Invariants, non-goals and givens

7. Global invariants

I1. Nothing lands untested in the combination it lands in (10, 11, 22).
I2. A session never moves a branch (1).
I3. Every failure has exactly one culprit, named only once everything ahead of it is known (17, 18).
I4. A branch never moves past what passed, and never from a revision other than the one its candidate was formed on (22, 24).
I5. sluice runs no check, starts no service and chooses no port (30, 31).

Running checks, caching their outputs, or hosting an executor.
Describing a repository: its parts, what a change affects, what a check reads. That is the repository’s description, read through B.2.
Deciding policy: which checks gate a branch, whom to trust, how flaky reads.
Approving or reviewing work. A verdict is evidence for a person or a platform, never an approval.
Submissions that span repositories.
The forge’s own pull-request flow for contributors outside the fleet.

Constraints already fixed:

Repositories are git repositories, and places are git worktrees.
Branches are named by convention, so a target is known from its name: the shared branch, a bolt’s branch, a unit’s branch, a fix’s branch.
sluice is free and open source.
sluice is written in Rust.

The rest of the stack, which a model builds on unless it says why not:

The task runner that declares inputs and caches by content is moon, with its cache shared by every place on a host.
Places are managed by worktrunk, which runs a repository’s hooks and tethers processes to a place.
The drivers are crew and flywheel; the forge is GitHub.
Records are plain JSON, kept on one host under the repository’s common git directory until several hosts submit to one branch.
A branch’s policy is a file checked into the repository.