The gate library

An open, community-contributed library of quality gates: deterministic, non-LLM checks that turn a written rule into something the build can refuse. Each gate is one YAML file, mapped to a rubric property, validated against a shared schema.

For how gates fit the method, and the standard tools behind each property, see Quality gates.

All gates

This table is generated from the gate files by scripts/generate-gates-table.py on every change to the library, so it is always the current list.

Current Gate Library (51 gates)

Gate Description GS Property Tags Phase Trigger
docker-service-boundaries Each application service in docker-compose.yml that depends on a database must reference an explicitly named database service rather than a generic name (db, database, postgres). Self-describing docker, any development pr
env-vars-documented Every environment variable consumed by the application must appear in a committed documentation file (e.g., .env.example, docs/configuration.md, or a table in the README). Self-describing any development pr
extension-manifest-committed .vscode/extensions.json must exist and be committed to the repository. Self-describing any development commit
internal-consistency No two claims in the paper may be logically incompatible. Self-describing academic-paper staging pr
jsdoc-public-functions Every public function and method has a JSDoc comment with a description, typed @param tags, and a @returns tag. Self-describing typescript, javascript development pr
readme-setup-section The repository README includes a Setup or Getting Started section containing at least one fenced code block with runnable commands sufficient to get the project running locally. Self-describing any development pr
register-consistency If the paper disclaims a theoretical frame in its opening (e.g., “paradigm carries Martin’s sense, not Kuhn’s”), that disclaimer must be honored in every subsequent section. Self-describing academic-paper staging pr
vocabulary-stability Every technical term introduced with a definition must be used with that definition throughout. Self-describing academic-paper staging pr
claim-scope-calibration Every claim in the paper must be supported by evidence of equivalent scope. Bounded academic-paper staging pr
cyclomatic-complexity-max-10 No function may have a cyclomatic complexity above 10. Bounded javascript, typescript, node, any development commit
file-length-max-300 No TypeScript or JavaScript source file exceeds 300 lines. Bounded javascript, typescript, any development commit
function-length-max-50 No function or method body exceeds 50 lines of code. Bounded javascript, typescript, eslint development pr
max-function-parameters No function or constructor accepts more than 5 positional parameters. Bounded javascript, typescript, eslint development pr
no-any-type No explicit ‘: any’ type annotations appear in non-test TypeScript source files. Bounded typescript development commit
no-direct-db-in-routes Route handlers do not import or call database clients (Prisma, Sequelize, TypeORM, mongoose, raw SQL) directly. Bounded node, typescript, javascript, api, express, fastify development commit
no-duplicate-string-literals String values that appear more than three times in the codebase must be extracted into named constants. Bounded javascript, typescript, node, any development commit
no-duplicated-code-in-diff Copy-pasted code multiplies the places a change must touch. Bounded javascript, typescript, node, any development pr
no-unused-exports-dead-code Code that nothing uses still has to be read, searched and reconciled. Bounded javascript, typescript, node development pr
api-error-envelope-resource-scoped API validation errors must be returned under a key that names the failing resource, not a generic “body” key. Verifiable api, rest, node, typescript, javascript development pr
api-nullable-field-coercion Optional profile fields (bio, image) must be stored and returned as null when the client sends an empty string. Verifiable api, rest, node, typescript, javascript, database development commit
contract-tests-against-live-env The committed API contract test suite must pass against the live target environment (staging, CAE, or production candidate) before promotion. Verifiable api, rest, any staging release
coverage-threshold-80 Test line coverage is at or above 80% for the entire project. Verifiable javascript, typescript, jest development pr
experimental-design-standards Any section presenting experimental results must clearly state: (1) whether conditions were pre-registered or post-hoc; (2) N per condition; (3) whether the auditor/evaluator is independent of the treatment generator (same-family AI auditing same-family AI output is a confound that must be disclosed); (4) whether statistical inference is claimed and if so whether sample size supports it. Verifiable academic-paper staging pr
mutation-score-threshold The Stryker mutation testing score (Mutation Score Indicator) is at or above 65% for the full project, and at or above 70% for changed files on a pull request. Verifiable javascript, typescript, stryker, mutation-testing development pr
