Proof Gates
A configured role is not a result. Cross the real boundary, keep the receipts, and name the boundary that remains blocked.
The evidence workflow prefers logs, timestamps, and diffs over self-description. This lesson applies that rule to model routing.
By the end, you can
- separate configuration proof from runtime proof
- recognize fail-closed behavior
- report a blocked boundary without overclaiming
The big idea
Every claim needs a matching receipt. A unit test proves the mapping; a real command proves startup behavior; a container run would prove the sandbox.
Think of airport gates. A boarding pass gets you to a gate, not to your destination. The analogy breaks because software gates can be replayed deterministically.
In the code
The Factory preflight requires a gateway root, gateway token, and GitHub token before constructing the roster. The full workspace baseline passed. Docker remains explicitly unproved because Colima never became SSH-ready.
In one picture
In the code
packages/factory/src/FactoryRuntime.ts
const parsed = factoryEnvironmentSchema.safeParse(env);
if (!parsed.success) {
const field = parsed.error.issues[0]?.path[0];
return failure(
`Missing required Factory environment variable: ${String(field ?? "unknown")}`,
);
}How to find or run this
FACTORY_CLIPROXY_URL= FACTORY_CLIPROXY_TOKEN= GH_TOKEN= pnpm exec tsx .factory/run.ts exits before any container or model call.
Try it
Toggle the two receipts. The simulator allows a ready claim only when both are present.
Boundary claim simulator
Both receipts are present.
Report what passed and name what did not.
Flip the three cards, commit a prediction, then take the check.