An AI coding agent quality gate is a check that decides whether an agent's step counts as done, run by something other than the model's opinion of its own work. As of 18 October 2026 I read 16 governance frameworks that promise such gates for Claude Code, OpenAI Codex, Cursor and GitHub Copilot. Of the eight I compare here, four block nothing on a default install: they only warn, or the gate is text the agent is asked to follow. For most teams the pick is gap-trap, whose gates run in CI and pre-commit whether the agent cooperates or not.
What is an AI coding agent quality gate? #
An AI coding agent quality gate is a check between an agent's step and the word "done" that the agent cannot pass by saying it passed. Gates come in three kinds by where they run: instruction text in AGENTS.md or a skill, a hook or orchestrator in the agent's harness, and a required job in CI. Only the last two can stop an agent.
The difference matters because instruction files are followed only part of the time. Damon McMillan measured 1,650 Claude Code sessions in a paper published in May 2026: a trivial annotation rule written in CLAUDE.md was followed in 60% to 68% of generated functions, depending on the condition. The AGENTS.md format itself enforces nothing. Its site says the agent "will attempt to execute relevant programmatic checks" if you list them.
A harness gate in Claude Code is a hook that exits with code 2: a PreToolUse hook blocks the tool call, a Stop hook keeps the agent working. Two limits apply. Hooks fail open on errors and timeouts unless set to onFailure: "block", and Claude Code overrides a Stop hook after eight consecutive continuations by default. A required CI check has neither limit.
How I picked the eight #
I started from 13 repos that trended on GitHub and Hacker News in September, plus three that rank for the query, read every README, and read the hook or gate script wherever one exists. Eight made the list because they ship a gate of their own or are widely used enough to compare against. Star counts are from the GitHub API on 18 October 2026.
Left out, and why:
- spec-superflow gates completion only when the agent calls
ssf workflow complete. Thespec-driven development tools post covers it withOpenSpec and Spec Kit. - AI Factory has its gates write their own pass or fail verdict, and its repository has no licence file despite the MIT claim in its README.
- Anbeeld's AGENTS.md is one instruction file with no checks: the control group.
- AI Ready generates an
AGENTS.mdand a CI workflow; it sets a repository up rather than gating it. - zl190/agent-gates (0 stars) has a test gate that trusts a
.test-passedfile the agent can create itself. - deeppatternai/agent-quality-gates has one star.
- Vibe Code Stack For CEOs is an app template with husky and CI gates already wired, not a layer for an existing repository.
- Evidence Gate 's server-side check against criteria the agent never sees is announced, not shipped; its README says the hosted API "is not launched".
The repos did not all appear in mid-September, as the topic assumed. Only gap-trap and deeppatternai were created that month. Most of the rest date from September 2025 to June 2026, and 11 of the 16 shipped a release in September or October.
Eight agent quality gate frameworks, by where the gate runs #
gap-trap
MIT · Claude Code, Codex · gate runs in CI, pre-commit and the test suite · v0.2.2, 29 September 2026 · 181 stars
gap-trap reads the repository and writes per-area contracts into AGENTS.project.md, each with Owns:, Path:, Never: and Gate: lines, then installs a check per rule. Its gates verify that every path and symbol a contract cites still exists, grep for each Never: clause a text search can settle, fail a new test that already passes on the old code ("proven red"), and stop counts of known problems from rising. The README states the problem in one line: "The rules are text, and the only thing that reads them is the agent that breaks them." Pick it to turn rules into checks the agent cannot skip.
loki-seal (Loki Mode)
BUSL-1.1 · Claude Code · gate runs in the harness (SessionStart and Stop hooks) · Loki Mode v11.17.58, 17 October 2026 · 1,098 stars
loki-mode ships loki-seal as a separate Claude Code plugin. It runs your test suite at session start for a baseline, then again at every stop attempt, and exits 2 on newly failing tests, a deleted test file, fewer assertions, new .skip or .only markers, or CI config softened with continue-on-error: true or || true. It lets the agent stop after five blocks, marked "NOT VERIFIED". The author lists what it misses: an assertion replaced with assert.ok(true), and a model that edits the hook. The licence is free for personal, internal and non-commercial use and turns into Apache 2.0 in 2030.
