Skip to content

I1309 — The boundaries this milestone asserts are gates, not sentences

Add the gates that make ADR 0025 enforceable: the dependency boundary of majordomus-cli, the credential leak check over the store and the fixtures, the retention cap, and the publication boundary.

BLOCKED wave 4 · p0 · deep-work profile · parallel safe

Part of external-workspaces — An external workspace is read the way this repository reads anything else, and its content never becomes public by accident.

Blocked. This issue cannot start until I1303, I1308 are done. The status is derived from that, not declared.

Objective

Add the gates that make ADR 0025 enforceable: the dependency boundary of majordomus-cli, the credential leak check over the store and the fixtures, the retention cap, and the publication boundary.

Why

This repository's own doctrine is that a rule enforced by nobody is normative for whoever reads it and nothing else. Three of the four boundaries here are exactly the kind that hold until the first hurried afternoon.

Current state

No gate covers any of them. The only adjacent precedent is scripts/site-check, which greps rendered output for secret-shaped strings and fails the site gate.

Desired state

Four gates in .ai/repo/ci/gates.yaml, each a script, each selected by the paths it protects, each with a test case that proves it fails when the boundary is crossed.

Scope

  • .ai/repo/ci/gates.yaml
  • .ai/repo/rules/project
  • scripts/ci
  • test/cases
  • docs/CLAIMS.yaml

Out of scope

  • Adding a new CI job; these gates belong to jobs that already exist

Dependencies

What waits on this

Acceptance criteria

  • A gate fails if majordomus-cli's runtime dependency list changes, naming what was added
  • A gate greps the store, the fixtures, the logs and the snapshots for credential-shaped values and fails on a hit
  • A gate fails if the store exceeds its declared retention cap
  • A gate fails if any published projection names a path under .ai/local/workspaces/
  • Each gate has a test case that proves it red before it proves it green, and each rule carries the x-majordomus block that makes it enforced rather than stated

Validation

  • bash test/run.sh
  • scripts/ci-plan --full
  • bin/majordomus doctrine

Evidence required

  • dependency_gated
  • leak_gated
  • retention_gated
  • publication_gated
  • each_gate_proven_red

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

A leak grep tuned to today's token shapes finds today's tokens. It is a floor, and the record says so rather than implying the boundary is proven.

Timeline

started
—
verified
—
completed
—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I1309.yaml. Read it back with majordomus plan show I1309.