ADR-007 — Governance, tracking & the build pipeline (E9)

Status: Proposed (design-panel synthesis) · Date: 2026-07-22 · Track: E9 (governance · tracking · build pipeline · quality gates) Method: adversarial design panel — estate-scout + four thinker-canon lenses (tracking/living-record · build-vs-adapt · simplicity · simple-vs-easy). Dissent preserved below.

Same shape as ADR-001 (the template). Brand-free: engines/tools named by capability only. The estate governance stack here is deep — that depth is the trap this track exists to resist.

---

1. Context

The platform is a no-code greenfield: nothing ships until the credit-funded build pipeline (plan now, build later) wakes up. E9 must decide how to govern that build and track it — before there is a line of code to govern.

The estate offers a mature apparatus: a binary-eval harness, an audit harness (deterministic security/hygiene/link-check gates), a fail-closed rollout-gate, artifact signing into a transparency log, a beads-on-Dolt version-controlled task substrate with per-op history, a three-way mirror (beads ↔︎ GitHub ↔︎ self-hosted project tracker), and a live self-hosted project tracker.

The estate-scout's verdict splits that apparatus cleanly in two: a software-release-grade bucket (mature, real — but built to govern autonomous agents that sign artifacts and can misbehave at scale) and a learner/community-facing governance bucket (essentially absent — content moderation, credential-integrity, progress policy). E9 governs a known, small team hand-writing a greenfield — not the agent-at-scale threat the heavy machinery was forged for. The track brief's own warning is the binding constraint: do not over-govern a greenfield.

The estate's own memory records the cost of over-adopting: ~30 high-throughput settles used the raw close path, skipped the mirror fan-out, and **~37 tracker cluster issues drifted stale-open**. The three-way mirror is not a neutral asset — it is a synchronization tax the estate has already been bitten by twice.

2. Decision drivers

• Match governance to the actual threat model (three known humans on reviewed PRs), not to what the estate happens to own.
• Split every candidate gate by retrofit cost: cheap-now / ruinous-later gets built now; cheap-to-add-later is deferred behind a named trigger.
• Reader-cost is the binding constraint on a small team — the second engineer must understand why without asking a founder. Every unread artifact is debt from the moment it stops being read.
• The moat is the permissioned index; the one gate that guards it is non-negotiable. Everything else is negotiable.
• Reversibility: deferring a gate must be a scheduled, written decision with a trigger — not neglect that rots into "phase 2 never happened."

3. Options considered

• A — Reuse the estate wholesale. Full three-way mirror, binary-eval harness, audit harness on every repo, rollout-gate + signing, ADR index — all of it, day one.
• B — Lighter subset, scoped to a small team. Two-layer tracking, ADRs, the one fail-closed eval, secrets + smoke + rollback; heavy agent-infra gates deferred.
• C — Custom / minimal. Hand-rolled tracker + ad-hoc review; ignore the estate. (Or bespoke pipeline code.)
• D — Triggered-phase adoption. Start at B, and pre-declare the specific event that promotes each deferred gate to active, plus keep deterministic and probabilistic gates in separate lanes.

4. The panel (rankings diverged; read the core argument, not the rank)

Lens	Rank #1	Core argument
Simplicity (Torvalds)	B	"Ceremony exceeding work." A three-way mirror for one small team is three places to update, two places to drift — the estate's own 37 stale-open issues are that failure mode. Signing/rollout-gate on a repo with no production surface is armor on an empty repo — you cannot roll back a deploy that never happened. Split by retrofit cost: tier-leak eval + append-only log built now; everything else the day it earns its place.
Build-vs-adapt (Fowler)	D	Wholesale is "BDUF in a governance costume." Signing answers "an untrusted/autonomous producer might ship something I can't trace" — the agent pressure, not the small-team pressure. Score every gate on irreversible-vs-reversible failure: tier-leak (a member sees what they didn't earn) is irreversible → hard gate now; a bad deploy is reversible with smoke + rollback → build the rail, not the signing pipeline. Pre-declare the promotion triggers so deferral is scheduled, not neglect.
Tracking / living-record (Cunningham)	D (phased)	The estate is a cathedral; a small team needs a workshop. The three-way mirror is a liability the estate already documented. But the spec forgot the after: an ADR is a promise, an AAR is the reconciliation — without the loop, ADR-001's preserved dissent ("the day discipline slips, C silently becomes B") is a tripwire with no one assigned to watch it. Make deferrals explicit: a register of "governance we are deliberately NOT running yet, and the signal that flips each on" — debt as a visible loan, not a mess.
Simple-vs-easy (Hickey)	D (decomposed)	"Already wired together" is the problem, not the asset — the estate stack arrives complected: tracker braided to eval braided to signing braided to rollout-gate. Adopting wholesale means adopting the braid. Decompose into separable capabilities behind stable seams, gated on need. The category error to forbid: putting the fail-closed tier-leak eval in the same lane and exit-semantics as markdown-lint — the important gate inherits the cosmetic one's seriousness.
Estate-scout	—	Tracking + build-pipeline gates come almost entirely from the estate: a live self-hosted tracker (REUSE), a battle-tested task substrate with full change history (REUSE), a provenance-signed gate CLI whose security/link-check/anti-erosion gates drop into CI unchanged (REUSE). Release-governance (fail-closed ship policy, signed audit trails) is strong to ADAPT but heavier/more agent-shaped than a human product needs. Learner/community governance is the genuine greenfield — build it new on the estate's plumbing.

