> ## Documentation Index > Fetch the complete documentation index at: https://docs.zookooree.ai/llms.txt > Use this file to discover all available pages before exploring further. # Certificate #001: op-headless 1.1 > The first unit re-certified under the new gate equipment, defect and all. A skill, family skill, version 1.1. Certificate of Conformance **#001**. The first unit pulled back through [Verify](/stations/3-verify) and [Certify](/stations/4-certify) under the certification machinery, and the first to prove why re-certification exists: it opened red, and the defect was four months old. ## The card | Field | Value | | ---------- | -------------------------------------------------------- | | Unit | op-headless | | Family | skill | | Version | 1.1 | | Status | certified | | Issued | 2026-07-11 | | Work order | re-certification under the new gates (WO-A7, issue #130) | | Principal | the operator of record | op-headless is a skill for headless credential-CLI operation; the credential specifics stay off this page by design (see [Credentials and Security](/credentials-and-security)). A skill is prose consumed by whatever agent loads it, so it binds no model at runtime and lapses on a consuming-model swap. ## Bill of materials The BOM is content-hashed. A re-certification recomputes every hash against the file on disk; a single mismatch means the certified unit no longer exists, and the certificate fails closed. * `skills/op-headless/SKILL.md`, sha256 `2b7512a5f11c6696a04aecfa1adff8b77a7fbdfeb6b1296aaa3b79f185542654` (the sole file constituent) * Part: none * Model: one binding in the certifying role; the exact model and version are recorded in the certificate on disk. No runtime model binding. ## Evidence * **Eval:** the skill-validator gate battery, 5 of 5 required gates PASS (verdict PASS\_WITH\_WARNINGS, 2 advisories: environment assumptions and error handling). No dedicated skill-family eval suite exists yet; that gap is recorded as a finding. * **Proof of work:** the recorded gate output, all 5 required gates green. The pre-fix failing state is on record too (the `code_syntax` gate FAIL), so the defect and its fix both live in the evidence, not just the passing result. * **Judge:** none. The independent-judge harness is not built yet (a published gap). The probabilistic layer was manual: a second agent's independent review of the delivery, one model reviewing another's work. * **Traces:** the original production-use retro (issue #4) and the re-certification retro (WO-A7, issue #130). ## Provenance * Work order: re-certification, WO-A7, issue #130. * Assembling agent: original assembly by a sub-agent; re-certification by a separate worker session. * Trial runs: none required. Supervised trial runs are the agent family's gauge; a skill's proof is its planted-defect fixture battery. Prior production use is recorded in the original retro. ## Liability * **Owner of record:** the operator of record. * **Escalation:** the consuming agent or session opens an issue on the factory's public repository, and the operator of record takes the call. * **Recall:** kill switch. Revert the skill file to the last certified revision, mark the certificate recalled, find root cause by Five Whys in a retro, fix the die (the skill or its validator) upstream, re-run the Verify gates, and re-issue. ## Expiry * **Re-certify by:** 2026-08-10 (30 days from issue). * **Triggers:** a change to the skill validator (the gauge changed, so this certificate's verdict no longer means the same thing); a dependency change in the underlying credential CLI or the private credential store's auth model (see the private registry); a consuming-model swap; or 3 production failures. ## The defect, published Certificate #001 is not a clean-sheet story, and the page keeps it honest. The skill shipped on 2026-03-12, before the line had a syntax gate. It carried an unrunnable shell block: a conditional whose body was a comment only, which the shell rejects. It also referenced a command with no matching prerequisites documentation, so the command-reference gate failed on a clean continuous-integration machine where that command is absent. Both defects lived for four months. Worse, a 2026-03-19 test run *saw* the red gate and rationalized it as "expected, the snippet is intentionally incomplete" instead of filing a defect. A red gate that gets explained rather than fixed is a gate with a human bypass. Re-certification under WO-A7 caught both deterministically and fixed them: the shell block now emits a diagnostic, and a prerequisites section carries real install lines. The die fix is the machinery this certificate inaugurates. Expiry triggers, including "the gauge changed," now force shipped units back through the gates so a red verdict can no longer be talked past. Published defects are the brand; this is the first one. ## Self-audit | Claim | Source | | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------- | | Card fields, BOM hash, evidence numbers, provenance, liability, expiry | certificates/op-headless-1.1.md | | Defect story: unrunnable shell block, missing prerequisites doc, four months in production, the rationalized red gate, the fix | quality/retros/002-op-headless-recert.md | | A skill binds no model at runtime; lapses on consuming-model swap | certificates/op-headless-1.1.md (BOM, Expiry) | | Re-certification is the answer to perishable certification | docs/factory-design.md:158 (model swap reopens as a query); Thesis 2 ([no finished goods](/six-theses/no-finished-goods)) |