CI planned from one model, the site deployed from its verified run

A change runs the gates its paths can affect, every gate is the same script a person runs, and the public site is published only from a commit whose derived data proved current.

status

stable

exposed through

• ✓cli
• ·api
• ·mcp
• ·cockpit
• ✓docs

area

verification

What it does

scripts/ci-plan reads the gate model and nothing else to decide what a change must run; a changed path no class matches escalates the whole plan and names the path. The pre-commit hook runs doctor, the worktree guard and the derived-data fingerprint gate, so a stale generated file is refused before the commit exists rather than after the merge.

What it does not do

Publication carries only what can make the published bytes wrong; merging is decided elsewhere. Nothing here trusts a green run it did not observe.

The commands that run it

• majordomus doctor inspect · read-only

  Is Majordomus itself healthy, and is every enforcement it declares actually wired here?

• majordomus watch inspect · read-only

  What has drifted since the last update — policy, projections, state, retention.

What it answers

Operational moments from the Why catalogue that name one of this feature's mechanisms. Nothing here was assigned: a moment appears because it names a rule, a command, a capability or a claim this feature also names.

• →opened CLAUDE.md and AGENTS.md and found two different rulebooks for one repository
• →found a task "in progress" that nobody had touched for three weeks
• →asked what the workers did last night and had only transcripts to grep
• →found the rule for that directory in a README no session ever loaded
• →read three roadmaps for one project and believed none of them
• →watched the always-loaded instruction file grow past a thousand lines
• →found five worktrees and could not say which of them still mattered
• →changed a policy in one place and found the old one still in force in three others
• →found a rule everyone believed was enforced and nothing ever invoked
• →found code that contradicted a decision the repository had written down
• →closed an issue whose acceptance criteria nothing had actually checked
• →was asked how far the milestone had got and had to go and ask four people
• →read a promise in the README that no test stood behind
• →shipped an interface change whose contract document still described the old one
• →pasted a command from the documentation and watched it fail
• →had a green pipeline over generated files that no longer matched their sources
• →found the same thing explained three times, slightly differently
• →published a page that promised more than any test could support

The rules that hold it

• blockingBlocking checks are deterministic and cheapproject.blocking-checks-cheap
• blockingTests run in disposable repositoriesproject.tests-run-in-disposable-repos
• blockingThe Rust executable carries its evidence with itproject.rust-cli-evidence
• blockingA command asserts in the file that declares it that it is what it claims, and is composed rather than registeredproject.rust-command-tested-in-file

What is guaranteed

• guaranteed A change runs the gates its paths can affect, decided by one model of what affects what, and a change to the pipeline itself or a path the model does not know runs every gate
• guaranteed The one status a branch rule requires is green only when planning succeeded and every gate the plan selected ran in a job that succeeded; a failed or cancelled job, a selected gate whose job was skipped, or a plan that selected nothing is red
• guaranteed The behavioural suite runs a bounded number of cases at a time with the serial runner's semantics, a case that writes into the checkout declares itself exclusive and runs alone, and the parallel phase fails naming the paths when the checkout changed under it
• guaranteed Publication is gated on everything that can make the published site wrong and waits for nothing else; the checks that decide whether a change may merge run beside it on the same commit, not in front of it
• guaranteed The site is deployed by one script, scripts/site-deploy, from a terminal or from the publication workflow; it refuses a dirty tree, a commit master does not contain and a build that is not HEAD's, pushes site/public to gh-pages with the source commit named, and pushes nothing when the output is unchanged
• guaranteed Every gate the Rust executable must pass is one script, scripts/rust-check, and CI runs that script on every change that can reach the crate

Executable use cases

• policyGate CI on the tool itself, with an exit code that is a contract