Reference: fixture vs production

Status: stable framing for the Fixture Preview era. Driven by contracts/production-admission.v0.json customer_boundary_lane.required_doc_topics entry fixture_vs_production_posture.

This page exists so no end user — developer, agency, advisor, operator, MCP host — accidentally treats Gestalt’s fixture posture as authentic company reality.

The two questions every receipt answers

Every membrane response carries two assertions:

receipt.fixture            true today on every receipt
body.productionAdmission   false today on every body that includes it

If either says “fixture / not production,” what you are looking at is not company reality. It is shape-correct rehearsal.

What the central evaluator returns

Production admission is globally disabled by default. The central evaluator returns one of:

production_admission_disabled_by_default — the global default, for any operation that has not been admitted by a signed pilot record.
candidate_pending — the operation is in scope and the prerequisite ladder is clean, but no signed pilot admission record names it.
admitted — a signed pilot admission record exists and lists this operation in its admitted_operations set, for this tenant, company, jurisdiction, vertical, package and epoch, connector, effect class, and timeframe.

Period close is candidate-only in v0; economy.periodClose is fixture-rehearsed per contracts/production-admission.v0.json operation_maturity and is not eligible for v0 admission.

The pilot admission lane keeps public_launch_claim_remains_refused set to true. See ../legal/public-claims-review.md for the customer-facing claim review.

What “fixture” means

A fixture call:

Walks through Gravity, the structural evaluator.
Returns a refusal if structurally incorrect — same code paths as production.
Emits a receipt with the same shape a production receipt will have.
May be durable (staging-durable operations persist across restarts).
May fail in the same ways production will fail.

A fixture call does not:

Bind real company facts.
Produce a cryptographically verifiable signature against canonical bytes.
Activate real authority packages.
Dispatch real external acts (no email sent, no payment posted).
Create real standing for any actor.
Survive into a “real Gestalt deployment” — there is no such thing yet.

What “production” will mean

A production call (none today) will:

Be admitted under a real authority package activated by a real Verlag with real reviewer signatures.
Be signed with a real runtime signer (KMS/HSM) under explicit key custody.
Produce a receipt that any third party can cryptographically verify offline against the runtime signer’s published key.
Bind real company facts in a tenant the customer onboarded.
Dispatch real external acts through real adapters.
Carry real reliance terms backed by real liability.

The contract version field will move off 0.0.1-fixture when the first operation reaches authentic. Today the contract is "0.0.1-fixture" and status: "fixture".

What you can build today

A Koerper UI / SDK against the membrane contract that will work the day operations become authentic, with no shape changes.
An MCP integration where an LLM agent can safely propose actions and inspect refusals.
A CLI workbench script that orchestrates fixture rehearsals.
A demo that walks the German invoice → payment → advisor flow end-to-end as a fixture.
An advisor console that handles refusals and pending actions correctly.

What you cannot build today

A real product that issues real invoices.
A real Steuerberater integration that admits binding opinions.
A real connector that ingests live bank movements.
A real authority package that you intend to publish for actual reliance.
A real proof bundle a regulator will accept.

For the full breakdown, see ../../workflows/open/022-end-user-api-completeness-gap-report.md.

How to be honest with your users

If you ship a Koerper that talks to today’s Gestalt:

Display fixture status. Surface the fixture: true marker on every receipt.
Display productionAdmission: false. Surface this on every body that carries it.
Don’t claim binding. A fixture admission is not a binding admission.
Don’t strip the markers. Keep them in your stored receipts and forwarded artifacts.
Don’t translate fixture refusals into “system error.” A refusal is governed; render it as such.
Don’t pretend to advisors. A Steuerberater console showing fixture data must say so.

These rules sound paranoid because they are. The whole reason Gestalt exists is to prevent the slow accumulation of false reliance. The fixture honesty discipline is part of that.

Capability state recap

Each operation is labeled in capability-state.md:

Label	What you can do
`shape-only`	Call the operation, get a shape-correct response, prototype your handling
`fixture-rehearsed`	Walk an end-to-end fixture flow including refusals and receipts
`staging-durable`	The above, plus state persists across restarts on staging cloud
`authentic`	Production. Real consequence. Real proof. (No operation today.)

If a doc page does not state a capability state, treat the operation as shape-only.

When this page becomes obsolete

This page becomes obsolete the day:

The contract version moves off 0.0.1-fixture.
At least one operation carries an authentic label in capability-state.md.
Production admission is documented and gated only by tenant onboarding, not by absence.

Until then, this page is load-bearing.