The ladder Three levels, each governed by the layer above it:
Level What it is Governed by Tool A registered MCP capability (search, crawl, scrape) Cedar policy per action SOP A state machine of verified steps composing tools Verification prompts + engine limits Skill A tree of SOPs composing SOPs, routed by intent The same machinery, recursively SOPs call SOPs The composition primitive is the EXECUTE_SUB_SOP step. In dynamic mode it runs a child SOP once per locked item from parent state — the branch reads its item directly, with no human intake inside the branch:
{ "step_id": "RP08", "type": "parallel", "action_type": "EXECUTE_SUB_SOP", "dependencies": ["RP05B"], "execution": { "mode": "dynamic", "sub_sop_id": "competitor_move_deep_dive" }} The parent's verification prompt then audits the fan-out as a whole — every locked competitor must return its complete post-audit report, or the step fails strictly. Composition does not dilute verification; it nests it.
Routing by intent The top of the tree routes on intent_match — the declared string describing exactly what user request this SOP serves. The company profile SOP's intent match is deliberately narrow:
"User provides only a company website URL and requests a deep, evidence-backed Company Intelligence Profile built by expanding research across the public web until information becomes repetitive."
Narrow intent strings are what keep routing deterministic. A skill's tree is selected because the request matches a declared shape — not because a model freestyled a plan.
One audit tree Because every step — at every depth — emits artifacts and verification verdicts into the same ledger, a skill run audits as one tree: the intake gate, every parallel branch, every sub-SOP report, every compensation. The metadata.parent_id and depth fields on each step preserve the tree shape in the record.
What the ladder buys The wrapper architecture plateaus: every new capability is another prompt, another bespoke failure mode. The composed architecture compounds — a new deep-dive SOP becomes available to every skill that can use an EXECUTE_SUB_SOP step, inherits the same policy gateway, the same evidence model, the same bounded retries. New surface area arrives pre-governed.