decommission-gate

decommission-gate — build-and-validate first, turn-off last, GO re-derived live

Turn-off is the one irreversible, highest-blast-radius action of a migration. This skill governs it with three machine-checkable stages driven through scripts/foundry-decommission.py. The gate consumes a recorded design principle: a persisted "validated" flag alone NEVER authorizes a sever — GO is re-derived from live re-checks at the moment of turn-off.

The register (one YAML, class-aware, generated status)

• Enumerate every in-scope component in decommission-register.yaml: stable id, the legacy_identity being turned off, the replacement and how it is reached, a class, a parallel_name, a custody flag, a soak_window, per-component checks.reverify / checks.old_safe slot commands (read-only by contract), and a generated gate_status — derived from the ledger by validate-register --regen, NEVER hand-edited (a hand edit that disagrees with the ledger fails validation closed).
• Class semantics decide the old-side safety question (they are OPPOSITES, not variants):
  • endpoint-bearing (inbound) — safe when ZERO consumers remain over the soak window (flow logs to the old interface / load-balancer request+connection counts == 0).
  • headless (outbound worker: signer, poller, listener) — the hazard is DUAL-OPERATION (double-spend, conflicting signatures, duplicated side effects), so safe means the old instance is QUIESCED: stopped + confirmed down AND no new outbound activity.
  • decommission-only (no replacement) — zero-traffic corroboration of the dead claim, so a live component cannot be hand-downgraded to "dead" to skip the gate.

The independence policy (positive-leaning — no pass-by-omission)

• The policy template denies on any known legacy marker AND denies any host-like endpoint ref NOT on the allow-set — a dependency reached by an un-enumerated hostname cannot pass by omission. Evaluate it over the component's EFFECTIVE rendered config (the checks.reverify slot renders — e.g. helm template output + IaC source literals — and evaluates; a render error is FATAL, never skipped):