> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trykode.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Kode Verification Pipeline: Nine Gates, Zero Guesses

> How Kode's nine-gate pipeline catches syntax errors, hallucinated imports, bad calls, security issues, runtime hazards, and UI regressions before any generated code reaches your disk.

Every LLM-generated patch Kode produces passes through a deterministic, nine-stage verification pipeline before a single byte reaches your filesystem. No file is written speculatively, no diff is applied optimistically — the pipeline runs entirely in-memory (Gates 1–6) and against an isolated sandbox / dev server (Gates 7–9) and rejects anything that cannot be structurally and behaviourally proven correct for your project. If even one gate fails, the write is blocked and the verdict is returned immediately.

## How verification works

When Kode generates a patch, it invokes the `Gate` — a Go struct that chains nine checkers in order:

```text theme={null}
Diff Applier → Syntax → Imports → Calls → Blast Radius → Architecture → Security → Sandbox Replay → QR Tunnel → Browser E2E
```

All content is held in memory throughout. The `DiffApplier` reconstructs the modified file contents from the patch and the originals. The resulting `map[string]string` — file path → proposed content — flows through each gate. The first gate to return `FAIL` stops the chain and returns a `Verdict` with `"overall": "FAIL"`.

Files are only written to disk when the overall status is `PASS`.

## The 9 gates

<Steps>
  <Step title="Gate 1 — AST Syntax">
    Dual-engine AST parsing. Official Tree-sitter bindings when CGo is enabled; zero-dependency regex fallback otherwise. Parses Go, TypeScript, JavaScript, Python, and Rust. Parse errors hard-block the write.
  </Step>

  <Step title="Gate 2 — Imports">
    Cross-references every generated import path against the local dependency graph. Hallucinated packages are rejected and self-corrected.
  </Step>

  <Step title="Gate 3 — Calls">
    Validates that every function and method call references a real, existing symbol with a compatible signature.
  </Step>

  <Step title="Gate 4 — Blast Radius">
    Walks the dependency graph backward from each modified file and counts downstream impact. Exceeds `max_blast_radius` → block.
  </Step>

  <Step title="Gate 5 — Architecture">
    Enforces `architecture_rules.disallowed_imports`. Prevents illegal cross-package or cross-microservice imports.
  </Step>

  <Step title="Gate 6 — Security (SAST)">
    Sicario AST-based SAST scanner. High and critical findings block; medium/low warn.
  </Step>

  <Step title="Gate 7 — Sandbox Replay">
    CPU- and memory-bounded sandbox runs the patched code in isolation. Traps infinite loops, memory leaks, and unauthorized system / network socket activity.
  </Step>

  <Step title="Gate 8 — QR Code Tunnel">
    Provisions a secure public dev tunnel for the local web server and renders the URL as a terminal QR code for instant mobile-device testing.
  </Step>

  <Step title="Gate 9 — Browser Verification (E2E)">
    Synthesizes and executes headless Playwright E2E scripts against the running dev server. Captures walkthrough recordings and flags visual regressions, layout failures, and console errors. Rolls back on failure.
  </Step>
</Steps>

## Two input modes for `kode verify`

The `verify` command supports two JSON input shapes, depending on whether you have a diff or proposed file contents.

<CodeGroup>
  ```json Hunk Mode theme={null}
  {
    "hunks": [
      {
        "file_path": "internal/auth/handler.go",
        "diff": "@@ -10,6 +10,7 @@ ..."
      }
    ],
    "original_files": {
      "internal/auth/handler.go": "package auth\n..."
    }
  }
  ```

  ```json File Mode theme={null}
  {
    "files": {
      "internal/auth/handler.go": "package auth\n\nimport (...)\n..."
    }
  }
  ```
</CodeGroup>

In **hunk mode**, Kode applies the hunks in-memory against the originals first, then passes the resulting content through all nine gates.

In **file mode**, the proposed file contents are verified directly without hunk application — useful when you have already assembled the full file outside of Kode.

Run verification:

```bash theme={null}
kode verify --input patch.json --project-dir .
```

## Audit logging

Every verification result is appended as a JSONL entry to `logs/kode.log` in your project directory:

```json theme={null}
{
  "timestamp": "2025-11-14T09:31:04.123Z",
  "task_id": "verify",
  "status": "FAIL",
  "files": [],
  "failures": {
    "internal/auth/handler.go": "syntax: Syntax check failed: unmatched closing brace '}'"
  },
  "rounds_used": 1,
  "duration_ms": 23,
  "input_source": "patch.json"
}
```

Override the log directory with `--log-dir`:

```bash theme={null}
kode verify --input patch.json --log-dir /var/log/kode
```

## Exit codes

| Code | Meaning                                             |
| ---- | --------------------------------------------------- |
| `0`  | Pipeline passed — all gates returned `PASS`         |
| `1`  | Pipeline failed — at least one gate returned `FAIL` |

<Note>
  Architecture violations downgraded to `WARN` do not cause a non-zero exit. Only hard `FAIL` results exit `1`.
</Note>

## Related pages

* [CLI: `kode verify`](/cli/verify) — full flag reference for the verify command
* [Troubleshooting gate failures](/troubleshooting/gate-failures) — how to read and resolve each gate's error messages