Doer Bound
KIRRA bounds any planner behind the seam · real #131-checker verdicts
The invariant bound
same Mick intent · same world · two doers
The planner is a swappable doer behind one generic seam. Mick proposes the intent GoTo(40, 0); the world (corridor, obstacle, envelope) comes from perception. Whatever the doer proposes, KIRRA is the bound: the careful planner (Occy) is admitted, and a reckless / learned stand-in that drives straight through the obstacle is rejected — then the always-available safe-stop takes over. No unsafe trajectory reaches the actuator, whoever authored it.
Blocked road
stopped car at x=25 m · ego at x=5 · goal at x=40
Occy — reference planner
careful, safety-aware
Stops short of the car well before reaching it — KIRRA admits the plan.
RecklessDoer — black-box stand-in
ignores obstacle / corridor / lane
Drives straight through the car. KIRRA rejects it — the same bound that admitted Occy.
On rejection → safe-stop
the always-available fallback
When a proposal is vetoed, the architecture falls back to a controlled safe-stop the checker accepts. The unsafe intent never actuates.
Clear road — the bound is precise
the very same RecklessDoer, no obstacle
With nothing to hit, the reckless doer is admitted — KIRRA rejects unsafe outputs, not the doer itself. That precision is what makes “swap in a learned planner, the safety case is unchanged” a real claim rather than blanket paranoia.