Today the gate re-runs three hundred checks for a one-line change, and throws every verdict away. This keeps the verdicts — with proof — so a change re-runs only what it can actually touch, and every skip carries a receipt anyone can recheck. Faster is the side effect. Verification becoming capital is the point.
Today. You fix a typo in a doc and open a PR. The gate re-runs all ~300 checks — twenty minutes of compute — exactly as if you’d rewritten the engine. Every one of those verdicts is thrown away the moment it’s printed. Tomorrow’s PR pays for them all again. We burn verification like fuel.
The idea. When a check passes, keep the verdict — and staple to it the list of what that check actually depends on. Now when your typo PR arrives, we ask one question per check: did anything this check stands on move? For most checks the answer is provably no — so they don’t re-run. They present their receipt. Your typo PR re-runs the three checks it can actually touch, not three hundred.
↘ go deeper — the vault is already built
The record and the refusal engine shipped in an earlier wave and are merged: buildDeposit (src/deposit/types.mjs:88-104) mints a verdict carrying its file foundation, environment fingerprint, and freshness pin; decideReuse (src/deposit/reuse.mjs) is the fail-closed court — its full predicate is the contract (foundation drifted, environment moved, completeness unproven, hermeticity unproven → RUN). Sink: tracked in-tree genome/deposits/<leg_id>.jsonl. This arc builds nothing that duplicates them — it populates, proves, integrates, and capitalizes. (Review round one caught an earlier draft reinventing this; round two verified the current text against disk.)
The obvious worry — which is the whole design. What if a skipped check would have failed? A skip that lies is a false green, the thing this company exists to kill. So a skip is earned, never assumed, three ways:
A check only gets skip privileges after we’ve watched what it actually reads and proven its dependency list covers that. No proof, no privilege — it just keeps re-running.
Any doubt runs. A dependency we can’t trace, a flaky history, anything uncertain — the check runs. Doubt never skips.
After every merge the full gate still runs everything and compares: a check we would have skipped that actually fails is a caught lie — alarm, privilege revoked, incident on the record.
↘ go deeper — how the watching itself is kept honest
Every check runs inside child processes, so a naive observer would watch the wrong process, see nothing, and approve everything (“covers everything it reads” is trivially true of an empty observation — the re-review’s catch N1). So the tracer rides inside the check’s own process, and every observation run must first prove it can see: a planted read it MUST record, or the whole run is void and grants nothing. The comparison run after merges is the field’s hardest-won practice (Microsoft ships exactly this side-by-side protocol; Google runs the full set after every submit) — and it’s near-free here because the full run already happens. Structural ceiling, stated honestly: at most ~60% of the 303 checks can ever be skippable; the rest always run, named and counted.
The tripwire. If keeping receipts ever costs more than just re-running the checks, we stop and study why. Built in from day one, judged by a real side-by-side — the same changes run both ways, wall-clock against wall-clock — never by our own savings estimate.
Why this is the jewel and not a CI optimization. Anyone can cache test results — the industry does, and its postmortems are full of caches that lied. What nobody ships is a skip that proves itself — a receipt a stranger can recheck with one command, without trusting us. That’s attestation, the thing that appreciates. Faster gates are the side effect; verification becoming an asset that compounds instead of evaporating is the point.
↘ go deeper — the field receipts behind that claim
The frontier scan (docs/ai/FRONTIER-stage2-incremental-verification.md, every load-bearing citation re-fetched from raw): Bazel’s own docs admit machines wrongly share cache hits on untracked toolchains; a 9.4-critical CVE lets a PR author poison a remote build cache; Meta’s selection model is production-gated at 95%/99.9%. And the sharpest finding: no tool scanned treats provable completeness of the dependency closure as a first-class fail-closed gate — every one trusts its closure or falls back on an enumerated blind-list. Our fail-closed fence is the genuine divergence — and it is already implemented in the merged court, not a promise.
The build — five slices, in order
Teach the court. Tell it what each of the 303 checks depends on — and prove every claim against what the check actually reads before any skip is granted. The load-bearing slice: a wrong dependency list is where a lying skip would be born.
Prove the controls. Touch nothing → everything eligible skips, zero false alarms. Gut the court on purpose → it must get caught. Touch one file → exactly the right checks wake up.
Stand up the comparison. The post-merge full run diffs against what would have been skipped — the net under everything, the one instrument that catches a blind spot nobody named.
Wire it in, behind a flag that starts OFF. PR runs get the court once 1–3 are green; merges stay full forever. One revert turns it all off.
Make it capital. The one-command stranger’s recheck, and the honest A/B ledger of what this actually buys.
Already settled (so you don’t re-decide it)
The verdict vault that already shipped stays the vault — nothing gets rebuilt or duplicated.
Doubt always runs. Skips are earned by proof, never granted by configuration.
Flakiness is measured, not hand-listed — a check whose answer flips with nothing changed loses its privilege automatically.
Our savings counter never testifies — only the real side-by-side does.
What could actually go wrong
A blind spot nobody named. Then a stale green ships — once. The comparison run catches it in bounded time, revokes the privilege, alarms. The design assumes this WILL happen and budgets for catching it, not for being perfect.
Receipts cost more than re-running. The tripwire fires, we stop and study. Stopping is a ratified outcome, not a failure.
The win is small. If most checks reach most files, few skips happen. The report says so honestly — and the receipt machinery still stands for the next stage.
Your calls
1 · How often the comparison runs.
Every merge (a lie caught within hours; my rec — the full run happens anyway, the diff is the only addition) or nightly (cheaper bookkeeping, slower catch).
2 · The doubt list.
The list of things that disqualify a check from skipping: dependencies we can’t trace, files the graph can’t read, checks living outside the graph, environment drift. That list being complete is the one place this design could quietly go wrong. It wants your paranoia more than anything else on this page.
3 · The smell test.
If any of this reads as “we made CI faster,” flag the sentence — that’s the drift this spec exists to prevent.