THE GATES

I · The adjudication gate

The Challenger pokes holes and rates them — BLOCKER, WARNING, SOLID. It does not decide what to do about them; the Conductor does. Finding holes and deciding which are worth fixing are two different jobs, held by two different minds on purpose.

The adjudication runs finding by finding. A blocker defaults to a fix — overriding one requires stating specifically why the critic is wrong, in the log, where the override can be audited later. A warning is discretionary: fix now, or note it and proceed. A finding that is really a scope or product decision goes to neither of them — it raises a checkpoint for the human, because taste belongs to the Visionary. And every fix is routed to the role it is rooted in: requirements go back to Analizer 2000, architecture to the Architect, prompts to the Spellwright. Fix the root, not the symptom.

Two critique loops per agent is the cap. A third round means the disagreement is structural, and structural disagreements belong to a human — the run checkpoints instead of looping.

II · The production boundary

The Bureau's finish line is development, never production. It builds, verifies on dev, and stops:

[DEV-VERIFIED CHECKPOINT] — dev build complete,
stopping before anything leaves dev

Built + green on dev:  <what works>
NOT done (yours to decide): deploy, release, public ship.

Three rules hold the line. A deploy step written in a plan is a description of intent, not a command — the run reads it, stops before it, and hands it back. Authorization is never inferred from ambiguity: "continue," "looks good," and silence do not clear the gate, because a clarifying question costs seconds and a wrong production push is irreversible. And production is the human's domain outright — when a feature reaches the public is the Visionary's call, every time.

III · The external-action boundary

Parallel to the production gate, not inside it: some actions are externally visible and not cleanly reversible — a sent email, a webhook, a payment, a DNS change. Before any of them fires, regardless of workflow, regardless of which agent proposed it:

[EXTERNAL-ACTION CHECKPOINT]
Action type:     <category>
Target:          <the real recipient / URL / account>
Content/payload: <the message, payload, or amount>
Reversibility:   <irreversible | reversible> — one line why

The checkpoint is logged before the action fires, and the log entry is the approval record. A baked-in instruction — "send the confirmation email after running X" — is not authorization; the gate demands a real-time human decision. And when the classifier can't decide whether something is reversible, it is treated as irreversible. Doubt defaults to the careful side.

IV · The canon gate

The Bureau's own process — its workflows, personas, and conventions — is itself an artifact, and changing it is gated harder than changing product code. Any run that touches a process surface must declare, in the critique request, Promotion to canon: yes or no, with a reason. Silence is not a valid answer — a missing declaration is itself a blocker. The cold reviewer keys off the declaration and never infers a promotion from context.

Promoting a workflow to canon carries one more obligation: the full battle-test matrix is re-run fresh, and the results are written into the record before the promotion is declared. Staleness becomes the promoter's problem to disprove, not the reviewer's problem to detect.

V · The Notary's guardrails

For high-stakes artifacts there is one more gate, and it is optional by design: an external cold attestation on a sealed packet of files. The Notary reads only what is in the packet, under isolation, and returns a receipt for exactly what was reviewed. Its findings are advisory — they route through normal adjudication, never around it. It cannot approve checkpoints, expand scope, or stand in for the Challenger. And if the seal was broken — if anything reached the Notary warm — it flags, the findings are discarded, and the review is re-issued cleanly. The full argument for why the checker itself gets checked is the dispatch Who Checks the Checker?