Planning · Occy & Mick

Any planner you like.
None of them trusted.

Kirra's thesis is doer-invariance: the planner is swappable — geometric, learned, even LLM-directed — because the safety case never depends on it. Occy is the reference doer that proves the seam works; the checker is what makes it safe.

The intent seam

From language to a governed trajectory

Mick turns natural language into a typed MickIntent — GoTo, LaneChange, Cruise, Overtake, PullOver, TurnAt, RouteTo — through exactly one fail-closed parse. Free text can steer a conversation; it can never steer the vehicle.

Planning pipeline: intent to governed trajectory Natural language becomes a typed MickIntent through one fail-closed parse. Occy grounds the intent against the lane graph into a trajectory proposal, which the Kirra checker validates before anything moves. A safe-stop proposal always exists. “Take the next left” LLM utterance (untrusted) MickIntent one fail-closed JSON parse Occy grounds it route → corridor → trajectory KIRRA checks it Accept · Clamp · MRCFallback hallucinated / out-of-map intent ⇒ HOLD

The LLM runs locally (Gemma via Ollama) and its failure mode is HOLD — a model outage stops the conversation, not the safety case.

crates/kirra-planner/src/mick.rscrates/kirra-planner/src/mick_llm.rscrates/kirra-mick/src/lib.rs

The actuation fence is structural, not procedural: a CI gate proves the LLM-facing crates have no dependency route to actuation — no release token, no serial consumer, no ROS/DDS — so Mick publishes intents and physically cannot publish commands.

ci/check_mick_actuation_fence.py

Geometric planning

A lane graph that knows what it can't see

Multi-junction routing

A Lanelet2-lite lane graph routes with Dijkstra, stitches a drivable corridor across junctions, and re-resolves from the ego pose every tick — a receding horizon over real geometry, with right-of-way derived from the map.

crates/kirra-mapdocs/adr/0019-map-derived-junction-right-of-way.md

Occlusion-aware approach

Sight distance is carried per approach lane. At a blind junction the planner caps speed to the assured-clear-distance bound (RSS Rule 4), so the ego creeps in rather than betting on an empty road.

crates/kirra-planner/src/behavior.rsdocs/adr/0016-occlusion-aware-junction-speed-bound.md

Safe-stop always exists

PlanOutput::safe_stop is a structural requirement: every planner must always offer a minimum-risk proposal. A planner with no stop output would deadlock the loop — so it can't exist.

crates/kirra-planner/src/lib.rs

Learned planning

A neural doer the checker can catch

The learned planner is deliberately Hydra-MDP-shaped: a fixed trajectory vocabulary scored by a small MLP, fit by a seeded evolution strategy — fully deterministic from its seed, no GPU, no opaque model files. It exists to prove the safety case, not to win a leaderboard.

Two teachers, one lesson

Train it against a SafetyAware teacher and its plans sail through the checker. Train it against a ProgressOnly teacher and the checker catches the misalignment — demonstrated in tests, and measured continuously: the learned doer's admissibility floor (≥90.3%) is a blocking CI gate.

crates/kirra-planner/src/learned.rsci/scenario_kpi_thresholds.json

Maneuver vocabulary

A 2-D lateral-offset × speed vocabulary lets the network route around obstacles. Kirra admits a band-clearing pass that fits the corridor and rejects one that doesn't — same checker, richer doer.

crates/kirra-planner/src/learned.rs

READ THE SOURCE

Swap the doer. Keep the proof.

The planner trait, the intent vocabulary, and the always-available safe stop are all in the open — bring your own doer and let the checker hold it.

View the repository Browse the documentation