GitHub Actions · Fail-closed

Evidence-based quality gates
for AI-generated changes

The free Action checks evidence files, JSON validity, and numeric thresholds before merge, and fails closed.
Blind Gates / hosted API: coming soon.

Get Started Free View Quick Start
.github/workflows/ci.yml 
# Validate NemoClaw blueprint before deploy
- uses: evidence-gate/evidence-gate-action@v2
  with:
    gate_type: "nemoclaw_blueprint"
    phase_id: "deploy"
    evidence_files: "blueprint.yaml"

How It Works

Three steps to enforced quality in every pull request

1

Define

Add Evidence Gate to your workflow YAML. Specify gate types, evidence files, and thresholds.

2

Evaluate

The free action checks that evidence files exist, are valid JSON, and meet numeric thresholds.

3

Enforce

Fail-closed: pipelines stop on quality violations. Results appear in PR summary and workflow annotations.

Blind Gates (Coming soon)

Not launched. Planned for the hosted API (api.evidence-gate.dev, Pro). When an LLM writes your code and your tests, a visible threshold can become a target to optimize against.

Traditional Gate CI Pipeline GATE 80% coverage (visible) 80.1 AI agent reads threshold LLM generates hollow tests targeting exactly 80.1% vs Blind Gate CI Pipeline GATE PASS or FAIL AI agent cannot see criteria × LLM cannot game what it cannot see

The problem: Traditional CI gates publish their thresholds in workflow YAML. An AI coding agent (Copilot, Cursor, Devin, etc.) instructed to "pass CI" can read these thresholds and generate minimal tests that hit exactly 80.1% coverage — satisfying the metric while proving nothing about quality.

The planned approach (Coming soon): Blind Gates would evaluate evidence on the hosted API against criteria that are not exposed to the pipeline, the repository, or the AI agent. That API is not launched.

How it is planned to work: A pipeline would submit evidence files. The hosted API would evaluate them against private criteria. The pipeline would receive pass or fail, not the criteria. This behavior is not available today.

Availability: Blind Gates are coming soon. They require the hosted API at api.evidence-gate.dev (Pro), which is not launched. Free mode is available now: local checks of file existence, JSON validity, and numeric thresholds, with no API key.

What is available, and what is coming soon

Free mode fails closed on file, JSON, and threshold checks. Blind Gates and L4 are coming soon.

Fail-Closed Safety

All gates default to FAIL. Only explicitly verified evidence earns a PASS. Supports the guideline's emphasis on safety and risk prevention.

Transparency & Trust Levels

Trust levels L1–L4 are a way to describe evidence reliability. L4 is a tamper-evident evidence chain: an unkeyed SHA-256 hash of the previous record and the evidence hash. A single-record edit is detectable. A full rewrite by a writer is not prevented. L4 requires the hosted API at api.evidence-gate.dev (Pro), which is coming soon.

Security & Accountability

The free GitHub Action checks file existence, JSON validity, and numeric thresholds, then writes annotations and a job summary. It does not record a tamper-evident chain. Quality State tracking requires the hosted API at api.evidence-gate.dev (Pro), which is coming soon.

Evidence Gate supports practices aligned with key principles including transparency, safety, and accountability.

This product is not endorsed by or affiliated with any government body. Feature descriptions are for informational purposes only and do not constitute compliance certification.

What Evidence Gate Protects

The free action can check NemoClaw blueprint and policy files before merge. It does not deploy or run the sandbox. Blind Gates, L4, and api.evidence-gate.dev are coming soon.

NemoClaw sandboxes are a separate runtime. The free check looks at blueprint and policy files so a bad config can be caught before someone deploys. The diagram shows that runtime. It is not a claim that Evidence Gate operates it.

OpenClaw CLI extends CLI command nemo run NemoClaw Plugin TypeScript package extending OpenClaw CLI resolve verify execute @evidence-gate/nemoclaw subprocess NemoClaw Blueprint Versioned Python artifact (blueprint.yaml) plan sandbox apply policy nemoclaw-governance validate OpenShell Sandbox ghcr.io/nvidia/ openshell-community container isolated runtime network + resource policy
Plugin (TypeScript)
Blueprint (Python)
OpenShell Sandbox

Sandbox Lifecycle

Five stages from blueprint resolution to running sandbox — the Plugin handles stages 1–2, the Blueprint handles stages 3–5

1

Resolve

Plugin resolves blueprint version and downloads the versioned Python artifact

›
2

Verify

Plugin checks blueprint signature and integrity before execution

›
3

Plan

Blueprint determines the OpenShell resources needed for the sandbox

›
4

Apply

Blueprint invokes OpenShell CLI to create and configure sandbox resources

›
5

Status

Blueprint reports sandbox readiness and connection endpoints

›

Related tools

Separate projects. Evidence Gate’s launched product is the free CI check. Blind Gates, L4, and api.evidence-gate.dev are coming soon.

