TrustGate

Inspiration

AI can now write a market report, a research summary, or a thousand-line diff in seconds — but when a team asks "can we ship this?", the honest answer is usually "we don't know." The model's confidence isn't evidence, and letting the same kind of system grade its own homework is circular.

We were inspired by how real engineering organizations work: nobody asks "was the AI smart?" — they ask "show me the evidence, who approved it, and exactly what was approved." TrustGate answers those three questions deterministically, and enforces the answer at the moment it matters: the git push.

What it does

TrustGate is an evidence-driven security review system for VS Code-compatible IDEs. A developer checks saved changes or a committed range; TrustGate returns BLOCK (low trust), ESCALATE (needs a human), or APPROVE (high trust) — driven by validated evidence, not model confidence:

$$ \text{decision} = f(\text{grounded evidence},\ \text{coverage},\ \text{findings}) ;\not=; g(\text{model confidence}) $$

Evidence grounding — every extracted claim must quote the source text verbatim; ungrounded output fails closed to NOT VERIFIED, which never grants permission. Report review — import an Ezio PDF/text report, state who relies on it, and the same policy evaluates all four challenge samples (nuclear, WFH, EV, AGI) with zero topic-specific code. Push gate — a Git pre-push hook recomputes a fingerprint over repo, base, head, and the exact bytes of the diff. An approval for one change can never authorize another: $$ \text{fingerprint} = \text{SHA256}(\text{repo} ,|, \text{base} ,|, \text{head} ,|, \text{scope} ,|, \text{diff}) $$

Human review — reviewers resolve escalations with a substantive written reason; hard blocks can't be overridden, and every approval expires after 15 minutes. How we built it Early bet: zero npm dependencies. The entire backend is Node 24 built-ins — node:http for the authenticated API and node:sqlite (WAL, foreign keys, busy timeout) for the durable review queue and audit trail. No npm install, no supply chain, runs anywhere.

Four surfaces, one API:

Editor extension — one editor-neutral VSIX targeting the stable VS Code API (^1.93.0); nonce-CSP webview, token in SecretStorage, no provider keys. Browser dashboard — same-origin only, tokens in tab memory, evidence inspector + reviewer console. Git pre-push CLI — reads every ref update from stdin, recomputes the fingerprint, fails closed on tags, deletes, missing objects, and network errors. Policy engine — the LLM (via HarnessRouter) advises; deterministic policy decides. Reviewer approvals record explicit risk acceptance — they never inflate the evidence score. Challenges we ran into Honest provenance. The documented Ezio integration is PDF/text export — there's no authenticated code-verification API. Instead of faking one, we made provenance explicit: imported reports are labeled user-supplied, and code reviews escalate for human risk acceptance unless blocked. Fail-closed everything. Every unknown — stale review, changed diff, provider failure, malformed JSON — had to deny by default. Restarts mark interrupted jobs failed; no stale approval is ever inferred. LLM quote-faking. Models produce plausible-sounding quotes that aren't real. Our normalization layer rejects any extracted claim whose quote doesn't literally appear in the source text. Environment fights. The build sandbox denied loopback ports (EPERM) and Docker sockets, so we built two test modes — in-process transport and real loopback HTTP — and validated Git behavior in real temporary repositories. Accomplishments that we're proud of A gate that actually gates. Approvals are bound to the exact content fingerprint and expire in 15 minutes — we tested that a changed range is rejected and multi-ref pushes require per-ref approvals. 28 passing integration tests covering evidence grounding, every decision branch, role separation, expiry, replay denial, and provider failures. Zero-dependency shipping artifact — service, extension, CLI, and dashboard with no npm install. A topic-agnostic policy — the same deterministic code handles nuclear energy and work-from-home reports without a single if topic == ... branch. Intellectual honesty as a feature — synthetic fixtures are clearly labeled and can never authorize a push; limitations are visible in the UI, not buried in a footnote.

What we learned

The hardest part of "trustworthy AI" isn't the model — it's the binding: binding an approval to exactly what was reviewed, binding a report to who relied on it, binding a human decision to a reason. We also learned that saying no well is a feature — a system that blocks cleanly and explains why is worth more than one that approves generously. And keeping a human in the loop only works if the human's review is substantive: a 20-character minimum reason beats a checkbox.

What's next for TrustGate

Live Ezio API binding — replace user-supplied report provenance with cryptographically authenticated imports once Ezio exposes a verification contract. Org-level enforcement — the local hook is honestly bypassable; a required GitHub check running the same CLI against protected branches is the real deployment target. Deeper analysis — full SAST, dependency auditing, and whole-repo coverage beyond the diff. Enterprise surface — SSO, multi-tenant orgs, and a hosted control plane.