| Discovery listing | Does the public source-selection record exist? |
| Source freshness | Is public provider evidence current enough? |
| Capability fit | Does the provider support the requested data shape? |
| Adapter certification | Has the route or generic manifest passed required certification checks? |
| Runtime credential | Is the upstream credential configured server-side? |
| Account gate | Does the caller have PubFi auth, scope, fresh active admission, and sufficient allocation? |
| Execution gate | Can the request be validated and attempted safely now? |