Skip to content

Diagram — Gate 0 Go/No-Go Decision (BUILT)

Status: BUILT. This is Gate.Aggregate (src/FleetRoutine.Cli/Gate.cs), covered by GateTests.cs (6 tests). It is also the project-level gate: per docs/BOARD.md and docs/FLT-104-gate0-auth-smoke-spec.md §6, no scheduler code (FLT-105+) is written until this returns PASS on the main PC.

flowchart TD
    Start([6 HarnessResult from the probe run]) --> Loop{for each result}
    Loop --> Pass{result == PASS?}
    Pass -->|yes| KeepPass[keep as PASS]
    Pass -->|no| Named{harness named in<br/>--allow-missing?}
    Named -->|no| KeepFail[keep as FAIL]
    Named -->|yes| FClass{failureClass in<br/>AllowlistableFailures?<br/>PATH_OR_EXE_NOT_FOUND /<br/>MODEL_UNAVAILABLE /<br/>NETWORK_UNREACHABLE}
    FClass -->|yes| Allow[rewrite to ALLOWLISTED_MISSING]
    FClass -->|no, e.g. AUTH_TOKEN_MISSING,<br/>AUTH_PROMPT_REQUIRED,<br/>DPAPI_DECRYPT_FAILED,<br/>CANARY_MISMATCH| KeepFail

    KeepPass --> Agg{{all gated results<br/>are PASS or ALLOWLISTED_MISSING?}}
    KeepFail --> Agg
    Allow --> Agg

    Agg -->|yes| GO[["overall = PASS (GO)<br/>unblocks FLT-105+"]]
    Agg -->|no| NOGO[["overall = FAIL (NO-GO)<br/>fix auth — do NOT work around<br/>it in scheduler code"]]

Why the allowlist can't launder a broken credential

--allow-missing exists for a seat that is genuinely absent or unreachable (no grok binary installed on this box, or the local Ollama isn't pulled a model) — never for a seat whose credentials are broken. Gate.AllowlistableFailures is a hard-coded allowlist of only PATH_OR_EXE_NOT_FOUND, MODEL_UNAVAILABLE, NETWORK_UNREACHABLE. Naming a harness in --allow-missing when it actually failed with AUTH_TOKEN_MISSING, AUTH_PROMPT_REQUIRED, DPAPI_DECRYPT_FAILED, or CANARY_MISMATCH has no effect — the gate stays FAIL. This was a council review fix (GateTests.Allow_missing_must_not_swallow_auth_or_canary_failures, source comment: "council review 2026-07-18") after the earlier draft allowed any named seat through.

Per spec §6: recurring paid/API routines (Claude/Codex/Gemini/Grok) require a full 6/6 pass — no allowlist shortcut — before they may be enabled. The allowlist path exists for the two local/HTTP seats (Odysseus, Ollama) whose absence is an infra fact, not an auth fact.