RACI

Generated from internal/verbs/registry.go and internal/verbs/raci.go by go generate ./... (WP5.1). Every verb has exactly one Accountable seat (A). The Responsible party (R) is always that seat's agent twin working in the verb's model lane, with the seat's paired human when it has one; the seat that owns the verb's thresholds or policy may differ (the AI Native Engineer executes verify against floors the Quality Architect owns in CONSTRAINTS.md; the Engineering Manager owns the inspect policy that the review lane executes). Consulted seats (C) are asked before the verb acts and Informed seats (I) are told after. Every layer has exactly one owner seat (LAYERS.md). The registry lint (verbs.LintRACI) fails generation otherwise. Each seat runs solo (agent only) or paired (agent twin plus a human): [seats.<name>], set by aayu seat add|remove. Charters: seats/<seat>/CHARTER.md.

Verbs

Model calling: none is deterministic; host means the host's model reasons inside the skill; direct means the binary calls a model itself; hybrid is host reasoning plus a direct pass (ground rule 5). MCP: read is exposed by default, write only with [mcp] expose_writes = true, never is human-only or admin (WP3.3).

Plumbing commands

Seats

Model lanes

Settled defaults per host. Configuration ([models.<lane>.<host>], WP1.2) overrides them; the model gateway resolves them (WP1.6). Model IDs are as the AI gateway lists them; the family belongs to the model, not the endpoint. Cursor cannot run the openai family, so a GPT model configured for Cursor falls back to the lane's Cursor default. Cursor's defaults follow [hosts.cursor] plan (the review-ladder decision of 2026-10-17): x, the default, for a plan that includes only Cursor's own models, or legacy for one that still includes Claude and Gemini. When the binary calls a model itself and the host's default is a host-managed mode, it uses the Claude Code default.

The reviewer model family must differ from the builder model family on every story (reviewer.family != builder.family).