notation-audit Any formula presented in mathematical notation (LaTeX, symbolic expressions) must be accompanied by either (a) a derivation, (b) a citation to a source containing the derivation, or (c) an explicit label as “proposed theoretical model, not yet empirically fitted.” Specific numerical predictions derived from unfitted formulas must be removed or labeled “illustrative only.” Two-decimal precision in estimates described as “order-of-magnitude” is false precision and must be rounded. Verifiable academic-paper staging pr
sonarqube-quality-gate-ok SonarQube analysis must return Quality Gate: OK — ratings A on reliability, security, and maintainability, with zero bugs and zero vulnerabilities on new code. Verifiable any, sonarqube, static-analysis, quality staging pr
container-image-no-critical-cve The production container image must pass a CVE scan (Trivy, Grype, or Docker Scout) with no critical or high severity vulnerabilities before deployment. Defended docker, any staging release
db-migrations-reversible Every database migration file must include a rollback or down function alongside the up migration. Defended database, any staging pr
environment-variables-config All environment-specific configuration (URLs, ports, credentials, feature flags, thresholds) is read from environment variables or a config file, not hardcoded in source. Defended any development commit
no-debug-routes-in-production Routes matching debug, test, internal, or admin path prefixes must either not exist in the production build or require authenticated access with role enforcement. Defended api, rest, any production release
no-hardcoded-secrets No credentials, API keys, JWT secrets, passwords, or connection strings appear as literal values in source files. Defended any development commit
npm-audit-no-high-cve npm audit –audit-level=high exits 0. Defended node, npm, javascript, typescript development commit
tls-enforced The production deployment must redirect HTTP to HTTPS or refuse HTTP connections entirely. Defended any production release
adr-files-emitted Every Architecture Decision Record referenced in the specification or README must exist as a committed file with substantive content — context, options considered, decision, and consequences. Auditable any development pr
conflict-of-interest-disclosure Any material relationship between the author and tools, products, or organizations central to the paper’s claims must be disclosed in a dedicated section near the abstract — not buried in a single sentence mid-paper. Auditable academic-paper staging pr
conventional-commits Commit messages follow the conventional commit format: type(scope): description. Auditable any development commit
rollback-plan-documented A ROLLBACK.md file (or equivalent runbook section) must exist and describe: the rollback command or procedure, the expected rollback time, any data migration considerations, and the person or role responsible for executing it. Auditable any production release
no-circular-dependencies The module dependency graph is acyclic. Composable any development commit
docker-compose-defined A docker-compose.yml exists at the repository root with at least one named service. Executable any development pr
health-endpoint-responds The application must expose a /health endpoint (or equivalent per platform convention) that returns HTTP 200 with a JSON body containing at minimum: status, version, and uptime. Executable api, any staging release
hurl-contract-tests-pass The full Hurl test suite for the published API spec must exit 0 against a running server. Executable api, rest, hurl, contract-testing, any staging pr
jest-no-failed-tests jest –json exits with numFailedTests === 0. Executable javascript, typescript, jest development commit
no-console-log-production No console.log, console.warn, or console.error calls appear in non-test production source files. Executable javascript, typescript, any development commit
no-localhost-hardcoded No occurrence of ‘localhost’ or ‘127.0.0.1’ appears as a string literal in application source code. Executable any development commit
node-esm-cjs-safe-imports CommonJS packages (jsonwebtoken, bcrypt, multer, and similar) do not expose named exports under ESM interop. Executable node, typescript, javascript, esm development commit
python-dependencies-pinned Python projects must have a locked dependency file with pinned versions. Executable python, any development pr
runtime-version-pinned A runtime version pin file must exist in the repository root: .nvmrc for Node.js, .python-version for Python, .tool-versions for multi-runtime projects. Executable any development commit
smoke-test-passes A minimal smoke test suite (at minimum: health check, authentication, and one core user journey) must exit 0 against the target environment before promotion is considered complete. Executable any staging release
tsc-no-emit-exits-zero tsc –noEmit exits 0 on every commit. Executable typescript development commit
typescript-strict-mode The project’s tsconfig.json has compilerOptions.strict set to true. Executable typescript development commit
no-redundant-deploy-pipelines Warns when a project has both a platform deploy config (railway.toml, vercel.json, fly.toml, render.yaml) and a .github/workflows/ directory. convergence any development pr

Underrepresented properties (highest-value contribution targets): Composable.