---
description: Gate-state names and pass criteria summary — auto-loaded every session for quick recall; references/common/quality-gates.md has the full tables.
---

# Quality Gates

Gates block phase transitions until criteria are met. See [references/common/quality-gates.md](../../references/common/quality-gates.md) for the full gate-set tables, pass criteria, and fail actions.

**Enforcement (invocation, not completion).** `gate-enforcer.sh` (PreToolUse hook) blocks manifest writes that set `gate-passed: true` unless the gate's required skill/agent (per `hooks/config/gate-requirements.json`) was invoked **for this work item**. The check is `work_id`-scoped: the enforcer extracts `work_id` from the edited manifest's path (`.forge/work/{type}/{name}/manifest.yaml`) and filters `.forge/state/telemetry.jsonl` to records matching that work_id. Stale invocations from another work item — or from before the work_id field was added (legacy records) — do not satisfy fresh gates. After upgrade from a pre-work_id version, re-invoke any required skill once to write a tagged telemetry record.

What this proves and does NOT prove:
- **Proves:** the required skill was invoked via the Skill tool during this work item — i.e. the workflow actually ran.
- **Does NOT prove:** the skill produced correct output, the gate's pass criteria were actually met, the user reviewed the artifacts, or the skill ran to completion (it could have errored partway, been aborted, or returned no findings). Content correctness is the calling skill's responsibility; the user remains the final reviewer.

Gate names (per `hooks/config/gate-requirements.json`):
- code-review-final
- code-review (per-slice)
- test-plan
- test-execution
- uiux-review
- runtime-reach (per-slice wiring gate)
- wiki-lint (per-slice)

Security audit is invoked as a skill (`quality-security-audit`) on High/Critical-risk diffs — see `quality-code-review` Risk Classification — rather than a dedicated `phases.*` gate.