Gates

A claim about the code that is not a test is a box someone ticked. CVN ships its gates as functions so a repository's tests can assert them against its own files.

Purity

import { checkPurity } from '@enc-protocol/cvn/gates'
const violations = checkPurity({ 'kernel/a.ts': srcA, 'kernel/b.ts': srcB }, {
  exempt: { 'kernel/host-glue.ts': 'the one file that names the platform, by design' },
})
assert.deepEqual(violations, [])

Forbidden globals: window document localStorage sessionStorage navigator fetch setTimeout setInterval XMLHttpRequest WebSocket Buffer process require __dirname. Forbidden members (not namespaces): Date.now Date.parse new Date Math.random performance.now. Strings, template literals, comments and regex literals are stripped before matching — /failed to fetch/ once counted as two uses of fetch. An exemption without a reason throws.

Port contracts

import { declaredInInterface, declaredByDestructure, suppliedInLiteral, diffPorts, untravelled } from '@enc-protocol/cvn/gates'

Three failures, each silent at runtime, each named here: a declared port nobody supplies (missing), a supplied port nobody declares (extra), a declared port nobody travels (untravelled). Wire all three into the repository's fast tier.

Log gate

node tooling/log-gate.mjs <log> [...] refuses a run whose captured console contains a TypeError-class message, an unrouted Cmd, a failed unwrap, or a ladder rejection — de-duplicated and counted. An exemption is a regex with the spec's name and the reason, never a wider pattern.

Certificates

node tooling/certify.mjs check | run | hash <tier> — see Testing cadence.