Red-team your gates before implementing.

Born from a failed experiment: an agent writing its own gates produces theater, not verification.

When you write tests for your own code, you have the same blind spots that cause bugs. Gates that seem thorough often just check shapes, not behavior.

For each gate, ask: "What bad code would pass this?"

If you can write broken code that passes, the gate is too weak.

# Review a gate file
node index.mjs gates/my-gates.js

# Review a single gate by description  
node index.mjs --gate "POST /learn returns id"

── GATE: POST /learn returns id and status stored
   ⚠️  Trusts response without verify
      Attack: Return success without writing
      Fix: GET by ID and verify round-trip

Findings are stored in deja for future reference.

Built during the deja experiment. Blog post: coey.dev/deja