> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zookooree.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificates

> What a certificate attests, who signs it, and why every one of them expires.

The certificate is the factory's unit of trust — the answer to the governing question any operator must face: *when this breaks in production, who takes the call?* The factory does, and the certificate is the artifact that makes that answerable.

A **Certificate of Conformance** — the lot number — is a signed, versioned record issued at [Station 4](/stations/4-certify):

| Field             | Content                                                                                                 |
| ----------------- | ------------------------------------------------------------------------------------------------------- |
| Unit              | Name, family (skill/tool/agent), version                                                                |
| Bill of materials | Content hashes of every context file, skill version, tool version, model and version per binding        |
| Evidence          | Eval scores, proof-of-work artifacts, judge transcripts, trace links                                    |
| Provenance        | Work order link, principal, assembling agent, trial-run records                                         |
| Liability         | Owner of record, escalation path, recall procedure                                                      |
| **Expiry**        | Re-certification interval plus trigger conditions: model swap, dependency change, N production failures |

## Not a badge — a claim with an expiry

A certificate attests that a specific unit, with a specific bill of materials, passed specific verification against a specific work order, on a specific date. Every word of that sentence is load-bearing, and the last one is why certificates expire: the unit's quality is a distribution over future runs, and the world under it drifts ([Thesis 2](/six-theses/no-finished-goods)). A unit without a certificate is not finished; the certified unit — artifact plus certificate — is the factory's unit of production.

The builder does not certify. Verification is independent of generation ([Station 3](/stations/3-verify)), and the signature at Station 4 is human acceptance of the claim and its evidence — one of the line's two takt-bound touches.

## What a certificate buys

**Full traceability comes free:** any field defect walks backward from certificate to BOM to part to die, so the fix lands on the die — the template, the part process — not on the single unit. **Fleet response becomes a query:** a model swap reopens every certificate that binds that model; the BOM makes this a lookup, not an investigation. **Early invalidation is defined,** not improvised: the expiry field names its own triggers.

Certificates live in git alongside the units they attest. The certificates are proof you can sleep.

## The shelf: certificates issued

Every certificate below is a live record, not a sample. Each page renders the real card, the content-hashed bill of materials, the evidence with its actual numbers, the liability chain, and the expiry with its triggers. Two of the four carry a published defect: that is the point, not an embarrassment. A factory that hides its escapes is selling permanent trust, which nobody honest sells.

| Certificate                               | Unit                    | Family | The story                                                                                                |
| ----------------------------------------- | ----------------------- | ------ | -------------------------------------------------------------------------------------------------------- |
| [#001](/certificates/op-headless)         | op-headless 1.1         | skill  | Re-certified under the new gates. Opened red; a four-month-old defect, found and fixed.                  |
| [#002](/certificates/validate-work-order) | validate-work-order 1.0 | tool   | The factory's own intake gate, certified. Clean first pass.                                              |
| [#003](/certificates/silence-watchdog)    | silence-watchdog 1.0    | tool   | The second andon wire, certified. Clean first pass.                                                      |
| [#004](/certificates/todo-issue-sync)     | todo-issue-sync 1.0     | skill  | The first demand-pulled unit. Three escapes found in review after certification, all fixed before merge. |

## Self-audit

| Claim                                                                        | Source                                                                                                                                          |
| ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| "Who takes the call?" — the certificate makes it answerable                  | docs/factory-design.md:131                                                                                                                      |
| Certificate field table (unit, BOM, evidence, provenance, liability, expiry) | docs/factory-design.md:135–142                                                                                                                  |
| Traceability: certificate → BOM → part → die                                 | docs/factory-design.md:144                                                                                                                      |
| Human acceptance at exit; reviews the claim and evidence, not the work       | docs/factory-design.md:146                                                                                                                      |
| Model swap reopens affected certificates as a query                          | docs/factory-design.md:158                                                                                                                      |
| Certified unit is the unit of production; certificate committed in git       | workflows/production-line.md:56, 64                                                                                                             |
| The four issued certificates and their published defects                     | certificates/op-headless-1.1.md, validate-work-order-1.0.md, silence-watchdog-1.0.md, todo-issue-sync-1.0.md; retros quality/retros/002 and 004 |