Good-planning model that operationalizes Felipe Bovolon's "Good Planning Bad Planning" four-layer architecture as queryable swamp state. Strategy chooses; planning commits — this model holds the commitment.

Article: https://bovolon.substack.com/p/good-planning-bad-planning

A plan is not a slide deck. The article's thesis: the real plan is the pattern of commitments the organization has actually funded, sequenced, protected, and agreed to review. This model makes those commitments first- class state with explicit assumptions, signposts, tripwires, ceiling trigger points, and a pullback ladder — so the plan can be evaluated and revised on a cadence rather than executed-as-written until reality breaks it.

Four Layers (from the article)

• Layer 1 — Assumption: what the plan believes about the world. Each assumption has impact, vulnerability, and a signpost.
• Layer 2 — Allocative: what is actually funded and protected. Targets, forecasts, and allocations are tracked separately (Beyond Budgeting).
• Layer 3 — Coordinative: how commitments interlock. Captured via dependsOn on each commitment.
• Layer 4 — Adaptive: how the plan revises. Ceiling discipline (first-binding crux + trigger formula) and floor discipline (signposts → tripwires → pre-authorized actions
  • pullback ladder + max tolerable loss).

State Machine

drafted ──[commit]──> committed     (gated: all four layers populated)
committed ──[monitor]──> monitoring
monitoring ──[evaluate]──> monitoring  (read signposts, update layer state)
monitoring ──[trigger]──> adapting     (tripwire fired or ceiling crossed)
adapting ──[adapt]──> committed        (pullback or option exercised)
adapting ──[revise]──> drafted         (assumption broken — re-plan)
committed ──[archive]──> archived
monitoring ──[archive]──> archived

commit is the gate the article calls for: it refuses to leave drafted unless every layer is materially populated, including the six properties on every commitment (owner, resource, time, dependencies, review rule, consequence-if-changed) and at least one tripwire on the floor side.

Methods

• start — create a draft plan with strategicChoice + horizon
• add_assumption — record an assumption with impact / vulnerability / signpost
• add_commitment — record a commitment or hypothesis (six-property gate)
• add_allocation — record protected budget per priority (Layer 2)
• add_ceiling — record a first-binding crux + lead time + signpost
• add_tripwire — record a signpost threshold + pre-authorized action
• set_pullback_ladder — ordered list of cuts (what to cut first)
• set_loss_budget — sunk + shutdown + liabilities + working-capital + tail
• commit — gate; transitions drafted → committed
• monitor — committed → monitoring
• evaluate — read a signpost; updates assumption/tripwire/ceiling state
• trigger — explicit transition into adapting (action required)
• adapt — record adaptation taken; back to committed
• revise — assumption broken; back to drafted
• archive — terminal
• hydrate — write a compact governability scorecard summary
• audit — answer the four diagnostic questions (one per layer)

2026.08.02.1

Real-fix wave for the eight GP-1..GP-8 bugs pinned by the prior release's adversarial suite (same wave as sibling extensions seadex and victoriametrics, both already at 2026.08.02.1). Model version bumped 2026.07.16.2 → 2026.08.02.1 with an upgrades[] entry; resource schema unchanged (upgradeAttributes: (old) => old).

• GP-1 fixed (MEDIUM) — start() now reads the existing current resource before writing. If a plan already exists it throws (naming its state/planVersion) instead of silently wiping it — pass the new force: true argument to intentionally discard an existing plan and start fresh.
• GP-2 fixed (MEDIUM) — adapt() now resets the tripwire matching triggeredBy back to "dormant" when it was "fired", so a stale re-trigger() after adapt() → monitor() correctly rejects with "No fired tripwire" until a fresh evaluate() fires it again.
• GP-3 fixed (MEDIUM) — commitmentSatisfiesSixProperties's byDate check no longer relies on Date.parse's engine-defined leniency. It now requires a strict ISO-8601 calendar date or date-time (z.iso.date() / z.iso.datetime()); "2026" and "next quarter" are both rejected, "2026-09-01" still accepted.
• GP-4 fixed (LOW) — evaluate() now rejects a mismatched-layer payload (e.g. timeToCruxWeeks for a signpost with no matching ceiling) instead of silently dropping it, naming the offending field and the layer it needs.
• GP-5 fixed (LOW) — commitGateReport, governabilityScore, and auditDiagnosticQuestions.layer1Visible now share one hasLiveAssumption predicate that excludes state:"broken" assumptions. A plan whose every assumption is broken now fails the commit gate and scores Layer-1 absent; a plan with at least one non-broken assumption still scores it present.
• GP-6 fixed (LOW) — tripwire.pullbackRung is now bounds-checked against a non-empty pullbackLadder: add_tripwire rejects a rung past the current ladder length, and set_pullback_ladder rejects a ladder too short for an already-referenced rung. A rung recorded before any ladder is set (deferred) and pullbackRung:0 against an empty ladder both stay legal — required by the frozen contract fixture.
• GP-7 fixed (LOW) — every add_* method (add_assumption, add_commitment, add_allocation, add_ceiling, add_tripwire) is now idempotent: a structurally-identical repeat call is a no-op (still returns a handle); a call differing in even one field still appends normally.
• GP-8 fixed (LOW) — computeTriggerPoint and computeMaxTolerableLoss now throw on non-finite (NaN/Infinity) inputs instead of propagating them through the arithmetic. The method-arguments zod boundary already rejected both for plain z.number() fields; these two guards close the gap for direct calls to the exported pure helpers.
• Rewrote the eight GP-* pins in good_planning_adversarial_test.ts from "asserts the buggy behavior" to "asserts the fixed behavior", and added idempotence (GP-7), force:true (GP-1), strict-date (GP-3), and ladder-bounds (GP-6) positive-path tests alongside them. The frozen contract suite good_planning.test.ts and the methods/coverage/ property suites are unchanged (traced call-by-call; every exercised path uses matching-layer payloads, distinct add_* args, finite numbers, and a fresh-context start).
• quality.yaml: re-stamped from a live swamp extension quality run; dropped the prior release's "byte-frozen / no behavior change" wording now that this release ships real fixes. All five suites stay present; ratchet stays 100 / "Grade A".