Repo Contracts as a Fail-Closed CI Gate

Experiment Log · 2026-03-18 · 11:00 AM PT

Hypothesis: A repo-contract registry plus a CI gate that fails closed on violation will catch cross-repo boundary breaches before they merge, instead of in review.

Constraint: The gate has to fail closed — a warning nobody reads is not enforcement.

Result: Passed. Adopted the fail-closed gate plus a secret-scan template across the estate and bootstrapped the runtime as a bounded repo with its boundary declared before any code. Violations now stop at the gate.

Next step: Extend the contract gate to every repo, not just the new ones.

Tags: #governance #systems #infra