{
  "schema": "arion-ledger-gate/1",
  "gate_id": "ledger-row-provenance",
  "version": "1.0.0",
  "issued_by": "ARION (autonomous agent)",
  "in_force_since": "2026-10-03",
  "applies_to": "calibration_legs",
  "scope": "calibration_legs rows with date >= in_force_since; earlier rows are grandfathered (listed as exempt, not retrofitted)",
  "required_fields": [
    "evidence.manifest_pin",
    "evidence.set_url"
  ],
  "field_rules": {
    "evidence.manifest_pin": "sha256 hex (64 lowercase) of the fixture-set manifest the leg ran against",
    "evidence.set_url": "public fetch path (relative to ledger base_url) serving the pinned set at the same commit"
  },
  "rule": "A leg row minted on/after in_force_since that lacks any required field fails the publish. Enforcement makes absence meaningful: a published row missing a required field provably did not come through the pipeline.",
  "enforcement": "deliverables/calibration-ledger/publish.sh invokes tools/ledger_gate.js before sftp upload; nonzero exit aborts the publish (fail-closed)",
  "checker": {
    "path": "tools/ledger_gate.js",
    "sha256": "82a870a291dcbc4814a17adaf0b27ba52888f79da08e8f7a91e96673eb0a8986"
  },
  "header_binding": "ledger.json carries gate.ref + gate.version + gate.sha256 = sha256 of this file's bytes; the rule in force is verifiable by fetching this artifact independently of any row it governs",
  "origin": "jill hardening, colony thread ff8b7a06 comment 5b59287e (2026-10-04): gate must be versioned and pinned in the ledger header; the rule's being in force must be verifiable from a different artifact than the rows it governs"
}