@alphazede/bearing-lite 0.2.0 → 0.2.2

package/schemas/journey.schema.json

@@ -5,26 +5,18 @@
   "description": "Append-only decisions and authority-event history plus the generation-bound checkout lease. The full mutable file digest is not the stable SEIT execution baseline. Extra lifecycle metadata is allowed at the document root. Lease identity fields stay closed.",
   "type": "object",
   "additionalProperties": true,
-  "required": [
-    "schema_version",
-    "journey",
-    "checkout_lease",
-    "decisions",
-    "open_decisions",
-    "planning_receipts",
-    "lineup_selection"
-  ],
+  "required": ["schema_version", "journey", "checkout_lease", "decisions", "open_decisions", "planning_receipts", "lineup_selection"],
   "properties": {
-    "schema_version": { "type": "string", "minLength": 1 },
+    "schema_version": {"type": "string", "minLength": 1},
     "journey": {
       "type": "object",
       "additionalProperties": true,
       "required": ["id", "title", "status", "planning_repository"],
       "properties": {
-        "id": { "type": "string", "minLength": 1 },
-        "title": { "type": "string", "minLength": 1 },
-        "status": { "type": "string", "minLength": 1 },
-        "planning_repository": { "type": "string", "minLength": 1 }
+        "id": {"type": "string", "minLength": 1},
+        "title": {"type": "string", "minLength": 1},
+        "status": {"type": "string", "enum": ["planning", "implementation", "complete", "cancelled"]},
+        "planning_repository": {"type": "string", "minLength": 1}
       }
     },
     "checkout_lease": {
@@ -42,47 +34,162 @@
         "state"
       ],
       "properties": {
-        "journey": { "type": "string", "minLength": 1 },
-        "controller": { "type": "string", "minLength": 1 },
-        "repository": { "type": "string", "minLength": 1 },
-        "checkout": { "type": "string", "minLength": 1 },
-        "branch": { "type": "string", "minLength": 1 },
-        "candidate_revision": { "type": "string", "minLength": 1 },
-        "acquired_at": { "type": "string", "minLength": 1 },
-        "generation": { "type": "integer", "minimum": 1 },
-        "state": { "enum": ["active", "released"] }
-      }
+        "journey": {"type": "string", "minLength": 1},
+        "controller": {"type": "string", "minLength": 1},
+        "repository": {"type": "string", "minLength": 1},
+        "checkout": {"type": "string", "minLength": 1},
+        "branch": {"type": "string", "minLength": 1},
+        "candidate_revision": {"type": "string", "minLength": 1},
+        "acquired_at": {"type": "string", "minLength": 1},
+        "generation": {"type": "integer", "minimum": 1},
+        "state": {"enum": ["active", "released"]},
+        "released_at": {"type": "string", "format": "date-time"},
+        "release_reason": {"type": "string", "minLength": 1}
+      },
+      "if": {"properties": {"state": {"const": "released"}}},
+      "then": {"required": ["released_at", "release_reason"]}
     },
     "history": {
       "type": "object",
       "additionalProperties": true,
       "description": "Optional append-only Journey history wrapper",
       "properties": {
-        "decisions": { "type": "array", "items": { "type": "object", "additionalProperties": true } },
-        "authority_events": { "type": "array", "items": { "type": "object", "additionalProperties": true } }
+        "decisions": {"type": "array", "items": {"type": "object", "additionalProperties": true}},
+        "authority_events": {"type": "array", "items": {"type": "object", "additionalProperties": true}}
       }
     },
     "decisions": {
       "type": "array",
       "description": "Append-only confirmed owner decisions",
-      "items": { "type": "object", "additionalProperties": true }
+      "items": {
+        "type": "object",
+        "additionalProperties": true,
+        "allOf": [
+          {
+            "if": {"required": ["record_type"], "properties": {"record_type": {"const": "owner_stop"}}},
+            "then": {"$ref": "#/$defs/ownerStop"}
+          }
+        ]
+      }
     },
     "authority_events": {
       "type": "array",
       "description": "Append-only authority grant, amend, revoke, or supersede events",
-      "items": { "type": "object", "additionalProperties": true }
+      "items": {"type": "object", "additionalProperties": true}
     },
     "open_decisions": {
       "type": "array",
-      "items": { "type": "object", "additionalProperties": true }
+      "items": {
+        "type": "object",
+        "additionalProperties": true,
+        "allOf": [
+          {
