Droplet Sentinel

Merge Gate AuthorityRelease Approver Governance

The independent, merge-blocking quality gate. Evidence enters once; corpus-backed lanes judge it into a signed, immutable verdict.

Probing…acmetenantretries safe — Idempotency-Key stamped (ADR-0039)

Quality Law (Release Criteria)Service guide

Identity context (preview)

sample preview

Override and lane-register are gated by the caller identity the edge stamps. Until the proxy forwards it (A1), set a previewed identity to see the server's structural bars — the independence wall (factory/agent hold zero authority) and the Release Approver requirement — before you send.

SubjectTier factory agent

Tier 0 human: may register a lane, but not override (Release Approver only). The judge stays independent either way.

Lane catalog (law-as-code)

The lane catalog is platform-shared, not tenant-scoped — a register / sweep / quarantine affects EVERY tenant's future judgments. Higher blast radius than a per-candidate action.

Lanes unavailable — load failed.

Register a lane

sample preview

A lane may reach blocking only with BOTH a fire corpus (cases it should catch) and a must-not-fire corpus (cases it must stay silent on). “A lane that can't prove its silence cases is a rumor, not a rule.” Corpora are comma-separated case IDs.

nameownerseverity

fire corpus (comma-sep)must-not-fire corpus (comma-sep)

⚠ Would be rejected 422 (ErrUntestedLane): “a lane cannot be blocking without fire and must-not-fire corpora.” Ship both corpora, or register as advisory instead — an untested lane fails open for blocking.