Case Study 06: Automated Pre-Commit Architectural Guard.
Continuous architectural governance showcase on argoproj/argo-cd (Kubernetes continuous delivery platform with 18 subsystems and 4,216 files). Demonstrates how CodeExplorer Semantic Invariant Gates (SIG) evaluate 6 production rules in 422 ms with zero LLM tokens ($0.00), freeze legacy technical debt into line-shift-immune SHA-256 baselines, block single-line PR regressions, and monotonically tighten architectural ceilings.
422 ms
Pre-Commit Latency
Evaluates all 6 production architectural gates across 4,216 files in 422 ms (330 ms pure query execution).
55 ms average query time per gate
0
Tokens Consumed
0 tokens ($0.00 cost). Runs entirely offline as a compiled native binary with zero network calls.
Zero API cost / local pre-commit execution
Exit 1 / 0
Native CI/CD Blocker
Blocks Day 0 debt (Exit 1), freezes SHA-256 baselines (Exit 0), and rejects any single new PR leak.
Line-shift immune SHA-256 ratchet
6 of 6
Architectural Invariants
Evaluated all 6 rules: 2 PASS, 1 WARN, 3 FAIL with exact call sites, line numbers, and AST symbols.
3 layer leaks & 12 god types caught
Evaluated system & configuration:
1. CodeExplorer (
2. Evaluation Mode: 4-Phase CLI Lifecycle (
3. Target Repository:
1. CodeExplorer (
ce): v1.80.2 (.NET 11, SQLite + OpenCypher, Semantic Invariant Gates & SHA-256 Baseline Ratchet, 45,616 nodes, 134,005 edges)2. Evaluation Mode: 4-Phase CLI Lifecycle (
ce gate check + ce gate ratchet --update + ce gate details --new): 0 tokens, $0.003. Target Repository:
argoproj/argo-cd (commit 6d689fa3, 18 subsystems, 4,216 files)1. The 6 pre-commit architectural invariant rules.
To prevent architecture drift, teams enforce rules at pre-commit and PR review time. CodeExplorer evaluates these invariants deterministically as zero-match OpenCypher gates.
Reverse Layer Inversion Shield
SIG-P-B-101
Foundational utility packages (util/**) must remain self-contained and never directly call package functions in server/**, controller/**, reposerver/**, or cmpserver/**.
FAIL: 3 direct cross-layer call sites
God Type Complexity Limit
SIG-C-R-102
No production Go struct or TypeScript class may declare more than 30 methods in a single type unit without an explicit ratchet exemption.
FAIL: 12 types (11 Go + 1 TS)
GitOps Engine Isolation
SIG-P-B-103
The embedded gitops-engine/** subsystem must remain strictly standalone with zero upward package calls into Argo CD host services or util/**.
PASS: 0 upward host calls
Storage Abstraction Boundary
SIG-P-B-104
Raw Kubernetes secret repository storage backends (repository_secrets.go) must be encapsulated strictly within util/db.
PASS: 0 external call sites
Notification DB Decoupling
SIG-P-B-105
Notification utilities in util/notification must not instantiate standalone database instances or call db.NewDB directly.
FAIL: 2 violation sites in service.go
Public Auth Bypass Audit
SIG-M-B-106
All server endpoints implementing AuthFuncOverride bypass standard authentication and must be explicitly audited and allowlisted.
WARN: 4 legitimate overrides audited
2. Semantic invariant gates evaluation scorecard.
Evaluated natively on argoproj/argo-cd @ 6d689fa3 via ce gate check in 422 ms total wall-clock time (330 ms pure OpenCypher query execution) across 45,616 graph nodes and 134,005 relationships.
