Every change clears contract checking, blast-radius validation and signed ratification before it merges. Nothing reaches production on assertion alone.
Tier 1 · Contracts
The cheapest pass goes first. Interface and type-level contracts are verified in a fifth of a second, so a broken signature never consumes a full review cycle.
Tier 2 · Coherence
The change is walked outward through its dependents to find what it actually touches — including the governance and QA structures attached to the code, not just the imports.
The passes
Each tier is cheaper than the one after it, so the common failures are caught first and the expensive analysis only runs on changes that have earned it.
0.2s
Type and interface parity against every declared consumer.
0.4s
Blast radius, cross-file side effects and regression cover.
Human
A person rules on anything the first two tiers escalated.
Merge
The signed record of what was checked, and by whom.
Ratification
Every merge carries a cryptographic nonce binding the diff to the checks that cleared it. Months later you can still show which gates ran and what they saw.
Review tiers
Contract pass
Coherence pass
Merges nonce-stamped