Deploy gate

Deploy gating reports by default. Enforcement is opt-in.

The deploy gate evaluates a deploy operation for an artifact whose receipt is stale or mismatched. By default, it is advisory.

What the deploy gate does

coderifts deploy-gate gates a deploy on the current { environment, artifact } using a preflight receipt (phase-1 advisory).

Default vs enforcement

Default

REPORTS

Advisory, exit 0. Phase 1 reports and exits 0 even on a gate deny.

With opt-in

PREVENTS

Exit 1. When the step is marked enforcing, a failure exits 1.

How to opt in

Mark the step enforcing with --enforce or CODERIFTS_DEPLOY_ENFORCE=true.

coderifts deploy-gate --env production --artifact "$SHA" --receipt receipt.json
coderifts deploy-gate --env production --artifact "$SHA" --receipt receipt.json --enforce

Honest bound

Advisory by default means it REPORTS unless enforcement is configured. Prevention holds inside the wired boundary; a host that bypasses an unwired surface is outside it. Merge and deploy enforcement depend on repository configuration, not on this gate alone.