| Field | Content |
|---|---|
| Unit | Name, family (skill/tool/agent), version |
| Bill of materials | Content hashes of every context file, skill version, tool version, model and version per binding |
| Evidence | Eval scores, proof-of-work artifacts, judge transcripts, trace links |
| Provenance | Work order link, principal, assembling agent, trial-run records |
| Liability | Owner of record, escalation path, recall procedure |
| Expiry | Re-certification interval plus trigger conditions: model swap, dependency change, N production failures |
Not a badge — a claim with an expiry
A certificate attests that a specific unit, with a specific bill of materials, passed specific verification against a specific work order, on a specific date. Every word of that sentence is load-bearing, and the last one is why certificates expire: the unit’s quality is a distribution over future runs, and the world under it drifts (Thesis 2). A unit without a certificate is not finished; the certified unit — artifact plus certificate — is the factory’s unit of production. The builder does not certify. Verification is independent of generation (Station 3), and the signature at Station 4 is human acceptance of the claim and its evidence — one of the line’s two takt-bound touches.What a certificate buys
Full traceability comes free: any field defect walks backward from certificate to BOM to part to die, so the fix lands on the die — the template, the part process — not on the single unit. Fleet response becomes a query: a model swap reopens every certificate that binds that model; the BOM makes this a lookup, not an investigation. Early invalidation is defined, not improvised: the expiry field names its own triggers. Certificates live in git alongside the units they attest. The certificates are proof you can sleep.The shelf: certificates issued
Every certificate below is a live record, not a sample. Each page renders the real card, the content-hashed bill of materials, the evidence with its actual numbers, the liability chain, and the expiry with its triggers. Two of the four carry a published defect: that is the point, not an embarrassment. A factory that hides its escapes is selling permanent trust, which nobody honest sells.| Certificate | Unit | Family | The story |
|---|---|---|---|
| #001 | op-headless 1.1 | skill | Re-certified under the new gates. Opened red; a four-month-old defect, found and fixed. |
| #002 | validate-work-order 1.0 | tool | The factory’s own intake gate, certified. Clean first pass. |
| #003 | silence-watchdog 1.0 | tool | The second andon wire, certified. Clean first pass. |
| #004 | todo-issue-sync 1.0 | skill | The first demand-pulled unit. Three escapes found in review after certification, all fixed before merge. |
Self-audit
| Claim | Source |
|---|---|
| ”Who takes the call?” — the certificate makes it answerable | docs/factory-design.md:131 |
| Certificate field table (unit, BOM, evidence, provenance, liability, expiry) | docs/factory-design.md:135–142 |
| Traceability: certificate → BOM → part → die | docs/factory-design.md:144 |
| Human acceptance at exit; reviews the claim and evidence, not the work | docs/factory-design.md:146 |
| Model swap reopens affected certificates as a query | docs/factory-design.md:158 |
| Certified unit is the unit of production; certificate committed in git | workflows/production-line.md:56, 64 |
| The four issued certificates and their published defects | certificates/op-headless-1.1.md, validate-work-order-1.0.md, silence-watchdog-1.0.md, todo-issue-sync-1.0.md; retros quality/retros/002 and 004 |