Gates and Signoff

Gates and sign-off

Every task in the run had to pass its required gates before it counted as done. A human decision sat between the build and the deploy. This page lists what the gates were and where they actually changed the outcome.

The gate catalog used in this run

Phase	Gate	Who ran it	What it checked
Plan	design-review	Product Designer	UX flows, themes, states, accessibility notes cover the brief
Plan	prototype-review	Product Designer	Prototype passed 7 real-browser checks (desktop and 360 px, keyboard, reduced motion, console)
Plan	spec-review	Product Owner, Architect	Every brief item traced to a PRD requirement, architecture, ADRs
Build	build, lint, unit	Frontend Developer	TypeScript build, ESLint with zero warnings, Prettier, Vitest
Test	acceptance	QA	Unit, 16 Playwright scenarios, PWA/offline, privacy network, Lighthouse
Test	critic-review	Code Reviewer	Blocking defects in correctness, reliability, accessibility
Test	security	Security and RAI	SAST, secrets, dependencies, lockfile, privacy, import threats, responsible AI
Sign-off	human	Product Owner, Security Team, Tech Lead	Approve or request changes for one exact commit
Deploy	pre-deploy, smoke, rollback-ready	DevOps	Approved tree only, live checks, documented rollback

Where the gates changed the outcome

1. The first PRD failed spec-review. It had replaced the required 25/5, 50/10 and 15/3 rhythms with different durations and deferred required features. It was reopened and fixed.

   

2. Critic review found a real state bug. Pressing Done or Escape left the completed timer in place instead of returning to idle. It was fixed and covered by regression tests.

3. QA was blocked on three manual checks that no agent can do (a representative screen reader, current Safari offline and update, a manual zoom and forced-colors matrix). A named human recorded a waiver, verbatim, in decisions.md.

4. The human sign-off requested changes for three defects every automated gate had passed: a malformed SVG path in the plant art, small and similar plants, and a heavy focus outline after navigation. See the before and after screenshots in the evidence page.

5. Security blocked on a lockfile problem. A clean npm ci on Node 24 reported third-party-web@0.30.0 missing. It was repaired with exact overrides and the whole chain re-ran.

How the human gate works

• The orchestrator never fills in the approvers. It pauses and presents what was built, the gate results, the decisions and risks, and the exact commit.
• A human answers. The answer, the identity and a verbatim quote are written to an append-only record in decisions.md, and only then does state.json show signoff.status: approved.
• Any change after approval resets the sign-off to pending and loops back to build.
• Deploy ships the approved tree only. The merge into main was verified to have the same tree hash as the approved commit.