| Gate ID & Invariant Rule | Scope & Dimension | Target Subsystems | Query Time | Findings Detected | Status & Action |
|---|---|---|---|---|---|
SIG-P-B-101Reverse Layer Inversion Shield |
Module × Boundaries | util/** → server/**, controller/**, reposerver/**, cmpserver/** |
58 ms | 3 call sites | FAIL (Block PR) |
SIG-C-R-102God Type Complexity Limit |
Class × Resources | Production Go structs & TS classes (>30 methods) | 206 ms | 12 types (11 Go + 1 TS) | FAIL (Block PR) |
SIG-P-B-103GitOps Engine Layer Isolation |
Module × Boundaries | gitops-engine/** → Argo CD host packages |
27 ms | 0 upward calls | PASS (Isolated) |
SIG-P-B-104Storage Abstraction Boundary |
Module × Boundaries | repository_secrets.go access outside util/db |
29 ms | 0 external calls | PASS (Encapsulated) |
SIG-P-B-105Notification Subsystem Decoupling |
Module × Boundaries | util/notification direct db.NewDB calls |
2 ms | 2 call sites | FAIL (Block PR) |
SIG-M-B-106Public Authentication Bypass Audit |
Method × Boundaries | server/** AuthFuncOverride endpoints |
8 ms | 4 endpoints | WARN (Audited) |
| Total Suite (incl. SQLite & YAML init) | Agnostic | 4,216 files across 18 subsystems | 422 ms (330 ms queries) | 17 errors + 4 warnings | Exit 1 (Build Blocked) |
Key architectural takeaways: Deterministic pre-commit gate execution
1. Compiled native binary execution:
2. Zero false positives on Dependency Inversion: By targeting direct exported package-level calls (
3. Continuous CI/CD enforcement: Returns an immutable binary exit code (
1. Compiled native binary execution:
ce gate check evaluates declarative OpenCypher structural invariant rules directly against the local SQLite graph database. All 6 gates complete in 422 milliseconds wall-clock time (330 ms pure query execution) with 0 tokens and $0.00 cost.2. Zero false positives on Dependency Inversion: By targeting direct exported package-level calls (
NOT (:Type)-[:HAS_METHOD]->(callee)), SIG-P-B-101 isolates the exact 3 true upward dependencies in util/session, util/app/discovery, and util/webhook while cleanly passing util/git and util/helm (which properly invert dependencies via local cache interfaces).3. Continuous CI/CD enforcement: Returns an immutable binary exit code (
0 for pass, 1 for fail) suitable for git pre-commit hooks and GitHub Actions without introducing non-deterministic LLM loops into the pull-request path.
3. Brownfield adoption: 4-phase SHA-256 ratchet lifecycle.
Mature codebases cannot halt feature delivery for weeks to refactor 70-method structs on Day 1. CodeExplorer hashes structural AST tuples instead of volatile line numbers, enabling zero-friction CI adoption and one-way debt reduction.
Day 0 Debt Discovery
Phase 1Run ce gate check on unbaselined argo-cd: surfaces all 17 existing errors and 4 auth overrides in 422 ms.
Exit 1: 21 new findings
Line-Shift-Immune Freeze
Phase 2Run ce gate ratchet --update to snapshot SHA-256 AST hashes. Inserting +15 header lines in service.go triggers zero false alarms.
Exit 0: 0 new, 21 tolerated (356 ms)
Surgical PR Blocker
Phase 3A PR adds GetClusterSecretCount calling db.NewDB. All 21 legacy items stay quiet; ce gate details --new isolates only the 1 new leak.
Exit 1: 1 new at service.go:188
Monotonic Debt Ratchet
Phase 4Refactoring GetCommitMetadata drops SIG-P-B-105 from 2 to 1. ce detects the improvement and locks the lower ceiling permanently.
Exit 0: ceiling locked 2 to 1 (183 ms)
| Lifecycle Phase | Engineering Action | CLI Command | Check Time | Gate State | CI Exit |
|---|---|---|---|---|---|
| Phase 1: Day 0 Audit | Initial check on unbaselined repository | ce gate check |
422 ms | 17 errors + 4 warnings (21 new) |
Exit 1 |
| Phase 2: Baseline + Shift | Snapshot SHA-256 baselines, then insert +15 comment lines above violations in service.go |
ce gate ratchet --updatece gate check --scan |
356 ms 2.63 s w/ scan |
0 new, 21 tolerated (graph preserved) |
Exit 0 |
| Phase 3: PR Regression | Add GetClusterSecretCount calling db.NewDB in service.go:188 |
ce gate checkce gate details --new |
196 ms 3 ms details |
1 new on SIG-P-B-105, 21 tolerated |
Exit 1 |
| Phase 4: Debt Paydown | Refactor GetCommitMetadata to injected ArgoDB (violations drop 2 → 1) |
ce gate checkce gate ratchet --update |
183 ms | 0 new, 20 tolerated (ceiling locked 2 → 1) |
Exit 0 |
Why SHA-256 AST fingerprinting survives everyday refactoring:
Each baseline entry in
Each baseline entry in
.codeexplorer/baselines/*.json hashes SHA256(GateId || FilePath || CallerSymbol || TargetSymbol || OccurrenceIndex) rather than source line numbers. When +15 lines were inserted at the top of service.go (shifting GetCommitMetadata from line 66 to 81 and GetAppDetails from line 89 to 104), the incremental scanner recognized a zero-AST-delta edit in 2.63 s and preserved both fingerprints with 0 false positives.