+            "if": {"required": ["record_type"], "properties": {"record_type": {"const": "owner_stop"}}},
+            "then": {"$ref": "#/$defs/ownerStop"}
+          }
+        ]
+      }
     },
-    "planning_receipts": {
+    "planning_receipts": {"type": "array", "items": {"type": "object", "additionalProperties": true}},
+    "lineup_selection": {"type": "object", "additionalProperties": true},
+    "owner_wait_tracking": {"type": "boolean", "description": "Explicit coverage marker; absence is unavailable, never zero owner wait."},
+    "owner_blocked_intervals": {
       "type": "array",
-      "items": { "type": "object", "additionalProperties": true }
-    },
-    "lineup_selection": {
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["decision_ids", "started_at", "ended_at"],
+        "properties": {
+          "decision_ids": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "string", "minLength": 1}},
+          "started_at": {"type": "string", "format": "date-time", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$"},
+          "ended_at": {"type": ["string", "null"], "format": "date-time", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$"}
+        }
+      }
+    }
+  },
+  "$defs": {
+    "ownerStop": {
       "type": "object",
-      "additionalProperties": true
+      "additionalProperties": true,
+      "required": [
+        "record_type",
+        "id",
+        "class",
+        "question",
+        "why_owner",
+        "evidence_ref",
+        "affected_slices",
+        "blocking",
+        "status",
+        "created_at",
+        "asked_at",
+        "answered_at",
+        "cancelled_at",
+        "round_trip_id"
+      ],
+      "properties": {
+        "record_type": {"const": "owner_stop"},
+        "id": {"type": "string", "minLength": 1},
+        "class": {"enum": ["A", "B", "C", "D", "E", "F"]},
+        "question": {"type": "string", "minLength": 1},
+        "why_owner": {"type": "string", "minLength": 1},
+        "evidence_ref": {"type": "string", "minLength": 1},
+        "affected_slices": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}},
+        "blocking": {"type": "boolean"},
+        "status": {"enum": ["queued", "asked", "answered", "cancelled"]},
+        "created_at": {"type": "string", "format": "date-time", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$"},
+        "asked_at": {"type": ["string", "null"], "format": "date-time", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$"},
+        "answered_at": {"type": ["string", "null"], "format": "date-time", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$"},
+        "cancelled_at": {"type": ["string", "null"], "format": "date-time", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$"},
+        "round_trip_id": {"type": ["string", "null"], "minLength": 1},
+        "answer_ref": {"type": "string", "minLength": 1}
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"status": {"const": "queued"}}},
+          "then": {
+            "properties": {
+              "asked_at": {"type": "null"},
+              "answered_at": {"type": "null"},
+              "cancelled_at": {"type": "null"},
+              "round_trip_id": {"type": "null"}
+            }
+          }
+        },
+        {
+          "if": {"properties": {"status": {"const": "asked"}}},
+          "then": {
+            "properties": {
+              "asked_at": {"type": "string"},
+              "round_trip_id": {"type": "string", "minLength": 1},
+              "answered_at": {"type": "null"},
+              "cancelled_at": {"type": "null"}
+            }
+          }
+        },
+        {
+          "if": {"properties": {"status": {"const": "answered"}}},
+          "then": {
+            "properties": {
+              "asked_at": {"type": "string"},
+              "answered_at": {"type": "string"},
+              "cancelled_at": {"type": "null"},
+              "round_trip_id": {"type": "string", "minLength": 1}
+            },
+            "required": ["answer_ref"]
+          }
+        },
+        {
+          "if": {"properties": {"status": {"const": "cancelled"}}},
+          "then": {"properties": {"cancelled_at": {"type": "string"}, "answered_at": {"type": "null"}}}
+        }
+      ]
+    }
+  },
+  "allOf": [
+    {
+      "if": {"required": ["owner_wait_tracking"], "properties": {"owner_wait_tracking": {"const": true}}},
+      "then": {"required": ["owner_blocked_intervals"]}
     }
-  }
+  ]
 }

package/skills/bearing-lite/SKILL.md

@@ -3,29 +3,30 @@ name: bearing-lite
 description: Bearing Lite Router for Journeys. Not for ordinary work, assigned packets, implementation, or publication.
 ---
 
