1---
 2name: lane-planner
 3kind: service
 4---
 5
 6# Lane Planner
 7
 8### Description
 9
10Choose reviewer and validator lanes from discovered runner capabilities and
11candidate model IDs.
12
13### Requires
14
15- `brief`: review brief
16- `runner_capabilities`: capability report with exact candidate model IDs
17- `preferences`: optional run guidance
18
19### Ensures
20
21- `lane_plan`: Markdown lane plan with active and skipped lanes, exact runner
22  invocation profile, exact candidate model ID, model family, focus, validator
23  profile, safety class, workspace-copy needs, and reason. The plan includes
24  at least one validator invocation for each active reviewer lane.
25
26### Errors
27
28- `no-eligible-lanes`: no runner is usable under current preferences
29
30### Shape
31
32- `self`: pick lanes for independent model-family coverage and fail closed on
33  safety
34- `prohibited`: using prompt-only safety by default, inventing models, querying
35  model lists, hiding skipped lanes, or treating provider diversity as
36  model-family diversity
37
38### Strategies
39
40- Safety classes: `read-only-capable`, `best-effort-read-only`, `prompt-only`,
41  `unknown`, `unsafe`.
42- When choosing model-family diversity, read `references/model-families.md`.
43- Choose only exact candidate model IDs reported by `runner-discovery`. If a
44  preferred family is not in the roster, skip it rather than fabricating a model
45  target or querying model lists directly.
46- Eligible by default: `read-only-capable` and `best-effort-read-only`.
47- Plain `crush run` is `read-only-capable`; `crush run --yolo` is
48  `best-effort-read-only` and must be disclosed.
49- Skip by default: ordinary Pi, prompt-only, unknown, and unsafe profiles.
50- Partition work by distinct surfaces or bug classes so lanes do not converge:
51  changed component, entry point, protocol stage, trust boundary, or one
52  narrowly named vulnerability class.
53- Keep prompts compact. Give goal, context, focus, bug bar, output shape, and a
54  few high-value false positives to skip; avoid dumping a large checklist.
55- When the brief identifies LLM, agentic, RAG, MCP, or tool-calling behavior,
56  include a lane for the relevant prompt/tool/data boundary.
57- Plan validators separately from reviewers. For every active reviewer lane,
58  assign at least one validator invocation. Prefer a validator model family not
59  used for that reviewer lane, and give validators neutral candidate briefs
60  plus fresh workspace copies.
61- The minimum is invocation cardinality, not necessarily distinct validator
62  models: if only one eligible validator profile exists, reuse it in separate
63  validator invocations and disclose the reuse.
64- Prefer open-weight families: Qwen, GLM, Kimi, MiniMax, Mimo, DeepSeek.
65- If there are multiple eligible Prose Complete harnesses, diversify both model
66  families and the harnesses/runners they're running in.
67- Emit exact lane order. Candidate IDs later follow this order.