4. Source-verified findings on argoproj/argo-cd.
Every violation reported across the failing and warning gates was verified directly against the Go and TypeScript source files at commit 6d689fa3.
3 Reverse Layer Leaks & 2 Direct DB Calls
SIG-P-B-101 & 105
SIG-P-B-101 (util/** upward calls):
1. util/session/sessionmanager.go:288: Parse → GetProjectRoleFromSubject (server/rbacpolicy)
2. util/app/discovery/discovery.go:171: cmpSupports → cmpserver/apiclient
3. util/webhook/webhook.go:500: storePreviouslyCachedManifests → NewManifestKey (reposerver/cache)
SIG-P-B-105 (util/notification direct DB instantiation):
1. util/notification/argocd/service.go:66: GetCommitMetadata → db.NewDB
2. util/notification/argocd/service.go:89: GetAppDetails → db.NewDB
12 Polyglot God Types & 4 Public Auth Overrides
SIG-C-R-102 & 106
SIG-C-R-102 (>30 methods across Go & TypeScript):
SettingsManager (70), ApplicationController (64), client (61), Server (59), nativeGitClient (50), store (44), ArgoCDSettings (38), Angular ApplicationsService (36 in applications-service.ts), db (35), Service (35), syncContext (35), and Cache (34).
SIG-M-B-106 (AuthFuncOverride public gRPC endpoints):
server/session/session.go:103 (login), server/settings/settings.go:202 (UI login config), server/version/version.go:76 (CLI version), and server/server.go:969 (healthServer probes).
5. Declarative YAML gates and verbatim CLI transcripts.
Click any drawer below to inspect OpenCypher gate rules, Day 0 output, or the 4-phase ratchet transcriptDeclarative YAML Suite gates/architectural-gates.yaml: Complete 6-Gate OpenCypher Rule Definitions
# ==============================================================================
# CodeExplorer Semantic Invariant Gates (SIG)
# Architectural Governance Suite for argoproj/argo-cd
# Configured in: .codeexplorer/gates/architectural/
# ==============================================================================
# --- Gate 1: Reverse Layer Inversion Shield ---
id: SIG-P-B-101
category: Architectural
platform: agnostic
scope: Module
dimension: Boundaries
name: "Reverse Layer Inversion Shield (util/ calling higher services)"
severity: Error
description: "Foundational utility packages (util/) must remain self-contained and must never directly call package-level functions in server/, controller/, reposerver/, or cmpserver/."
remediation: "Invert dependency using interfaces defined in util/, callbacks, or move the caller to the owning service layer."
message: "Reverse layer inversion: util function '{caller.name}' ({caller.path}) prohibited from calling '{callee.name}' ({callee.path})"
thresholds:
warning: 1
error: 1
query: |
MATCH (caller:Function)-[r:CALLS]->(callee:Function)
WHERE caller.path STARTS WITH 'util/'
AND NOT caller.path CONTAINS '_test.go'
AND (callee.path STARTS WITH 'server/' OR callee.path STARTS WITH 'controller/' OR callee.path STARTS WITH 'reposerver/' OR callee.path STARTS WITH 'cmpserver/')
AND NOT (:Type)-[:HAS_METHOD]->(callee)
AND callee.name >= 'A' AND callee.name <= 'Z'
RETURN caller, r, callee AS target
---
# --- Gate 2: God Type Complexity Limit ---
id: SIG-C-R-102
category: Architectural
platform: agnostic
scope: Class
dimension: Resources
name: "God Type Complexity Limit (>30 methods)"
severity: Error
description: "Production structs and classes must declare at most 30 methods. Monolithic God Types degrade maintainability and violate the Single Responsibility Principle."
remediation: "Decompose the struct or class into smaller, cohesive domain components or service delegates."
