Entry gate
Verify’s exit gate: all deterministic layers green, judge confidence above threshold, conscience clean — the complete evidence bundle, not the unit’s word for it.Standard work
Assemble the Certificate of Conformance — the lot number: a signed, versioned record binding together the unit’s identity, its bill of materials as content hashes, the verification evidence, its provenance back to the work order, its liability chain (owner of record, escalation path, recall procedure), and its expiry — a re-certification interval plus the triggers that reopen it early: model swap, dependency change, N production failures. The full anatomy is on the Certificates page. Expiry is set by family: skills expire on dependency change, tools on runtime or API change, agents on the shortest interval — and also on model swap or any context-stack edit. A certificate without an expiry is a claim about a world that does not move, and no such world exists (Thesis 2).Exit gate
Human acceptance. The operator signs — one of the line’s two takt-bound touches, deliberately. What the human reviews is the claim and its evidence, not the work: that leverage is what the verification shop bought. The signature is the moment trust-bandwidth is spent, which is why the whole line paces to it (Thesis 6).Escalation
Fail closed, promoted to plant law: a gate that cannot determine pass/fail reports FAIL. Unable-to-determine means not certified. Insufficient evidence does not mean a smaller signature; it means the unit returns to Verify, or the verification plan returns to Design. Nothing ships on benefit of the doubt.Enforcement
Row 7 of the compilation table: a certificate generator — BOM hashing, evidence bundling, signing — with certificates committed in git alongside their units. Scheduled in the construction plan’s Phase 2, compiled as the pilot units demand it; until then the certificate is assembled by hand against the field table, which is the standard the generator will automate.Self-audit
| Claim | Source |
|---|---|
| Certify answers “who takes the call?“ | docs/factory-design.md:131 |
| Certificate contents: unit, BOM hashes, evidence, provenance, liability, expiry + triggers | docs/factory-design.md:135–142 |
| Expiry by family: dependency / runtime-API / shortest + model swap or context edit | docs/factory-design.md:172 |
| Exit gate is human acceptance; claim and evidence, not the work; takt-bound touch | docs/factory-design.md:146 |
| Fail closed as plant law: cannot-determine reports FAIL | docs/factory-design.md:213 |
| Row 7: generator script; certificates in git; Phase 2 JIT compilation | docs/factory-design.md:200, 269 |