> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zookooree.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Gates

> The checks between stations: what they test, why they fail closed, and who may open one by hand.

A gate is the check a unit must pass to move from one station to the next. It encodes the receiving station's right to refuse bad input — jidoka's "never pass a defect downstream," made structural.

Each gate is documented at the station it guards, with the compiled enforcement that runs it: [intake schema](/stations/0-work-order), [red eval on record](/stations/1-design), [zero manual intervention](/stations/2-assemble), [three verification layers](/stations/3-verify), [human acceptance](/stations/4-certify), [BOM-matched deployment](/stations/5-deploy) — and [no gate at all](/stations/6-operate), by design.

## Fail closed — plant law

A gate that cannot determine pass/fail reports FAIL. This began as one QA agent's rule and is promoted to plant law. The alternative — pass on uncertainty — quietly converts every outage, every unparseable input, every ambiguous case into a shipped defect. The factory's gates say no when they cannot say yes: the intake linter treats unparseable as nonconforming, the changelog gate treats an unevaluable range as a violation, the watchdog treats an unevaluable obligation as a ringing alarm.

## A gate is not a review

A gate is deterministic and shape-checking: it gauges *form* — schema present, eval red, hashes matched — and it cannot be argued with. A review is judgment on *substance*, and it belongs to reviewers and judges, not to gates. The intake linter states this about itself: a pass is a shape check, not a quality verdict. The division is deliberate — gates make the checkable unskippable so that reviews spend judgment only where judgment is required.

## Four gates already run on every pull request

Compilation is shipped where it matters most. The CI workflow `factory-gates.yml` runs four validator gates on every pull request, fail closed: the skill validator, the work-order linter proven against its planted-defect fixtures, the germline changelog gate, and the export validator. The workflow's own header states the plant law it enforces: a gate that cannot determine pass or fail reports FAIL, never PASS.

## The andon protocol

Between and around the gates runs the compiled form of stop-the-line — three signal states:

* **Flowing (green).** Work moves.
* **Attention (yellow).** Judge low-confidence, approaching WIP or cost limits, a certificate nearing expiry. Yellow notifies.
* **Stopped (red).** Gate failure, actively-wrong judge verdict, effect-watchdog miss, starvation, security event. Red halts the affected line segment and pages the operator. Every red requires a structured resolution record.

## Handoffs are gated too

Row 14 of the compilation table lands on this page: **A3 handoff metadata** — schema validation on every work-completion signal, per work type. Handoff is signal, and a handoff whose completion metadata does not validate is not a completed handoff; it is an unverified claim of one. The gate between stations inspects the messenger as well as the unit.

## Overrides

A human may open a gate by hand only as a logged, named exception with a reason attached — the same shape as a red-andon resolution record. Frequent overrides are not flexibility; they are a signal the gate is mis-specified or the line is broken, and either way the fix goes to the gate, not to the habit of walking around it.

## Self-audit

| Claim                                                                                          | Source                                               |
| ---------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
| Entry/exit gates added to the standard work by the plant design                                | docs/factory-design.md:85                            |
| Fail closed everywhere; cannot-determine reports FAIL, promoted to plant law                   | docs/factory-design.md:213                           |
| Andon protocol: three states, yellow notifies, red halts and pages, resolution record required | docs/factory-design.md:213                           |
| Row 14: A3 metadata schema validation per work type                                            | docs/factory-design.md:207                           |
| Handoff is signal                                                                              | docs/factory-design.md:184                           |
| Gate-vs-review division: shape check, not quality verdict                                      | workorders/validate-work-order.py (module docstring) |
| Four validator gates run on every PR, fail closed                                              | .github/workflows/factory-gates.yml (header comment) |