Layered merge gates

The conservative answer is that the pull request is a hard point — the system may propose anything but never merges its own work — with any relaxation bounded explicitly by risk tier rather than by enthusiasm. The aggressive answer replaces the single human approval with a stack: code review, adversarial review, UX consistency, security review of the pipeline itself, agent-artifact checks, each implemented as a reviewer agent driven by a per-concern persona file. One team running the stack reported 295 issues opened and 217 shipped in 30 days, median triage 4.6 hours, triage-to-ship 1.6 hours, at roughly $3,000 a month for five people. Reviewer agents in that shape are, in their own description, “really just a matrix CI job that points at a bunch of markdown files.”

Both answers need the same supporting machinery, which is the transferable part. Conformance checking: keep decision records human-authored and hard-reviewed — agents bloat them until nobody reads them, which defeats the point — then invert the labor and point agents at every subsequent pull request to police drift against them. Traceability: require every implemented or verified item to trace to a stated requirement, and treat untraceable work as invented scope rather than as a pass. Agents given intent without reality invent acceptance criteria; agents given freedom without a brief invent architecture, and the production form is a microservice appearing that nobody asked for.

Cap the agent-versus-reviewer loop at a fixed number of rounds and escalate a structured disagreement packet — what each side claims and why — rather than more transcript. One team caps at five iterations and then has a human arbitrate; arbitration is cheap because plans and reviews are structured data, so they can query for where the agents disagree, and if it is still unclear they kill the session having lost ten minutes.

Branch plus draft pull request is Assay’s standing authorization, and merge is human-gated — a recorded ruling, not an accident of caution. GitHub Next hitting the same wall independently is evidence the constraint is structural rather than conservatism. Auto-merge is deliberately rejected: the risk posture is a decision, not an omission. The five-gate stack is nonetheless the useful checklist of what would have to exist first if low-risk classes were ever loosened, and the two counterexamples argue for writing down explicitly where the gate may relax and where it never may. That written boundary does not exist today.

Persona-split verdicts. The matrix-CI-job-over-markdown shape is cheap to trial on Assay’s own public repository: a core-systems persona carrying the defense-in-depth reviewer questions, a guardrails persona, a spec-fidelity persona. The reviewer role is already a markdown body, so the change is a fan-out, not a rewrite. Designed here, unbuilt. Conformance pass. Extend the reviewer checklist with “does this diff contradict any decision recorded in the phase briefs or linked findings?” — one extra section in the prompt; trial for a month and count drift findings against false positives. Invented-scope detection. Require every verdict to trace to a Definition-of-Done line, with verified-but-untraceable reported as invented scope, and treat any pull request that cannot trace to a brief as a quarantine case rather than a review case. Assay’s tooling already refuses to open a pull request that names no brief — that is the trace requirement enforced at creation; extending it to verdicts is the missing half. Loop bounding. The review loop is open-ended by design; a loop counter plus an auto-assembled arbiter packet would cut token burn on irreconcilable disputes and turn a stuck review into a well-formed decision request, which Assay already has as an escalation category. Not built.

• A defect-escape rate under a full automated gate stack. Throughput and cost were published; what got through was not, and without that number the stack-versus-hard-gate question is undecided on evidence.
• A published risk-tiered relaxation policy — which change classes may auto-merge and why — which is the artifact Assay would need before loosening anything.
• Whether the two no-review counterexamples are still running in six months.