The closing gate

Done is not a column you drag a card into. In Review → Done is the quality gate, and it checks two things:

Diff ⊆ declared zones

The whole diff, compared against the task’s Affected zones — every touched path either falls in a declared zone, in unprotected space, or in a generated: exemption. Anything else fails the close, with the surplus named. This is the same check Layer 3 runs on the pull request, from the same shared implementation, which is what makes a laptop that lied about its hook irrelevant by merge time.

The inventory comes from observation, not memory: the hook logs every mutation as it happens, and the close cross-checks that log against the git diff. Disagreement between the two is itself a finding.

Evidence, per quality gate

Each task carries a quality gate chosen at scoping — none, visual review, API contract check, regression suite, or QA sign-off. The gate demands its evidence — a URL, an attached capture, a green run — and CC never executes anything to get it. Demanding evidence and checking it keeps the product out of your execution path; anything that runs on your behalf would be blast radius added, not removed.

The audit record

Every close writes a markdown record: what was declared, what was touched, what evidence closed it, who approved what, and — the section that makes the records worth reading — what was not proven. The record is legible without the tool, which is the point: it’s the artifact you hand a skeptical CTO, not a database row you export for them.

Running it

cycle verify                  # the checks, without closing
cycle verify --close          # close it, and write the audit record

Two flags matter at the edges. --evidence <url|path> attaches what the quality gate asked for. --override "reason" closes when the checks cannot pass for a reason a person will put their name on — it records the bypass rather than hiding it, which is the only version of an override worth having. An override does not answer the evidence check, because a signature cannot stand in for the evidence itself. Run cycle verify --close again with --evidence and a URL, or a path committed in this repository.

There is also --from-history, for work that merged before it closed. Such work cannot be verified from its branch — the merge base is the tip, so the diff is empty — so the manifest is rebuilt from the task’s own commits in the trunk, and labelled as such so no record mistakes it for a branch diff.