Skip to main content
Reference — generated from the toolkit

Source of truth: toolkit/gates/build-merge.md. Edit it there; this page is regenerated on build.

Gate: Merge gate

Transition: within Build — every pull request Owner: Senior Dev (Lead) Runs: every PR

Purpose​

The enforceable definition of done for AI-generated code, expressed as policy-as-code. Assumes volume: automate everything machine-checkable so human review goes on intent, domain correctness and test honesty — never style.

Entry criteria​

  • PR raised from a short-lived branch off trunk.
  • PR template completed, including the AI-provenance declaration (agent/model/prompt or skill used).

Exit criteria (enforced as policy-as-code)​

  • Coverage thresholds met on changed code; mutation score within policy.
  • Zero critical findings from SAST, secrets scan and SCA.
  • Lint/format clean (formatting is never human-reviewed).
  • Docs updated in the same PR (stale-docs check passes).
  • An ADR is present if the change is of a type that requires one.
  • No new dependency added without explicit human approval in the PR.
  • Acceptance criteria demonstrably met; tests assert behaviour (not written merely to pass).
  • Human review recorded — a human always merges. Extra-scrutiny tiers apply for auth, payments, migrations, PII.

Evidence required​

  • CI run link; coverage + mutation report; scan results; review approval.

Automated vs human​

CheckAutomated in CIHuman sign-off
Coverage, mutation, SAST, SCA, secrets, lint, stale-docs✅—
Intent-match, domain correctness, test honesty—Reviewer (human)
Merge—Human (always)

Sign-off & waiver​

  • Signs: a human reviewer; SME where the change is flagged domain-sensitive.
  • May waive: a time-boxed, named-approver waiver may lower a threshold under documented pressure; it is logged and expires. Security-critical findings are not waivable.
  • Waiver record: logged in toolkit/registers/ with expiry.