I let Claude Code commit directly to my repositories. I don't review the diffs. I didn't think I needed to, because I built a deterministic verify gate — a script that lints, typechecks, builds, and runs tests. If the gate goes green, the PR merges automatically.
I trusted that gate implicitly. Until I actually sat down and asked the one question that matters: If an agent pushes completely broken code right now, will this gate actually go red?
Not "is the script configured?" Not "does the file exist?"
Will it actually fail?
Turns out, for three out of my four repos, the answer was an emphatic no. The gate was returning GREEN without running a single line of code.
