Room 04 · Refinery
A green gate applies to one exact candidate.
Verification binds a reviewed test profile and its evidence to immutable candidate identity; success cannot be transferred to different code.
Build first, then test that exact build
The refinery constructs a candidate from recorded base and source SHAs and gives the result its own candidate SHA. The gate evaluates that exact identity under a reviewed repository profile.
This is stricter than “the worker’s tests passed.” Workers run focused tests while implementing. The refinery runs the repository’s complete reviewed gate after composing the proposed work with the current target.
The gate lifecycle
The gate broker records intent before contacting a provider, then submits or recovers one provider job using an idempotency key bound to the lane, candidate, and immutable profile. Observed execution can move through submitted, starting, and running before settling as green, red, timed out, cancelled, lost, or infrastructure-failed.
The distinction between a verdict and infrastructure state matters:
- Green means the exact candidate passed every required gate.
- Red means the exact candidate was evaluated and failed.
- Infrastructure failure means the system could not obtain a trustworthy verdict.
An unavailable provider is not a red test, and it does not authorize an unreviewed local fallback.
Green is push authority, not a suggestion
Only terminal green authorizes a push, and only for the SHA that was gated. The refinery uses compare-and-swap behavior so the push succeeds only if the target is still the base the candidate was built against.
If the target moved, the result is push_raced. The old green result remains true for the old candidate, but it cannot be reused. The refinery must construct and gate a successor candidate against the new target.
Evidence survives every outcome
Each attempt keeps candidate identity, gate profile, provider execution identity, timing, verdict or infrastructure reason, and bounded artifact metadata. Logs and artifacts explain the result; they do not replace the state transition that records it.
Successful deployment, when configured, is a separate observed effect after push. A deployment result cannot retroactively turn a red candidate green or authorize different code.
Back to the Refinery.