Refusals and Validation

"Trustworthy" cannot stand on assertion, so here are the checks. None of them depends on anyone's diligence.

• b validate — parses and cross-references the whole project, with stable exit codes, and refuses illegal arrangements by name. A routed interface that is also public is rejected, because a direct front would be a second way in that skips the token exchange the gateway exists for — the one pairing whose failure is silent at every layer: both objects apply, both hosts answer, and nothing downstream can tell which way a request came in. A source variant carrying an image key, or an external one carrying either, is refused the same way.
• rustc — generated code that compiles has excluded a defect class. Part boundaries, Default obligations on unmarked fields and the totality of every generated CallError are ordinary compiler errors naming the offending item.
• kong check — the rendered gateway configuration is validated against the actual image before it ships: every service, both plugin schemas, every path.
• Contract tests — declared on the component, holding its interfaces to their declaration.

Together these four are the difference between "we generate carefully" and "the wrong thing does not build."