Pass isolation: run every phase as a delegated pass from records, not conversation

PROCESS.md

@@ -302,6 +302,48 @@ Before each phase, reconcile answered gates and state, then select the earliest
 unmet prerequisite. A focused skill's exit is a handoff, not completion of the
 full loop.
 
+### Pass isolation
+
+Every phase pass and every inner-loop iteration is re-enterable from the
+authoritative store, the repository at a named revision, and its skill file
+alone. It never depends on the conversation that preceded it: session working
+notes are not authoritative (see Authority), so nothing a pass needs is lost
+when that conversation is absent.
+
+A loop that spans many passes runs each one as a **delegated pass** in an
+independent context. The orchestrating context keeps only the frozen scope,
+its fingerprint, the current phase, the current item or clause, and each
+pass's report. Anything else the orchestrator knows that a pass needs — an
+applied human answer, a decision, a routed discovery — is written to the store
+before the pass is delegated, never carried in the brief. A context that is a
+copy of the orchestrator's conversation is not an independent context.
+
+A pass brief is a set of pointers, not a payload:
+
+| Part | Content |
+|---|---|
+| Skill | Exactly one skill to apply |
+| Scope | Exact item ids and the fingerprint or revision |
+| Reading | Paths to the records and the skill to open; never their content |
+| Boundary | What the pass must not do: widen scope, ask a human, advance an unnamed item, resolve a decision |
+| Exit | Return the skill's Report section and nothing else |
+| Stop rule | If the exit cannot be reached, stop at the last waypoint commit and report the exact resume condition |
+
+A brief never contains transcripts, earlier reports, packet bodies, code
+excerpts, background narrative, or a second item. It is a session working
+note: not citable, and never a substitute for the store.
+
+Size every pass as one skill, one item, one revision — one SR, one packet, one
+review, one reconnaissance surface. When a report says the exit was not
+reached, split at the next natural boundary — the next SR clause, the next
+reconnaissance surface — and delegate again. Never re-send the same brief with
+more context attached: the size of the request is what failed.
+
+A pass writes its findings into records and commits and returns only its
+Report fields, so the orchestrator stays small across the whole loop. A pass
+interrupted by its environment resumes from the last waypoint commit and the
+store, not from memory.
+
 ### AI TDD inner loop
 
 After human entry places the selected scope in `TODO`, the AI owns the automatic

skills/rdd-build/SKILL.md

@@ -40,6 +40,15 @@ Do not ask for human input inside the loop. Return to planning only when drift
 creates a new product, scope, architecture, acceptance, priority, release,
 workflow, or material technical decision. Record an external blocker exactly.
 
+This skill runs as one delegated pass per SR (`PROCESS.md` Pass isolation).
+It reads the SR, its planning, and the current records from the store, not
+from the conversation that selected it. A pass interrupted by its environment
+resumes from the last waypoint commit and the recorded state: re-establish the
+RED or passing observation from the repository before continuing. If the
+`IN_REVIEW` exit cannot be reached in this pass, stop at the last waypoint
+commit and report the exact clause and resume condition rather than pressing
+on with a larger attempt.
+
 ## Report
 
 Report the planning revision, RED and passing observations, code and test

skills/rdd-cold-review/SKILL.md

@@ -5,8 +5,9 @@ description: Independently audit a requirement planning packet before implementa
 
 # Run a cold technical review
 
-Start from a context independent of the planning-authoring conversation. Read
-the project `AGENTS.md`, canonical `PROCESS.md` (`.modernpath/rdd/PROCESS.md`
+Start from a context independent of the planning-authoring conversation — a
+delegated pass under the Pass isolation rules of `PROCESS.md`; a copy of the
+authoring conversation does not qualify. Read the project `AGENTS.md`, canonical `PROCESS.md` (`.modernpath/rdd/PROCESS.md`
 in a consuming repository), versioned product sources, selected requirements,
 optional epic/specifications, technical reconnaissance, and repository state at
 the recorded revision.

skills/rdd-deliver/SKILL.md

@@ -34,6 +34,23 @@ At an exact `OPEN` human gate, present its brief and wait. If an attributable
 answer is already available, apply it and continue. Never infer or supply the
 answer.
 
+## Run each pass in its own context
+
+Apply the Pass isolation rules of `PROCESS.md`. This skill is the
+orchestrator: it holds the frozen scope, its fingerprint, the current phase,
+the current item or clause, and each pass's report — nothing else.
+
+- Delegate each phase in steps 3–7 and each inner-loop iteration below as one
+  delegated pass with a pass brief: one skill, one item, one revision.
+- Write every fact the pass needs — an applied human answer, a routed
+  discovery, a decision — into the store before delegating. The brief points
+  at records; it does not restate them.
+- Accept only the skill's Report section back. Read the store for the rest.
+- When a report ends at its stop rule, split the work at the next natural
+  boundary and delegate again. Do not enlarge the brief.
+- Never delegate to a copy of this conversation. The pass starts cold from
+  the records and the repository at the named revision.
+
 ## Run the AI TDD inner loop
 
 After entry approval, iterate without human input while the approved fingerprint
@@ -42,7 +59,8 @@ remains unchanged:
 1. Evaluate every selected UR upper trace and SR lower trace. Establish any
    required initial RED observations.
 2. Select the next unmet approved SR clause. Apply `rdd-build` or `rdd-verify`
-   until its lower trace is current and passing.
+   as a delegated pass for that one SR until its lower trace is current and
+   passing.
 3. Rerun affected UR scenarios and update their separate upper evidence.
 4. Repeat for any failing or stale approved trace. Do not stop after the first
    GREEN result or completed SR while another selected trace remains unmet.

skills/rdd-plan/SKILL.md

@@ -22,7 +22,13 @@ scope, Item ownership, and Planning and readiness sections of `PROCESS.md`.
    behavior.
 4. Perform technical reconnaissance at a named repository revision. Record the
    affected surface, control/data flow, contracts, reuse targets, dependencies,
-   risks, test infrastructure, failure modes, and unknowns.
+   risks, test infrastructure, failure modes, and unknowns. For any scope wider
+   than a single SR, delegate reconnaissance per surface — affected code and
+   flow, contracts and data, integrations, test infrastructure, project gates —
+   as read-only passes under the Pass isolation rules of `PROCESS.md`. Each
+   pass returns `DOC:`, `CODE:`, and `TEST:` citations with the fact observed
+   at each; the packet author assembles citations rather than reading every
+   surface in its own context.
 5. Enrich every selected SR with its implementation context, explicit change
    boundary, and lower-RED strategy. Define a separate upper-RED strategy for
    every selected UR.

skills/rdd-start/SKILL.md

@@ -38,6 +38,12 @@ Freeze the selection per `PROCESS.md` work scope and record it in the
 work-selection record. Packet depth is proportional to the frozen scope; no
 packet item may be omitted.
 
+A session that ended by environment failure — a timed-out or aborted request,
+a lost process — re-enters here exactly like any other. The store, the
+waypoint commits, and the work-selection record carry everything the loop
+needs; nothing from the previous conversation is required, and routing to the
+earliest unmet phase is the recovery.
+
 ## Hold the session discipline
 
 These rules bind every subsequent phase in the session: