Hard Gate — Documentation + SBOM completeness (per task, always)
Status: ACTIVE — hard blocking gate & hook · Declared 2026-06-02 · Applies to all agents, all tasks.
Authority source: 08_GOVERNANCE/gates/GATE_DOCUMENTATION_AND_SBOM_20260602.md
"A full software BOM, RUNBOOK, DEV DOCS, End-User Docs (wiki or versioning) must be created fully for the entire build now and always on all tasks in the future."
We are an audit / replay / governance platform. Shipping work without documentation and an SBOM contradicts the product's own thesis. No task is "done" until its documentation set is complete and current.
The four artifacts every task must produce/update
- SBOM — bill of materials for components the task adds/changes (deps, versions, licenses).
- Runbook — operate/deploy/recover, with a true-test verification (not "it responds").
- Developer docs — what it is, how it works, how to change it.
- End-user / customer docs — task-relevant user-facing docs (or a justified, recorded N/A for pure-internal infra).
Definition of done (gate predicate)
A task is complete only when, with receipt paths: SBOM updated · runbook updated (real verify) · dev docs updated · end-user docs updated/justified · all four receipt-backed and replayable.
Enforcement
- Now: self-enforce on the board OUTSTANDING line (list the four artifacts + paths before closing).
- Planned: a blocking Stop-hook (sibling of
stop_verify_done_claim) that refuses a completion claim missing the artifacts.
Tooling
- Docs: this Docusaurus wiki, backed by governed workorders and receipts.
- SBOM: Syft (+Grype) and CycloneDX — see SBOM.