release-gate

The pre-deploy release gate for AI agents. It renders an evidence-based PROMOTE / HOLD / BLOCK verdict — catching the agent-layer risks that SAST, guardrails, and evaluators structurally miss.

v0.10.1 — the release where the gate stopped being static-only. RG-PII-001: sensitive context reaching the model unmasked on one path while an equivalent path redacts it — reported only on divergence, so your repo supplies its own oracle, a project that masks centrally stays silent, and the rule is structurally unable to punish the fix it recommends. Platform evidence ingestion (release-gate ingest, and now verify --trace too): Langfuse / OpenTelemetry / Arize-Phoenix / Promptfoo exports convert in place, so both the pre-deploy score and a running loop can be gated on telemetry you already emit — no bespoke file, no new instrumentation, no LLM in the loop, so runtime verdicts stay as reproducible as static ones. The loop check now keys on tool name + arguments, so multi-query retrieval is no longer mistaken for a stuck agent and an agent oscillating between two tools now is. A project's own model wrapper counts as LLM usage, so a production LangGraph app whose only model call goes through a local httpx helper is no longer waved through as "not a deployed agent". 93-case benchmark at 100% precision / 100% recall.

v0.9.4 — a lean, three-dependency CLI (pip install release-gate no longer pulls a web/SaaS stack) and a reproducible 93-case benchmark that covers every rule (≥2 vulnerable + ≥2 clean look-alikes each), so the zero-false-positive claim can be checked, not just read. Both sit on top of the v0.9.0 agent-safety catalog (9 new rules + 2 precision upgrades), holding the precision bar at 0 false positives on that labeled benchmark and a framework dogfood (llama_index / crewAI / langgraph / open-interpreter): indirect prompt injection from RAG/tool/HTTP provenance (RG-PROMPT-002), model-driven SSRF / filesystem / SQL sinks (RG-ACTION-002/003/004), secret/PII → prompt data-egress to the provider (RG-SECRET-002, an agent-aware egress path conventional SAST lacks context to model), taint-aware deserialization (RG-EXEC-004), unvalidated model-output parses (RG-PARSE-001), and tool blast-radius + irreversibility gates (RG-TOOL-001 / RG-GATE-001) — plus confirmed taint through the canonical resp.choices[0].message.content extraction and a reproducible PR-gate demo. See the catalog below. Builds on 0.8.5's release-gate pr, the AI-change review gate: one PROMOTE/HOLD/BLOCK on what a pull request introduced (net-new agent risk + lockfile/behaviour drift), plus a GitHub Action command: pr; 0.8.4's security-hardened MCP server (pip install 'release-gate[mcp]'); and 0.8.0–0.8.2's AST-based evidence-citing analysis, deserialization calibration, and team-adoption workflow (--mode / --baseline / --pr-comment).

Why it's not SonarQube: a SAST tool sees eval(x) and asks "is x tainted by SQL/HTTP?" — it has no concept of "x is the model's reply." That blind spot is the entire agent layer: eval/pickle of model output (the CVE-2025-51472 RCE class), user input reaching a system prompt, LLM loops wi

... View full README on GitHub