-The Router alone writes Journey planning state, owns owner conversation, and owns Expedition sequencing;
+Router alone writes Journey planning state, owns owner conversation, and owns Expedition sequencing;
 planning nodes return owner questions. Plugin hosts are partial; skill-copy is skills-only.
 
 1. Say `Preparing this Journey.` Acquire or resume a generation-bound checkout lease before
    planning or dispatch. A live same-checkout competitor returns `WAITING_ON` with sanitized identity.
 2. Resume the next incomplete stage in the same generation; refresh `candidate_revision`.
    Never replay accepted stages or duplicate dispatch. Invalid leases fail closed.
-3. If `~/.agents/bearing-lite/default-role-lineup.md` is absent, create a
-   proposed copy; never infer identity values. The recorded snapshot is authoritative for this Journey.
-   Later edits to
-   `~/.agents/bearing-lite/default-role-lineup.md` have no effect on it except through an
+3. Lineup comes only from `~/.agents/bearing-lite/lineups.json` per
+   `references/lineups.md`; a missing catalog returns `no_named_profiles`,
+   never a generated file; never infer identity values. The Router is observed, not selected.
+   The recorded snapshot is authoritative for this Journey. Later edits to
+   `~/.agents/bearing-lite/lineups.json` have no effect on it except through an
    explicit owner-confirmed dated visible amendment. Dispatch uses lineup identity from the recorded snapshot.
 4. Run Repository Fit → Set Bearings → Gather Supplies; unresolved material intent blocks Map the Route.
 5. Invoke Map the Route after settled intent. Do not ask for lineup or route
    before it; carry owner-supplied lineup and `review_cadence: at-end` as proposals.
-   Follow `references/lineups.md` for catalog selection and save.
-6. Enforce `references/review-policy.md`. Show one integrated
+6. Enforce `references/review-policy.md` and `references/owner-stops.md`. Show one integrated
    approval-or-change gate for outcome, design, route, lineup, role states,
-   reasoning, cadence, and plan. Record the approved Journey type and snapshot; regenerate changes.
+   reasoning, cadence, and plan. Record the approved Journey type and snapshot.
    Never add a staged lineup or route-review gate.
    Dispatch only after approval.
-7. Crewmate and Explorer may continue in-wave.
-   Use the visible wave receipt and update implementation and review once per wave.
+7. Crewmate and Explorer may continue in-wave. `work_class: light` slices go to the
+   Light Implementer; a `reclassify: judgement` return re-dispatches to the Crewmate.
+   Use visible wave receipts and update implementation and review once per wave.
 
 Return `READY`, `WAITING_ON`, `OWNER_DECISION_REQUIRED`, or `COMPLETE`.
 `max_assurance_rounds` is 1 per declared phase or wave-end, not per Journey;
@@ -35,12 +36,10 @@ deterministically without another review; failed repair/scope change returns
 `OWNER_DECISION_REQUIRED` naming the candidate and count. `COMPLETE` ends Bearing assurance.
 Authorized deployment without reopening review.
 Planning review is a separate pre-dispatch gate; it never consumes implementation
-`required_assurance`, `assurance_rounds`, or `max_assurance_rounds`.
+assurance.
 Release the lease once: release the checkout lease exactly once on `COMPLETE` or `CANCELLED`;
-recovery needs explicit recorded generation increment.
-Recovery cannot steal a live lease.
+recovery needs explicit recorded generation increment and cannot steal a live lease.
 Selected or required capabilities activate. Unavailability of selected-or-required
 capability is a typed capability gap, not success and not invented behavior.
-Selected-only missing and required-only missing are typed gaps. Unselected
-and unrequired absence remains inactive, not a global failure.
+Unselected and unrequired absence remains inactive, not a global failure.
 Never implement, self-assure, select models, or publish.

package/skills/bearing-lite/references/lineups.md

@@ -22,6 +22,37 @@ Missing user file means no named profiles. Do not auto-create the live
 catalog. An empty `lineups` object is valid and is not an error. A
 malformed unused catalog cannot override explicit inline owner choices.
 
