Skip to main content
A gate is the check a unit must pass to move from one station to the next. It encodes the receiving station’s right to refuse bad input — jidoka’s “never pass a defect downstream,” made structural. Each gate is documented at the station it guards, with the compiled enforcement that runs it: intake schema, red eval on record, zero manual intervention, three verification layers, human acceptance, BOM-matched deployment — and no gate at all, by design.

​
Fail closed — plant law

A gate that cannot determine pass/fail reports FAIL. This began as one QA agent’s rule and is promoted to plant law. The alternative — pass on uncertainty — quietly converts every outage, every unparseable input, every ambiguous case into a shipped defect. The factory’s gates say no when they cannot say yes: the intake linter treats unparseable as nonconforming, the changelog gate treats an unevaluable range as a violation, the watchdog treats an unevaluable obligation as a ringing alarm.

​
A gate is not a review

A gate is deterministic and shape-checking: it gauges form — schema present, eval red, hashes matched — and it cannot be argued with. A review is judgment on substance, and it belongs to reviewers and judges, not to gates. The intake linter states this about itself: a pass is a shape check, not a quality verdict. The division is deliberate — gates make the checkable unskippable so that reviews spend judgment only where judgment is required.

​
Four gates already run on every pull request

Compilation is shipped where it matters most. The CI workflow factory-gates.yml runs four validator gates on every pull request, fail closed: the skill validator, the work-order linter proven against its planted-defect fixtures, the germline changelog gate, and the export validator. The workflow’s own header states the plant law it enforces: a gate that cannot determine pass or fail reports FAIL, never PASS.

​
The andon protocol

Between and around the gates runs the compiled form of stop-the-line — three signal states:
  • Flowing (green). Work moves.
  • Attention (yellow). Judge low-confidence, approaching WIP or cost limits, a certificate nearing expiry. Yellow notifies.
  • Stopped (red). Gate failure, actively-wrong judge verdict, effect-watchdog miss, starvation, security event. Red halts the affected line segment and pages the operator. Every red requires a structured resolution record.

​
Handoffs are gated too

Row 14 of the compilation table lands on this page: A3 handoff metadata — schema validation on every work-completion signal, per work type. Handoff is signal, and a handoff whose completion metadata does not validate is not a completed handoff; it is an unverified claim of one. The gate between stations inspects the messenger as well as the unit.

​
Overrides

A human may open a gate by hand only as a logged, named exception with a reason attached — the same shape as a red-andon resolution record. Frequent overrides are not flexibility; they are a signal the gate is mis-specified or the line is broken, and either way the fix goes to the gate, not to the habit of walking around it.

​
Self-audit