How the build gate decides a build

Part of enforcement control, completion enforcement. The policy the gate applies — a build, compile or test waits until every open item carries a repair — is on the completion policy and work registers page; this page says who decides it and what the gate answers.

#Oko decides, the gate asks

block-one-off-repairs keeps no count of open work. For every compile it asks Oko's one admission decision, oko admit build --product <product> --session <id> --json, once for each product the command builds. Oko answers from the operator's rulings first; where none decides a session's build, compile or test, from his standing rule that it waits until every open defect is repaired or kept as a claim and every task the newest control pass owes carries a repair (oko tasks owed). An item the build itself unblocks — an open blocker that names it and waits (oko blockers record --waits-on) on a defect whose repair is pushed — is not waited on; oko blockers held lists those items, and the stop gate (block-stop-with-open-work) holds exactly the same ones.

#The session's own build attestation comes first

Before any consent or ruling is read, every build, compile, format or test the gate knows — cargo build, cargo test, cargo check, cargo fmt, rustfmt, stado product cargo and the other toolchains' compile subcommands — needs the session's own build attestation. The agent writes it and records it with tama attestation record --file FILE --session <id> (or Tama Desktop's Recorded attestations section) from a document whose "standard" is "build", attesting each claim of standards/build.json with "confirmed": true and a "how" of at least the operator's stated attestation minimum (attestation_min_words, 100 words) in its own words:

{
  "standard": "build",
  "attestations": {
    "building_is_not_marginal": {"confirmed": true, "how": "…"}
  }
}

• building_is_not_marginal: building, compiling, formatting or testing now is not marginal — the work it serves cannot be finished or proven without it, and reading the code does not replace it.

Whether open work holds the build is not attested: it is Oko's one admission decision (oko admit build), read from the operator's rulings and quoting the one that decided, so a ruling that admits a session's build — a build-and-test session he ordered, for one — is never refused by a copy of his policy kept in Tama.

An attestation that falls short is not kept (stands: false with every reason). A build the gate admits spends the attestation, once per command line however many compiles it runs, so the next build needs its own. Without one the build is refused with `<build>` builds, compiles, formats or tests, and no build attestation of this session admits it: session <id> needs its own build attestation, and none is recorded: write it and record it with …; a recorded attestation that no longer stands is named with its reasons, and one that cannot be read or spent is named with its cause.

#What the gate answers

• A consent the operator gave in this conversation (the build capability of this session) is read first; a build it admits only asks oko admit build without a session, so a standing withdrawal still refuses it but no open work is read, and stderr says build admitted by that consent. No build is ever asked of him.
• A standing withdrawal (no-build or no-build:<product>): the build is refused quoting the ruling Oko answers with, whatever else consents.
• A standing consent (build or build:<product>): the build is admitted, and stderr says build admitted by the ruling.
• No ruling, no consent of this conversation, and Oko holds the build on open work: the build is refused with `<build>` builds, compiles or tests, and Oko does not admit it: build waits until every open item carries its pushed repair, and <n> open item(s) carry none, first <item>; …, followed by the route to repair and record each item.
• No ruling and nothing held: the build is admitted.
• Oko installed but unreadable: the gate does not take silence for an admission; the build is refused with Oko's admission could not be read (<cause>); an unread answer is not an admission. A machine with no Oko CLI has no register and no rulings, so nothing holds the build there.

Each Oko reading the gates make announces itself on stderr through the shared wait mechanism before it waits and when it ends, so a reading that stands still names the command it stands on.

#Qualification

tests/build-gate/attested.rs runs the built gate with a whole-session build capability: a build, rustfmt and cargo fmt without an attestation are refused naming how to record one; an attestation with short explanations, or without building_is_not_marginal, is not kept and admits nothing; stado product install <product> --plan is not held for an attestation; a standing one admits one build and is spent by it, and the next build is refused. tests/build-gate/consent.rs and tests/build-gate/standing.rs attest each build they expect admitted, then run the built tama hook block-one-off-repairs the way OMP's PreToolUse dispatch runs it, on a signed-in host, against the installed Oko CLI with defect, blocker and ruling registers of the run's own (OKO_DEFECT_REGISTER, OKO_BLOCKER_REGISTER, OKO_RULING_REGISTER) holding one open defect recorded through oko defects record with no repair: without consent the build is refused naming that item; a whole-session build capability and a standing build:<product> ruling admit it; a newer no-build:<product> ruling refuses it quoting the withdrawal, even with the capability. Oko's own journey oko/tests/constraints/open_work.rs covers the rule itself, the held items and a run naming no session.