Verification

Cheap and certain first, judgement last#

Every gate is deterministic until the final one. The table below is the same order with the failure conditions spelled out.

1. 01EmptySomething was committed
2. 02ScopeOnly declared paths touched
3. 03ParseSource parses, wiring present
4. 04BuildThe tree compiles
5. 05TestsYour own suite passes
6. 06TypesNo new diagnostics
7. 07AcceptThe judgement call

The gate order#

The deterministic gates run first, in order. The judgement call comes last, and only sees diffs that already passed everything cheap and certain.

The smoke probe#

After the branches are merged, the smoke probe runs against the integrated tree — never per task, because a service is only whole once everything is assembled.

For each service that declares a start command it installs, builds, starts the process, polls the health route, requests each declared smoke route, and tears everything down.

Constraints the probe was built with#

Each of these was learned the hard way.

Never hangs

A per-service readiness budget and a whole-module watchdog force-kill every tracked process group. A stuck verification phase is worse than a wrong one.

Never leaks processes

New sessions plus process-group kills, because a preview server spawns children that outlive the shell that started them. A test asserts the group is actually dead.

Never touches your dashboard port

The port your local dashboard runs on is reserved and the allocator re-rolls. It binds loopback only, never all interfaces.

Never blocks shipping by itself

It reports, the repair loop reacts, and the gate decides. Same trust class as the integration test.

No new dependencies

The standard library only. A probe is not worth a package.

Flake discipline

A failure is re-run once from a fresh process, and only a reproducing failure counts.

A failed probe feeds the repair loop#

A smoke failure goes into the same self-heal loop the integration tests use: up to three fixer rounds, with scope widened to every path the plan touched, re-probing after each.

Its objective names the causes that actually produce this failure — a route never mounted, a handler raising, a missing environment default, a wrong host or port binding, a build output that was never produced.