thresholds:
warning: 1
error: 1
query: |
MATCH (t:Type)
WHERE coalesce(t.kind, 'class') IN ['class', 'struct']
AND NOT (coalesce(t.path, t.file_path, '') CONTAINS 'Test' OR coalesce(t.path, t.file_path, '') CONTAINS 'test' OR coalesce(t.path, t.file_path, '') CONTAINS 'mock')
OPTIONAL MATCH (t)-[:HAS_METHOD]->(m:Function)
WITH t, count(m) AS method_count
WHERE method_count > 30
RETURN
coalesce(t.path, t.file_path) AS file,
coalesce(t.start_line, 1) AS line,
coalesce(t.start_col, 1) AS column,
t.name AS symbol,
'GodType' AS target,
'God type detected: ' + t.name + ' has ' + toString(method_count) + ' methods (max allowed: 30)' AS message
---
# --- Gate 3: GitOps Engine Layer Isolation ---
id: SIG-P-B-103
category: Architectural
platform: agnostic
scope: Module
dimension: Boundaries
name: "GitOps Engine Layer Isolation (Zero Host Calls)"
severity: Error
description: "The embedded gitops-engine/ subsystem must remain strictly standalone and never call upward into Argo CD host services or util/ packages."
remediation: "Keep gitops-engine self-contained; pass Argo CD host behavior via interfaces defined inside gitops-engine/pkg."
message: "Engine boundary leak: gitops-engine function '{caller.name}' ({caller.path}) prohibited from calling host symbol '{callee.name}' ({callee.path})"
thresholds:
warning: 1
error: 1
query: |
MATCH (caller:Function)-[r:CALLS]->(callee:Function)
WHERE caller.path STARTS WITH 'gitops-engine/'
AND NOT caller.path CONTAINS '_test.go'
AND (callee.path STARTS WITH 'server/' OR callee.path STARTS WITH 'controller/' OR callee.path STARTS WITH 'reposerver/' OR callee.path STARTS WITH 'cmpserver/' OR callee.path STARTS WITH 'applicationset/' OR callee.path STARTS WITH 'util/')
AND NOT (:Type)-[:HAS_METHOD]->(callee)
AND callee.name >= 'A' AND callee.name <= 'Z'
RETURN caller, r, callee AS target
---
# --- Gate 4: Storage Abstraction Boundary ---
id: SIG-P-B-104
category: Architectural
platform: agnostic
scope: Module
dimension: Boundaries
name: "Storage Abstraction Boundary (Raw Secrets Access Shield)"
severity: Error
description: "Raw Kubernetes secret storage backends (repository_secrets.go) must be encapsulated strictly within util/db and never called directly from other packages."
remediation: "Access repository storage exclusively via the high-level ArgoDB interface."
thresholds:
warning: 1
error: 1
query: |
MATCH (caller:Function)-[r:CALLS]->(callee:Function)
WHERE callee.path CONTAINS 'repository_secrets.go'
AND NOT caller.path CONTAINS 'util/db'
RETURN caller, r, callee AS target
---
# --- Gate 5: Notification Subsystem DB Decoupling ---
id: SIG-P-B-105
category: Architectural
platform: agnostic
scope: Module
dimension: Boundaries
name: "Notification Subsystem DB Decoupling"
severity: Error
description: "Notification utilities in util/notification must not construct standalone database instances or call db.NewDB directly; DB instances must be injected."
remediation: "Inject ArgoDB as a dependency rather than creating a new DB instance inside the notification service."
thresholds:
warning: 1
error: 1
query: |
MATCH (caller:Function)-[r:CALLS]->(callee:Function)
WHERE caller.path CONTAINS 'util/notification'
AND callee.name IN ['NewDB', 'NewSecretDB']
RETURN caller, r, callee AS target
---
# --- Gate 6: Public Authentication Bypass Audit ---
id: SIG-M-B-106
category: Architectural
platform: agnostic
scope: Method
dimension: Boundaries
name: "Public Authentication Bypass Audit (AuthFuncOverride)"
severity: Warning
description: "All server endpoints implementing AuthFuncOverride bypass standard JWT authentication and must be explicitly audited and documented as intentionally public."
remediation: "Verify that each AuthFuncOverride implementation is intended to be public, or enforce standard JWT authentication."
