Governance & gates

Generation is autonomous; consequences are not. Spine stops at two human gates, and nothing reaches the outside world without your approval.

The two-gate pipeline

Requirements → Intents → 🔒 GATE 1 → Grounded codegen + tests → Review → 🔒 GATE 2 → PR
                         human                                             human
                         approval                                          approval

The two gates are the only places the machine writes to the outside world — and both need you.

Gate 1 — intent approval. Spine proposes intents (planned changes). Nothing is generated until you approve.
Gate 2 — PR approval. After grounded codegen and tests, Spine stops. Nothing is pushed or merged until you approve.

Guarantees

Property	What it means
Policy-as-code	Rules live in version control, reviewed like any other code.
Append-only audit	Every action recorded. Nothing rewritten after the fact.
Replayable runs	Durable execution on Temporal — re-run a workflow deterministically.
Budget caps	Hard spend and step limits on any autonomous run.
Safe by default	`--safe` writes nothing external. Opt in to every side effect.