execute

Run each task through a fixed gate pipeline: diff, syntax_check, placeholder_scan, imports, lint, build_check, and pre_check_batch, followed by reviewer and test_engineer agent approval. A pre-commit rule blocks any commit until every gate has actually run and passed.

Return a structured rejection to the coder agent with the gate name, failure reason, and required fix, then resume at the failed step rather than restarting. The orchestrator must never fix the code itself or skip the gate.

pre_check_batch runs four automated tools: lint:check, secretscan, sast_scan, and quality_budget. It does not replace human-style code review, security review, or functional and adversarial testing, which still require dedicated reviewer and test_engineer agents.

A phase-scoped baseline of pre-existing SAST findings is captured once per task via sast_scan with capture_baseline. Subsequent scans diff against it so only new findings fail the gate, while pre-existing findings go to the reviewer for triage.

The security-only review triggers when a change matches TIER 3 criteria, contains security keywords, or when secretscan or sast_scan report findings at or above threshold. Rejection before the retry limit sends the task back to the coder.

The checklist forces every gate value to come from actual tool or agent output in the session, preventing fabricated PASS claims. Any blank value means the gate never ran and the task is not complete.