1---
 2name: lane-planner
 3kind: service
 4---
 5
 6# Lane Planner
 7
 8### Description
 9
10Choose reviewer and validator lanes from discovered runner capabilities and
11candidate model IDs.
12
13### Requires
14
15- `brief`: review brief
16- `runner_capabilities`: capability report with exact candidate model IDs
17- `preferences`: optional run guidance
18
19### Ensures
20
21- `lane_plan`: Markdown lane plan with active and skipped lanes, exact runner
22  invocation profile, exact candidate model ID, model family, focus, validator
23  profile, safety class, workspace-copy needs, and reason. The plan includes
24  at least one validator invocation for each active reviewer lane.
25
26### Errors
27
28- `no-eligible-lanes`: no runner is usable under current preferences
29
30### Shape
31
32- `self`: pick lanes for independent model-family coverage and fail closed on
33  safety
34- `prohibited`: using prompt-only safety by default, inventing models, querying
35  model lists, delegating lane planning to reviewer or validator runners,
36  hiding skipped lanes, or treating provider diversity as model-family
37  diversity
38
39### Strategies
40
41- Safety classes: `read-only-capable`, `best-effort-read-only`, `prompt-only`,
42  `unknown`, `unsafe`.
43- When choosing model-family diversity, read `references/model-families.md`.
44- Choose only exact candidate model IDs reported by `runner-discovery`. If a
45  preferred family is not in the roster, skip it rather than fabricating a model
46  target or querying model lists directly.
47- Eligible by default: `read-only-capable` and `best-effort-read-only`.
48- Plain `crush run` is `read-only-capable`; `crush run --yolo` is
49  `best-effort-read-only` and must be disclosed.
50- Skip by default: ordinary Pi, prompt-only, unknown, and unsafe profiles.
51- Partition work by distinct surfaces or bug classes so lanes do not converge:
52  changed component, entry point, protocol stage, trust boundary, or one
53  narrowly named vulnerability class.
54- Keep prompts compact. Give goal, context, focus, bug bar, output shape, and a
55  few high-value false positives to skip; avoid dumping a large checklist.
56- When the brief identifies LLM, agentic, RAG, MCP, or tool-calling behavior,
57  include a lane for the relevant prompt/tool/data boundary.
58- Plan validators separately from reviewers. For every active reviewer lane,
59  assign at least one validator invocation. Prefer a validator model family not
60  used for that reviewer lane, and give validators neutral candidate briefs
61  plus fresh workspace copies.
62- The minimum is invocation cardinality, not necessarily distinct validator
63  models: if only one eligible validator profile exists, reuse it in separate
64  validator invocations and disclose the reuse.
65- Prefer open-weight families: Qwen, GLM, Kimi, MiniMax, Mimo, DeepSeek.
66- If there are multiple eligible Prose Complete harnesses, diversify both model
67  families and the harnesses/runners they're running in.
68- Emit exact lane order. Candidate IDs later follow this order.