architecture-is-enforced — A violated invariant fails a gate, and green means every required check ran

•ACTIVE 3 of 6 issues done

ready

1

blocked

1

active

1

verify

0

done

3

cancelled

0

Problem

Several invariants are enforced well: no shadow operation inventory (projection-check, command-graph, mcp-tool-run, shell-inventory, mesh-check), generated drift (generate --check), skipped shell cases (test/run.sh --no-skips). Others are not. The full scheduled CI plan, the only one that selects every gate, has not produced a green verdict in its last 10 runs while push runs on master stay green, and nothing alarms; rule project.never-reported-is-not-green is review-only. rule-proof calls a rule satisfied when its proof is named and present: of 163 rules, 133 are 'not run'. No guard keeps a credential out of HTTP responses, MCP results, logs or mesh frames (apps/majordomus-cli/src/generate.rs:1364,1398 guards generated documents only), and redaction::public_text has no production caller (apps/majordomus-cli/src/redaction.rs:223). Nothing starts a shared server from an installed release in a foreign repository, and the release smoke swallows the launcher's failure (.github/workflows/release.yml:452). Measured in the runtime baseline audit of 2026-10-09 at master 1fb8d6be44 (plan/RUNTIME_BASELINE.md).

Outcome

A deliberate architectural violation fails a named gate; a red or cancelled full run is raised the day it happens; a rule is reported proven only when its proof ran; a credential shape never leaves through a response, log or frame; an installed release is proven to serve a repository that is not this one.

Current state

Gated: projections, generation, docs commands, release-follows-CI (scripts/ci/release-verdict). Partial: false green (push subset green over a red full plan), rule proof, secrets (prompt-privacy and no-machine-paths cover tracked text only), wire versions (version-surface covers the public surface only, see I2164), dogfood (install-check runs --standalone against this repository, scripts/ci/install-check:176). Remote unauthenticated mutation is I2123.

Desired state

Each row of the audit's enforcement table (plan/RUNTIME_BASELINE.md) is gated in CI with a fixture that makes the gate fail, and the session briefing shows the last full-plan verdict.

Scope

• scripts/ci
• .github/workflows/validate.yml
• .github/workflows/release.yml
• .ai/repo/ci/gates.yaml
• .ai/repo/rules/project
• apps/majordomus-cli/src/redaction.rs
• apps/majordomus-cli/src/logging.rs
• apps/majordomus-cli/src/http
• apps/majordomus-cli/src/execution/redact.rs
• apps/majordomus-cli/tests/executions.rs
• apps/majordomus-cli/tests/redaction.rs
• site/static/install.sh
• test/cases
• docs/DISTRIBUTION.md

Out of scope

• Shortening the slowest case, which is I2115 (milestone ci-critical-path).
• The evidence publication's use of public_text, which is I1955 (test-evidence).
• A second CI pipeline; checks join the existing gates.yaml plan.

Acceptance criteria

• A scheduled run that ends red or cancelled produces a visible record naming the failing jobs
• rule-proof reports each rule from recorded runs, and the not-run count of blocking rules is printed
• A credential-shaped value sent to the server never appears in a response, an MCP error or server.log
• CI installs a release archive, starts its shared server in a fresh foreign repository and reads its readiness

Validation

• bin/majordomus plan validate
• scripts/ci/core-check
• MJ_TEST_JOBS=4 bash test/run.sh <the cases these issues add>

Evidence required

• full_plan_alarm
• rule_proof_from_runs
• secret_never_echoed
• installed_release_dogfood

Risks

• Raising every cancelled scheduled run will be noisy until bench and macos fit their timeouts; that is the point, and the first runs should be read rather than silenced.
• Opening GitHub issues from CI is an outward mutation; it must go through scripts/github-sync and be idempotent.

Issues

Each one is an execution contract with its own acceptance criteria, validation command and required evidence. The wave column is the layer of the dependency graph it sits in.

The graph

flowchart LR
    I2161["I2161<br/>No answer, log line or mesh frame carries a credential the redactor knows"]:::done
    I2162["I2162<br/>A released archive, installed, serves a foreign repository over the shared server in CI"]:::done
    I2708["I2708<br/>A mesh event field nobody listed fails the mesh check, and no log field or review body carries a credential the redactor knows"]:::done
    I2841["I2841<br/>The site's browser probe is split, so the site job runs well inside its timeout"]:::active
    I3090["I3090<br/>The UI audit warms every surface and gives an unreachable page a second load"]:::ready
    I3602["I3602<br/>The interaction probe is split, so every control of every page is driven inside its bound"]:::blocked
    I2161 --> I2708
    I2841 --> I3602
    classDef done stroke:#16a34a,fill:#dcfce7,color:#14532d,stroke-width:2px
    classDef active stroke:#2563eb,fill:#eff6ff,color:#1e3a8a,stroke-width:2px
    classDef verify stroke:#7c3aed,fill:#f5f3ff,color:#4c1d95,stroke-width:2px
    classDef ready stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef planned stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef blocked stroke:#b45309,fill:#fffbeb,color:#78350f,stroke-width:2px
    classDef cancelled stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px
    classDef superseded stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px

Canonical record: .ai/repo/project/milestones/architecture-is-enforced.yaml. Read it back with majordomus plan show architecture-is-enforced.