Roles, Models and Safety Rails
Gates and Secret Scanning in v6.2
The Build and Test Gate
gate.js auto-detects your stack (package.json runs npm run build / npm test; Cargo.toml uses cargo; go.mod uses go; and so on) and can be overridden with gate.config.json. It applies zero-collected false-green teeth: a test leg that finds no tests is a failure, not a pass.
What is new in 6.2:
- An opt-in
visualleg runs in the full gate only, locally only, and a run that finds zero snapshots fails - The test-leg summary reports TIMED OUT with detail, and a killed visual leg is reported as TIMED OUT
- Build, lint, e2e and visual legs get a default timeout when your config omits one
Scoped Secret-Scanner Allowlists
The scanner's generic secret-assignment patterns used to flag harmless source lines. v6.2 adds a source-code reference allowlist and a TypeScript type-member allowlist. They apply to source files only and are judged on the whole line tail. What they never exempt: a credential-shaped quoted literal, a comment, a shell string or an opaque run.
Keep the Gate Honest
Adopter gates are application-only: your project's build, test, lint and e2e. The toolkit's own test suite runs in the toolkit repository and never becomes a leg of your gate — not even after you edit agent files.
Never weaken an assertion or skip a scan to get a green check. A red gate with a clear cause is information; a green gate you bought by loosening the check is a liability.
In v6.2, the opt-in `visual` gate leg finds zero snapshots. What happens?