delivery-gate

DeliveryGate

Verify before you ship. DeliveryGate gives Hermes Agent a pre-delivery
verification gate: after the agent finishes a build or change task, the
plugin runs the deterministic checks declared in a task spec (test commands,
lint, repro scripts) and only releases the deliverable when every required
check passes. Every run writes a replayable, hash-chained evidence record.

The verdict comes from the deterministic checker, never from the model.
The model only produces candidates; the gate decides.

Install

Requires Hermes >= 0.23.0.

hermes plugins install ToniAdreal/delivery-gate
hermes plugins enable delivery-gate

Validate the plugin the same way catalog CI does:

hermes plugins validate /path/to/delivery-gate --install-deps

Usage

Call delivery_gate_verify with a task spec. The spec is data, never code:
it declares what to run, the plugin never invents commands.

{
  "task": "Fix add() so it sums its inputs",
  "workspace": "/path/to/task-workspace",
  "checks": [
    {"name": "unit-tests", "command": "python3 -m pytest test_calc.py -q",
     "required": true, "timeout_seconds": 60},
    {"name": "compile-check", "command": "python3 -m py_compile calc.py",
     "required": true, "timeout_seconds": 30}
  ]
}

task: non-empty description of the work being gated.
workspace: directory the checks run in. Empty means the current
working directory.
checks: non-empty list. Each check needs a unique name, a non-empty
command, required (default true), and timeout_seconds (default
120, range 1-3600).

The tool returns JSON with verdict (RELEASE or BLOCK), per-check
results (exit code, output digests, truncated output, duration, timeout),
and the evidence path. RELEASE only when every required check exits 0
without timing out; an optional check failing never blocks.

Read a run back with delivery_gate_evidence (workspace + run_id,
or run_id: "latest"). Evidence lives at
<workspace>/.delivery-gate/evidence/<run_id>.json, plus a latest.json
pointer. Records are hash-chained: each record's previous_hash is the
previous record's record_hash, so a run history can be replayed and
tampering with an earlier record breaks the chain.

Config (in plugin.yaml, overridable at install): default_timeout_seconds
(120), evidence_dir (empty = <workspace>/.delivery-gate/evidence),
max_output_chars (8000; output digests are always computed over the full
output, only the stored text is truncated).

End-to-end demo

examples/broken-check-demo/ is a tiny calculator task with a deliberately
broken variant. Run it from the plugin root:

.venv/bin/python examples/run_demo.py

It swaps the broken calc.py in, runs the gate (expect BLOCK with the
failing unit-tests check in the evidence), restores the fix, and runs the
gate again (expect RELEASE). Both evidence records stay under
examples/broken-check-demo/.delivery-gate/evidence/, hash-chained.

Disclosure: what this plugin can do

Read this before installing. DeliveryGate performs two risk-sensitive
actions, by design and only within the task workspace:

It runs shell commands — through Hermes' terminal tool. Each
check a task spec declares runs via ctx.dispatch_tool("terminal", ...), so Hermes' dangerous-command approval and your configured
terminal backend (local, Docker, SSH, sandbox) apply to every check
before it runs. The plugin never invents commands, never executes
the spec itself as code, and runs each check with the task workspace
as its working directory and a per-check timeout. A spec can still
name absolute paths, so only run specs from sources you trust.
The plugin itself runs no subprocess in the Hermes path; a local
subprocess runner exists only for direct library use (tests, demos),
is disabled by default, and when explicitly enabled passes only a
minimal environment (PATH, HOME, LANG plus variables the spec names).
It reads files in the task workspace. It reads the task spec file
and writes only its own evidence records
(.delivery-gate/evidence/). It never reads .env, auth.json, or
any other tool's credentials, and evidence records hold command text,
exit codes, output digests and truncated output tails, never secret
material. Through the terminal tool, a check's stdout and stderr
arrive merged as one output stream; the record keeps the merged text
under "stdout".

It does not self-update, does not override Hermes core, and takes no
secrets: there are no secret_scope or OAuth declarations because the
plugin needs none. Check execution goes through the Hermes approval
system; it does not bypass it.

Topics

verification, testing, delivery, evidence

Notes

Built with AI assistance; all code is new, written for this plugin. The
verification approach reuses the author's VerifyGate research philosophy
(deterministic checks decide, the model only proposes); no VerifyGate code
is included.

License: MIT. See LICENSE.

README from the reviewed commit 9665a67; it updates when the author re-pins.

About