thresholds:
warning: 1
error: 10
query: |
MATCH (fn:Function)
WHERE fn.name = 'AuthFuncOverride' AND fn.path CONTAINS 'server/'
RETURN
fn.path AS file,
coalesce(fn.start_line, 1) AS line,
coalesce(fn.start_col, 1) AS column,
fn.name AS symbol,
'AuthBypass' AS target,
'Public authentication override detected at ' + fn.path + ':' + toString(coalesce(fn.start_line, 1)) AS message
CLI Execution results/ce-gate-output.txt: Verbatim ce gate check & ce gate details output on argo-cd
$ ce gate check --dir ./repos/argo-cd --- Semantic Invariant Gates Evaluation --- STATUS ID CATEGORY PLATFORM SCOPE VIOLATIONS NAME --------------------------------------------------------------------------------------------------------- [FAIL] SIG-C-R-102 Architectural agnostic Class 12 new God Type Complexity Limit (>30 methods) [WARN] SIG-M-B-106 Architectural agnostic Method 4 new Public Authentication Bypass Audit (AuthFuncOverride) [FAIL] SIG-P-B-101 Architectural agnostic Module 3 new Reverse Layer Inversion Shield (util/ calling higher services) [PASS] SIG-P-B-103 Architectural agnostic Module 0 GitOps Engine Layer Isolation (Zero Host Calls) [PASS] SIG-P-B-104 Architectural agnostic Module 0 Storage Abstraction Boundary (Raw Secrets Access Shield) [FAIL] SIG-P-B-105 Architectural agnostic Module 2 new Notification Subsystem DB Decoupling --------------------------------------------------------------------------------------------------------- Total: 6 gates | Passed: 2 | Warnings: 1 | Failed: 3 | Duration: 422ms Tip: Run 'ce gate details' to view failure details and remediation. Exit code: 1 $ ce gate details --dir ./repos/argo-cd --all --- Semantic Invariant Gate Details --- [FAIL] SIG-C-R-102 [Architectural/agnostic] - God Type Complexity Limit (>30 methods) (206ms) Rule: Production structs and classes must declare at most 30 methods. Monolithic God Types degrade maintainability and violate the Single Responsibility Principle. Remediation: Decompose the struct or class into smaller, cohesive domain components or service delegates. Violations (12 new, 0 tolerated) | Showing 12 of 12: STATUS | LOCATION | SYMBOL | TARGET / CALL -------+---------------------------------------------------------+-----------------------+-------------- [NEW] | controller/appcontroller.go:120:6 | ApplicationController | GodType [NEW] | gitops-engine/pkg/cache/cluster.go:243:6 | store | GodType [NEW] | gitops-engine/pkg/sync/sync_context.go:364:1 | syncContext | GodType [NEW] | pkg/apiclient/apiclient.go:164:6 | client | GodType [NEW] | reposerver/cache/cache.go:32:6 | Cache | GodType [NEW] | reposerver/repository/repository.go:93:6 | Service | GodType [NEW] | server/application/application.go:103:6 | Server | GodType [NEW] | ui/src/app/shared/services/applications-service.ts:57:8 | ApplicationsService | GodType [NEW] | util/db/repository.go:58:1 | db | GodType [NEW] | util/git/client.go:202:6 | nativeGitClient | GodType [NEW] | util/settings/settings.go:87:6 | ArgoCDSettings | GodType [NEW] | util/settings/settings.go:632:6 | SettingsManager | GodType -------+---------------------------------------------------------+-----------------------+-------------- [WARN] SIG-M-B-106 [Architectural/agnostic] - Public Authentication Bypass Audit (AuthFuncOverride) (8ms) Rule: All server endpoints implementing AuthFuncOverride bypass standard JWT authentication and must be explicitly audited and documented as intentionally public. Remediation: Verify that each AuthFuncOverride implementation is intended to be public, or enforce standard JWT authentication. Violations (4 new, 0 tolerated) | Showing 4 of 4: STATUS | LOCATION | SYMBOL | TARGET / CALL -------+-----------------------------------+------------------+-------------- [NEW] | server/session/session.go:103:1 | AuthFuncOverride | AuthBypass [NEW] | server/settings/settings.go:202:1 | AuthFuncOverride | AuthBypass [NEW] | server/version/version.go:76:1 | AuthFuncOverride | AuthBypass [NEW] | server/server.go:969:1 | AuthFuncOverride | AuthBypass -------+-----------------------------------+------------------+-------------- [FAIL] SIG-P-B-101 [Architectural/agnostic] - Reverse Layer Inversion Shield (util/ calling higher services) (58ms) Rule: Foundational utility packages (util/) must remain self-contained and must never directly call package-level functions in server/, controller/, reposerver/, or cmpserver/. Remediation: