Proving what the agent built

The construction node finishes and the agent reports success — tests pass, lint clean, build green. Sometimes that's true. But the agent is narrating its own outcome, and a vendor's tool grading its own agent is the fox auditing the henhouse. Nothing is proven yet.

The agent's own ok never decides an outcome. Green has to be a fact Cadora observed — not a sentence the model emitted.

Cadora runs the gate itself — the same command a CI job would: ruff check . && pytest -q. Not a summary, the actual process, in the node's workspace. A zero exit with real tests is a pass; a non-zero exit blocks the run.

The gate is fail-closed: ambiguity resolves against the agent. There is no "agent says it passed" path — only the process return code and what Cadora reads out of the output.

A gate can be gamed. Under an offline sandbox an agent can stand up a local script named pytest that always exits 0, or leave functions hollow — raise NotImplementedError — that weak tests skip over. So a separate deterministic scan reads the workspace for counterfeit or substituted tooling. It runs alongside the gate.

Integrity is deterministic too — it catches the dishonesty the shell can't express (a fake pytest, hollow code that tests pass over) without ever asking an LLM to judge.

Two nodes, side by side. One ran real tests against a real toolchain: green, and here green is a fact. The other exited 0 but its suite ran zero tests — a vacuous pass. The command ran; it verified nothing. Cadora refuses to green it.

A green that certifies a suite which tested nothing is exactly the false-green the gate exists to prevent. Substance over a green exit — red isn't failure theatre, it's an honest "not proven yet."

The outcome lands as a badge on the node. gate passed in green; gate vacuous or gate blocked_prerequisite in amber — it ran, but proved nothing; integrity clean or flagged. When a node is blocked, a failure panel shows exactly why.

All checks passed!
no tests ran in 0.01s
warning: No Python files found under the given path(s)

Amber is reserved: it means ran, but proved nothing. The failure panel is the gate's own output, verbatim — not a paraphrase — so the reason is inspectable, not asserted.

Every gate outcome is archived whole — the status, the command's output, the exit code, what tooling was provisioned, and any integrity findings. A run's "green" isn't a claim you must trust; it's a record you can open later and read. That is what audit-grade means: not that the agent said it worked, but that Cadora proved it — and kept the proof.