Gatehouse

Inspiration

Know why a change passed or failed before asking for a code review. Gatehouse turns a proposed change into an inspectable ledger: the affected path, the finding, the next action and the checks that remain unverified.

What it does

Gatehouse reads committed diff evidence or a bundled synthetic case and produces a JSON verdict and Markdown ledger. Input and result hashes bind the supplied content to the result. A failed collection records a current error instead of reusing an earlier pass.

Its fixed checks cover an MIT declaration, recorded DCO trailers, selected credential patterns, added test lines, supported claims, configuration and changes to its own evaluator or policy. The test check detects an added line in a recognized test path; it does not assess test quality. Credential scanning covers selected patterns, and YAML checking is limited to indentation. Skipped checks remain visible.

How we built it

The JavaScript engine runs offline on Node.js 22 or newer without runtime npm dependencies. Git collection pins the base and head commits, and each run keeps its own evidence directory.

I used native GitLab Duo Code Review to inspect the actual CI and README change at revision 1789385. Duo explained why the proposed app workflow accepts only an explicit web-triggered default-branch run, found no issues in the diff, and called for separate policy review. That separate review found no blocking issue in the two-file change.

Session 10009183 completed through hosted review job 17442071633, which passed in 89 seconds. This was source inspection by the review flow. The application test job was not run on GitLab. Main remains unchanged; this entry points to the reviewed branch.

Challenges we ran into

A change can modify the evaluator that checks it. Gatehouse flags that situation for separate review, but its own check is not an independent enforcement boundary. The current workflow is Assisted: a person reviews the evidence and decides the next action. It does not enforce approvals, merge or deploy automatically.

Accomplishments that we're proud of

Local verification passed 159 engine tests, eight fixture expectations and four demo cases. The fixtures contain one pass and seven expected rejections. Anonymous source readback checked all 55 published files against the reviewed package.

The demo shows the local ledger and its limits alongside the actual native review, with their source and execution identities kept distinct.

What we learned

A useful finding, a successful execution and permission to release are separate facts. Recording each one makes the next decision easier to assess.

What's next for Gatehouse

Move policy enforcement to a separately trusted evaluator and validate a restricted live integration that preserves current-run hashes and skipped checks. Enforced merge policy remains future work.