1. SAST Gate: Pinned Semgrep AST scan against SQLi, eval RCE, and XSS.
2. Secrets Gate: Gitleaks scan blocking exposed API tokens and private keys.
3. Depvuln Gate: Containerized Trivy scan catching CVEs in third-party packages.
4. Engines Gate: Node & Docker runtime version parity preventing cloud skew.
5. RLS Gate: Postgres/Supabase scanner verifying policy coverage on tables.
6. RLS Enforce Gate: Hard-blocks open unauthenticated endpoints (anti-CVE-2025-48757).
7. Migrate Gate: PGlite DDL verification enforcing expand-and-contract zero-downtime.
8. PII Gate: Automated detection of unmasked credit cards & PII in routes.
9. Compliance Gate: Enforces data sovereignty and statutory compliance boundaries.
10. Prod Readiness: Checks env vars, error boundaries, health probes, and telemetry.
11. Verify Gate: Hermetic clean-room container build, boot, and smoke testing.