Fail closed — plant law
A gate that cannot determine pass/fail reports FAIL. This began as one QA agent’s rule and is promoted to plant law. The alternative — pass on uncertainty — quietly converts every outage, every unparseable input, every ambiguous case into a shipped defect. The factory’s gates say no when they cannot say yes: the intake linter treats unparseable as nonconforming, the changelog gate treats an unevaluable range as a violation, the watchdog treats an unevaluable obligation as a ringing alarm.A gate is not a review
A gate is deterministic and shape-checking: it gauges form — schema present, eval red, hashes matched — and it cannot be argued with. A review is judgment on substance, and it belongs to reviewers and judges, not to gates. The intake linter states this about itself: a pass is a shape check, not a quality verdict. The division is deliberate — gates make the checkable unskippable so that reviews spend judgment only where judgment is required.Four gates already run on every pull request
Compilation is shipped where it matters most. The CI workflowfactory-gates.yml runs four validator gates on every pull request, fail closed: the skill validator, the work-order linter proven against its planted-defect fixtures, the germline changelog gate, and the export validator. The workflow’s own header states the plant law it enforces: a gate that cannot determine pass or fail reports FAIL, never PASS.
The andon protocol
Between and around the gates runs the compiled form of stop-the-line — three signal states:- Flowing (green). Work moves.
- Attention (yellow). Judge low-confidence, approaching WIP or cost limits, a certificate nearing expiry. Yellow notifies.
- Stopped (red). Gate failure, actively-wrong judge verdict, effect-watchdog miss, starvation, security event. Red halts the affected line segment and pages the operator. Every red requires a structured resolution record.
Handoffs are gated too
Row 14 of the compilation table lands on this page: A3 handoff metadata — schema validation on every work-completion signal, per work type. Handoff is signal, and a handoff whose completion metadata does not validate is not a completed handoff; it is an unverified claim of one. The gate between stations inspects the messenger as well as the unit.Overrides
A human may open a gate by hand only as a logged, named exception with a reason attached — the same shape as a red-andon resolution record. Frequent overrides are not flexibility; they are a signal the gate is mis-specified or the line is broken, and either way the fix goes to the gate, not to the habit of walking around it.Self-audit
| Claim | Source |
|---|---|
| Entry/exit gates added to the standard work by the plant design | docs/factory-design.md:85 |
| Fail closed everywhere; cannot-determine reports FAIL, promoted to plant law | docs/factory-design.md:213 |
| Andon protocol: three states, yellow notifies, red halts and pages, resolution record required | docs/factory-design.md:213 |
| Row 14: A3 metadata schema validation per work type | docs/factory-design.md:207 |
| Handoff is signal | docs/factory-design.md:184 |
| Gate-vs-review division: shape check, not quality verdict | workorders/validate-work-order.py (module docstring) |
| Four validator gates run on every PR, fail closed | .github/workflows/factory-gates.yml (header comment) |