3-Layer Governance Architecture

CI Layer
Before deploy
Blueprint Validation
Structure, version, profiles
Policy Audit
TLS, wildcards, filesystem
SBOM & Provenance
CycloneDX, SLSA checks
▼ deploy ▼
Infra Layer
Runtime isolation
Filesystem Isolation
Sandbox filesystem policy
Network Control
Deny-by-default, agentgov-only
Process Sandboxing
Sandbox runtime
▼ agent requests ▼
Runtime Layer
Per-request controls
Budget Gate
Hold / Settle
HITL Approval
Slack / webhook
Loop Detection
Auto-halt
Audit Log
SHA-256 chain
▼ governed LLM call ▼
LLM Provider — OpenAI / Anthropic / Gemini

evidence-gate-action

Free mode: 30 of 35 gate types, including NemoClaw blueprint and policy files. Checks file existence, JSON validity, and thresholds. Fail-closed. Blind Gates and the hosted API are coming soon.

View on GitHub →

nemoclaw-governance

Validates Plugin+Blueprint configurations for NVIDIA OpenShell sandboxes. Checks blueprint.yaml and policy.yaml. pip install nemoclaw-governance

View on GitHub →

agentgov

Runtime governance proxy for NemoClaw sandboxes. Budget enforcement with hold/settle billing and operator-controlled network approval.

View on GitHub →

These are separate tools. The launched Evidence Gate check is the free GitHub Action (file existence, JSON validity, and thresholds). Blind Gates, L4, and the hosted API at api.evidence-gate.dev are coming soon.

Plans

Free mode is available now. Blind Gates, L4, and the hosted API (api.evidence-gate.dev, Pro) are coming soon.

Feature Free ($0/mo) Pro (Coming soon) Enterprise (Coming soon)
Evaluations/month No limit (local mode) TBA TBA
API calls/month Not needed (local) TBA TBA
Free-mode gate types (30): 26 generic, SBOM, provenance, NemoClaw blueprint & policy ✓ ✓ ✓
Pro-only gate types (5, Coming soon): blind_gate, quality_state, remediation, composite, wave — ✓ ✓
Check Run annotations ✓ ✓ ✓
File existence, JSON validity, and threshold checks ✓ ✓ ✓
Fail-closed error handling ✓ ✓ ✓
Three enforcement modes (warn / observe / enforce) ✓ ✓ ✓
Config file (.evidencegate.yml) — zero required inputs ✓ ✓ ✓
SBOM gate (CycloneDX/SPDX structural validation) ✓ ✓ ✓
Provenance gate (SLSA build attestation) ✓ ✓ ✓
NemoClaw gates (blueprint + policy) ✓ ✓ ✓
Signal-sorted Job Summary (Critical > Warning > Info) ✓ ✓ ✓
AI agent repair contract (retry_prompt output) ✓ ✓ ✓
Gate presets ✓ ✓ ✓
Sticky PR comments ✓ ✓ ✓
Blind Gate evaluation (Coming soon) — ✓ ✓
Tamper-evident evidence chain (L4, Coming soon) — ✓ ✓
Quality State tracking (Coming soon) — ✓ ✓
Remediation workflows (Coming soon) — ✓ ✓
Missing evidence + suggested actions ✓ ✓ ✓
Self-hosted deployment (Coming soon) — — ✓
Custom API base URL (Coming soon) — — ✓
Dedicated support — — ✓
Get Started Free Coming soon Coming soon

The hosted API at api.evidence-gate.dev (Pro) is coming soon and is not a working endpoint. Blind Gates and L4 (a tamper-evident, unkeyed hash chain) are not launched. Pro and Enterprise are not yet on sale. Questions: info@allnew.work

Up and Running in 5 Minutes

Add quality gates to your GitHub Actions workflow in three simple steps

1 Install from Marketplace

Visit the Evidence Gate Marketplace page and click "Use latest version" to add the action to your repository.

2 Add to your workflow

Add the Evidence Gate step to your GitHub Actions workflow file:

name: Quality Gate
on: [pull_request]

permissions:
  contents: read
  checks: write

jobs:
  evaluate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Your build & test steps here...

      - name: Evidence Gate
        uses: evidence-gate/evidence-gate-action@v2
        with:
          # Or use .evidencegate.yml config file for zero required inputs
          gate_type: "test_coverage"
          phase_id: "testing"
          evidence_files: "coverage.json"

3 See results in your PR

Evidence Gate writes a summary to GITHUB_STEP_SUMMARY in the workflow run. In Free mode that summary reflects file existence, JSON validity, and threshold checks. It does not include a tamper-evident evidence chain.

NemoClaw Integration Quick Start

Validate NemoClaw configs, enforce runtime budgets, and gate everything in CI — one workflow

name: NemoClaw Governance
on: [pull_request]

permissions:
  contents: read
  checks: write

jobs:
  validate-blueprint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Validate NemoClaw blueprint.yaml
      - name: Blueprint Gate
        uses: evidence-gate/evidence-gate-action@v2
        with:
          gate_type: "nemoclaw_blueprint"
          evidence_files: "blueprint.yaml"

  validate-policy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Validate sandbox policy constraints
      - name: Policy Gate
        uses: evidence-gate/evidence-gate-action@v2
        with:
          gate_type: "nemoclaw_policy"
          evidence_files: "policy.yaml"

  enforce-budget:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Validate agentgov budget configuration
      - name: Budget Gate
        uses: evidence-gate/evidence-gate-action@v2
        with:
          gate_type: "custom"
          phase_id: "budget"
          evidence_files: "agentgov.config.json"

Three parallel jobs — blueprint structure, sandbox policy, and runtime budget — all validated before merge. Each gate is fail-closed: if any config is invalid, the PR is blocked.