+## Configurable roles
+
+Catalog entries assign Explorer, Crewmate, Light Implementer, Test Engineer,
+Scribe, Plan Integrator, Systems Modeler, Integration Engineer, Requirements
+Engineer, Park Ranger, and Surveyor. The Light Implementer takes only slices
+whose `work_class` is `light` (criteria in `skills/light-implementer`); it
+has its own primary and fallbacks, usually a lighter and cheaper route. Navigator and Validator are not lineup roles;
+existing plans that still assign them use the compatibility diagnostics and
+treat the assignment as unused. Never fill agent, model, or reasoning values
+on the user's behalf. `review_cadence` is `at-end`.
+
+The Router is not a configurable role: it is whatever session is running
+planning. The Journey snapshot records the observed Router identity
+(harness, model, reasoning at that time). A catalog or snapshot entry with
+`role: Router` is ignored with the typed note `router_row_ignored`; it is
+never a deviation.
+
+Only verified primary unavailability activates its approved fallback. If
+both are unavailable, return `OWNER_DECISION_REQUIRED`.
+Activation within the frozen ordered fallbacks is a dated execution receipt,
+not a lineup amendment or a new owner approval. Verify the approved activation
+condition and remaining eligible routes before escalating exhaustion. A new
+identity or changed fallback condition requires an owner amendment; follow
+`owner-stops.md` for classification and batching.
+
+This catalog is the single lineup source. A legacy
+`~/.agents/bearing-lite/default-role-lineup.md` is never read or created;
+when one is present it is ignored with the typed note
+`legacy_lineup_md_ignored`. A missing catalog returns the typed outcome
+`no_named_profiles` and an inline-selection prompt.
+
 ## Validity
 
