ComplianceGate

AI coding agents commit faster than humans review. By the time a pull request reaches review, PHI, card numbers, or secrets may already be in git history, where removal is painful and the exposure has already happened. Teams under HIPAA, PCI, or SOC 2 obligations had no control between "the agent wrote it" and "it's pushed."

Solo build with no budget for a hosted service.
Had to run on every change without slowing developers down, or it would get bypassed.
Sensitive code could not be sent to a third-party model by default.
Audit evidence had to exist without requiring a database server.

Pull-request-time review only: too late, because secrets are already in git history.
LLM-only review: slow, costly, non-deterministic, and sends code off the machine.
Hosted compliance dashboard: adds a vendor, and the data leaves the developer's machine.

1. Gate at the source. Three checkpoints: watch, commit, and push.
2. Heuristic first, LLM second. Deterministic rule packs (base, PII, HIPAA, PCI) run first. An optional two-stage LangChain review handles nuance: a reasoning pass analyzes diffs against the enabled rules, and an analytical pass produces structured findings without inventing new issues.
3. Local-first audit trail. Storage is the user's choice: SQLite, markdown, or remote Postgres/MySQL (metadata-only by default). redact_before_send protects anything routed to a model.
4. Escape hatch by design. CG_SKIP=1 exists because a gate people can't override in an emergency is a gate people remove.
5. Meet agents where they work. It ships as a CLI (cg) plus Cursor and Claude skills for in-chat review.

Flow: agent, watch, commit hook, push hook, audit store. Rule packs feed the heuristic checks, and the LLM review runs only on ambiguous findings.

Limitations: heuristics miss novel patterns, and the LLM stage inherits model error. Local enforcement can be skipped by a determined developer, so it complements server-side controls and does not replace them.

Target: capture a real catch from a test repository and track the false-positive rate of the rule packs. No adoption or effectiveness figures have been measured yet.

I built this in about three weeks and have had little user feedback so far. The open question is whether the gates change how people work on real projects, and that is what I plan to measure next.