Physical Inspection

The 44 Gates.

We do not rely on hope. In version 2.0.7, every full build your agent runs through the factory goes through the same chain of 44 gates (48 with a paid license) before it leaves the shop floor. Almost all are fixed, rule-based checks. The chain is fitted to the project: a gate that does not apply reports n/a instead of a fake pass. If an applicable gate blocks, the build is not marked done. These are checks, not certifications: VibeHard is not SOC 2 audited, and you should not send health records or card numbers to any VibeHard service today.

Phase 1: Measuring the Joints

The plan, the structure and the contracts. Does the build match what was approved?

  • 01. plan-lock: Checks the planning documents against the sealed plan digest.
  • 02. plan-vs-code: Compares the built code against the sealed plan.
  • 03. intent-fidelity: Checks that the build honored the plan’s buy-or-build decisions instead of rebuilding a component it chose to adopt.
  • 04. architecture: Layering rules, dependency cycles, complexity budgets and dead code.
  • 05. cli-contract: Command-line tools: help and version flags, safe output when not on a terminal, and argument fuzzing that checks malformed arguments do not crash the tool.
  • 06. api-contract: Checks implemented routes against the declared API contract.
  • 07. breaking-changes: Flags removed endpoints, new required parameters and other breaking API changes.
  • 08. schema-lint: Lints API and data schemas for structural completeness.
  • 09. cross-contract: Checks both sides of every boundary between components.
  • 10. capability-router: Checks that each part of the job goes to an agent that has shown it can do that kind of work.
  • 11. engines: One runtime version, declared the same way everywhere it can be pinned.
  • 12. measurement-integrity: Guards declared performance budgets against being gamed.
Phase 2: The Vault Doors

Secrets, data and supply chain. These gates look for leaks and unvetted parts, and a leaked secret always blocks.

  • 13. secrets: Scans the project for leaked keys and passwords. Any leaked secret blocks.
  • 14. sast: Static analysis for risky code patterns, including injection sinks.
  • 15. depvuln: Flags dependencies with known vulnerabilities.
  • 16. supply-chain: Lockfiles, a software bill of materials and license checks.
  • 17. pii: Catches personal data written to logs or other high-risk outputs.
  • 18. compliance: Checks the controls a project that handles sensitive data must declare.
  • 19. encryption-asserted: Checks that encryption at rest and in transit is declared and enforced for sensitive data.
  • 20. rls: Static check for row-level security on tables that hold tenant data.
  • 21. rls-enforce: Applies the migrations to a real database and proves a cross-tenant read is denied.
  • 22. database-migrations: Migrations apply, roll back and stay backward compatible.
  • 23. db-fuzz: Fuzzes schema rules, migrations and tenant isolation.
Phase 3: Stress Testing

We hit the structure with sledgehammers to make sure it holds.

  • 24. verify: Builds the project and proves it actually runs.
  • 25. skipped-tests: Blocks skipped or disabled tests unless they carry a signed waiver.
  • 26. coverage-threshold: Blocks when measured coverage falls below the declared target.
  • 27. mutation-score: Injects small bugs and checks that the tests catch them.
  • 28. flake-detection: Re-runs the tests to catch ones that pass or fail at random.
  • 29. property-invariants: Checks properties across many randomized inputs instead of a few examples.
  • 30. http-fuzz: Fuzzes HTTP entry points with injection and crash inputs.
  • 31. native-build: A clean, optimized release build for native code.
  • 32. memory-safety: Rust: no authored unsafe code, or a clean memory-checker run. C and C++: sanitizers configured.
  • 33. abi-wheels: Python native extensions build for more than one operating system family.
  • 34. clippy: Rust lints, with warnings treated as errors.
  • 35. rustfmt: Rust formatting check.
Phase 4: The Handover

Operations, then the final lock before we turn the keys over to you.

  • 36. smoke-journey: Runs the primary user journeys end to end.
  • 37. load-slo: Checks latency and error-rate targets under the declared load.
  • 38. graceful-shutdown: Clean shutdown, restart and crash recovery.
  • 39. sre-telemetry: Structured logs and the basics of observability.
  • 40. resource-limits: Memory and CPU limits are declared and respected.
  • 41. rollback: Proves a release can be rolled back to the previous version.
  • 42. prod-readiness: Pinned dependencies, a README and the other basics of a shippable project.
  • 43. completeness: A reviewer compares the finished features against the spec; a missing feature blocks.
  • 44. coverage: The roll-up: a passing chain needs at least one substantive gate to have done real work, so an all-n/a board cannot pass.