🚦 Turn Written Rules into Checks
Every team has agreed-upon rules: “don’t commit secrets,” “maintain compatibility,” “cover with tests.” They work as long as everyone remembers. With AI generating volume, remembering is no longer enough — the rule needs to run on its own.
How to read: is a queue, not a menu. Each box is a required condition; the last one (human approval) only receives what has already passed everything else. The value of the diagram is in the sentence below: a gate that can be skipped is no longer a gate.
🆕 New here?
Quality gate is an automated check that prevents the change from moving forward when it fails. Static analysis examines the code without running it, looking for dangerous patterns. Contract test checks that the interface other systems consume continues to behave as before.
Required
Isn’t a recommendation
Automatic
Doesn’t depend on remembering
Objective
Pass or fail
The same for everyone
Human and agent
🏗️ Set up the foundation: build, lint, and tests
These three are the gates the agent itself uses inside the loop. That’s why their most important characteristic isn’t rigor—it’s speed and determinism.
✓ A gate that serves the loop
- ✓Runs in seconds, not tens of minutes
- ✓Same input, same result—every time
- ✓Error message that says where and why
- ✓A single command, documented in AGENTS.md
✗ A gate that gets in the way
- ✗40-minute suite—the loop can’t use it
- ✗Flaky test that fails once every five runs
- ✗Generic error ("failed") with no context
- ✗A sequence of seven commands only a veteran knows
💡 Practical tip
Split the suite: a fast target for the loop (unit tests for affected modules, a few seconds) and a full target for the merge. Without that separation, either the loop is too slow to be useful or you cut checks where you shouldn't.
Fast
The loop depends on this
Deterministic
Instability kills trust
Two targets
Loop and merge
Lint
Ends style debates
📜 Add contract tests and minimum coverage
As the volume of changes grows, the contract is the first silent casualty—and the one who discovers the breakage is the person consuming your API. A contract test turns that unspoken agreement into a gate.
🧪 Copyable exercise — generate the missing gates
Objective: find out which of your team’s rules are still just “understandings” and not gates. Run this in the actual repository.
Leia a configuração de CI em <caminho do workflow/pipeline> e o AGENTS.md. 1. liste os gates que JÁ existem hoje (o que bloqueia o merge de verdade); 2. liste as regras que estão escritas em texto mas NÃO são verificadas automaticamente (ex.: "não commitar segredo", "manter compatibilidade"); 3. para cada regra do item 2, proponha a verificação automática correspondente e diga o custo (baixo/médio/alto) de implementá-la; 4. ordene por (impacto se violada) ÷ (custo de implementar); 5. implemente APENAS a primeira da lista e me mostre o diff. Não altere gates existentes. Não desative nada.
How to verify: open a test PR that deliberately violates the newly automated rule (for example, a file with a fake secret). If the pipeline doesn’t turn red, the gate doesn’t exist — only its configuration does.
📐 About coverage
Minimum coverage serves as a safety net that prevents a fall, not as a target to pursue. An agent that needs to "hit 90%" generates tests that execute the code without asserting anything. Prefer: coverage must not drop compared with the baseline, and new code must come with coverage.
Contract
Agreement became a test
Floor
Coverage doesn’t drop
New code
Arrives covered
% target
Generates empty test
🛡️ Include Static Analysis and Security
These are objective, costly findings—the perfect candidates for automatic blocking. None of these checks should depend on an attentive reviewer on a Friday afternoon.
Secret in the repository—absolute blocker
A committed key, token, or password is an incident, not a finding. And remember: deleting it in the next commit doesn’t solve the problem—the secret is already in the history and needs to be rotated.
Critical dependency vulnerability
Blocks the merge when the issue is critical and exploitable in your context. Calibrate severity—a noisy scanner will eventually be turned off by everyone.
Dangerous patterns and architecture rules
SQL concatenation, insecure deserialization, imports crossing a domain boundary. Here, static analysis becomes module 3.2's architectural gate.
Secret
Block + rotate
Critical CVE
Blocks the merge
Calibrate
Noise leads to shutdown
Boundary
Becomes a static rule
⚡ Control performance and reversibility
Performance degradation creeps in, one small change at a time, until it becomes an incident. And an irreversible migration is what turns a ten-minute mistake into an all-nighter.
📊 Gates worth having
- •Performance budget: response time and queries per request must not worsen by more than X% from the baseline.
- •Reversible migration: every migration comes with a way back—and it’s run in the test environment.
- •Compatibility: no public contract breaks without versioning and notice.
- •Change size: diffs above the agreed limit require explicit justification.
⚠️ Attention
A rollback that has never been run isn’t a rollback — it’s an intention. If your migration has a script to revert it that nobody has run, assume it doesn’t exist.
Budget
Performance has a ceiling
Reversible
And tested
Compatible
Or version-controlled
Size
Diff is a gate, too
✅ Define the criteria for approving the change
Code only moves forward when all required gates are met. A gate that can be skipped “just this once” isn’t a gate—it’s a suggestion. And in two weeks, the exception becomes the rule.
Release checklist
☐ Build complete · ☐ lint passed
☐ Unit, integration, and contract tests passed
☐ Minimum coverage achieved (no decrease)
☐ No critical vulnerabilities · ☐ No secrets exposed
☐ Contracts preserved · ☐ migrations reversible
☐ Performance within limits
☐ Review complete (agent + human)
☐ Human approval recorded when the action is irreversible
Quick check: delivery is today and the coverage gate failed by 0.4%. What should you do?
All
No silent exceptions
Exception
Recorded, with a deadline
Evidence
Attached to the release
Protects
The gate belongs to the team
📌 Module Summary
Next track:
Track 4 - Architecture in the AI era: legacy systems, agent-readable repositories, and debt management.