementation.md` and `review.html`, then becomes authoritative only after
+the integrated owner approval; do not offer `per-slice` or `per-round`.
+`journey` stays a proposal until the mapped implementation graph exists and the
+integrated owner review approves it. `lineup_snapshot` is authoritative after
+that approval. Later
 edits to `~/.agents/bearing-lite/default-role-lineup.md` have no effect.
 Replace it only through an explicit owner-confirmed dated visible amendment.
 Record the amendment date beside the replacement values. Dispatch identities
 come from this snapshot, not from the current global defaults file.
 
+Every configured planning-review slot uses the same candidate ref, revision,
+and digest. Findings stay isolated until one aggregation. Slot exhaustion is
+`FAIL_ROUND`; policy violations halt or require an owner amendment. The binding
+does not populate `required_assurance` and does not dispatch reviewers.
+
 ## Checkout lease (record before any planning write)
 
 The Router's first write is this visible lease. Inventory nonterminal Journeys
@@ -52,6 +77,26 @@ same generation. `COMPLETE` or `CANCELLED` releases the lease exactly
 once. Stale recovery is explicit, recorded, increments generation, and cannot
 steal a live lease. Process discovery cannot replace this durable lease.
 
+## Wave receipt (record at wave start)
+
+Continuations reuse this visible record beside the checkout lease. Validate at
+wave start, after detected drift, and before commit — not before every
+mutation. Resume from it; do not reread every accepted artifact or redispatch
+completed slices.
+
+```markdown
+- wave_receipt:
+  - wave: <wave id>
+  - lease_generation: <generation>
+  - branch: <branch>
+  - candidate_revision: <revision at last check>
+  - authority: <envelope>
+  - checked_at: <wave_start | external_change | commit>
+```
+
+Stale, forged, or drifted receipts fail closed. Changed HEAD, authority,
+generation, route, or writer overlap forces revalidation or a fresh session.
+
 ## Always present
 
 ```markdown
@@ -66,7 +111,7 @@ steal a live lease. Process discovery cannot replace this durable lease.
 Field rules:
 
 - `task_id` — stable identifier unique within the plan.
-- `outcome` — approved intent for this task only.
+- `outcome` — approved intent for this task only. Never a role-return token and never copied into `verdict`.
 - `status` — one of `PROPOSED`, `READY`, `WAITING_ON`, `IN_PROGRESS`, `EVIDENCE_READY`, `VALIDATING`, `REVIEWING`, `ACCEPTANCE`, `CORRECTION_REQUIRED`, `OWNER_DECISION_REQUIRED`, `COMPLETE`, `CANCELLED`.
 - `assigned_role` — current role contract for the active step, or unassigned while proposing.
 - `depends_on` — list of other `task_id` values only, never prose.
@@ -86,19 +131,22 @@ Field rules:
 
 ```markdown
 - candidate_ref: <strongest native revision or changed-path reference available>
-- evidence: <commands run, results observed, and inferences labeled separately>
-- assurance_rounds: <0-3 completed assurance rounds for this candidate lineage>
+- changed_paths: <paths changed in this candidate>
+- tests: <commands run and observed results>
+- findings: <labeled inferences and gaps>
+- verdict: <closed role-return token>
+- assurance_rounds: <0-1 completed assurance rounds for this Journey>
 ```
 
+`verdict` is one of `ACCEPT`, `ACCEPT_WITH_FINDINGS`, `BLOCK`, `CANDIDATE_READY`, `FAIL`, `GAPS`, `NEEDS_MORE_EVIDENCE`, `OWNER_DECISION_REQUIRED`, `PARTIAL`, `PASS`, `READY`, `REPAIR_REQUIRED`, `REROUTED`, `WAITING_ON`. Do not copy task `outcome` into `verdict`.
 `candidate_ref` must not claim stronger provenance than the client can prove.