 Named selection and save require a valid catalog. Bind

package/skills/bearing-lite/references/owner-stops.md

@@ -0,0 +1,122 @@
+# Owner decisions and continuation
+
+One integrated approval covers the approved work and its continuation grant.
+Before asking, identify the unresolved decision, affected slices, evidence,
+and why the current policy or authority does not answer it. Never invent an
+extra role, review gate, approval checkpoint, or scope to resolve uncertainty.
+
+| Class | Decision | Router behavior |
+| --- | --- | --- |
+| A | Existing policy | Apply the cited rule and record a dated execution receipt. A real policy conflict is a C boundary decision. |
+| B | Approved fallback | Verify unavailability under the frozen fallback condition; activate the next eligible approved route and record evidence. Changing the lineup or fallback condition is C. |
+| C | Bound, scope, or policy conflict | Ask for the smallest amendment when it blocks ready work. Never reset a spent bound. |
+| D | Continue approved work | Use the effective continuation grant; never ask again while its conditions hold. Missing or expired authority is F. |
+| E | Integrated plan approval | Present the package once for approval or change; execution waits for explicit approval. |
+| F | Authority reserved to the owner | Ask only when the action is not already expressly authorized. Owner holds remain effective until explicitly lifted. |
+
+A/B/D continuation requires verified authority, scope, budget, exclusions,
+expiry, and owner-hold checks. Missing evidence is `NEEDS_MORE_EVIDENCE`, not
+permission and not automatically an owner question. Recover discoverable
+evidence first; escalate a real unresolved boundary as C or F. Fallback
+activation is an execution receipt, not an authority amendment. Only the
+owner changes the frozen lineup or grants authority.
+
+## Approval and authority
+
+Map the Route includes `authority.json.continuation` in the integrated gate:
+`granted`, `owner_decision_id`, named `exclusions`, and `expires_at` (UTC or
+null for event-based expiry). The surrounding envelope retains allowed and
+prohibited actions/paths, role grants, approval receipt, and nonempty
+`expiry_conditions`. Record explicit approval against the exact package;
+the continuation decision ID must occur in `granting_owner_decisions`.
+No grant is inferred from silence, a lineup selection, or passing checks.
+
+Always exclude scope change, budget exhaustion, owner holds, and owner-only
+actions from the continuation grant. A separate explicit action grant can
+authorize an otherwise owner-only action; continuation cannot create it.
+Revocation, supersession, expiry, or changed authority invalidates the grant.
+An older envelope without continuation remains valid historical data but
+provides no standing continuation grant. Do not manufacture a retroactive one.
+
+For first approval show outcome, scope/exclusions, role responsibilities,
+route, bounds, risks, open decisions and proof coverage in a concise summary.
+For revisions show changed requirements, design, proof cases, slices,
+lineup, authority and bounds against the last owner-reviewed package, citing
+both revisions/digests. Explain invalidated approvals and unresolved decisions.
+Keep the complete frozen `review.html` accessible in both cases; a diff or
+freeze PASS is neither approval nor proof of semantic completeness. An
+unchanged package does not need reapproval. A changed package returns to the
+same gate, never an extra gate.
+
+## Queue and continue
+
+Keep pending questions in the existing `journey.json.open_decisions` array
+as typed `record_type: owner_stop` records. Preserve stable IDs when moving
+answered records to `decisions`; append owner answers to normal history.
+Automatic resolutions and unsolicited owner directions remain normal dated
+receipts, not fabricated questions. Required fields are defined by
+`schemas/journey.schema.json` and checked by the metrics helper.
+
+Queue nonblocking questions until wave end and present one batch with the
+wave receipt. Queue nonblocking owner-only closeout actions until Journey
+end. Required credentials, publication prerequisites, or other owner-only
+dependencies surface immediately when they block ready work. Do not defer
+safety/integrity intervention or an explicit owner stop. Each actual
+presentation has a stable `round_trip_id`; questions in the same batch share
+that ID and the exact same presentation timestamp.
+Record `asked_at` when presented, not when drafted or queued; `answered_at`
+when the owner answers. Cancellation uses `cancelled_at`, never a fabricated
+answer. Times are UTC with a `Z` suffix and either whole seconds or exactly
+three fractional digits (milliseconds); normalize host timestamps before
+recording. Re-presenting an unanswered question keeps its ID and
+original asked time; it is not another distinct question.
+
+While waiting, walk the approved slice graph. Dispatch only READY slices
+with satisfied dependencies, active authority, valid lease, available route,
+and verified independence from the question and other running slices.
+Disjoint writes alone do not prove independence: check shared runtime,
+resources, integration order, and read/write dependencies. `parallel_safe`
+is evidence to inspect, not permission. Respect host concurrency limits and
+never dispatch completed or already-running work again. Keep dependent work
+pending. Owner holds apply to their stated scope, including the whole Journey
+when so directed; they cannot be bypassed by calling work independent.
+
+## Deterministic checks and measurement
+
+Before a proposed stop, run `hooks/transition-order.cjs` with
+`action_kind: owner_stop_check` and `owner_stop` containing `class`,
+`blocking`, `evidence_ref`, `resolution_ref`, `authority`, `checked_at`,
+and `checks`. Checks are explicit booleans: `scope`, `budget`, `exclusions`,
+`expiry`, `owner_hold`, plus `policy` for A or `fallback` for B. Router must
+verify them against the actual frozen inputs; the helper does not authenticate
+receipts or interpret arbitrary path globs or expiry prose. C/E/F need the
+class, evidence reference and blocking flag; return ASK or QUEUE. A/B/D
+return CONTINUE only with the grant and all required checks. This is a
+procedural transition adapter, not a new registered host event, permission
+grant, scheduler, or security boundary. Skills-only hosts execute the same
+checklist and disclose unavailable deterministic checks.
+
+New Journeys set `owner_wait_tracking: true` and initialize
+`owner_blocked_intervals: []`. Record intervals only while no authorized ready
+work can progress specifically because of unanswered owner questions. Each
+interval lists their `decision_ids`, `started_at`, and nullable `ended_at`.
+End the interval as soon as work can progress, even if some questions remain
+unanswered. Do not treat every dependency wait, off-hours gap, or commit gap as
+owner-blocked time. Never backfill unknown times. Legacy Journeys without
+tracking report `unavailable`, not zero waiting.
+
+Run `node <plugin root>/hooks/owner-stops.cjs <journey.json> <as-of-UTC>` at
+wave receipts and final closeout. It validates typed records, rejects duplicate
+IDs or inconsistent times, counts `decisions_asked`, distinct approval
+`round_trips`, pending/queued/cancelled questions and A–F counts, and reports
+`response_ms` (sum of completed response intervals), `pending_response_ms`,
+`response_window_ms` (union of asked-to-answer/cancellation/as-of intervals),
+and `blocked_ms` (union of the explicitly recorded fully blocked intervals).
+Overlapping questions are not additive wall-clock wait. Local records only:
+no telemetry or network transmission. Closeout renders these metrics and
+coverage limitations; it must not claim measured savings from legacy gaps.
+
+Operational target after settled scope: zero unnecessary stops per wave;
+one integrated approval batch and one closeout batch per unchanged Journey
+when closeout needs owner authority. Exceptions are recorded, never suppressed
+to hit a quota. Forecast savings only from verified classified observations.

