Skip to content

Finding — the deployed gate, read directly, and what it says about three of RTOpacks' four questions

0. Why this document could not have been written yesterday

Baton D's every live-substrate line reads ALEX-ATTESTED, NOT CLAUDE-VERIFIED. Today's ruling gave this seat workers_get_worker_code. Deployed source can now be compared against committed source, which is a class of verification neither seat could perform before — Alex could read both but is the one who deploys, and this seat could read neither.

The binding was checked on returned content before anything below was relied on, per the standing guard: 22 Workers, all UCCA-shaped, zero RTOpacks-shaped.

1. Deployed matches committed — predicate for predicate

The deployed artefact is an esbuild bundle: comments stripped, __name() wrappers added, undefined lowered to void 0. It is therefore NOT byte-comparable to the committed file, and no digest equality is claimed. The comparison made was structural, function by function, over every predicate on the forward path.

Every one is identical. No deployed/committed divergence exists in the gate. Recorded because the opposite result was live until it was checked, and because this house has twice this week asserted a mechanism without establishing the path.

2. Q3 — the validation booleans. The answer is neither

RTOpacks asked whether the gate trusts validation.structural_valid / semantic_valid or re-derives them. Deployed source, verbatim:

function validationBlockOK(t) {
  return !!t?.validation;
}

It checks that the validation key exists and is truthy. It never reads either boolean.

  • validation: {} → passes.
  • validation: { structural_valid: false, semantic_valid: false } → passes.

And nothing downstream reads them either. Every occurrence of those two names in the engine repo is a write, a dataclass field declaration, a DDL column, or the TGA adapter computing them on the producer side. reasoner/consumer.py contains no reference to either name. They are written to D1 and never consulted for any decision.

So the honest answer to RTOpacks is stronger and less comfortable than either option they offered: on the forward path the booleans are decorative. A compiler asserting false on both is treated exactly as one asserting true.

What this is NOT. It is not a bug against the gate's own design. ADR-0002 makes the gate structural — evaluating semantic validity there would be the domain knowledge the throat is forbidden to carry. The defect is not the behaviour; it is that a required field's contract is unwritten. Either the contract says "presence only, contents unread", or the field earns a reader, or it goes. That is Tim's, and it belongs in the runnable-state document either way.

3. Q4 — the two empty payloads. The gate half is answered; the reasoner half is not

There is no outcomes check anywhere in the gate. Walking a generation payload carrying only triumvirate_schema_version, source_code and validation through runGateChecks in deployed order:

check result
JOB_TYPES.has(job_type) pass
ACCEPTED_TRIUMVIRATE_VERSIONS.has("1.0") pass
structureOK — b.triumvirate truthy pass — presence only
adapterSignatureOK pass — return true
referencesOK pass — return true
validationBlockOK pass — container present
limitsOK pass — return true

The gate accepts a generation payload with no title, no application and no outcomes. By construction, not by accident. RTOpacks asked without insinuation whether the forward path fails open on empty outcomes. At the gate it does.

What the reasoner then did with those two jobs is D1 and R2 and is NOT asserted here. If they sealed failed, the shape is sound and the real sample is 39. If they produced an envelope, the fail-open runs the whole length of the path. That is the single most consequential open question in this document and it is Alex's read, not this seat's.

4. Unasked, and it matters more than either — three error codes cannot fire

async function adapterSignatureOK() { return true; }
function referencesOK() { return true; }
function limitsOK() { return true; }

Unconditional in the deployed bundle. Therefore GATE_SIGNATURE, GATE_REFERENCES and GATE_LIMITS can never be returned. The committed source marks the first and third // TODO §7.1 / // TODO §7.3; the deployed bundle carries the same stubs with the comments stripped.

Reachable today: GATE_STRUCTURE, GATE_SCHEMA_VERSION, GATE_UNVALIDATED, GATE_AUTH. Dead: the other three.

Why this is urgent rather than tidy. RTOpacks named the error model as owed into the runnable-state document. A client handed seven codes will build handling for seven. Three of them describe protections that do not exist — and GATE_SIGNATURE in particular reads as "the gate verifies your adapter's signature", which it does not. Publishing that list unqualified would be an over-claim against the client in the same direction as the one withdrawn yesterday.

Related, minor, recorded so it is not rediscovered: every runGateChecks rejection calls reject() with element = null, so gate_rejects.fault_location is always NULL for check failures. The column works; nothing populates it on that path.

5. The submission contract, read off deployed source — the thing RTOpacks put first

Endpoint host submit.ucca.online, established from observability, not from config.

  • POST /v1/jobs — Authorization: Bearer <token>. Success 202 → { job_id, status: "accepted" }.
  • GET /v1/jobs/{job_id} — same Bearer. Returns { job_id, status }; on completed the UCCO envelope inline from R2 at envelope_ref; on failed the failure_code. A job belonging to another client returns 404, not 403 — non-ownership is indistinguishable from non-existence, which is the correct choice and should be stated so nobody builds a retry on it.
  • Auth — the token is SHA-256'd and matched against client_credentials; rejected if unknown, revoked, expired, or lacking submit in scopes. Fail-closed → 401 GATE_AUTH. The token is never stored, logged or echoed.
  • x-ucca-client is NOT identity. It is recorded as source_identity on rejects only. Identity comes from the credential — credential → client, never payload → client.
  • Error body shape: { error_code, severity: "reject", phase: "gate", affected_element, message, remediation }.
  • Health: GET /_health → {status:"ok",surface:"gate"}; GET /_build → {surface:"gate",version:"0.1.0-spine"}.
  • On accept: payload to R2 at default/payloads/{job_id}.json, job row accepted → queue send → queued.

0.1.0-spine is what /_build reports. It is a string in the source and is not evidence of anything else.

6. Q2 — not answered, but bounded, and the bound is useful

The caller is not named by anything readable from this seat. D1 is out of reach; the jobs table as written by the gate stores no IP, no user-agent and no fingerprint.

What was established: across the full window 2026-07-24T06:00Z → 2026-07-31T06:00Z, ucca-gate received ZERO POST requests. Every logged trigger is GET or HEAD. The unnamed process has not submitted for at least seven days.

Stated as a bound, not a clearance. Seven days is the retention limit, the jobs date from 2026-07-20, and dormancy is not identity. RTOpacks' request stands exactly as they made it.

The lead this seat could not follow, and the reason the D1 query should select more than timestamps: the gate persists webhook_url from the submission. If any of the seven rows carries one, that URL names the caller's host. The query should return it.

Context, unsolicited but relevant to a credential question: submit.ucca.online is publicly exposed and continuously scanned. In the same window the gate served 404s to probes for /.env, /.env.production, /.aws/credentials, /.git/config and forty more. Nothing leaked and no probe reached an authenticated route — the gate 404s everything off-route. It is background internet noise, it is named so nobody mistakes it for the unidentified caller, and it is a reason to prefer rotation sooner over later.

7. What is NOT established

  1. What the reasoner did with the two empty-outcome jobs. D1/R2. The sharpest open question here.
  2. What holds the rtopacks credential. D1 — and webhook_url is the lead.
  3. Whether any node other than ucca-gate accepts submissions. Not checked. Absence is not provable from this seat — the connector reaches Workers, not R2, D1, KV or containers, and a read this connector cannot make is a question for Alex, never a negative result.

RECEIPT-CHECK: echo this line's end before acting.