-`assurance_rounds` counts each candidate version submitted to required assurance
-in one candidate lineage against Bearing Lite `max_assurance_rounds`. A repair
-of the same work stays in the lineage. A new candidate lineage resets the count
-to 0. The parent coordinator writes the count and checks it before redispatched
-assurance. Review and repair rounds are separate budgets, and the cycle ends on
-a repair: `assurance_rounds` counts reviews while `attempts` counts repairs.
-When the last review permits a remaining repair, spend it and close the gate
-without another review.
+`assurance_rounds` counts the Journey's single submission to required assurance
+against Bearing Lite `max_assurance_rounds`. A repair or replacement candidate
+does not reset it; only a separately scoped, materially changed new Journey starts at 0, and a new Journey is not a way around the bound. The parent
+coordinator writes the count before dispatch. If the review permits correction, spend at
+most one remaining `attempts` repair, run deterministic coordinator verification,
+and close the gate without another review. A failed repair or scope change
+returns `OWNER_DECISION_REQUIRED`.
 
 ## Waiting or correcting only
 
@@ -109,6 +157,10 @@ without another review.
 
 Omit `blocker` and `attempts` when the task is not waiting or correcting. Waiting does not consume correction attempts.
 
+`COMPLETE` ends Bearing assurance. An already authorized deployment keeps its
+own operational checks and rollback evidence but does not reopen independent
+review. Any source or candidate change during deployment is separately scoped.
+
 ## Single-writer reminder
 
-Only the parent coordinator updates this block after rereading it. Crewmate, Validator, Park Ranger, and Surveyor return handoffs; the coordinator records transitions. Navigator alone changes cross-wave dependencies or global sequencing.
+Only the parent coordinator updates this block after rereading it. Crewmate, Validator, Park Ranger, and Surveyor return compact receipts (`verdict`, `candidate_ref`, `changed_paths`, `tests`, `findings`, `blocker`); the coordinator records transitions. Router alone changes cross-wave dependencies or global sequencing. Update `implementation.md` and `review.html` once per wave, plus owner-decision or blocker changes.

package/skills/crewmate/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: crewmate
 description: >
-  Implement one approved bounded packet in a fresh session and exact write set.
-  Use for Crewmate, implementation, repair, or integration packets. Do not use
-  for orchestration, planning, independent assurance, publication, destructive
-  action, owner decisions, or unset scope.
+  Implement one approved bounded packet in an exact write set. Continue the
+  same-wave session when identity, authority, route, and generation are
+  unchanged. Use for Crewmate, implementation, repair, or integration packets.
+  Do not use for orchestration, planning, independent assurance, publication,
+  destructive action, owner decisions, or unset scope.
 ---
 
 # Crewmate
@@ -14,36 +15,41 @@ Lowest mutation authority and highest hands-on work in the Bearing ladder.
 ## Inputs and match
 
 - **Inputs:** approved baseline, objective, dependencies, exact write set,
-  authority, acceptance/SEIT rows, commands, cadence, stop rule, return schema,
-  and lineup identity from the recorded Journey snapshot.
+  authority, acceptance/SEIT rows, commands, stop rule, compact return schema,
+  visible wave receipt, and lineup identity from the recorded Journey snapshot.
 - **Match:** one packet is `READY` and every input is fixed.
 - **Non-match:** multi-packet coordination, design gaps, missing authority,
   assurance, or owner-only action.
