13 stages, 3 of which are a person.
Every stage names what goes in, what comes out, and what would make it refuse. A stage that cannot say what it produced did not run.
| # | Stage | Refuses when | Actor |
|---|---|---|---|
| 01 | Reuse mapWhat already does 80% of this? | Named the existing service/table/adapter for each need, with paths | auto |
| 02 | PRDWhat breaks today, and how will we know it is fixed? | Problem stated in 1–2 sentences | auto |
| 03 | ArchitectureWhere does this live, and what does it depend on? | Core vs application decided | auto |
| 04 | Design | Migration additive, RLS declared AND forced, service-role grants included | auto |
| ◆ | Gate 1 · agreementThe owner stamps the exact version under review | Scope cannot be inferred from a one-line prompt, and reuse-vs-rebuild is decided here | human |
| 05 | Test strategyWhat proves each criterion, at which layer? | Every acceptance criterion mapped to a layer | auto |
| 06 | Environment strategy | Which stacks must receive this, and which one serves real users (resolved, not assumed) | auto |
| 07 | Build | Nothing beyond the approved design | auto |
| 08 | Test execution | Build run UNPIPED; exit code read directly | auto |
| 09 | Deploy | Target stack resolved via DNS chain before deploying | auto |
| ◆ | Gate 2 · staging to productionThe owner live stamps the exact version under review | Three deploy failure modes are invisible to every automated signal — wrong stack, pinned traffic, empty bodies | human |
| 10 | Observability | Deploy boundary visible (which revision, since when, from which commit) | auto |
| 11 | Post-deploy testDoes the deployed host actually do this? | A real query against the deployed host, asserting on the BODY | auto |
| 12 | Monitoring | Alerts on user-visible symptoms, not causes | auto |
| 13 | Operational readiness | Rollback without a deploy | auto |
| ◆ | Gate 3 · declare liveThe owner stamps the exact version under review | A capability is done when someone who did not build it can operate it | human |
Six refusals, built into the shape of the code
Not policy. Not configuration. There is no method that expresses these.
Reach production alone
STAGED is the last state a build can reach on its own.
Ship a prototype
Own namespace, no production credentials, an expiry date.
Advance on a simulated build
Stub source control reports NONE. NONE does not pass.
Regenerate on no feedback
Rewriting an artifact requires saying what should change.
Approve what nobody saw
Approval is stamped onto the exact version under review.
Lose a decision
Every transition writes an audit event naming its actor — including refusals.
Adopting into a system that already exists
Four ports. Nothing else touches your estate.
A store
Postgres, MySQL or a document store. One writer per table.
A model-provider chain
Several vendors including a local runtime, behind one port. Failover recorded per answer.
Source control
GitHub, GitLab, Azure DevOps, Bitbucket. Changes arrive as pull requests.
A feature gate
Your flag system decides exposure. Rathvan never flips it for you.