package/skills/bearing-lite/references/review-policy.md

@@ -35,3 +35,8 @@ confirmation or rereview returns `OWNER_AMENDMENT_REQUIRED`.
 This gate reviews planning artifacts before dispatch. It never invokes a
 reviewer. Implementation assurance remains governed separately by
 `max_assurance_rounds` and task `required_assurance` / `assurance_rounds`.
+
+Owner presentation and continuation follow `owner-stops.md`: one integrated
+gate includes the bounded grant, first-approval summary or revision diff, open
+decisions, and access to the full frozen package. This adds no reviewer,
+review round, or approval checkpoint and does not alter the bounds above.

package/skills/bearing-lite/templates/task.md

@@ -40,7 +40,10 @@ the integrated owner approval; do not offer `per-slice` or `per-round`.
 `journey` stays a proposal until the mapped implementation graph exists and the
 integrated owner review approves it. `lineup_snapshot` is authoritative after
 that approval. Later
-edits to `~/.agents/bearing-lite/default-role-lineup.md` have no effect.
+edits to `~/.agents/bearing-lite/lineups.json` have no effect. The `Router`
+row of the snapshot is the observed identity of the session that ran planning
+(harness, model, reasoning at that time); it is never a catalog selection and
+never a deviation.
 Replace it only through an explicit owner-confirmed dated visible amendment.
 Record the amendment date beside the replacement values. Dispatch identities
 come from this snapshot, not from the current global defaults file.

package/skills/explorer/SKILL.md

@@ -13,7 +13,6 @@ description: >
 Wave authority. Coordinates more and implements less than Crewmate.
 
 ## Inputs and match
-
 - **Inputs:** approved baseline, wave objective, packet graph, dependencies,
   scope, authority, lineup from the recorded Journey snapshot, visible wave
   receipt, acceptance, and compact return schema.
@@ -21,7 +20,6 @@ Wave authority. Coordinates more and implements less than Crewmate.
 - **Non-match:** one bounded packet needs no orchestration, multiple waves conflict, or assurance alone is requested.
 
 ## Algorithm
-
 1. Continue this wave when identity, authority, route, and generation are
    unchanged; otherwise start fresh. Verify wave readiness, packet boundaries,
    dependencies, and approved identities from the recorded Journey snapshot,
@@ -42,6 +40,9 @@ Wave authority. Coordinates more and implements less than Crewmate.
 4. Inspect compact returns against write sets and acceptance; integrate
    evidence without implementing. Update `implementation.json` and `review.html`
    once per wave, plus owner-decision or blocker changes.
+   Apply `../bearing-lite/references/owner-stops.md` for queued questions,
+   blocking prerequisites, proven-independent progress and owner holds; never
+   add unapproved roles or gates.
 5. Dispatch declared assurance automatically at wave-end on this wave's
    integrated candidate. Deterministic checks always run. Honor
    `max_assurance_rounds` of 1 per declared phase or wave from visible
@@ -53,7 +54,6 @@ Wave authority. Coordinates more and implements less than Crewmate.
    `COMPLETE`, deployment checks do not reopen assurance.
 
