Nothing is held.
v13 is serving.

Production reads only the trusted version. Any new upstream version will wait at the gate until policy or a person releases it.

Gateway: Serving trusted
Protected app: islamic-qa-demo
Binding updated: 12 Oct, 17:11:32
Source data: Controlled test data · see source provenance

Gateway

What production reads and what waits outside.

Serving state

UpstreamTrust GatewayProduction

Nothing waiting at the gate

v13Latest trustedTrusted

Trusted only

Islamic Q&AServingReads v13

Latest seenv13Trusted

Latest trustedv13Trusted

Served to Islamic Q&Av13Serving

Latest seen is not the same as trusted, and only trusted is served. The protected app resolves the gateway, never the newest upstream version.

Bindings

One row per protected app and source.

Gateway bindings

gateway_bindings

Protected app	Source	Serves	Latest seen	Status	Updated
Islamic Q&A islamic-qa-demo	HadeethEnc 10618 hadith-evidence-sandbox	v13 · r2	v13 · r2	SERVING_TRUSTED	12 Oct, 17:11:32

GATEWAY_RESOLVEDRe-points with the gate

Assets that read through the gateway switch versions in the same transaction as the binding. They never go stale.

MATERIALIZEDGoes stale after promotion

Frozen copies keep the version they were built from. After a promotion they are marked stale until rebuilt.

Gateway response for this binding

GET /api/gateway/islamic-qa-demo/sources/hadith-evidence-sandbox { "appId": "islamic-qa-demo", "appName": "Islamic Q&A", "sourceId": "hadith-evidence-sandbox", "sourceName": "HadeethEnc 10618 — controlled integrity sandbox", "binding": { "id": "6cc16119-5d6c-4f22-bdef-4167f8661e03", "appId": "islamic-qa-demo", "sourceId": "hadith-evidence-sandbox", "updatedAt": "2026-10-12T17:11:32.389Z" }, "latestSeen": { "id": "09d0933c-fc18-4410-8cd7-c3f5fc1bf448", "label": "v13", "revisionNumber": 2, "status": "TRUSTED", "detectedAt": "2026-10-06T17:46:38.049Z" }, "latestTrusted": { "id": "09d0933c-fc18-4410-8cd7-c3f5fc1bf448", "label": "v13", "revisionNumber": 2, "status": "TRUSTED", "detectedAt": "2026-10-06T17:46:38.049Z" }, "served": { "id": "09d0933c-fc18-4410-8cd7-c3f5fc1bf448", "label": "v13", "revisionNumber": 2, "status": "TRUSTED", "detectedAt": "2026-10-06T17:46:38.049Z" }, "gatewayStatus": "SERVING_TRUSTED", "heldCandidate": null }

Promotion

Only a signed approval or POL-005 can trust a version.

Promotion paths

Signed human approvalNo case open

A reviewer approves the incident. Required for every quarantined or review-held candidate.

REVIEW_DECISION · APPROVE

POL-005 allowNot in use

Deterministic fast path for metadata, whitespace, Unicode or serialization-only changes.

ALLOW · no incident

Promotion transactionpromoteCandidateTx

1Lock the source, its bindings, the candidate, the trusted version and the policy evaluationFOR UPDATE
2Assert the transition is legal: every binding still serves the trusted versionINVALID_REVIEW_TRANSITION
3Supersede v13TRUSTED → SUPERSEDED
4Trust the candidate→ TRUSTED
5Re-point the gateway binding for Islamic Q&Aserved → candidate
6Re-point gateway-resolved derivationsGATEWAY_RESOLVED
7Record the signed decision and resolve the incident

Audit

Changes to what this binding serves.

Binding history

12 Oct 17:11:32Demo reset to the trusted baselineSandbox only; real sources untouchedDEMO_RESET

7 Oct 10:37:26Demo reset to the trusted baselineSandbox only; real sources untouchedDEMO_RESET

7 Oct 10:30:06Demo reset to the trusted baselineSandbox only; real sources untouchedDEMO_RESET

Review decision

The gateway never decides. Nothing is waiting at the gate.

Serving trusted v13Nothing to sign

Nothing is waiting at the gate.

A held candidate appears here, and opens only on a reviewer’s signature.

Open the incidentsOnly POL-005 or a signed approval can move a version to trusted

Nothing is held.v13 is serving.