Understand Shutdown Gates

A Shutdown Gate is a living, durable condition for retiring one target dataset. It binds the retirement objective, target and replacement, accountable owner, declared predicates, immutable evidence versions, approvals, application evidence, evaluations, monitoring runs, and invalidation history.

Gate evaluation can be Blocked, Needs review, Open under current evidence, Insufficient evidence, Verification failed, Monitoring degraded, or Previous approval invalidated. None of these labels grants automatic authority to delete a dataset.

Self-invalidating approval

An open gate registers the assumptions behind its decision for monitoring. Fresh evidence can reaffirm the current outcome or invalidate the previous approval. A new production consumer, changed contract evidence, authority drift, or failed monitoring can make yesterday’s approval untrustworthy without erasing its history.

The model can explain a delta. Deterministic predicates decide whether it violates the gate, and PostgreSQL preserves both the prior and current records.