S2 · Isolation gate

Two jobs. Decide whether the design can be expanded, and cut the raw spec into rules. Unlike the previous stage, both are code.

Stop it before you build it

The design gate answers exactly three ways: expandable, defective, error. Defective sends it back for a repair loop, and the attempt count is tracked so it can’t ping-pong forever.

Without this gate, a defective design produces several hundred rows and the review stage discovers it afterwards. Rows built from a wrong design are cheaper to throw away than to fix. So the check happens before they exist.

This is not reading the same document twice

The previous stage already reviewed the design once. It gets read again here. That looks like duplication. It isn’t.

The earlier review was read by an LLM. This one is read by code.

They fail to see different things. An LLM reads meaning and routinely lets format violations through; code catches format exactly and cannot see “does this case make sense” at all. So it is two different kinds of eye on the same document, not the same check run twice.

There’s a reason the machine gate sits second, too. Put it first and the LLM writes to pass the gate — you get documents with correct shape and empty content.

The ledger’s anchors get planted here

The slicer cuts the raw spec into sections and rules. That rule list later becomes the left-hand column of the coverage ledger — “which case verifies this rule from the spec?”

Traceability is not something you bolt on at the end; it has to be planted here. Add it later and you have to re-count how many rules the spec contained, and that number comes out different for every person who counts. Counting once, on the first read of the source, is the only version that reproduces.

And the denominator has to be fixed first for “we covered everything” to mean anything later. Count the denominator afterwards and you only ever count what you covered.