 ## Return and recovery
-
 Return `READY`, `REROUTED`, `WAITING_ON`, or `OWNER_DECISION_REQUIRED` with
 verdict, candidate_ref, changed_paths, tests, findings, and blocker. Reroute only from new evidence; three attempts per packet.
 

package/skills/light-implementer/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: light-implementer
+description: >
+  Execute one approved light slice exactly as its packet states, verified by
+  the packet's deterministic command. Use for Light Implementer, light,
+  mechanical, scaffold, bind, assemble, regenerate, or runbook packets. Do
+  not use for judgement work, authoring, repair, review, or any decision.
+---
+
+# Light Implementer
+
+The cheapest route in the ladder. Inputs fully determine the output, a
+command decides pass or fail, and nothing is decided in-session.
+
+## Inputs and match
+
+- **Inputs:** the Crewmate packet contract (baseline, objective, exact write
+  set, authority, commands, stop rule, return schema, visible wave receipt,
+  lineup identity from the recorded snapshot) for a slice whose
+  `work_class` is `light`.
+- **Match:** every criterion holds:
+  1. Inputs are all named and present: paths, digests, UIDs, a runbook.
+     Nothing is discovered or interpreted.
+  2. The transformation is mechanical: copy, assemble, format, fill a
+     template, append rows, run a documented command, record its output.
+  3. The packet names the command whose exit status verifies the output.
+  4. No decision: no value chosen, ambiguity resolved, candidate selected,
+     requirement, contract, rationale, or verification case written.
+  5. Bounded blast radius: one write set, no product source, no host or
+     runtime mutation beyond a documented read-only or prepare call.
+- **Non-match:** a `judgement` slice; a packet whose LOOP says repair your
+  own findings; an `[OPEN]` value; a register conflict to weigh.
+
+## Algorithm
+
+1. Revalidate the checkout lease exactly as the Crewmate does. On mismatch
+   return `WAITING_ON` without writing.
+2. Do exactly what the packet states, inside the write set, and nothing else.
+3. Run the packet's verification command at the candidate revision. Record
+   exit status, output digest, and changed paths.
+4. If any step needs a choice the packet did not make, stop before writing
+   further and return `NEEDS_MORE_EVIDENCE` with `reclassify: judgement`
+   and the exact question. Never guess, never escalate silently.
+5. There is no in-wave repair loop. A failing command returns the typed
+   failure with its output; the Router decides.
+
+## Return and recovery
+
+Return `CANDIDATE_READY`, `NEEDS_MORE_EVIDENCE`, `WAITING_ON`, or
+`OWNER_DECISION_REQUIRED` with verdict, candidate_ref, changed_paths, tests,
+findings, blocker, and `reclassify` when set.
+
+Never author, repair, self-certify, expand the write set, or publish.

package/skills/map-the-route/SKILL.md

@@ -15,7 +15,7 @@ Fresh planning node. The Router writes Journey state and owns owner conversation
 
 - **Match:** material intent is settled and any technical-plan, design, SEIT,
   implementation graph, or review HTML is missing.
-- **Inputs:** confirmed decisions, repository map and evidence, artifact status,
+- **Inputs:** confirmed decisions, workspace.md and evidence, artifact status,
   requirements register, repository rules, proposed owner-supplied lineup and
   `review_cadence: at-end`, plus the return schema.
 - **Non-match:** unresolved material scope, behavior, authority, risk, or
@@ -38,14 +38,16 @@ Fresh planning node. The Router writes Journey state and owns owner conversation
    `review_cadence: at-end`. Bind the planning-review slots to owner-supplied
    primary and ordered fallback route references under one candidate ref,
    revision, and digest. Use supplied identities; never invent them.
-4. After those stable source inputs, generate `implementation.json` and the
+4. After those stable source inputs, freeze: `node <plugin root>/hooks/plan-package.cjs <plan dir>`
+   must PASS; any finding halts. Then generate `implementation.json` and the
    self-contained offline `review.html` together. Each includes the proposed
    route, lineup, role states, reasoning, cadence, traceability, waves,
    recovery, approval boundaries, and register references versus Journey-local
    requirements. Two `review.html` states: `planning-review` and `final-closeout`.
 5. Give every slice stable requirement/design/SEIT IDs, dependencies, exact
    write set, authority, role, session rule, evidence, recovery, and stop rule.
-6. Open and verify final HTML, then request exactly one integrated owner review
+6. Follow `../bearing-lite/references/owner-stops.md`.
+   Open and verify HTML, then request exactly one integrated owner review
    of outcome, design, route, lineup, cadence, and plan. Dispatch remains
    prohibited until approval. An owner change regenerates affected artifacts,
    then returns to this same gate; never insert a lineup or route-review pause.

