The Any-Seat Boarding Recipe

A boarding text that tries to carry everything either overflows the harness
settings box or goes stale the day a rule changes. The cure is the same
progressive-disclosure contract governed knowledge bases already use for
retrieval, applied to the boarding prompt itself. Three layers, strictly
ordered, each pointing one rung down:

L1 — the shim lives in the harness (project instructions, system prompt,
CI env, a voice runtime's preamble). Ten to fifteen lines: who sits here
(the seats), the covenant (creed and axioms, stated — the one thing that
cannot be a fetch away), the fetch-pointer to L2, and the canon-wins clause.
Nothing else. Anything that grows in the shim migrates down.

L2 — the full boarding prompt lives in the operator's
working-conventions repo and is fetched on the first substantive turn. It is
the complete line check: read order, seat selection by recipe, custody,
dispatch/ignition behavior, memory discipline, capture duty, clock, register,
cross-check. Every section ends with its pointer deeper.

L3 — the corpus is the knowledge base itself: rulings, role recipes,
specs, journals, canon. Consulted at the moment of use, per task, never
preloaded. The corpus is the memory; the seat's local files are bootstrap
pointers, and every load-bearing remembered claim is verified at source.

A harness boards a seat when it can do these six things, in order:

1. Fetch — reach the operator's governance (git checkout, MCP retrieval,
   or plain HTTPS). The checkout is the boarding door; a runtime that cannot
   read the repo has not boarded, whatever it remembers.
2. Read in order — the L2 prompt names the read order (charter → binding
   law → newest journal → live work state). Order is load-bearing: law
   before state, state before work.
3. Seat by recipe — roles are recipes in the corpus. The conversation
   names the seat(s); each boards from its own recipe. Multiple seats over
   one governed runtime are call signs, never personas; unaddressed input
   routes to the seat whose scope it plainly touches, and the routing is
   stated.
4. Hold custody — each seat's write surface is named in its recipe; an
   out-of-custody write is refused by name. Ignition never blocks the
   conversation: if the runtime can spawn, work rides spawned sessions
   carrying ticket custody (id, position, session pointer); if it cannot,
   it says so and degrades honestly.
5. Capture before context dies — an unwritten ruling cannot be routed;
   nothing load-bearing lives only in the transcript. Journal as turns land;
   never reconstruct at close.
6. Observe, never infer — the clock is read from an instrument every
   turn; claims carry citations; law is quoted from a fresh fetch, never
   paraphrased from memory. On conflict, the source wins instantly.

An adopter instantiates the ladder by writing their own L1 (swap in their
seats and their L2 URL), their own L2 (their read order and lanes), and
pointing L3 at whatever governance they already keep. At minimum the corpus
needs an operating contract for rung 1 to land.

Operator instance, as evidence (criterion 5 of the core-boundary criteria:
proof, not subject): L1 = a Cowork project-instructions shim naming two
seats (a dispatcher and an expeditor); L2 = cookbook/boarding/RECIPE.md in
the operator's working-conventions repo, DRAFT pending the operator's
exact-text review; L3 = that repo's health code, role recipes and journals,
plus this canon via oddkit. The July 2026 predecessor
(canon/bootstrap/generic-boarding-pass + operating contract) is the one
proven rung of this lineage — a seat boarded cold from it and ran a fleet.
The multi-seat split, custody refusal, and non-blocking ignition are, as of
this writing, one day and one operator old: bets, honestly labeled, awaiting
their second proof before any core extraction.

• canon/bootstrap/model-operating-contract — the binding procedure; this
  recipe is shape and pointers, the contract is the law.
• canon/bootstrap/generic-boarding-pass — the single-seat ancestor; still
  the right choice for one seat, one harness, no dispatch.
• canon/bootstrap/flight-deck-model — the why (crew, not clone).
• canon/methods/document-routing-tests — Gate 0 and the T3 bet gate this
  document's own constraint field obeys.