Invert dependency using interfaces defined in util/, callbacks, or move the caller to the owning service layer. Violations (3 new, 0 tolerated) | Showing 3 of 3: STATUS | LOCATION | SYMBOL | TARGET / CALL -------+----------------------------------------+--------------------------------+----------------------------------- [NEW] | util/session/sessionmanager.go:288:27 | Parse | GetProjectRoleFromSubject [NEW] | util/app/discovery/discovery.go:171:18 | cmpSupports | NewConfigManagementPluginClientSet [NEW] | util/webhook/webhook.go:500:20 | storePreviouslyCachedManifests | NewManifestKey -------+----------------------------------------+--------------------------------+----------------------------------- [FAIL] SIG-P-B-105 [Architectural/agnostic] - Notification Subsystem DB Decoupling (2ms) Rule: Notification utilities in util/notification must not construct standalone database instances or call db.NewDB directly; DB instances must be injected. Remediation: Inject ArgoDB as a dependency rather than creating a new DB instance inside the notification service. Violations (2 new, 0 tolerated) | Showing 2 of 2: STATUS | LOCATION | SYMBOL | TARGET / CALL -------+-------------------------------------------+-------------------+-------------- [NEW] | util/notification/argocd/service.go:66:14 | GetCommitMetadata | NewDB [NEW] | util/notification/argocd/service.go:89:14 | GetAppDetails | NewDB -------+-------------------------------------------+-------------------+--------------
Ratchet Lifecycle results/ratchet-lifecycle-output.txt: Verbatim Phases 2 to 4 CLI & SHA-256 Baseline Transcript
# ==============================================================================
# Phase 2A: Freeze Legacy Debt into SHA-256 Baselines (Day 1 CI Adoption)
# ==============================================================================
$ ce gate ratchet --update --dir ./repos/argo-cd
Successfully ratcheted down and updated baselines for 6 gate(s).
# Generated snapshot: .codeexplorer/baselines/SIG-P-B-105.json
{
"gateId": "SIG-P-B-105",
"allowedViolations": 2,
"entries": [
{
"fingerprint": "45d53d82dfc5293dcd8391c8a4a541653fd994b1199d68ebc3df085a21f61879",
"file": "util/notification/argocd/service.go",
"line": 66,
"column": 14,
"symbol": "GetCommitMetadata",
"target": "NewDB",
"acknowledgedAt": "2026-11-11T13:31:15.0720811+00:00",
"reason": "Baseline snapshot captured at 2026-11-11 13:31:15"
},
{
"fingerprint": "30f65d321503411ce4332641c5d5503b044daa3c85bea47a9bd5598474b9e8b9",
"file": "util/notification/argocd/service.go",
"line": 89,
"column": 14,
"symbol": "GetAppDetails",
"target": "NewDB",
"acknowledgedAt": "2026-11-11T13:31:15.0720811+00:00",
"reason": "Baseline snapshot captured at 2026-11-11 13:31:15"
}
]
}
# ==============================================================================
# Phase 2B: Line-Shift Immunity (+15 comment lines inserted at top of service.go,
# shifting GetCommitMetadata 66 -> 81 and GetAppDetails 89 -> 104)
# ==============================================================================
$ ce gate check --scan --dir ./repos/argo-cd
[Incremental] Changes detected: 0 added, 1 modified, 0 deleted.
[Incremental:Decision] Logic-only change in 'util/notification/argocd/service.go' (0 logic edits, 0 line shifts, 0 graph modifications). Preserving graph.
--- Semantic Invariant Gates Evaluation ---
STATUS ID CATEGORY PLATFORM SCOPE VIOLATIONS NAME
---------------------------------------------------------------------------------------------------------
[TOLERATED] SIG-C-R-102 Architectural agnostic Class 12 tol God Type Complexity Limit (>30 methods)
[TOLERATED] SIG-M-B-106 Architectural agnostic Method 4 tol Public Authentication Bypass Audit (AuthFuncOverride)
[TOLERATED] SIG-P-B-101 Architectural agnostic Module 3 tol Reverse Layer Inversion Shield (util/ calling higher services)
[PASS] SIG-P-B-103 Architectural agnostic Module 0 GitOps Engine Layer Isolation (Zero Host Calls)
[PASS] SIG-P-B-104 Architectural agnostic Module 0 Storage Abstraction Boundary (Raw Secrets Access Shield)
[TOLERATED] SIG-P-B-105 Architectural agnostic Module 2 tol Notification Subsystem DB Decoupling
---------------------------------------------------------------------------------------------------------
Total: 6 gates | Passed: 6 | Warnings: 0 | Failed: 0 | Duration: 356ms
All architectural semantic gates passed successfully.
