myGate

myGate keeps agent fleets from running up the bill. When an orchestrating agent tries to launch a swarm of sub-agents on the most expensive models, it denies the launch before it starts, unless every one of them is pinned to a lighter model.

It has since grown into my merge-request reviewer as well: it reviews the exact base and head commits of a GitLab MR in a disposable checkout and posts findings as native discussions, with a receipt that can be verified later.

It's agent-driven, but it took me so dang long to get all those guards and critics working that I just have to include it! From mid-August to 2 October 2026 it reviewed at least 1,561 merge requests across my repositories and published 1,818 distinct findings, five of which it ranked critical. One of those was in its own code: a path where a review blocked by the secret scan could be merged away into a clean verdict.

$ gate selftest 2>/dev/null
[ok] unpinned workflow under heavy session denied
[ok] fully light-pinned workflow allowed
[ok] explicit heavy pin denied even under light session
[ok] unpinned workflow under light session allowed
[ok] explicit heavy Agent override denied
[ok] inherited Codex sol spawn denied
[ok] garbage payload ignored
[ok] grant honored (heavy Agent allowed)
[ok] grant exhausted (heavy Agent denied)
[ok] expired grant ignored (heavy Agent denied)
[ok] unwritable store fails closed (denied)

0 failure(s).