The board and its two gates

Work enters CC through a board with five fixed states: Triage, Todo, In Progress, In Review, Done — plus Canceled. They are the data model, not a preference, and they live in a database CHECK constraint precisely so that there is nothing to add a row to.

The names come from Linear’s default workflow rather than from us. A gate that sits over your tracker should not ask you to learn a fifth vocabulary for the same five things.

The states

State	What it means	How work leaves it
Triage	A one-line request. Nobody has agreed to it	Scoping it — the four fields
Todo	Scoped and accepted, not started	The main gate ↓
In Progress	A grant exists, bound to a branch	`cycle submit` — or `cycle pause`, back to Todo, handing the grant back
In Review	Work handed in, evidence attached	The closing gate ↓
Done	Closed, with an audit record	—
Canceled	Dropped. Kept, not deleted	—

Only two of those transitions check anything. The rest are bookkeeping, and calling them gates would dilute the word.

The main gate — Todo → In Progress

This is the one that mints access. It refuses to start work that has not been described:

The task spec is complete — goal, non-goals, affected zones, acceptance criteria.
Every declared zone exists in the zone map.
Any high risk zone the task declared for write has its owner’s approval.

Passing it produces a grant: time-boxed, bound to the task and to a git branch, opening exactly the zones that were declared and nothing else.

There is no command that opens a zone directly. Only the board issues grants: here, at the start, and afterwards only an owner’s answer to an access request widens one, while a renewal re-issues the same zones with a new expiry. That is the design’s load-bearing property — not a policy, an absence. A back door has to exist before it can be found, and the only route into In Progress runs through the gate.

The closing gate — In Review → Done

The second check asks whether the work can honestly be called finished:

A change manifest exists — what actually changed, computed from git by the CLI, or reported by the closer over the connector and labelled as reported in the audit record.
The task’s quality gate is satisfied, with evidence attached where one is required.
In governance mode, a file in a protected zone the task did not declare refuses the close, with the surplus named — and so does a file in a zone the task declared for read only (CC-1300). A file in no zone passes, and is recorded as a logged exception rather than silently accepted.
In governance mode, a high risk zone declared for write still needs an approval that was granted for this task at some point; the board’s close refuses one that never had it (CC-1300).

Closing without knowing what changed is precisely what the gate exists to prevent, so a missing manifest refuses the close rather than warning about it.

What the gate and the close judge a task by — its declared zones, its quality gate, its mode — cannot be edited once the task has left Todo (CC-1313). The rest of the spec stays correctable.

What the board does on its own

Every 15 minutes the board runs a bounded sweep (apps/api/src/autopilot.ts, CC-1346):

an In Progress task whose grant expired more than 7 days ago is paused back to Todo through the gate, with the reason on the record;
an In Review task with no pull request for 14 days is marked, so it shows up as needing attention;
where the board has a repository registered and a GitHub App to ask, an In Review task whose pull request GitHub reports as merged is closed — through the same closing gate, which still refuses what it would refuse anyway.

A pull request’s merge counts only when GitHub says so: from the signed webhook or from the board asking GitHub itself. A merge reported by the CLI, the connector or an agent is kept as a claim and never as proof, and the console’s Review and close needs a merge GitHub confirmed — without one it sends the reviewer to cycle verify --close, which checks the branch reached the trunk (CC-1330, CC-1346). The console’s GitHub page shows what the board did on its own and what is waiting on a person (CC-1350, CC-1351).

Where work enters from

Triage is deliberately cheap to reach. A request that has not been scoped is not work in progress, and making intake expensive is how teams end up with agents running against a sentence in chat.

The console — measured at 4.0 seconds in-browser for a one-line request, with the typing scripted (CC-23, 2026-08-04).
The MCP server — cc_intake, without leaving the session you are already in.
An API endpoint — POST /v1/<tenant>/<repo>/tasks with a title and a board credential. CommitCycle integrates with no tracker; a small bridge you write can file into Triage through this endpoint.

What the board is not

It is not trying to replace your tracker. The first version ships its own because mapping five fixed states onto a workflow your team can rename is a per-customer configuration problem wearing a feature costume — and the five states have to stay fixed for the gate to mean anything.