Gate

gate

One ship/no-ship verdict from your whole nugehs toolchain.

gate runs aiglare, bouncer, tieline and repoctx against a repo and merges their four dialects into one normalized verdict. Each tool already answers a different "can this ship?" question — gate is the place they finally agree on the answer.

npx @nugehs/gate                      # audit the current repo

npx @nugehs/gate ./service --ci # fail the build on a blocking verdict npx @nugehs/gate --json # the unified verdict, machine-readable

┌──────────────────────────────────────────────┐ │ gate │ │ one config · one verdict · one report │ └──────────────────────────────────────────────┘ │ │ │ │ aiglare bouncer tieline repoctx red/amber/ pass/fail/ matched/ PASS/WARN/ green unknown drift FAIL │ │ │ │ └──── normalize to pass · warn · fail ─────┘ │ ✗ FAIL ⚠ WARN ✓ PASS

What it reports

  gate · /path/to/repo

✗ AI governance fail 2 red · 1 amber · 13 green · 1 blocking side-effect · Compliance skipped not configured (run bouncer init) · Contract drift skipped not configured (run tieline init) ⚠ Merge readiness warn 1 of 8 checks need attention

verdict: FAIL — 1 blocking · 1 warn · 2 skipped

Each tool's native result is normalized onto one status vocabulary:

The top-level verdict is the worst across the domains that actually ran (skipped never counts). unknown and error roll up to warn so nothing slips through as a silent pass.

How each dialect maps

gate runs aiglare without --ci and derives the blocking verdict itself,

so a tool that process.exit()s before flushing its pipe can't truncate the

report it feeds us.

A run that checked nothing is not a pass. If every domain is skipped or deselected (e.g. --skip them all, or a typo'd --only), gate reports NO CHECKS RAN (ok:false) and fails under --ci — a misconfiguration can't silently turn the gate green.

On repoctx + local mode. repoctx's merge-readiness gate can only verify review state (approvals, CODEOWNERS, required checks) against a host like GitHub. Run locally it reports those as a WARN, so on a clean local repo gate will often show merge readiness: warn. That's repoctx being honest about what it can't see locally — not a problem with your change.

CLI

gate [path] [options]

--json Emit the unified verdict as JSON --ci Exit non-zero when the gate fails (blocking by default) --strict Treat WARN/UNKNOWN as blocking too --only Run only these tools (aiglare,bouncer,tieline,repoctx) --skip Skip these tools -h, --help Show this help

gate mcp Start the MCP server (stdio)

By default only a fail verdict blocks under --ci — safe to adopt without drowning a team in warnings. Add --strict when you want warnings to gate too.

Tool resolution

gate doesn't bundle the four tools; it finds each one at runtime. Per tool, first hit wins:

1. GATE_ _BIN environment variable (explicit override)
2. the installed @nugehs/ package (from node_modules)
3. a sibling checkout at ../ (local development)

A tool that can't be resolved is reported as skipped, never a hard failure — so gate is safe to run in a repo that only uses some of the toolchain.

In CI

- run: npx @nugehs/gate . --ci

For a machine-readable record, --json emits the full verdict (schema version, per-domain results, counts, and the blocking reasons) for dashboards or audit evidence.

MCP

gate is also an MCP server, so an agent can ask "can this ship?" in one call — the unified verdict, not four separate tools.

gate mcp                 # stdio JSON-RPC server

npx @nugehs/gate mcp

Tools:

Registry manifest: server.json (io.github.nugehs/gate).

Editor extension

The same normalized verdict drives a VS Code / Cursor extension (clients/vscode) — the gates, shifted left from CI into the editor:

• a verdict cockpit and a checks tree in gate's own Activity Bar container;
• inline diagnostics, hovers, Quick Fixes (mute / open docs) and CodeLens on located findings;
• AI-native gating — an @gate chat participant, a gate_check tool agent mode can call before it says "done", and an MCP server provider — so the assistant writing the code is checked by the same gate as CI;
• debounced run-on-save with in-flight cancellation, and multi-root support.

Roadmap

gate is the shared spine. The same JSON already drives the CLI, the --ci gate, the MCP server, and the editor extension above. Next client on the same JSON:

• Web cockpit — a repo/PR verdict board over the JSON, unifying the four *-web sites.

License

MIT © Oluwasegun Olumbe