build-gate
Denies starting a high-risk ticket's build in a degraded (context-rot) session unless an audited override is durably recorded.
build-gate
ADLC phase: P4 Build · Gate: a high-risk ticket must not begin its build in a context-degraded session.
What it defends against
Nothing else in ADLC deterministically prevents starting a high-blast-radius
build while the executing session is context-rotted: deep, drifted, and past
the point where it reliably holds the plot. build-gate sits at the P3→P4 entry:
it derives the ticket's risk tier from its own fields (risk, external,
mutatesIdentity, trust-root scope, contract/architecture category), checks
a machine-checkable context-fitness signal (tool-call depth and transcript
bytes), and denies the build unless an audited override is recorded. A declared
"risk": "normal" can never downgrade a derived-high signal.
Usage
adlc build-gate <ticket-id> [--depth <n>] [--session-bytes <n>] [--transcript <path>]
[--depth-threshold <n>] [--bytes-threshold <n>] [--tickets <path>]
[--reason <text>] [--json]| Flag | Default | Description |
|---|---|---|
<ticket-id> | — | Ticket to gate (required positional). |
--depth <n> | — | Precomputed tool-call-count depth signal. |
--session-bytes <n> | — | Precomputed transcript byte-size signal. |
--transcript <path> | — | Derive depth / session-bytes from this transcript file. A transcript with no recognizable tool calls is "could not measure": exit 1 for a high-risk ticket, an allow with signalSource: "transcript-empty" otherwise. |
--depth-threshold <n> | 40 | Tool-call count at or past which a session is degraded (inclusive; HARD_DEPTH). |
--bytes-threshold <n> | 8388608 | Transcript bytes (8 MiB) at or past which a session is degraded (inclusive). |
--tickets <path> | .adlc/tickets.json | Path to the tickets file. |
--reason <text> | — | Free-text reason recorded with an override. |
--json | off | Machine-readable JSON result. |
The library export DEFAULT_BYTES_THRESHOLD remains HARD_BYTES (256 KiB) by
design, so the two numbers are not expected to agree: the flag default above is
the recalibrated operating threshold.
Every result carries a signalSource field: flags (--depth / --session-bytes,
which win over a transcript), transcript (derived from a transcript with at least
one recognizable tool call), transcript-empty (a transcript was given but yielded
zero tool calls), or none (no signal supplied). A transcript-empty signal is
could not measure, never "fresh": for a high-risk ticket the gate exits 1 with
could not derive a context signal from <path> rather than allowing; for a ticket
the gate does not guard it still allows, with a reason saying no signal could be
derived. The human one-liner appends [signal: <source>].
Supplying no signal defaults to "not degraded", since a gate given no signal
cannot deny. Set ADLC_BUILD_GATE_BYPASS=1 to override a deny; the override is honored
only if it can be durably recorded to .adlc/manifest.jsonl.
Exit codes
Example
$ adlc build-gate AUTH-9 --depth 61
build-gate: DENY (AUTH-9, risk=high) — high-risk build in a degraded session; no audited override
exit 2Go deeper
merge-forecast
Predicts merge conflicts before any agent runs, certifies the safe fan-out width, and emits a foundation-first merge schedule.
context-handoff
Absolute context-band signals, session-terminal mutation deny (D1–D3), and the operator CLI for write/resume/bypass/repair/unlock — F3 continuity handoff.