prove-the-gates

Prove the Gates

Purpose: every other review verifies claims about the code. None verifies the thing doing the verifying. A check that guards a place that no longer exists is noise; a check whose rule moved without it is a hole; a check that passes because it never reaches its own assertion is worse than no check, because it is trusted. An unproven check is a promise, not a gate.

Procedure

1. Inventory every check. Test files, gate scripts, lint configs, CI steps, pre-commit hooks. For each, write down in one line: what it guards. Fix your unit first and say what it is — a file, a named check id, or an assertion give wildly different fractions, and a fraction whose unit is unstated says nothing.

2. Does that place still exist? Match each check against the current tree. A check demanding a file that moved, a selector that was renamed, a build step that went to CI — that is noise to report, not a gate.

3. Does anything actually run it? Trace every check to the command that invokes it: the test script, the push command, the CI config, the hook. A check nobody runs is not a gate, however good it is — and this is the cheapest hole to find and the easiest to miss, because the file exists and reads well. Documentation claiming a check is enforced is a claim; the invocation is the fact.

4. Prove it reddens. For each check: copy the repo to a scratch directory — include .git, and whatever the build genuinely needs (node_modules, env files) or the run is not the real one — break exactly what that check protects there, and run the original unedited script against the copy. Mark each one proven / not proven / cannot be proven, because —. Never break anything in the working tree; confirm git status is unchanged when you finish, and report that.

5. Break it the way the application builds it. This is where a proof goes wrong while looking right. Injecting an artificial element, a hand-written fixture or a synthetic record can satisfy a check that every real one bypasses — the check then proves itself on a case that never occurs in production. Measured: a gate filtered out every button carrying a framework-internal property, which the framework attaches to everything it renders; a hand-injected button had none, was caught, and the gate was recorded as proven while it had not caught a real one in weeks. If your broken sample took a different path into existence than the real thing, you proved nothing.