Every guardrail by name, with the switch position.

Every word the fleet publishes outside your account passes through a local Presidio sidecar first: issue titles, run reports, failure comments, pull request bodies. A detection, a timeout or a malformed answer withholds the text and publishes a value-free reference to the mission instead. The screen is not behind a switch. The sidecar runs inside the cluster with the spaCy model in its image, and the fleet logs entity types and counts, never values. NetworkPolicy enforcement is on for the production cluster since 2026-09-14, so the sidecar's empty egress list is a real deny-all outbound; the one limit left, that the web and worker policies allow 443 to any address, is in the non-claims below.

The reviewing roles (verifier, compliance, merger) are marked independent in the roster and run on claude-sonnet-4-6; the building roles run on claude-opus-4-8. A role never reviews its own work. The work is reviewed by a separate model, not a separate vendor. Both are Anthropic models: claude-sonnet-4-6 reviews what claude-opus-4-8 wrote. The fleet certificate does not record which model reviewed.

Three gates, declared once in .softwerk/factory.yaml and pinned to code by test. Plan: after architect, before any code, a person approves the plan, on every mission. Question: any role may stop and ask, and the run pauses until answered. Merge: merger stops with the pull request open, the decision is recorded, and since merger holds no merge rights a person merges the pull request.

Supervision is Linear-native. A state change on the issue, a reaction on the gate's own comment, or a threaded reply is a gate decision, and a decision through POST /api/v1/mission-gates/<id> works the same way. Each role posts its activity on the issue with a link to the run and the report. An undecided plan gate expires after 24 hours and releases the repository.

The switch is 1 on production since 2026-09-14 on all three tiers: web and worker through the overlay, the agent Deployments through cdk/config/environments.ts. The runner stops before any commit, pull request or hand-off at the plan and question gates, and with the pull request open at the merge gate; the worker writes a gate row and pauses the run; a decision resumes it. Refusing the merge ends the run and leaves the pull request open and unmerged. Decisions are audited (mission_gate.decided with kind, decision, source and resume role; mission_gate.question_read; mission_gate.expired_by_sweeper) and the stored question is sealed under the tenant's key.

The role chain ends at merger. Merger holds no merge rights. Deployer and observer exist in the roster, are never triggered by the chain, and are refused as resume targets. Production itself is released by a person dispatching a workflow with an explicit image tag; nothing deploys on a push or a tag.

After a mission completes, a sweeper selects it, reads the pull request's head tree from GitHub under your own installation, runs the HIPAA, SOC 2 and HITRUST control sets over the whole tree and mints one certificate per tree: the per-framework results, a fail-closed verdict, disclosed warnings and an evidence report of finding counts. A tree already certified is reused rather than re-minted.

The certificate is a record. Minting is not enforcement: it happens after the pull request is open and, with the gates on, after the merge gate has been approved, so the certificate is the record of what was approved rather than an input to the approval. No switch turns a failed fleet verdict into a refused pull request today, and a person merges. Whether the team waits for the certificate before merging is the team's own rule.

Four more enforce switches sit in the production overlay beside the human gates, and a fleet mission never passes any of them. They are read on the generation and deploy path the factory inherited from the app builder: the worker's generation consumer, its pipeline consumer and the project deploy route. No fleet module imports them, and the fleet certificate module says so in its own words: minting is not enforcement.

Verification gate (VERIFICATION_GATE_ENFORCE): off, the gate at the generation ship boundary and on the project deploy route is a no-op; on, a failed certificate refuses the ship or deploy.

Compliance veto (COMPLIANCE_VETO_ENFORCE): off, the compliance verify on a generated build is disclosure-only; on, a failed verify withholds the generated build.

Reviewer enforce (REVIEWER_ENFORCE): off, the reviewer of a generated build is advisory and never blocks; on, a block verdict, or an independence that cannot be proven, fails the generation, and a revise verdict still ships.

Write screen (PHI_GUARD_ENFORCE): off, every file write and tool result of a generated build is scanned observe-only and detections are evented; on, a write carrying a high-precision identifier (SSN, MRN, card number, email, phone) is blocked. Names and dates are never blocked, because the detector is too noisy on source code to gate on them. Fleet code is written inside the agent pod, where only the publication screen runs, so nothing screens the executor's file writes inside a mission.

All four are 0 on production, and none of them changes what a mission does, on or off.

The fleet holds no tenant secret at rest; per task it receives exactly one credential, sealed and single-use (see the broker). The model subprocess runs as a second uid with an environment allowlist and cannot read the runner's environment; the executor fails closed without a uid split. Instance metadata is unreachable from pods (hop limit 1). The fleet's IAM role holds its lease table, its role queues and send-only on the progress queue. GitHub tokens are per-task installation tokens scoped to one repository.

Every query runs through a tenant-scoped client, and an exhaustive model registry test fails when a schema model is unclassified. Postgres row-level security is enabled on the factory tables as defense in depth (enabled, not forced, so it binds non-owner roles). Sensitive strings, including Linear tokens and gate questions, are envelope-encrypted at rest.