gate-manifest
A hash-chained evidence ledger recording what each ADLC gate verified, with optional HMAC signing so the chain attests authorship, not just consistency.
gate-manifest
ADLC: C11 cross-cutting provenance · Gate: every gate's verdict is recorded in a tamper-evident chain that CI and the P6 reviewer can verify.
What it defends against
Agentic code arrives at the merge gate with no memory of what was checked along the way.
gate-manifest is the append-only ledger the other gates write to: spec-lint, hollow-test,
rails-guard, and review-calibration each record what they verified into .adlc/manifest.jsonl.
Every entry's prev is the SHA-256 of the previous raw line, so tampering with any line
breaks the chain. Set ADLC_MANIFEST_KEY and each entry is additionally HMAC-SHA256 signed:
without it the chain proves only internal consistency (anyone who can write the file can
forge a clean one); with it, the chain attests authorship and defeats the forge-from-scratch
attack. It spans phases rather than owning one, and it gives auditors and the P6 gate the
provenance that agentic code was checked before it shipped.
Usage
adlc gate-manifest record <gate-name> [--ticket id] [--data '{json}'] [--files a,b,c] [--dir path] [--json]
adlc gate-manifest verify [--json] [--dir path] [--allow-legacy-unsigned]
adlc gate-manifest show [--ticket id] [--json] [--dir path]
adlc gate-manifest attest [--ticket id] [--dir path]
adlc gate-manifest repair-chain --reason "..." [--write] [--attest-unsigned] [--json] [--dir path]| Verb / Flag | Description |
|---|---|
record <gate-name> | Append one entry to the ledger; signs it when ADLC_MANIFEST_KEY is set. |
verify | Walk the raw lines and validate the hash chain (and signatures, when keyed). |
--allow-legacy-unsigned | Tolerate a missing signature on the contiguous legacy prefix (entries before the first signed entry) only — a missing sig after that point, or any invalid signature anywhere, still fails. |
repair-chain | Preserve and rechain a ledger produced by an older incompatible writer; dry-run unless --write is supplied. |
--attest-unsigned | Explicitly authorize keyed repair to sign previously unsigned entries; their count and original lines are audited. |
show | Print entries, optionally filtered by ticket. |
attest | Emit a Markdown gate-evidence table suitable for a PR comment. |
--ticket id | Associate or filter entries by ticket id. |
--data '{json}' | Arbitrary JSON payload for record; malformed JSON is a hard error. |
--files a,b,c | Comma-separated paths, each SHA-256 hashed (missing files hash to null). |
--dir path | Override the ledger directory (default .adlc). |
--json | Machine-readable output. |
Exit codes
record, show, and attest always; verify when the chain (and signatures, if keyed) is valid.1: operational error. Bad input, unreadable file, or malformed --data JSON.2: verify gate fails. The chain is broken (reports the seq and line of the first break).Prosecution, runner acceptance, rails evidence, and manual records share one
atomic chain writer. Repair refuses an already-valid ledger, preserves the
original bytes in a hash-named backup, and requires the original matching
signing key when signed entries are present. Every existing signature is
verified before repair rewrites anything. A keyed repair that would sign
previously unsigned entries refuses unless --attest-unsigned is supplied and
records their count and original line numbers.
Example
$ adlc gate-manifest record hollow-test --ticket T-42 --data '{"survived":0}' --files src/calc.mjs
recorded: seq=2 gate=hollow-test ts=2026-07-05T18:04:11.220Z (unsigned)
$ adlc gate-manifest verify
chain valid (2 entries)
exit 0Go deeper
behavior-diff
Captures each route's observable HTTP behavior before and after a change, then diffs in behavior-space so the human reviews six items, not a 5,000-line diff.
hollow-test
Diff-scoped mutation gate. Mutates only the lines your change touched and fails if any mutant survives your test suite, which proves the coverage is load-bearing.