# Quality gates — v100.0.29-consistency-architecture-quality-foundation-wip

## Required on every future patch

1. Release identity validation, exact UAIX URL, and exact three-part packaging mode.
2. PHP syntax for `src/`, `config/`, adapters, layouts, and tests.
3. Typed contract tests with zero failures.
4. No duplicate resolved script paths.
5. Route alias and dynamic-capture tests.
6. Catalog cardinality and required-field tests.
7. OpenAPI JSON/YAML mirror parity and stable operation IDs.
8. Deployment-manifest runtime conformance after all source changes.
9. Embedded/public/standalone UAI parity.
10. Changed-file manifest against the immutable baseline.
11. Three-part non-overlap and clean combined extraction.
12. No ZIP64, symlinks, traversal, Windows-invalid names, or case-insensitive collisions.
13. Explicit false acceptance boundaries unless separate live evidence exists.
14. Runtime-dependent generated evidence is outside the deployment component hash, while its executable producer remains hashed.

## Ratchets

- New PHP code must be namespaced and typed under `src/` unless it is a documented compatibility adapter.
- New endpoints must not add direct `header()` or `exit` ownership.
- New configuration, route, and script dependencies must be added to canonical config rather than copied into page logic.
- New release tools must reuse `tools/release_core/`.
- Generated evidence that reads deployment identity must not be added to the same deployment component hash.
- The count of unresolved P0 debt items may not increase without an explicit register entry and owner rationale.

## Current executable result

The architecture audit recorded **13/13 passing gates**. The PHP contract suite records **15/15 passing tests**; final validation reruns the same executable suite after metadata and UAI regeneration.

## Non-claims

Passing quality gates is not deployment, live-host acceptance, provider acceptance, human review, activation, or independent research verification.