ADR 0024: Stage gates: the only writer of the current stage, closed by two signers

Status: Accepted
Date: 2026-09-15
Deciders: Founder

Context

The program stage could be changed with PATCH P under program.settings.update without any check of what the stage required. Stage completion needs a definition in records and an accountable close.

Decision

stage_gates (R4) open -> ready -> reviewed -> closed become the only writer of programs.current_stage_id (422 stage_via_gate otherwise; the migration opens a gate per program). required_records is recomputed hourly while open, frozen at ready, and a change while ready reopens the gate (stage_gate.reopen).
Ready: progress.stages.manage (owner or lead; the manufacturing specialist for the manufacturing gate only). Reviewed: review.stage_reviews.approve held by a quality_reviewer (group-resolved), signature meaning reviewed, statement “I have reviewed the records listed in this gate’s checklist” (the brief is labelled agent-generated and is not what is signed). Closed: progress.stages.approve with an approvals row and signature approved; reviewer and approver must differ (409 same_signer); the next gate opens in the same transaction.
stage_gate joins SIGNATURE_TARGET_TYPES, APPROVAL_TARGET_TYPES, SIGNATURE_REQUIRED_TARGETS and RECORD_HASH_FIELDS with the review signature id inside the closing hash.

Consequences

Completion is defined in Trovensa records, never as a regulatory statement; clinical and manufacturing gates carry Progress-only checklists while those objects stay designed.
The lead’s twin writes the readiness brief (reads only).

Alternatives considered

A single approver closes the stage: no independent quality review; rejected.
Free stage changes with an audit row: leaves the checklist unenforced; rejected.

Follow-ups

Configurable checklists per organisation (R5).