tomatoInvariants
6 invariants, grouped by family. The family letter comes from the gate's id —
S supply chain, C convergence, D dev-deps
and toolchains — and each gate is one .rq file plus one Bazel target.
Supply chain#
S4 clean
a published module must not carry a *_override
S6 1finding
metadata.json and the version directories must agree
S7 clean
PG-release-versioned modules must not mix Postgres releases
Dev-dep & toolchains#
D2 49findings
a non-dev register_toolchains propagates to every transitive consumer
D3 25findings
a repo name CHOSEN on a SHARED extension must be namespaced
Convergence#
Two families are designed, not built
K (capability) and V (semver) exist in the gate's family
table and in its design diagram, but have no queries yet — and V1 was
dropped deliberately, because compatibility_level is a no-op as of
Bazel 8.6.0 / 9.1.0. So is the SHACL convention tier. What is listed above is what runs.