Deterministic pipeline

PR → diff → checks → decision

ReadyLayer is a governance framework for AI-generated code. It is model-agnostic, composable with Git + CI, and deterministic where it matters.

Inputs

PR diff + repository context

ReadyLayer reads the diff, repository config, and policy rules to determine which governance checks run.

Language + framework detection
Policy versions and thresholds
Test and coverage expectations
Documentation sync rules

Policy configuration

Policies are defined alongside the repo, versioned, and applied deterministically.

Policy v1.4

Coverage threshold: 80%

Rules: tests required, docs synced, critical findings block

Checks

Review Guard, Test Engine, Doc Sync

Review Guard

• Security and quality rules
• Policy-driven severities
• Deterministic outputs

Test Engine

• Test generation and enforcement
• Coverage thresholds
• CI-native execution

Doc Sync

• Documentation drift detection
• Artifacts attached to the PR
• Traceable updates

Decision

Deterministic outcomes

Decisions are traceable and repeatable. The same diff + policy yields the same decision every time.

Pass

No blocking findings, coverage meets policy

Block

Critical finding or policy violation

Run Artifacts

Every ReadyLayer run produces machine-readable artifacts for compliance, CI/CD integration, and audit trails.

Artifact Preview

Review Report (SARIF)

Security and quality findings in SARIF format

JSON

12.3 KB

{
  "version": "2.1.0",
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema.json",
  "runs": [{
    "tool": {
      "driver": {
        "name": "ReadyLayer Review Guard",
        "version": "1.0.0"
      }
    },
    "results": [{
      "ruleId": "hardcoded-secret",
      "level": "error",
      "message": {
        "text": "Potential API key found in code"
      },
      "locations": [{
        "physicalLocation": {
          "artifactLocation": {
            "uri": "src/auth.ts"
          },
          "region": {
            "startLine": 23
          }
        }
      }]
    }]
  }]
}

Exportable & Integrable

All artifacts are available via API and can be downloaded from the dashboard. SARIF reports integrate with GitHub Security, JUnit XML works with CI/CD systems, and coverage reports feed into your monitoring tools.

What if something goes wrong?

Every dependency failure needs an explicit fail-open or fail-closed policy owned by the deploying team.

Dependency unavailable

What happens if a required service is down or rate-limited

Warns

Fallback behavior

Fail open with rule-based checks and clear warnings

Audit trail message

Dependency unavailable, continuing with deterministic checks only

What happens:

•Review Guard uses static rules only
•Test Engine uses existing tests
•Doc Sync uses repo templates
•PR is not blocked, warnings are shown

CI timeout

What happens if ReadyLayer checks exceed timeout

Warns

Fallback behavior

Graceful timeout with partial results

Audit trail message

Check timeout after 5 minutes, partial results available

What happens:

•Completed checks are reported
•Incomplete checks show timeout status
•PR is not blocked (timeout is not a failure)
•Admins can configure timeout thresholds

Documentation generation fails

What happens if doc generation encounters errors

Warns

Fallback behavior

Skip doc generation, continue with other checks

Audit trail message

Doc generation failed: template error, continuing with other checks

What happens:

•Doc Sync check shows warning status
•Other checks (Review Guard, Test Engine) continue
•PR is not blocked (docs are non-critical)
•Error details logged for debugging

ReadyLayer service error

What happens if ReadyLayer itself encounters an error

Warns

Fallback behavior

Fail open with clear error message

Audit trail message

ReadyLayer error: database connection failed, PR allowed with warning

What happens:

•Error is logged with full stack trace
•PR is not blocked (fail-open policy)
•Clear error message shown in PR comments
•Admins notified via configured channels

Fail-open policy

The demo defaults optional analysis failures to a warning. Production deployments should fail closed for the protected change classes their owners identify as safety-critical.

Get started (OSS)

Loading the latest details...

Inputs

PR diff + repository context

ReadyLayer reads the diff, repository config, and policy rules to determine which governance checks run.

Language + framework detection
Policy versions and thresholds
Test and coverage expectations
Documentation sync rules

Policy configuration

Policies are defined alongside the repo, versioned, and applied deterministically.

Policy v1.4

Coverage threshold: 80%

Rules: tests required, docs synced, critical findings block

Checks

Review Guard, Test Engine, Doc Sync

Review Guard

• Security and quality rules
• Policy-driven severities
• Deterministic outputs

Test Engine

• Test generation and enforcement
• Coverage thresholds
• CI-native execution

Doc Sync

• Documentation drift detection
• Artifacts attached to the PR
• Traceable updates

{ "version": "2.1.0", "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema.json", "runs": [{ "tool": { "driver": { "name": "ReadyLayer Review Guard", "version": "1.0.0" } }, "results": [{ "ruleId": "hardcoded-secret", "level": "error", "message": { "text": "Potential API key found in code" }, "locations": [{ "physicalLocation": { "artifactLocation": { "uri": "src/auth.ts" }, "region": { "startLine": 23 } } }] }] }] }