Guardrails
A gate counts only after every planted defect makes it fail. Its proof is pinned to a hash of its definition; change the gate and the proof must be made again.
| Gate | Protects | Planted defects that must fail it | Proof |
|---|---|---|---|
tone-and-next-step | No message to a student scolds, reads above their level, or reports a problem without a next step (PRD P3, P4). | planted scolding message; planted message with no next step | valid acc3ce507609 |
student-sends | Nothing reaches an outside party without a single-use approval token for that exact content (PRD P9). | planted dispatcher that ignores tokens | valid 9291ad61107c |
safety-router | Crisis messages, including held-out phrasings, route to 988 before any model (PRD SAF-1). | planted router that only knows one phrase | valid 6b40e067a399 |
freshness | A catalog entry past its freshness window is never offered as available (PRD P11). | planted finder that ignores freshness | valid fcbe74161315 |
sealed-facts | A sealed fact never appears in a message unless the student released it to a playbook that needs it (PRD P10). | planted message quoting the sealed fact | valid 83a937648736 |
evidence-pseudonymous | The evidence store holds no student identifiers or content. | planted evidence row with a phone number | valid 0090315f6b70 |
no-status-question | The team never asks about citizenship or immigration status (PRD NAV-7). | planted citizenship question | valid a385b8910465 |
snap-income-oracle | SNAP income results match the published FY2027 table at and just over every limit (record-derived oracle, Pattern 17). | planted off-by-one limit | valid 476d7f2fa140 |
journey-lock | No change can edit or remove the journey cards it is judged by (Pattern 18). | planted lock missing a card | valid cc9247717e08 |
community-moderation | Harmful or risky posts never surface in the community (PRD COM-5). | planted community with no filters | valid ea36f3492c71 |
no-dead-ends | Every button any agent offers works, in the app and by text (PRD P3, P8). | planted registry missing a handler; planted handler that answers with no next step | valid 6e53f2ec92ae |
docs-linked | Every test file names the document it verifies, that document exists, and every document is verified by a test. | planted test file with no doc; planted link to a missing doc | valid 4dc1f4192ee8 |
no-hidden-egress | Only the model client and the egress block may reach the network; domain, agent and server code cannot (PRD P2). | planted fetch in a domain file | valid 6b1258fc1bb0 |
pattern-coverage | All 33 ZTHR patterns are implemented, each points at files that exist, and each is proven by a test (and a gate where it names one). | planted map missing a pattern; planted proof that does not exist | valid 2b875b39253f |
findings-register | Every finding we have not fixed is written down with a reason, an owner and an expiry, and none has expired (Pattern 13). | planted expired finding; planted finding with no owner | valid 632a7ae48af5 |
zero-bypass | Every required check runs in the live pipeline, none may fail and none can be skipped (Pattern 7). | planted pipeline without the gates step; planted step allowed to fail; planted step that swallows failure | valid 3debb42e2ae0 |
authorship-tiers | Every file belongs to an authorship tier and every tier names a guard that enforces it; the open tier comes last (Pattern 6). | planted tier with no guard; planted open tier first | valid 1f87e495db71 |
held-out | No rule is written against its own evaluation set: a held-out line that appears in a rule is caught, to be retired (Pattern 32). | planted rule written against a held-out line | valid 987f0ab15c23 |
sensitive-data | Every field the app keeps is classified, and a planted marker in each personal, sensitive and secret field turns up only where its class may go. | planted field with no class; planted income marker in the evidence log; planted field the trace never exercised | valid 6f4ea8d980b0 |
block-library | Every block has its own tests, a page saying what to use it for and what not, at least one consumer, a mutation score at or above its floor, and no copy of its code inside an app. | planted block with no tests; planted block nothing uses; planted block under its mutation floor; planted block with no purpose page; planted app copy of a block function | valid b23795afc27f |