Engine Control Plane

Engine Control Plane

Use this skill as the shared operating layer above domain engines. Domain skills remain authoritative for content and technical doctrine; the control plane governs ownership, lifecycle, evidence, handoff, and recovery.

Use When

• Designing or auditing a workflow that crosses two or more skill engines.
• Defining agent roles, thin commands, lifecycle hooks, evidence contracts, or handoffs.
• Reviewing release controls, bounded recovery, or a control-plane registry.

Do Not Use When

• A single domain skill can own the work without an orchestration decision.
• The task needs domain doctrine rather than routing, ownership, or release control.
• A safety-only review is required; load skill-safety-audit instead.

Required Inputs

• The participating engines, authoritative routers, intended output, and decision owner.
• Required capabilities, permissions, dependencies, evidence, stop conditions, and recovery constraints.
• The applicable registry or adoption document, if the workflow is already registered.

Prerequisites

• Read the primary domain skill for each participating engine.
• Load skill-writing and skill-composition-standards when changing a reusable contract.

Workflow

1. Preflight. Confirm scope, routers, permissions, dependencies, risk, and the exact mutation boundary.
2. Assign ownership. Select one coordinator and the smallest set of independent domain workers. Give each worker a single decision or artefact owner.
3. Load context. Carry forward requirements, decisions, constraints, evidence gaps, open risks, and the next owner. Do not reload unrelated doctrine.
4. Execute thinly. Use commands and hooks as entrypoints to canonical skills. Keep vendor adapters and command syntax outside model-neutral doctrine.
5. Check evidence. Require source, check, result, reviewer, timestamp, and release consequence for each material gate.
6. Recover or stop. Preserve the last safe state. Retry only with a named changed approach; escalate after two zero-progress cycles or when authority is missing.
7. Handoff and learn. Publish the artefact, evidence, unresolved risks, recovery path, and next owner. Promote a successful repeated lesson only after an independent check.

Core content

Required control surfaces

Agent topology

Use one coordinator. Assign independent decisions to a Router/Planner, Domain Worker, Evidence Collector, Adversarial Reviewer, Gatekeeper/Release Captain, or Librarian as needed. Never assign two agents the same decision; the coordinator carries decisions, constraints, risks, and artefact paths forward.

Hook semantics

Implement the same contract through native hooks, scripts, CI, or explicit steps. The minimum lifecycle is preflight, context, before_write, after_write, release, and stop. Advisory telemetry may fail open; safety, evidence, destructive-action, and release gates fail closed or return NOT ASSESSED.

Non-negotiables

• Keep domain rules in their owning engine; do not create a second source of truth.
• Treat missing tools, sources, screenshots, tests, or approvals as NOT ASSESSED, never as PASS.
• Default review and analysis to read-only. Require explicit authority for mutation or external side effects.
• Make stop conditions, rollback or recovery, and release consequences visible before work advances.
• Check the assembled runtime skill catalog before release; mark unavailable host or plugin evidence NOT ASSESSED.

Quality Standards

• A router is authoritative, discoverable, and checked against the registered catalogue.
• An agent has a role, inputs, outputs, permission boundary, and stop condition.
• A command is a thin entrypoint and does not duplicate domain doctrine.
• A hook names its event, action, failure mode, adapter, and retained evidence.
• A handoff names context, decisions, artefacts, open risks, and the next owner.
• A runtime catalog gate records exact roots, limits, counts, duplicate names, result, timestamp, and release consequence.

Anti-Patterns

• Two agents own the same decision. Fix: assign one accountable owner and make the other a reviewer.
• A command copies a specialist workflow. Fix: route to the canonical skill and keep the command thin.
• A missing approval is treated as an implicit approval. Fix: stop and record NOT ASSESSED.
• A retry repeats the same failed approach. Fix: preserve the prior result and name the changed approach.
• A handoff contains prose but no evidence or next owner. Fix: use the evidence and handoff fields as a release gate.
• A hook mutates a domain it does not own. Fix: require an explicit cross-engine handoff.

Outputs

Evidence Produced

Read next

• skill-engine-audit for whole-engine inventory and scoring.
• skill-safety-audit for unsafe instructions, dependencies, and provenance.
• advanced-testing-strategy for risk-based test depth and retained evidence.
• world-class-engineering for implementation and release gates.

References

• docs/engine-control-plane.md - shared vocabulary and lifecycle contract.
• docs/engine-control-plane.json - machine-readable eleven-engine registry.
• ../../../scripts/validate_engine_control_plane.py - deterministic registry validator.
• skill-writing and skill-composition-standards - authoring and composition rules.

Inputs

Capability contract

Read and search are required. Editing and execution require an authorised implementation scope. Network access is optional and must remain source- disciplined. Delegation is optional and must use disjoint ownership.

Degraded mode

If a router, registry, tool, source, approval, or test is unavailable, return a scoped plan with the unavailable check marked NOT ASSESSED. Do not infer success from a declaration, model confidence, or an unexecuted hook.

Decision rules