 
 ## Algorithm
 
-1. Start a fresh session and confirm candidate continuity, boundaries, and clean
-   dependency state. Do not infer missing owner choices. Read dispatch
-   identities only from the recorded Journey snapshot, never from the current
-   global defaults file. Revalidate the visible checkout
+1. Continue the current session when repository, worktree, branch, wave
+   generation, authority, and route are unchanged. Start a fresh session only
+   for a route change, conflicting writer, new authority envelope, independent
+   work, or explicit owner choice. Do not infer missing owner choices. Read
+   dispatch identities only from the recorded Journey snapshot, never from the
+   current global defaults file. Revalidate the visible checkout
    lease against the approved Journey, repository, checkout/worktree, branch,
-   candidate revision, generation, and active state before the first write and
-   every mutation. Released, stale-generation, forged, or
+   candidate revision, generation, and active state at wave start, after
+   detected drift, and before commit. Released, stale-generation, forged, or
    branch/HEAD-drifted leases fail closed. Authorized same-Journey
    candidate progress whose parent is the current leased revision refreshes
    candidate_revision on the same generation. On mismatch, return WAITING_ON without writing.
 2. For a verified contract defect, create the smallest failing regression first.
 3. Make the smallest change that satisfies the packet inside the write set.
-4. Run assigned focused commands and author self-checks. Review cadence never
+   When the packet implements a published standard, verify against the cited
+   document and clause before changing code; neighbouring behavior is not the
+   authority.
+4. Run assigned focused commands and author self-checks. At-end review never
    removes deterministic testing or grants independent-review identity.
-5. Preserve unrelated work and report every changed path and observed result.
+5. Preserve unrelated work. Return only the compact receipt.
 6. Stop on acceptance, authority boundary, design gap, or exhausted correction.
 
 ## Return and recovery
 
 Return `CANDIDATE_READY`, `PARTIAL`, `WAITING_ON`, or
-`OWNER_DECISION_REQUIRED` with plan ref, role, subject, dependencies, scope,
-authority, candidate ref, evidence, blocker, next action, and receiving role.
-Attempts 1–3 require new evidence, hypothesis, or narrower strategy.
+`OWNER_DECISION_REQUIRED` with verdict, candidate_ref, changed_paths, tests,
+findings, and blocker. Attempts 1–3 require new evidence, hypothesis, or
+narrower strategy.
 
 Never expand scope, self-certify as assurance, publish, or hide a failure.

package/skills/explorer/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: explorer
 description: >
-  Own one approved execution wave, dispatching bounded fresh-session packets
-  and integrating their evidence. Use for Explorer Journey, wave orchestration,
-  proven-independent in-wave lanes, or parallel packet sequencing. Do not use
-  for implementation, cross-wave work, planning, automatic nesting, or
-  independent assurance.
+  Own one approved execution wave, continuing bounded packets when the
+  envelope is unchanged and integrating their evidence. Use for Explorer
+  Journey, wave orchestration, proven-independent in-wave lanes, or parallel
+  packet sequencing. Do not use for implementation, cross-wave work, planning,
+  automatic nesting, or independent assurance.
 ---
 
 # Explorer
@@ -15,45 +15,45 @@ Wave authority. Coordinates more and implements less than Crewmate.
 ## Inputs and match
 
 - **Inputs:** approved baseline, wave objective, packet graph, dependencies,
-  scope, authority, lineup from the recorded Journey snapshot, review cadence,
-  acceptance, and return schema.
-- **Match:** one wave needs packet sequencing, dispatch, integration, or
-  proven-independent lane coordination.
-- **Non-match:** one bounded packet needs no orchestration, multiple waves
-  conflict, or assurance alone is requested.
+  scope, authority, lineup from the recorded Journey snapshot, visible wave
+  receipt, acceptance, and compact return schema.
+- **Match:** one wave needs packet sequencing, dispatch, integration, or proven-independent lane coordination.
+- **Non-match:** one bounded packet needs no orchestration, multiple waves conflict, or assurance alone is requested.
