Hardgate

Deprecated: Hardgate is deprecated. Use Jevgate instead.

Install Jevgate with cargo install jevgate --locked. See its crate page for setup and usage. The documentation below is retained for existing Hardgate users.

Hardgate is a local Rust CLI for deterministic quality gates, structural budgets, and anti-gaming checks in agent-assisted repositories. It turns repository policy and its required evidence into a report that maintainers, CI jobs, and coding agents can inspect before accepting a change.

A passing report means that the enabled engines found no blocking findings. It does not claim that every possible quality property was proven.

Local analysis and ordinary project checks support macOS and Linux. Native npm packages include the CLI, so users do not need Rust. Evidence producers and policies with orchestration.require_isolation = true require Linux containment. See installation and feature requirements.

Legacy Hardgate quick start

Install the latest released Cargo CLI, then initialize a structural policy in the project you want to check:

cargo install hardgate --locked
cd /path/to/your/project
hardgate init
hardgate check

check --checks policy is a partial static/evidence check, not full acceptance. Run hardgate check on macOS or Linux for all configured requirements.

balanced is a structural starting point. Initialization does not install project tools or execute project commands. An existing project may still fail its first check because its source roles, budgets, commands, or evidence need project-specific decisions. See Getting started for previews, diagnostics, and a small refactor walkthrough.

This repository also contains an unreleased source checkout. To try that checkout, run cargo install --path . --locked from its root; do not use its source version as an npm or registry install target before a release.

What Hardgate checks

• Role-aware discovery: files receive source, test, generated, fixture, migration, configuration, documentation, vendor, or unknown roles before engines choose their inputs.
• Structural budgets: configurable file and function budgets use Tree-sitter metrics for Rust, Python, JavaScript, TypeScript/TSX.
• Anti-gaming and architecture: suppression, forbidden-token, and declarative path-scoped import, call, and token rules can block a change.
• Clone debt: bounded normalized-token comparisons produce stable, path-independent clone fingerprints.
• Evidence: enabled LCOV, mutation-report, and generated-freshness checks fail closed when required inputs are missing, empty, unreadable, or malformed.
• Specialist evidence: optional cargo-mutants, Stryker, LLVM, Vitest and pytest producers bind fresh reports to source/test/config inputs and verify restoration.
• Acceptance: check verifies formatting and linting by default, together with configured tests, type checks and required evidence.

Hardgate inventories additional text and data formats for classification and safety rules. It does not claim compiler or type-checker analysis, global module resolution, or a hosted quality dashboard.

Command boundaries

Command	Purpose
check	Combined policy, formatting, linting, configured tests/type checks and evidence
check --diff	Changed/staged static scope and changed executable-line coverage
check --checks policy	Explicit partial run of policy and required evidence
evidence <producer>	Run a specialist in an isolated copy and bind its fresh report
mcp	Static check, file scan, and metrics tools over stdio

These commands distinguish static analysis, report evaluation and orchestration. See the CLI reference for scope, evidence, exit status, and agent integration details.

Documentation

Need	Guide
Install Cargo, npm, pnpm, or a direct binary	Installation
Initialize a policy and follow the first check loop	Getting started
Command behavior and agent/MCP integration	CLI reference
Presets, roles, budgets, evidence, and classification	Configuration
Internal components and execution boundaries	Architecture
Specialist mutation resources and limits	Mutation resources
JSON reports and execution evidence	Report schema
Stable diagnostic rule IDs	Diagnostic rules
Comparison with adjacent tools	Existing landscape
Product direction	Vision and paradigm

For release operations, see the maintainer guide, release recovery runbook, and publisher setup. The Rust API reference is generated from the crate.

Contributing and license

Read Contributing and the Code of Conduct before opening an issue or pull request. See the security policy for private vulnerability reports. See the changelog for user-facing behavior changes.

Hardgate is available under either the Apache License 2.0 or the MIT License, at your option.