ADR-0020.

Date: 2026-07-16 Status: accepted Deciders: Thibault Souris (maintainer) Method: decision-loop — factual multi-agent audit of the gate, replay of the founding incident (ADR-0001) against the typed-pointer layer, challenge on false-positive risk, durable position

Context

The founding incident: an agent cited frontier-deterministic-boundary and shipped no grounding guard; the gate passed green. Typed pointers (ADR-0019) close the hollow-trace hole — the evidence now provably exists and is non-empty — but they still cannot say whether the pointed content has anything to do with the rule. A pointer at a real, non-empty, unrelated file passes.

The full "does it truly implement the rule?" judgment is semantic and stays out of the deterministic gate forever (ADR-0001, ADR-0007). But there is a deterministic middle that no ADR has claimed yet: some rules carry an executable specification whose load-bearing tokens are named in the rule text itself. frontier-deterministic-boundary prescribes assertGrounded, a GroundingError, a guard that "fails closed". If the cited evidence contains none of those shapes, the citation is not credible — and a grep can say so.

Decision

A rule may declare, in its frontmatter, an optional signature: — an ECMAScript regular expression (compiled case-insensitive) that the evidence of an applied row must match.

• Semantics. For an applied row of a signed rule, at least one evidence file that resolves (typed file:/test: pointer or path token) must contain a match for the signature. Declaring a signature therefore makes file-backed evidence mandatory for applied rows of that rule — that is the point of signing it. deviated and n/a rows are untouched.
• Blocking under --strict. A signed rule marked applied whose evidence matches nowhere is a violation, with the signature shown in the message so the fix is legible.
• Still a grep, never a judgment. The check upgrades "a pointer exists" to "the pointer points at something that has the rule's shape". Whether the shape is honest remains the operator's call at the gate, plus the adversarial verify workflow (ADR-0007). Zero LLM, zero execution, zero network — unchanged.
• Shipped conservatively. One flagship signature ships: frontier-deterministic-boundary, whose own executable spec names its tokens. Signatures are added rule by rule, each justified by tokens the rule text itself prescribes — never wholesale. A wrong signature is a false red, and false reds erode the gate faster than any gap. Operators own their mission's runward/rules/ copy (read first by the gate) and may add, tighten or drop signatures there.

Alternatives discarded

• An LLM judging cite-vs-apply in the gate. Rejected by invariant (ADR-0001); it already exists in the right place, advisory and agent-executed (ADR-0007).
• Signatures on every CRITICAL rule at once. Most rules have no canonical token (hexa-architecture matches no grep); forcing one manufactures false reds. Coverage grows only where a rule genuinely prescribes its shape.
• A separate signatures file (predicates decoupled from rules). Splits a rule from its own predicate — the frontmatter is the rule's contract surface, versioned and migrated with it (ADR-0006).

Consequences

• Positive. The founding incident is now caught deterministically end-to-end: cite frontier-deterministic-boundary, point at code with no guard shape, and --strict turns red. The credibility claim "the gate verifies the shape of the evidence" becomes true, not aspirational.
• Negative, accepted. A signature can be gamed by pasting the token into a comment — the gate raises the cost of the lie, it does not abolish lying; the operator still reads pointers. Signature maintenance follows rule evolution (a renamed guard idiom means a rule edit).
• On other boundaries. parseRuleMeta learns signature:; the evidence layer (ADR-0019) gains the match pass; the rule-authoring documentation and the floor workflow explain when a rule earns a signature.

Reevaluation trigger (mandatory, dated)

Reopen if a shipped signature produces a confirmed false positive on a legitimate implementation (fix or drop that signature immediately; reconsider the mechanism if it recurs), or if signatures spread to rules whose text does not prescribe their tokens — scope creep toward pseudo-semantic checking the gate must not claim.

Trigger set on: 2026-07-16 · Watched via: the conformance-gate incident log and each rule-set release review.

References

• ADR-0001 — the incident this closes deterministically; the invariant this respects.
• ADR-0007 — where the semantic judgment lives, unchanged.
• ADR-0019 — the pointer layer this predicate reads through.
• templates/rules/frontier-deterministic-boundary.md — the flagship signed rule.