5. The convergence (what all five agree on, under the different ranks)

Despite splitting A/B/C/D, the lenses converge on one architecture:

1. Reuse exactly one estate piece wholesale: the tracking substrate. Beads-on-Dolt is the one genuinely simple thing in the estate — it separates identity (the bead ID, forever), value (current fields), and time (per-op Dolt history), and gives post-compaction recovery for free. Every lens takes it. Custom (C) throws it away and rebuilds worse.
2. But it is one log with rendered views — never a peer three-way sync. The moment "three-way tracker" is treated as one synchronized thing, you re-create the exact drift the estate already bled on. The tracker's own law — own the append-only log, rent the rendering (ADR-001 I9) — applies to governance too. Beads = the log. GitHub + the project tracker = one-directional rendered views out of it.
3. One eval is load-bearing from day one: the P0 tier-leak eval, fail-closed (already in ADR-001 §8). Reuse the binary-eval harness for exactly this. It guards an irreversible harm; it is not governance overhead, it is the moat's smoke detector. Contrast signing, which earns nothing until an untrusted producer exists.
4. Defer signing + rollout-gate behind a named trigger. No release artifact with an external consumer exists yet. Deferral is written, dated, and trigger-bound — not neglect.
5. Keep deterministic and probabilistic gates in separate lanes with separate exit semantics. A must-be-green hygiene check and a fail-closed-but-occasionally-flaky eval cannot share a lane, a report surface, or a "green" bar — or you learn to ignore red (or block on noise) on the one gate that matters most.

6. Decision — "Own the tracking log · one gate for the moat · deterministic ≠ probabilistic · defer the ceremony behind named triggers"

A triggered-phase subset (Option D) that takes the winning move from each lens.

6.1 Own (cheap now, catastrophic to retrofit)

• The tracking log is beads-on-Dolt, and it is the source of truth. GitHub issues (code-anchored) and the self-hosted project tracker (human-PM-readable) are rendered views projected one-directionally out of the log — never peer sync targets. A work item's identity is its bead ID. The project tracker renders the nine E-track epics a human watches; it does not mirror every task bead. This sidesteps the documented stale-open drift by construction.
• The P0 retrieval-permission tier-leak eval, fail-closed, in its own probabilistic lane — built before the first governed agent reads the first board (ADR-001 §8, I9). Golden set of (member fixture T0–T3, query, must-return / must-not-return), run on every model bump, prompt change, and schema migration. This is the single day-one gate the heavyweight estate contributes to this greenfield, unconditionally.
• A per-track AAR seam. When a track's first real slice ships, a ~1-page AAR: what we decided (link the ADR), what surprised us, which preserved-dissent tripwire fired. This is the reconciliation the spec forgot — and on a team this small it is the institutional memory.
• A deferred-gate register ("governance we are deliberately NOT running yet + the signal that flips each on"), dated and owned. Deferral is a visible loan, not a hidden mess.

6.2 Rent (reuse the estate's plumbing as it is)

• Deterministic hygiene gates (secrets/dependency/static scan, link-check, hash-pinning, the escape-scan that detects a change trying to lower a threshold or delete a gate) run as they ship, in their own lane, in-repo, enforcement-travels-with-the-code. Scope them to what they are — repo hygiene — and never let them share a lane, report surface, or "governance" label with the evals.
• Secrets discipline (the estate SOPS/age standard) from the first commit.
• The self-hosted project tracker and beads-on-Dolt substrate are adopted turnkey — the tracking layer is a config/project-creation task, not a build.