package/skills/map-the-route/references/artifact-grammar.md

@@ -56,6 +56,13 @@ optional derived export and is never authority.
    Journey-local, so a reviewer can tell which artifact owns each statement.
 6. `design.md` is unaffected: it records how the work is built, which no
    requirements register covers.
+7. A specification-authoring Journey carries its requirement register (UID,
+   statement, rationale, verification method, allocation) as a planning
+   artifact: a draft `.sdoc` path (Markdown sections are not lint-checkable),
+   recorded as `implementation.json` `journey_settings.journey_type:
+   specification` plus `journey_settings.requirement_register`. The freeze
+   fails without an existing register; the Requirements Engineer gates it
+   before the integrated owner review; no Expedition wave re-gates it.
 
 ## Published standards
 
@@ -82,7 +89,9 @@ optional derived export and is never authority.
    case | Negative/failure case | Command/procedure ID | Evidence.
 5. Every row carries exactly one SEIT row ID, requirement ID, design ID, and
    command ID, and names an observable failure.
-6. Bind a stable decision-baseline projection of confirmed decision identities
+6. For a specification wave, each case-authoring proof row cites the planning
+   register gate receipt.
+7. Bind a stable decision-baseline projection of confirmed decision identities
    and open-item statuses rather than the whole-file `journey.json` digest.
 
 ## Implementation rules
@@ -94,18 +103,26 @@ optional derived export and is never authority.
    owner-selected model route, reasoning, review path, write set, command IDs,
    stop condition, human decision, and `authority_id`. Goals are at most 512
    characters. Slice actions and write sets are subsets of current authority.
-3. Optional fields are Shared interfaces (`path#Symbol`), Integration
+3. `work_class` is `light` or `judgement` (default). A `light` slice names
+   the Light Implementer role, at least one command id, and a
+   `work_class_reason`; see `skills/light-implementer` for the criteria.
+4. For `journey_type: specification`, a specification-authoring Expedition
+   wave defaults to scaffold → author from the gated register → Test Engineer
+   verification cases → bind to the host → readback of the bound revision and
+   digest from the host → Park Ranger with both named in the review
+   request → owner decision. A deviation is a planning-review finding.
+5. Optional fields are Shared interfaces (`path#Symbol`), Integration
    boundary, Published standard (`doc#clause`) when applicable, SysML and
    integration fields when selected, and Parallel safe (`yes` or `no` plus
    reason).
-4. Write sets use one line: `Write only `path``. Paths are bounded, normalized,
+6. Write sets use one line: `Write only `path``. Paths are bounded, normalized,
    repository-relative literals. Put prohibitions in prose, not the write set.
-5. Multi-slice plans declare consecutive `Wave <n>: <ids>` lines. Every slice
+7. Multi-slice plans declare consecutive `Wave <n>: <ids>` lines. Every slice
    belongs to one wave. Dependencies use acyclic `S1 --> S2` arrows.
-6. Ordered integration steps, resources, ownership, and rollback live here.
+8. Ordered integration steps, resources, ownership, and rollback live here.
    Owner-configured reviewer count `n`, repair bound `k`, and confirmation
    count `c` are explicit fields with no assistant default integers.
-7. Plans may contain at most 128 slices, manifests, write paths, and commands.
+9. Plans may contain at most 128 slices, manifests, write paths, and commands.
    Aim for at most 500 estimated tokens per slice plus manifest; split larger
    packets when practical.