G01
Type safety
Check: TypeScript strict mode, no `any`, no implicit-any escapes
Why: Catches a class of runtime bugs at edit time. Cheaper than tests for what it covers.
G02
Lint and format
Check: ESLint with project rules; Prettier on every commit
Why: Style debate is a waste of senior time. Tools decide, nobody argues.
G03
Unit + integration
Check: Vitest / Jest on logic; real-database integration tests on the data layer
Why: Mocked database tests passed and prod broke. We learnt. Integration tests hit a real DB.
G04
Playwright visual
Check: Per-route screenshot diff against a baseline approved by a human
Why: Catches the regression that "the test passes but the page is broken" can hide.
G05
Hallmark design gate
Check: Layout, typography, spacing, motion, content density — graded against a rubric
Why: The bar for "is this AI slop" should be enforced by a checklist, not by hope.
G06
Dependency audit
Check: npm audit (high/critical fail the build); SBOM generated per release
Why: Known vulnerabilities are not allowed into prod, even transitively.
G07
Static analysis
Check: Semgrep + project-specific rules; secret scanning on every commit
Why: A leaked API key in commit history is a Friday-night incident. Stop it at the gate.
G08
Human review
Check: A named engineer approves every PR. No auto-merge on any branch that touches prod.
Why: Automation accelerates engineering; it does not replace accountability.