6.3 Defer (scoped, not killed — each behind a written trigger)

• Artifact signing + the fail-closed rollout-gate are deferred entirely. Trigger to promote signing + rollout-gate on a producer's outputs: the first autonomous authoring/curation agent that writes member-visible content (now there is an untrusted producer worth attesting). Trigger to promote the rollout-gate on deploys: the first time the platform auto-deploys to member-facing iron (now there is a deploy worth gating — until then, the smoke-check + auto-rollback rail is what makes a bad deploy reversible, and that rail is built as part of E1).
• The full audit-harness taxonomy runs when there is enough code for its architecture/bias/mutation layers to mean something.
• The P1 evals ride their own triggers: the directional home-ranking regression eval + engagement proxy promote when the ranking agent ships; the per-flow prompt eval for each governed agent promotes when that agent ships.
• ADRs are written for irreversible decisions only — not every reversible choice. The ADR index grows as a linked set; the formal catalog comes after there are eight ADRs to catalog, not before.

7. Tradeoff matrix

Dimension	A wholesale	B lighter	C custom/minimal	D triggered-phase	Decision
Reuse the tracking substrate (recovery for free)	✅	✅	❌ (rebuilds worse)	✅	✅ beads-on-Dolt as log
Avoid three-way mirror drift	❌ (peer sync)	◑	✅ (no mirror)	✅ (log + rendered views)	✅ one-directional views
Fail-closed tier-leak eval, day one	✅	✅	⚠️ (may skip the moat gate)	✅	✅ its own lane
Deterministic ≠ probabilistic lanes	❌ (one braid)	◑	⚠️	✅	✅
Ceremony cost on a no-code greenfield	❌ high	✅ low	✅ low	✅ low	✅ (defer signing/gate)
Deferred gates actually fire when needed	✅ (always on)	⚠️ drift risk	⚠️	✅ (named triggers)	✅ (register + AAR watch)
Reader-cost / second-engineer onboarding	❌ (buries the ADR)	✅	◑	✅	✅ (ADR is the spine)
Learning loop (ADR→reality reconciliation)	⚠️ (no AAR)	⚠️	❌	✅	✅ per-track AAR

8. Consequences

New locked invariants (promote into the foundation spec §7):

• I11 — The tracking log (beads-on-Dolt, per-op version history) is the source of truth; GitHub issues and the project tracker are one-directional rendered views out of it, never peer sync targets. A work item's identity is its bead ID, forever. (Cunningham/Hickey — apply "own the log, rent the rendering" to governance/tracking; kill the three-way peer sync before it drifts.)
• I12 — Deterministic checks and probabilistic evals run in separate lanes with separate exit semantics. The fail-closed tier-leak eval never shares a lane, a report surface, or a "green" bar with repo hygiene. (Hickey — the single most expensive complecting to disentangle later; nearly free to keep separate now.)
• I13 — Every deferred gate is registered with a named, dated promotion trigger and an owner. Deferral is a written decision, not neglect; the register is reviewed at each track AAR. (Fowler/Cunningham — make the tripwire someone's job, or phasing silently becomes never.)

New required evals / gates (the build is only as trustworthy as these):

• P0 — Retrieval-permission tier-leak eval, fail-closed (cross-ref ADR-001 §8). E9 owns wiring it into CI as a required check in the probabilistic lane, before the first agent reads member content. Amend foundation spec §7 to record this as a day-one gate, not an E9 deferral — otherwise it lives only in ADR-001's consequences, exactly the kind of decision that rots when it is not in the document the team uses.
• Gate-erosion (escape-scan) check, deterministic lane — every change that tries to lower a threshold or delete a test/gate fails the build. Governance that resists its own erosion.
• Deferred-gate liveness check — a periodic, owned review (at each AAR) that no deferred gate has silently become load-bearing without its trigger firing. This is the answer to "who watches the tripwire."

E9's first task is to stand up the subset, not the full apparatus:

"Stand up the triggered-phase governance subset: beads-on-Dolt log with one-directional GitHub + project-tracker views (epics only), the fail-closed tier-leak eval in its own lane, deterministic hygiene gates + escape-scan in their own lane, secrets/smoke/rollback, the per-track AAR seam, and the deferred-gate register — and pre-declare the signing / rollout-gate / flow-eval promotion triggers." Priority: high. Enhance an existing E9 tracking-setup bead under the program's project tracker rather than duplicating.

