Droplet Sentinel
Merge Gate AuthorityRelease Approver GovernanceThe independent, merge-blocking quality gate. Evidence enters once; corpus-backed lanes judge it into a signed, immutable verdict.
Identity context (preview)
sample previewOverride and lane-register are gated by the caller identity the edge stamps. Until the proxy forwards it (A1), set a previewed identity to see the server's structural bars — the independence wall (factory/agent hold zero authority) and the Release Approver requirement — before you send.
Tier 0 human: may register a lane, but not override (Release Approver only). The judge stays independent either way.
Independence board (independence rule)
LIVE DATAThe judge is independent of the thing it judges. A factory or agent identity holds ZERO verdict authority — barred from override AND lane registration by construction, before any tier check. “The factory cannot grade itself, nor unblock itself.” This is the moat no benchmark ships.
- Verdict signing key: lives only in the Droplet-exclusive droplet-exclusive-key Vault/KMS tier — unreadable by any factory credential. The key and raw signatures are never displayed; verdicts show a verify-pass status only.
- Zero-authority proof: no overrides in view — no waiver has been granted. —
- Human-approver ledger: every merge-waiver traces to a Release Approver human that paged Olu — never an agent, never the factory.
- Quarterly red-team of the independence wall — fixture placeholder (evidence pack lands here in production).
Bypass probe (security event)
LIVE DATAThis is an automated security probe, not an operator action — it asks “was a merge-around attempted on this blocked candidate?”, it does not attempt one. A #28 event (#28:gate-bypass-attempt) is raised only when the candidate is blocking-red with no active override.