GSD Pi
MIT · its own harness, with Claude Code and Cursor Agent as providers · gate runs in the harness · v1.22.0, 12 October 2026 · 1,326 stars
GSD Pi is a coding agent of its own, so the gate sits in the orchestrator. After every task the host runs the configured verification_commands, retries twice, and counts evidence only if it recorded each claimed command exiting 0: "A verification result with no host-run check is never a pass." In planning and docs units, writes outside allowed paths are "blocked with a hard policy error instead of relying on prompt compliance". I confirmed this from its docs and design records, not its source. Pick it if you will switch harness for gates the agent cannot argue with.
MoAI-ADK
Apache-2.0 · Claude Code · gate runs in the harness (a Go hook binary) · v3.1.2, 21 August 2026 · 1,236 stars
MoAI-ADK runs a spec lifecycle with separate auditor agents and a /moai gate command for lint, format, types and tests. Its Stop hook "Always returns 'allow'". The blocking happens elsewhere: a TaskCompleted hook refuses a task whose spec acceptance criteria are unchecked, and an opt-in guard rejects an auditor's PASS that cites no stored receipt. The README advertises v3.2; the latest tagged release is v3.1.2.
Andon
MIT · Claude Code · gate runs in the harness (a Stop hook) · v0.1.0, 5 September 2026 · 166 stars
Andon's Stop hook spots completion phrases in the agent's last turn and looks for a matching entry in a verification log, then blocks or warns. The default mode is warn. An opt-in mode, on main since the v0.1.0 release, accepts only a passing pytest, tox or similar run recorded in the Claude Code transcript. The known-limits section on main is candid: "The agent writes its own verification entry. Token overlap can accept unrelated work or a fabricated entry." Pick it when the failure is the agent saying done too early.
Agentic OS
MIT · Claude Code, Codex, Google Antigravity, plus Cursor and Copilot · gate runs in an opt-in pre-commit hook · v1.8.34, 18 October 2026 · 213 stars
Agentic OS scales phases to the task, from four for a tiny fix to nine for an architecture change, and keeps a work log per branch. Its validate.sh fails when a log lacks gate evidence receipts or skips a phase, and a credential scanner checks staged files. The README is plain about the limits: "A fresh install runs nothing by itself", work logs are gitignored so CI cannot check them, and ignoring the workflow is rated "Advisory, the same as a rules file".
Aegis
MIT · Codex, OpenCode, Claude Code and nine more · gate lives in skill text · v2.13.1, 18 October 2026 · 1,357 stars
Aegis is a skill pack derived from Superpowers for "baseline-first, evidence-verified, drift-checked" work. Its Drift Check makes the agent re-read the original intent, scope and stop condition during long tasks. Nothing blocks: the only hook injects context at session start, and the skills say "Never emit gate-passed". The author's A/B run on version 2.7.6 with Codex raised the contract pass rate from 61.67% to 93.33% across 120 runs, scored by the author's own checks rather than by independent human review.
AIGX
MIT tools, CC BY 4.0 spec · writes rules for Cursor, Claude Code, Codex, Windsurf, Aider, Copilot · gate lives in instruction text, with a CI lint of the rule index · v1.3.3, 20 June 2026 · 145 stars
AIGX keeps per-file rules with stable IDs in .aigx/, including <forbid> import boundaries, and aigx resolve <path> prints one file's constraints for the agent. The CI job checks that the rule index is not stale, not that code obeys it. On its author's benchmark, Claude Sonnet 4.6 and Haiku 4.5 crossed a forbidden import in 0% to 13% of 60 runs per format, and in 7% to 8% with rules in AIGX's own format.
An evidence gate checks a record, a test gate reruns the check #
A test gate runs the tests, lint or type check itself and blocks on red, as loki-seal does at every stop. An evidence gate checks that a record of verification exists and fits a schema or a claim, as Agentic OS and Andon do. The difference is who writes the record. In most evidence gates the agent does.
The authors say so themselves. Andon warns the entry can be fabricated. loki-seal: "a model with shell access can forge the baseline state file ... or edit the hook itself". MoAI-ADK's source carries a comment on the failure that made it add receipts: "an auditor returned PASS 0.92 three times without invoking the codex gate, and the same review forced through the gate came back FAIL with six defects."
The stronger evidence gates take the record from the harness, not the agent. GSD Pi counts only commands its host ran. spec-superflow runs the verification command itself and checks the exit code and that git HEAD did not move. For agent-written pull requests, the six verification layers post applies the same rule at review time.