Estate seams (what we actually reuse):

• Beads-on-Dolt substrate + self-hosted project tracker → the tracking log + its human-readable view (turnkey; a config task, not a build).
• Binary-eval harness → the P0 tier-leak eval (and later, trigger-gated, the P1 evals) — evaluator always separate from the artifact under test; honest coverage reporting (never claim a check ran when it didn't).
• Audit harness (security/hygiene/link-check + escape-scan + evidence-emit) → the deterministic CI lane, in-repo.
• Rollout-gate (policy-as-data, fail-closed, decision logic in a versioned lib) + signing → deferred, adopted behind their named triggers.
• Shared-schema convergence pattern (independent tools composing via one canonical contracts kernel) → the design principle for how the two lanes emit evidence without becoming one braid.
• Signed, hash-chained audit-log pattern → available to adapt later for credential/certification-integrity events (the genuine greenfield the estate has no purpose-built component for).

9. Preserved dissent (do not resolve away)

• Own the gate, don't rent your vigilance (Cunningham's self-dissent): phasing assumes someone notices when a gate becomes load-bearing and turns it on. The estate's own history — 37 drifted issues, stale-open umbrellas — is the story of a discipline that was supposed to be applied and quietly wasn't. If the team is genuinely too small to run AARs, it is too small to notice a graduation signal — in which case Option A's rigidity is a feature: the machinery fires whether or not anyone is paying attention. The AAR seam + deferred-gate register are the answer, but they are only as good as the person assigned to watch them. Real, unresolved.
• Deferral is how eval debt is born (Fowler's self-dissent, Beck concurring): a gate you "defer with a trigger" fires under deadline pressure — the trigger event (first paid member, first autonomous agent) is also the moment you least want to stop and stand up signing. The estate cost of turning these gates ON is near-zero because they already exist, so the honest argument for A is that the marginal cost of wholesale adoption is low and it removes the risk that phase 2 never happens. Teams delete oppressive ceremony far better than they add skipped rigor. Beck pushes further on the eval specifically: he wants the tier-leak eval and the per-flow prompt evals from line one, not phased. The decision takes the P0 eval now and lets the P1 flow-evals ride their triggers — a genuine disagreement, not a hedge.
• The third mirror might earn its keep (Torvalds' concession): dropping the project-tracker mirror down to "epics only" is the move most likely to bite. If E9 work is genuinely multi-repo from week one (learn hub + partner portal + CRM + dedicated iron), a single view may lose cross-surface work, and retrofitting the mirror onto hundreds of existing beads is the exact drift-reconcile pain we claim to avoid. The mirror is cheap if every mutation goes through the sync tool — the drift incidents were tooling misuse, not a design flaw. Concede the full mirror the moment E9 is multi-repo from the start.
• Make the change easy (Hickey's self-dissent, Beck's move): a single opinionated, already-integrated pipeline lets a small team push and get tracking + checks + gating turnkey. Insisting on separable seams imposes an assembly cost now, on people who would rather build the platform, to buy a decomposition benefit that only pays off later when something needs swapping. If the estate's braid works turnkey and the team never needs to swap a part, separability is a tax. The counter is a value claim, not a proof: a one-command "govern everything" pipeline trains you to stop distinguishing a cosmetic lint failure from a tier-leak.

10. Follow-up (beads to file in Phase B under the E9 epic)

1. Lock invariants I11 + I12 + I13 into the foundation spec §7; amend §7 so the tier-leak eval is recorded as a day-one gate, not an E9 deferral.
2. Stand up the triggered-phase governance subset (the §8 first-task bead): beads-on-Dolt log + one-directional views (epics only), the fail-closed tier-leak eval in the probabilistic lane, deterministic hygiene + escape-scan in their own lane, secrets/smoke/rollback, the AAR seam, the deferred-gate register.
3. Write the deferred-gate register with named, dated triggers + owners: signing + rollout-gate (first autonomous member-visible producer / first auto-deploy to member iron), full audit-harness taxonomy (enough code), P1 ranking + flow evals (their agents ship).
4. Configure the project tracker to render the nine E-track epics only; wire the one-directional bead→GitHub→tracker projection (never peer sync).
5. Specify the two-lane evidence contract (deterministic vs probabilistic) so both emit to one canonical schema without becoming one braid.
6. Author the per-track AAR template (decision link · surprises · which preserved-dissent tripwire fired) and make it a Settle-step deliverable.
7. Annotate the estate-governance map with per-gate retrofit cost (tracking log + tier-leak eval + lane separation = irreversible/build-now; signing, rollout-gate, full harness, third mirror = repoint/defer).

---

Panel transcript basis: estate-scout + Cunningham/Fowler/Torvalds/Hickey lenses, 2026-07-22. Follows the ADR-001 template shape; ADR-002…009 share it.