 
 ## Algorithm
 
-1. Start fresh and verify wave readiness, exact packet boundaries, dependencies,
-   and approved primary/fallback identities from the recorded Journey snapshot,
+1. Continue this wave when identity, authority, route, and generation are
+   unchanged; otherwise start fresh. Verify wave readiness, packet boundaries,
+   dependencies, and approved identities from the recorded Journey snapshot,
    never from the current global defaults file. Revalidate the visible checkout
    lease against the approved Journey, repository, checkout/worktree, branch,
-   candidate revision, generation, and active state before the first write,
-   dispatch, or integration. Released, stale-generation, forged, or
-   branch/HEAD-drifted leases fail closed. Authorized same-Journey
-   candidate progress whose parent is the current leased revision refreshes
+   candidate revision, generation, and active state at wave start, after
+   detected drift, and before commit. Released, stale-generation, forged, or
+   branch/HEAD-drifted leases fail closed. Authorized same-Journey candidate
+   progress whose parent is the current leased revision refreshes
    candidate_revision on the same generation. The same valid lease continues
-   without duplicate dispatch.
+   without duplicate dispatch. Resume from the visible wave receipt; do not
+   reread every accepted artifact or redispatch completed slices.
 2. Use direct Crewmates by default. When two or more lanes are proven
-   independent, coordinate those lanes directly inside this wave; never add a
-   nested coordinator.
-3. Give every node a fresh bounded session. Never pass raw conversation history.
-4. Inspect returns against write sets and acceptance; integrate evidence without
-   implementing missing packet work.
-5. Dispatch declared assurance at `per-slice` or after each integrated execution
-   or correction round at `per-round`. At `at-end`, an Explorer Journey reviews
-   its final wave once; an Expedition wave defers assurance to the Navigator's
-   final Journey boundary. Deterministic checks always run. Before redispatched
-   assurance, honor `max_assurance_rounds` from visible `assurance_rounds`. At
-   the bound, do not dispatch another review. If a repairable result has a
-   remaining `attempts` repair, spend it and close the gate; otherwise return
-   `OWNER_DECISION_REQUIRED` with candidate and count. A new candidate lineage
-   resets the count.
+   independent, coordinate those lanes directly inside this wave; never add a nested coordinator.
+3. Permit Crewmate continuation when the envelope is unchanged. Never pass raw
+   conversation history. Independent work, a changed envelope, or owner choice
+   starts a fresh Crewmate.
+4. Inspect compact returns against write sets and acceptance; integrate
+   evidence without implementing. Update `implementation.md` and `review.html`
+   once per wave, plus owner-decision or blocker changes.
+5. Dispatch declared assurance only at-end on the final integrated candidate.
+   Expedition waves defer assurance to the Router's final Journey boundary.
+   Deterministic checks always run. Honor `max_assurance_rounds` of 1 from
+   visible `assurance_rounds`. If the review is repairable, spend at most one
+   remaining `attempts` repair, run deterministic coordinator verification,
+   and close the gate without another review. A failed repair or scope change
+   returns `OWNER_DECISION_REQUIRED` with candidate and count. After Journey
+   `COMPLETE`, deployment checks do not reopen assurance.
 
 ## Return and recovery
 
 Return `READY`, `REROUTED`, `WAITING_ON`, or `OWNER_DECISION_REQUIRED` with
-plan ref, role, subject, dependencies, scope, authority, evidence, blocker, next
-action, and receiver. Reroute only from new evidence; three attempts per packet.
+verdict, candidate_ref, changed_paths, tests, findings, and blocker. Reroute only from new evidence; three attempts per packet.
 
 Never implement, self-assure, select models, or expand the wave.

package/skills/gather-supplies/SKILL.md

@@ -15,7 +15,8 @@ Planning node, not a persona or plan-state writer.
 
 - **Match:** a material scope, behavior, authority, risk, or acceptance
   decision is unresolved. The Explorer-versus-Expedition route choice is not
-  gathered here; the Router asks it at the pre-implementation gate.
+  gathered here; the Router asks it at the route review after Map the Route
+  maps the implementation graph.
 - **Non-match:** evidence can answer it, the owner already decided it, or a work
   packet is ready.
 - **Inputs:** goal, visible plan state, repository evidence, prior decisions,