Gates cost a test run per stop and a retry per failure #
No framework here published what its gates cost in time or tokens, gates on against gates off, so the cost of gating a coding agent comes from parts. A Stop-hook test gate costs one full test run per stop attempt and an extra turn per block. Instruction files cost tokens on every request. Repair loops cost time and tokens too, and nobody measured them for these tools.
What has been measured:
| Cost | Number | Who measured |
|---|---|---|
| Context files on every request | Over 20% more inference cost on average | Gloaguen et al. , controlled runs, 2026 |
| Governance text read per task, Agentic OS | 22,077 to 44,130 tokens | Author, static count, May 2026 |
| loki-seal per stop attempt | Your full suite, up to 270 s timeout, up to 5 blocks | Defaults in its code |
| Deterministic pre-commit check | 493 ms for 238 proof obligations | Gorinevski , one machine, April 2026 |
| gap-trap gate set | About a minute; the instruction gate about a second | Author, method not given |
| An extra agent pass for one kind of issue | "maybe 5-15 min" | Iouri Khramtsov , own estimate |
Khramtsov's essay reached 129 points on Hacker News with the claim the gates are built on: agents "aren't great at following complex instructions in AGENTS.md or CLAUDE.md. But they do pretty well if you add a separate pass to find and fix specific issues."
Which gate catches architecture drift on long tasks? #
The gate that catches architecture drift on long tasks is a deterministic boundary check, an import rule or a typed component boundary, run in pre-commit or CI. Instruction-level drift checks help the agent notice, but McMillan found compliance with a CLAUDE.md rule fell by about 5.6% in the odds with each additional function the agent wrote in a session.
A July 2026 case study by Davis et al. tried agent audits first: "The audits were expensive and non-deterministic, and structural drift accumulated." What held was a typed catalog of components, each with its own scope and checks, enforced by static and dynamic analyses.
Of the eight, gap-trap comes closest: its Never: clauses become grep gates and its ratchets keep known problems from growing. GSD Pi re-checks each milestone against its roadmap. Aegis's Drift Check and AIGX's <forbid> rules are advisory, and on AIGX's own benchmark agents crossed AIGX-format boundaries in 7% to 8% of runs. For the testing and spec-first moves these frameworks wrap, see the AI coding tools developers use.
The eight side by side #
| Framework | Gate runs in | Blocks on a default install | What it checks | Licence | Stars, 18 Oct 2026 |
|---|---|---|---|---|---|
| gap-trap | CI, pre-commit, tests | Yes | Cited paths exist, Never: greps, proven red, ratchets |
MIT | 181 |
| loki-seal | Claude Code Stop hook | Yes, releases after 5 blocks | New failures, removed or skipped tests, softened CI | BUSL-1.1 | 1,098 |
| GSD Pi | Its own harness | Yes | Host-run verification commands, milestone validation, path policy | MIT | 1,326 |
| MoAI-ADK | Hook binary | Partly: TaskCompleted only | Spec acceptance boxes, opt-in auditor receipts | Apache-2.0 | 1,236 |
| Andon | Claude Code Stop hook | No, warn by default | Completion claim matches a verification entry | MIT | 166 |
| Agentic OS | Opt-in pre-commit | No | Phase order, evidence receipts, credentials | MIT | 213 |
| Aegis | Skill text | No | Baseline, drift, verification before completion | MIT | 1,357 |
| AIGX | Instruction text, CI lint of the index | No | Per-file forbidden imports (advisory) | MIT / CC BY 4.0 | 145 |
Which one for which setup #
- Any agent, rules you can grep: gap-trap, since its gates run in CI whatever the agent does.
- Claude Code, tests that already work: loki-seal at Stop, plus a required CI check for the cases its five-block valve lets through.
- Ready to change harness: GSD Pi, which counts only commands its host ran.
- Claude Code all day, spec-first: MoAI-ADK, knowing its Stop hook allows everything.
- The agent says done too early: Andon, promoted from warn to block once the false positives settle.
- Long tasks that wander: Aegis for the agent's own checks, behind a deterministic gate it cannot skip.
- Per-file boundaries in a large codebase: AIGX for retrieval, plus an import linter in CI as the real gate.
New posts by email #
About one email a week with what we published. No account needed.
Which of these do you use? #
Nobody on Stackness runs gap-trap yet. Tick what you use and be the first.