Every gate can be talked around, except one
Every gate in this book can be defeated by a conversation. A card can be reinterpreted in a hallway. A threshold can be described as guidance. A refusal can be escalated to a room where the person who understands the refusal is not present. There is exactly one place in the stack where none of that works, and it is continuous integration. A test either passes or it does not. A hash either matches or it does not. This chapter is the cookbook for that layer: twelve promote stages, their inputs, outputs, and fail codes, deliberately the least elegant chapter in the book, because its subject is plumbing.
The fixture the whole book keeps returning to
A desk runs a challenger for twelve trading days, observes a +2% improvement, and submits a promote request. Nothing about the story is dishonest. The desk did the work, the number is real, the deck is persuasive.
Compute the arithmetic before any result is unblinded. The standard error, taking the reported interval's half-width as 1.96 standard errors: SE = 0.06/1.96 = 0.030612. Against a pre-registered minimum detectable effect of 0.05, the power of a one-sided test at 5% comes out to Φ(0.05/0.030612 - 1.645) = Φ(-0.0117) ≈ 0.4953. The exam had a forty-nine-and-a-half percent chance of finding the effect it was designed around. The desk pre-registered a coin flip and then read its outcome as news. The observed interval, +0.020 ± 1.96(0.030612) = [-0.040, +0.080], contains zero comfortably. And the sample size that would have answered the question at 80% power was computable on day zero: n ≥ 28. Twelve episodes held 12/28 = 42.9% of the mass the study needed to answer its own question, a fraction knowable before a single trade was run.
The fixture, written so a machine enforces it
As a unit test, the assertion block pins the arithmetic, not the label: verdict equals inconclusive; standard error equals 0.030612; power equals 0.4953 and is less than 0.80; the confidence interval contains zero; twenty-eight episodes required; mass fraction held equals 0.429; no lease issued; and the verdict enum has exactly three members.
Five of those properties generalise to every fixture in the library, and each one closes a real failure mode. Asserting verdict: inconclusive rather than verdict != allow matters because a stage that refuses everything passes the negative assertion and fails the positive one — a pipeline whose fixtures only forbid allow will happily ship something uselessly conservative, which gets switched off by an operator within a month. Asserting the standard error pins the derivation: change the interval convention from 1.96 to 2.0 standard deviations and the label stays inconclusive while the number moves, catching a silent convention drift no verdict-level test could see. Asserting n_required_80 == 28 converts a refusal into an instruction — the desk isn't told "no," it's told "twenty-eight," which is the difference between a gate that generates resentment and one that generates episodes. Asserting lease_issued == false reaches across stages, catching the integration failures that unit tests by construction cannot see. And asserting the verdict enum has exactly three members guards against the single most consequential regression available in this codebase: a refactor that quietly maps the three-way verdict onto a boolean and routes inconclusive into the truthy branch.
The hash must move in both directions, and getting it wrong in one is worse
Replay is the promise that an audit can reconstruct a decision, and it is only a promise if the reconstruction is bit-identical. The hash-boundary test has to be run in both directions, because both failure modes are quiet and each is fatal in a different way. Reword a comment in a card — change "the estimation window" to "the estimation period" — and the content hash must be unchanged. Get this wrong and every rewording breaks every lease; re-issuance becomes routine noise, and a real card change slips through unnoticed inside it. Change an actual threshold, 0.25 to 0.26, and the hash must change. Get this wrong and a threshold edit silently preserves the old binding, so every lease issued under the old number continues under the new one without anyone re-approving anything — a silent policy edit wearing the costume of a routine deploy. Getting the boundary wrong in this second, permissive direction is the more dangerous half, precisely because nothing ever fails and no alarm ever fires.
Twelve stages, one determinism boundary
This fixture is one of twelve stages, running from a feature pack that isn't lying, through binding the loss and measuring what the crowd disagrees about, through the powered-eval fixture above, through Holm/Benjamini-Hochberg selection when siblings compete, through world and family arithmetic, to a final accounting identity that catches a routed inconclusive before it reaches production. A card schema says what a valid object looks like. This chapter says what happens to that object on every commit, forever, without a human in the loop. That is the actual load-bearing wall: everything elegant elsewhere in this book only holds up because this chapter's plumbing never sleeps, never gets tired of an argument, and never accepts "it's basically twenty-eight" as twenty-eight.
Book: Chapter 30 in Rulers Before Models.