When Plan mode quietly overrode my routing table

What I was doing

I asked one of my project orchestrators to design a new ingestion path for pulling in an external code repository. The request was explicit about process: make the plan first, run the safety protocols before scanning the repo, and use the right agents for the job.

That ask maps cleanly onto the orchestrator's routing table. The right specialist is the architecture-planner, because the architecture-planner always folds in the security baseline. So the orchestrator started where it should have: it read its own routing and evaluation-gate references and searched for the relevant pipeline docs. Standard orientation, nothing acted on yet.

Where it went sideways

On the third tool result, an injected system reminder turned on Plan mode. The reminder forbade any non-read-only tool, laid out a fixed five-phase workflow, and stated that it superseded any other instructions already in play.

The orchestrator did what the reminder said. Instead of dispatching the one architecture-planner its routing table pointed to, it spun up three generic exploration subagents in parallel.

The findings those explorers came back with were good. But they were research, nothing more. They did not cover the "run the safety protocols" half of the ask, which is exactly what the architecture-planner's security baseline would have produced. I read the output, saw the routing miss, stopped the run, and restarted with the correct routing.

Why it is worth logging

Two policies that are each correct on their own collided, and the more assertive one won.

Plan mode's no-execute discipline is right. It keeps irreversible actions behind an explicit decision point, which is the same human-in-the-loop stance I hold everywhere in the system. That part was never the problem.

The problem is the part of Plan mode that prescribes which agent to reach for first. Its built-in opening move is a generic explorer. It has no knowledge of a project-scoped orchestrator's routing table, so it cannot know the right first move here was a specialist that integrates a security baseline, not a general explorer. The injected reminder settled it by declaring it overrode everything else, and the orchestrator took it at its word.

A generic workflow does not know what my specialists know. When it lands inside a routing agent's session, it should not silently replace the routing.

So the lesson is about precedence. When a generic, injected mode prescription shows up inside a routing agent's session, the routing agent should still check whether the specialist its own table points to is valid under that mode, rather than defaulting to the generic agent the mode happens to name. The fix is not to weaken the no-execute discipline. It is to keep the domain routing from being quietly masked by a generic phase prescription.

It is also a plain reminder of where I still sit in the loop. The system did something plausible and confidently wrong, and my reading the output is what caught it.