Gate: proof-crosses-boundary
A rule asserting a relation with another unit has the code importing that unit.
| Property | Value |
|---|---|
| Checker | proof-crosses-boundary |
| Confronts | spec |
| Blocking by default — new project | yes |
| Blocking by default — existing project | no — informs |
How it measures
Section titled “How it measures”Confronts a spec against the question the whole unit leaves open: a rule says it mirrors another unit — does the governed code actually IMPORT that unit, or is the claim prose while the proof stays local?
The measurement comes from an audit of 51 spec×code divergences in a reference app (2026-08). The three GRAVEST findings had the same shape: two sides defined the same thing, each side had its own test, and each test confronted its OWN copy.
| finding | the divergence |
|---|---|
| RFB codes | 12 = “Terreno” in the app, 12 = “Casa” in the backend — and the document filed with the tax authority carried the wrong heading |
| balance filter | === 'statement' in the app, !== 'invoice' in the backend |
| minimum boundary | <= on two screens, < on the third and in the audit |
In every one of them 53 gates stayed green — correctly, by the rulers they had. The unit was complete: rule declared, scenario written, test whose title matched. What no gate asked was whether the PROOF reaches the other side.
The case that motivated the design is ALIVE in the repository and has not yet diverged:
the seat-price rule declares “the price mirrors the backend orgBilling.ts — diverging here lies
about the billing”, the scenario says “the two values are the same the backend charges”,
and the test does expect(SEAT_PRICE.individual).toBe(15). It proves it is 15; it does
not prove it is the same the backend charges. Changing the backend to 18 keeps everything
green.
What separates it from its neighbours: unit-complete asks whether the test exists,
feature-test-match confronts scenario against test case, rule-implemented asks whether
the rule reached the code — all three answer “yes” about a rule whose proof never leaves
its own file. And like dependency-honored, this gate charges only what the spec DECLARED:
it does not go hunting duplicated concepts across the project.
Declaring it
Section titled “Declaring it”gates: - name: proof-crosses-boundary on: [spec] check: proof-crosses-boundary