Simple version: GPT‑5.5 and Opus help us design what excellent looks like offline. At runtime, the app should not blindly trust a model. It routes the user request through skills, memory, tools, and deterministic safety/governance gates before returning an answer.
User asks → model/skill replies. If the skill is shallow, it may give generic advice, fake tool actions, forget constraints, or miss safety issues.
User asks → route skill → load memory → create draft/plan → governance checks facts, assumptions, missing confirmations, live data, side effects, privacy, and safety.
This is what should happen every time a user sends a message.
“Set up soccer carpool Tue/Thu…”
Router chooses carpool/planner, or safety override if emergency.
Kids, preferences, past plans, constraints, permissions.
Builds draft plan using rule packs and skill references.
Checks missing confirmations, live data, side effects, safety, privacy.
If unsafe: draft only, ask confirmation, or emergency guidance.
Returns answer + hidden/structured governance envelope.
Every response carries facts, assumptions, missing confirmations, unsafe unknowns, side effects, plan status, freshness.
draftneeds_confirmationblockedBefore sending/bookings/orders/calendar writes, OiMy must create a proposed action, get confirmation, then require a tool receipt.
proposedconfirmedexecutedIf the response says weather/traffic/price/hours, it needs a fresh source receipt — otherwise it must say “not connected / verify.”
weather receipttraffic receiptUser: Set up a Tue/Thu soccer carpool for Ava, Ben, and Chloe. Parents are me, Sam, and Priya. Practice is 5pm across town.
Good answer: Draft rotation, leave-time buffer, booster/car-seat confirmation, exact pickup spot, authorized adults, backup driver, late protocol, carpool kit, draft message to parents.
Governance blocks: It cannot say “I texted Sam” unless SMS capability exists, user confirmed exact message/recipients, and a tool receipt is logged. It cannot claim live traffic unless traffic integration returns a fresh receipt.
Generated references, reviewed Opus-driven fixes, found bypasses like negation and fake ledger binding.
Reviewed GPT outputs, forced deterministic gates, then passed final governance/API integration after fixes.