Explicit Skill Lock

Problem

Users need their named SKILLs respected, but asking for consent on every Router-selected support capability makes normal work unusable. Silent substitutions are worse: they violate the user’s instruction and hide context cost.

Contract

When no SKILL is named, selection mode is auto; the Router chooses minimal support without asking permission for its own recommendation. When the user names one or more SKILLs, selection mode is explicit-locked:

Directive	Routing contract
use	Prefer a named SKILL as primary; added support requires the current Phase’s concrete consent.
only	Constrain routing to the named set; no added support is allowed.
all	Every named SKILL must be covered; added support remains consent-scoped.

The public MCP input accepts use, only, and all; it does not accept internal routing values. No directive grants SKILL activation or authority. Activation remains gated, and Host permission remains authoritative for file writes, deployment, messages, secrets, and production access. If a named SKILL is unavailable or insufficient, the Router narrows the outcome or reports a block; it does not automatically fall back or silently substitute.

In Plugin mode, consent is not a second free-form route generation. propose_support_consent persists the current Phase route and concrete support set before the question is shown. The follow-up model turn classifies only approved, rejected, or unclear; transition_support_consent materializes the bound route and rejects stale scope, revision, or context. Skill-only mode follows the same policy as advisory instructions but cannot claim durable enforcement.

State, input, and output example

{
  "input": {"explicit_skill_ids": ["skill:api-designer"], "semantics": "use"},
  "proposal": {"support": "skill:qa-test-planner", "scope": "verify contract"},
  "user_decision": "reject",
  "active_selections": ["skill:api-designer"]
}

Failure modes

• Rejected support appears in the audit trail but never in activation events.
• The same rejected proposal cannot be asked again after a cosmetic phase-ID change.
• If the requested SKILL cannot complete mandatory work, the Router narrows the outcome or reports a block; it does not automatically fall back or substitute silently.

Security and authority boundary

SKILL consent authorizes instruction activation for a declared scope. It does not authorize Plugin installation, file writes, deployment, messages, secrets, or production access. Host permission remains authoritative for R2/R3 actions.

Verify

$env:PYTHONPATH = (Resolve-Path "packages/router-core/src").Path
Set-Location packages/router-core
$env:PYTHONPATH = (Resolve-Path src).Path
python -m unittest tests.routing.test_explicit_lock tests.routing.test_consent tests.integration.test_local_consent_control_plane -v