Status: Experimental, fail-closed, offline gate.
Authority: none by itself.
ACE now has canonical observation, causal lineage, recoverable capacity, shadow policy, and privileged-workflow safety layers on main. The activation gate answers a separate question:
Is the repository actually allowed and evidenced well enough to leave shadow mode?
A controller cannot activate itself.
Let:
O = observer accepted;L = lineage protocol accepted;S = security boundary accepted;C = shadow controller accepted;P = protected integration boundary actually enforced;D = at least one real independently verified descendant exists;K = review-capacity state is readable, fresh, single-writer, and above threshold;B = public-write budget is at most one per generation;F = forbidden high-impact capabilities remain disabled.Then:
Activation = O AND L AND S AND C AND P AND D AND K AND B AND F
This is deliberately not a weighted score. Healthy capacity cannot compensate for missing protection. High activity cannot compensate for absent verified descendants. Model confidence cannot authorize GitHub writes.
As of the current convergence:
merged #106 cohort observer
-> trusted bootstrap exposure / eligible-parent evidence
merged #48 causal lineage
-> parent -> seed -> descendant receipts + verification evidence
merged #104 live-open-work capacity
-> recoverable current integration/review pressure
merged #68 shadow controller
-> R_community + strategy fitness + replicator-mutator policy
merged #98 safety/protected-integration workflow guards
-> fail-closed metadata-plane authority boundary
this activation gate
-> independent PASS / BLOCK before future Phase B
The gate does not replace GitHub rulesets, lineage verification, or the controller. It composes their evidence states.
examples/community/ace-activation-gate-current.example.json is a point-in-time reproducible snapshot, not a live API collector.
The current fixture records:
observer accepted (#106)
lineage accepted (#48)
security accepted (#98)
controller accepted (#68)
integration protection accepted (#35: main protected, required checks gate (3.11)/gate (3.13))
verified descendants 0
live capacity ~0.913 (healthy against current 0.6 gate)
The capacity value is taken from the Bootstrap Cohort Observatory (#109), which reported at its snapshot:
ACE review load: 3.3
ACE capacity: 0.912934227...
external participants: 0
bootstrap verified descendant PRs: 0
recommendation: HOLD_COHORT_1
This is an important control-system result: consolidation can recover capacity, but recovered capacity does not create authority or evidence.
Therefore the expected decision remains:
BLOCK
with the single meaningful current blocker:
real_verified_descendant_evidence
review_capacity should not be a blocker in this fixture.
scripts/ace_activation_gate.py rejects malformed or incomplete snapshots rather than guessing. A valid snapshot with any failed check returns:
{
"decision": "BLOCK",
"activation_gate_passed": false,
"required_controller_mode_if_blocked": "SHADOW"
}
A BLOCK result is expected whenever one independent prerequisite is missing.
The gate consumes a normalized capacity value in [0,1]; it does not calculate repository pressure itself.
The canonical source is now #104’s recoverable live-open-work-v1 model rather than the obsolete cumulative historical event-load scalar. Future snapshot builders should bind the value to a timestamp/source and keep the capacity computation independently inspectable.
A capacity check passes only when:
capacity >= minimum_capacity.Stars, comments, commits, issue volume, merged unrelated PRs, and owner-driven implementation do not satisfy D.
At least one descendant must be independently verified under the accepted observer/lineage semantics. The current cohort observatory reports zero external participants and zero bootstrap verified descendants, so this gate remains blocked even though the infrastructure PRs themselves are merged.
Repository files cannot substitute for actual GitHub branch protection/rulesets, so this component is read from public branch metadata, never from documentation.
As of 2026-08-29 that metadata reports main as protected, with gate (3.11) and gate (3.13) required, force-pushes and deletions denied, and conversation resolution required. The repository-admin procedure tracked by #35 is therefore complete, and the integration_protection component reads accepted.
This component is re-derived from live metadata whenever the fixture is refreshed; it is not a permanent grant. If protection were removed, the component would return to blocked and the gate would fail closed for a second, independent reason.
The explicit ACE actuation opt-in introduced by #98 is an additional authority gate; neither it nor branch protection is by itself an activation authority.
The gate blocks if any of these are enabled:
These remain outside the first Phase-B authority envelope.
tests/test_ace_activation_gate.py covers:
This change does not:
Integrate this gate as an offline canonical contract. Branch protection is now configured and verified, so the single remaining blocker is real external cohort evidence: at least one independently verified descendant. Only after every independent check passes should a separately reviewed metadata adapter even be considered.
main (completed 2026-08-28)