TrustGate

AI coding tools now generate code faster than humans can review it safely. A developer can ship hundreds of lines in minutes, but speed creates new risks: hardcoded secrets, hallucinated packages, missing auth checks, prompt injection attacks, and spec violations that slip through human review undetected. TrustGate is an automated merge gate built to catch these AI-specific failure modes before code reaches production. When a pull request is submitted, five specialized IBM watsonx-powered checkers run in parallel on the code and deliver a clear PASS, REVIEW, or BLOCK verdict with exact cited evidence file path, line number, and quoted snippet before the code is allowed to merge. The five checkers are: Security Reviewer (finds hardcoded secrets, SQL injection, missing auth), Spec Conformance (reads the PRD and compares it against code using document understanding), Injection Scanner (finds prompt injection attempts in comments and README), Dependency Verifier (catches hallucinated PyPI packages), and License Checker (detects GPL violations in MIT projects). Every finding must cite exact evidence or it is not reported. This eliminates hallucinated false positives that make AI security tools untrustworthy. The verdict engine scores findings (high=5, medium=2, low=1) and forces a BLOCK on any single high-severity finding regardless of total score. TrustGate integrates directly into GitHub via a GitHub Action that fires on every pull request and posts the verdict as a PR comment. The Explainable Trust Dashboard shows judges and reviewers exactly why a PR was blocked, with a human-approval-with-reason override flow that demonstrates responsible AI deployment. Built in 48 hours for the IBM Bob 2.0 Hackathon.