05 · The gates
A finding is a checkpoint. The agent cannot talk its way past it.
The reason a coding agent can be trusted with this is not that it is careful. It is that the things that must not be probabilistic are contracts and gates it can only call — and a build that fails, fails.
Static rules over the tree, under one config. Fails when code invents an ontology term, holds a private key, calls MCP from the browser, drifts from the pinned agent rules, or when the lock is incoherent. A rule that throws is an error, never a pass.
Proves the agent rules in .cursor/rules, AGENTS.md and CLAUDE.md are byte-identical to the pinned source. A coding agent that "helpfully" edits a rule fails this.
Pins an archetype’s digest and the AUTHORITY SHAPE of every tool it carries — risk, action, requirement type, approval policy, effects. An upgrade that changes what a tool may do stops and names the change; a wording change does not.
Runs the real flow against the real estate: sign in, charter, grant, act, receipt, revoke, refuse. Nightly in the template’s CI. If the estate says no, the gate says no.
Conformance for the surfaces your app exposes: the A2A agent card and task lifecycle; the MCP protocol if you expose one. The A2A suite is TCK-green on the estate.
In CI, from the template
# ci.yml — every push pnpm typecheck && pnpm test pnpm ap doctor && pnpm ap doctor --rules # live-gates-nightly.yml — against the estate pnpm ap test --live-gates live-gates.json pnpm ap conform a2a https://<your-agent>/a2a
None of this is authority. A green doctor is a review checkpoint, never a verifier input; the verifier is the DelegationManager on chain, checking the grant at redemption. The gates keep the code honest about how it uses that — they do not stand in for it.
What the agent cannot do, by construction
- — Write a permission system. Authority is DelegationManager + enforcer contracts; the app can only present a grant.
- — Hold an identity. The person signs at her Home; a service signs with a delegate key under a revocable wire.
- — Invent a domain fact. Terms are bound by IRI to the ontology; the doctor fails on a term the T-box does not have.
- — Skip the receipt. Every protected step on the harness leaves PROV-O provenance in the owner's vault.
- — Approve for the person. A confirmation is a signature bound to the digest of the exact intent; a chat "yes" authorizes nothing.