Skip to main content
Version: Next

Hard Gate — Documentation + SBOM completeness (per task, always)

Status: ACTIVE — hard blocking gate & hook · Declared 2026-06-02 · Applies to all agents, all tasks. Authority source: 08_GOVERNANCE/gates/GATE_DOCUMENTATION_AND_SBOM_20260602.md

"A full software BOM, RUNBOOK, DEV DOCS, End-User Docs (wiki or versioning) must be created fully for the entire build now and always on all tasks in the future."

We are an audit / replay / governance platform. Shipping work without documentation and an SBOM contradicts the product's own thesis. No task is "done" until its documentation set is complete and current.

The four artifacts every task must produce/update​

  1. SBOM — bill of materials for components the task adds/changes (deps, versions, licenses).
  2. Runbook — operate/deploy/recover, with a true-test verification (not "it responds").
  3. Developer docs — what it is, how it works, how to change it.
  4. End-user / customer docs — task-relevant user-facing docs (or a justified, recorded N/A for pure-internal infra).

Definition of done (gate predicate)​

A task is complete only when, with receipt paths: SBOM updated · runbook updated (real verify) · dev docs updated · end-user docs updated/justified · all four receipt-backed and replayable.

Enforcement​

  • The governed runtime profile, startup entrypoint, and role adapters carry the rule into agent behavior.
  • Codex injects it on SessionStart startup/resume/clear through B:\.codex\hooks\griff-acb-session-start.ps1, including post-compaction re-grounding, Verify First, Test the Test, and No Guess—Always Prove.
  • 08_GOVERNANCE\Test-AgentGuidanceEnforcement.ps1 -SelfTest -Json verifies the live hook/profile/adapters and deliberately removes a required marker to prove the verifier catches a broken contract.
  • Completion remains blocked at the governed receipt/reconciliation boundary unless all four artifact dispositions are present. A client Stop hook is not represented as live until its real event payload and fail-closed behavior are proven.

Tooling​

  • Docs: this Docusaurus wiki, backed by governed workorders and receipts.
  • SBOM: Syft (+Grype) and CycloneDX — see SBOM.