Validation Gates Before a Model Touches the Machine

No model gains any authority without clearing a fixed sequence of gates — accuracy, calibration, safety-envelope, parity, and uncertainty — each of which can hard-block promotion.

Gates, not vibes

Promotion at Kronos is not a judgment call; it is a checklist of automated gates, each with a numeric threshold that either passes or fails. A model that fails any gate is quarantined, and the failure is logged with the evidence. The gates are identical for the breeder and burner so certification is uniform across the two machines.

The gate sequence

• Accuracy gate: error on the frozen holdout below threshold, no regression vs incumbent
• Calibration gate: predicted uncertainty matches observed error (reliability curve within band)
• Safety-envelope gate: model never proposes a command outside hardware limits on adversarial probes
• Parity gate: compiled edge artifact matches offline model (see skew)
• Uncertainty gate: model abstains or lowers confidence outside its validated regime
• Reproducibility gate: retraining the artifact reproduces it within tolerance

def promotion_gate(model, holdout, probes, incumbent):
    checks = {
     'accuracy':   rmse(model, holdout) <= TH.rmse and
                   rmse(model, holdout) <= rmse(incumbent, holdout),
     'calibration':ece(model, holdout) <= TH.ece,
     'safety':     no_envelope_breach(model, probes.adversarial),
     'parity':     parity_ok(model),
     'uncertainty':abstains_outside_regime(model, probes.ood),
     'repro':      reproduces(model, tol=TH.repro)}
    return all(checks.values()), checks   # any False -> QUARANTINE

The safety-envelope gate is adversarial by design: it does not test whether the model behaves on typical inputs but whether it can be made to propose something dangerous. For the burner, gates are read against the four honest constraints — the plug stress (3 to 3.9x over-stress at design bore), the un-post-dictable operating regime (166 to 830x beyond any device), the He-3 supply gap (about 400x domestic supply per commercial unit), and availability (0.86 to 0.995 vs hyperscale 0.99982) — so a model is never validated into implying a capability the physics does not support. Passing all gates moves a model to STAGING and eligibility for shadow.