Exit code: 0
# ==============================================================================
# Phase 3: PR Regression Catch (New method GetClusterSecretCount calls db.NewDB)
# ==============================================================================
$ ce gate check --dir ./repos/argo-cd
--- Semantic Invariant Gates Evaluation ---
STATUS ID CATEGORY PLATFORM SCOPE VIOLATIONS NAME
---------------------------------------------------------------------------------------------------------
[TOLERATED] SIG-C-R-102 Architectural agnostic Class 12 tol God Type Complexity Limit (>30 methods)
[TOLERATED] SIG-M-B-106 Architectural agnostic Method 4 tol Public Authentication Bypass Audit (AuthFuncOverride)
[TOLERATED] SIG-P-B-101 Architectural agnostic Module 3 tol Reverse Layer Inversion Shield (util/ calling higher services)
[PASS] SIG-P-B-103 Architectural agnostic Module 0 GitOps Engine Layer Isolation (Zero Host Calls)
[PASS] SIG-P-B-104 Architectural agnostic Module 0 Storage Abstraction Boundary (Raw Secrets Access Shield)
[FAIL] SIG-P-B-105 Architectural agnostic Module 1 new Notification Subsystem DB Decoupling
---------------------------------------------------------------------------------------------------------
Total: 6 gates | Passed: 5 | Warnings: 0 | Failed: 1 | Duration: 196ms
Tip: Run 'ce gate details' to view failure details and remediation.
Exit code: 1
$ ce gate details --new --dir ./repos/argo-cd
--- Semantic Invariant Gate Details ---
[FAIL] SIG-P-B-105 [Architectural/agnostic] - Notification Subsystem DB Decoupling (3ms)
Rule: Notification utilities in util/notification must not construct standalone database instances or call db.NewDB directly; DB instances must be injected.
Remediation: Inject ArgoDB as a dependency rather than creating a new DB instance inside the notification service.
Violations (1 new, 0 tolerated) | Showing 1 of 1:
STATUS | LOCATION | SYMBOL | TARGET / CALL
-------+--------------------------------------------+-----------------------+--------------
[NEW] | util/notification/argocd/service.go:188:14 | GetClusterSecretCount | NewDB
-------+--------------------------------------------+-----------------------+--------------
# ==============================================================================
# Phase 4: Monotonic Ratchet Tightening (GetCommitMetadata refactored: 2 -> 1)
# ==============================================================================
$ ce gate check --dir ./repos/argo-cd
--- Semantic Invariant Gates Evaluation ---
STATUS ID CATEGORY PLATFORM SCOPE VIOLATIONS NAME
---------------------------------------------------------------------------------------------------------
[TOLERATED] SIG-C-R-102 Architectural agnostic Class 12 tol God Type Complexity Limit (>30 methods)
[TOLERATED] SIG-M-B-106 Architectural agnostic Method 4 tol Public Authentication Bypass Audit (AuthFuncOverride)
[TOLERATED] SIG-P-B-101 Architectural agnostic Module 3 tol Reverse Layer Inversion Shield (util/ calling higher services)
[PASS] SIG-P-B-103 Architectural agnostic Module 0 GitOps Engine Layer Isolation (Zero Host Calls)
[PASS] SIG-P-B-104 Architectural agnostic Module 0 Storage Abstraction Boundary (Raw Secrets Access Shield)
[TOLERATED] SIG-P-B-105 Architectural agnostic Module 1 tol Notification Subsystem DB Decoupling
---------------------------------------------------------------------------------------------------------
Total: 6 gates | Passed: 6 | Warnings: 0 | Failed: 0 | Duration: 183ms
1 gate(s) have fewer violations than allowed by baseline.
Run 'ce gate ratchet --update' to lock down resolved technical debt.
All architectural semantic gates passed successfully.
Exit code: 0
$ ce gate ratchet --update --dir ./repos/argo-cd
Successfully ratcheted down and updated baselines for 6 gate(s).