Entry gate
A signed, current Certificate of Conformance. No certificate, no deployment — an uncertified unit is inventory, and inventory does not ship.Standard work
The progressive-autonomy dial. Capabilities as runtime flags; canary stages — dogfood, then 1%, 10%, 50%, GA; the kill switch retained forever; and measure before expanding — baseline error and escalation rates gate each widening of the dial. Mechanical export. Deployment to the runtime substrate is a mechanical export from the certified BOM — no re-authoring, no drift between what was certified and what runs. This station is the only one that speaks the runtime’s language; everything upstream is runtime-agnostic by construction, which is the sovereignty seam described in Open Source and Decentralization. Least privilege. The unit receives exactly the access its work order justifies, recorded as part of its deployment record — the practice, in principle, is on the Credentials and Security page; the specifics live in the private registry. Registration with the watchers. The unit’s recurring obligations — the artifacts it owes and their deadlines — are declared to the silence watchdog before the unit starts. A unit that is not registered for silence monitoring is not deployed; it is abandoned in advance.Exit gate
Deployed context matches BOM hashes exactly; monitoring configured; obligations registered; kill switch tested. A deployment is complete when the unit can be recalled, not merely when it is running.Escalation
The founding cautionary tale: the factory’s own export pipeline once shipped empty context placeholders — a deploy that does not carry the certified context is deploying an uncertified unit. That class of failure halts the deployment; the fix goes to the pipeline (the die), not the instance.Enforcement
Two rows of the compilation table land here:- Row 8 — export/deploy integrity:
export/validate-export.py, the poka-yoke — it fails when any exported agent context is empty or a known placeholder, or when a manifest references a missing path. The design’s fuller form diffs deployed context against BOM hashes and refuses on mismatch. - Row 9 — progressive autonomy: capability flags plus staged rollout configuration plus the kill-switch runbook.