祝融说。

AI coding without quality gates is just accelerating the accumulation of technical debt. A teaching scenario (a synthetic case): a team adopted AI coding and improved their efficiency, but a month later the codebase was a mess—not because AI was bad, but because there were no quality gates.

You let your team use AI coding. Efficiency improved, and you were satisfied. But a month later, you found the codebase was a mess—inconsistent styles, tightly coupled modules, core features quietly altered by the AI. You asked the team: "What happened?" They replied: "The AI wrote it. We didn't look too closely."

This is the consequence of having no quality gates. The "side effects" of AI coding—surged code volume, uneven quality, architecture drift—aren't the fault of AI itself. They are the result of "missing processes." Quality gates are the answer: establish checkpoints along the path from code to production, ensuring every piece of code is examined.

4.1 Three Layers of Defense for Quality Governance

Quality governance isn't "a single checkpoint"—it's "three layers": prevention, inspection, and audit. Each layer covers the blind spots that the layer above it cannot.

Why three layers? Because errors in AI coding occur on three levels, so you need three levels of detection. Prevention before coding solves the question of "is the direction right," inspection after coding solves "is the code quality acceptable," and audit after commit solves "are there systematic deviations." With prevention alone, you can't catch problems that arise during coding. With inspection alone, you can't see systematic trends. The three layers complement one another; none can be omitted.

Layer 1: Prevention

Prevention has the lowest cost and the best payoff. Ensure the direction is right before coding begins.

Blueprint review:

• Before every project, the blueprint must be reviewed by at least one colleague
• The review focuses on: whether terminology is accurate, whether the data model is complete, whether the milestone breakdown is reasonable
• Coding can begin only after the review passes

Acceptance criteria, defined upfront:

• Before each milestone, its acceptance criteria are already explicit
• The criteria are written into the milestone description, not improvised after coding is complete
• The criteria must be verifiable (not "good code quality," but "the code passes Lint checks")

Layer 2: Inspection

Inspection is the post-coding quality gate—the most critical step in AI coding.

Make inspection mandatory:

• All AI-generated code must pass inspection before it is committed
• Inspection results must be recorded (PASS / NEEDS_FIX / REBUILD)
• Inspection records serve as references for code review

Three inspection principles:

1. Functional inspection: Does the code implement the requirements?
2. Architecture inspection: Does the code deviate from the blueprint?
3. Security inspection: Does the code contain security vulnerabilities?

Layer 3: Audit

Audit is a periodic, retrospective check that surfaces systemic issues.

Audit frequency:

• Small projects: audit once at project completion
• Large projects: audit monthly

Audit content:

• Blueprint coverage: How many projects have blueprints?
• Inspection execution rate: How many milestones have inspection records?
• Architecture drift rate: How much code exhibits architecture drift?
• Technical debt assessment: How healthy is the codebase?

4.2 Three Disciplines

The following three disciplines are the bottom line of quality management. Code that touches them must be rolled back immediately. Why these three? Because they correspond to the three core risks of AI coding: without a blueprint, the AI "guesses"—guesses the tech stack, the naming conventions, the data structures; without inspection, the AI's "self-consistency trap" hardens hidden problems into the codebase; and without rebuilding amid chaos, code decays faster through endless "patching and fixing."

Discipline 1: No Blueprint, No Coding

Description: No CONTEXT.md blueprint was produced before the project began.

Consequence: AI coding has no direction, code quality cannot be controlled, and architectural consistency cannot be guaranteed.

Resolution: Pause coding and produce the blueprint first.

Discipline 2: No Inspection, No Commit

Description: AI-generated code was committed to the codebase without inspection.

Consequence: Quality issues can't be caught early and may affect other team members.

Resolution: Roll back the uninspected commit, complete the inspection, then recommit.

Discipline 3: When in Chaos, Rebuild

Description: When code shows architecture drift (tampering with the foundation, over-engineering, runaway size), continuing to patch on top of the wrong foundation.

Consequence: The code structure keeps deteriorating and maintenance costs explode.

Resolution: Roll back immediately, analyze the cause, and start over from a clean state.

Supplement: Security Red Line

Beyond the three disciplines, there is one impassable security red line—zero tolerance for security vulnerabilities:

• AI code contains SQL injection, XSS, missing permissions, or other security vulnerabilities
• Consequence: System security is compromised, potentially leading to data breaches
• Resolution: Fix immediately, then perform a security review after the fix

The three disciplines are behavioral bottom lines. The security red line is a consequence-level bottom line. The disciplines determine "how to do it." The security red line determines "what must never be done."

4.3 Quality Gate Design

Quality gates are automated or semi-automated quality checkpoints set along the path from code to production. Why four gates? Because each gate solves a different problem: the local acceptance gate answers "was it done carefully," the code review gate answers "was it done correctly," the integration verification gate answers "does it work once combined," and the deployment gate answers "can it go live."

Gate 1: Local Acceptance Gate

Location: On the developer's local machine, after the AI finishes coding

Check items:

• Functional completeness check
• Architecture compliance check
• Basic security check

Pass condition: All checks pass, or all NEEDS_FIX issues have been fixed

Gate 2: Code Review Gate

Location: Before committing to a shared branch

Check items:

• Code style check (automated)
• Test coverage check (automated)
• Code review (human)

Pass condition: Automated checks pass + at least one colleague's review passes

Gate 3: Integration Verification Gate

Location: Before merging into the main branch

Check items:

• Build check (can the project build successfully)
• Test suite (all tests pass)
• Integration tests (cross-feature verification)

Pass condition: All checks pass

Gate 4: Deployment Gate

Location: Before deploying to the production environment

Check items:

• Security review (comprehensive)
• Performance testing (if needed)
• Change log check

Pass condition: All checks pass

4.4 Architecture Drift Audit

Architecture drift is the most easily overlooked yet most impactful quality issue in AI coding. Why the most impactful? Because other problems (functional bugs, security vulnerabilities) are "explicit"—you notice them immediately. Architecture drift is "implicit"—the code runs, the functionality is correct, but the structure is wrong. It doesn't cause problems right away, but it steadily raises maintenance costs until the day you find that fixing one bug requires touching five files.

What Is Architecture Drift

Architecture drift means: AI-generated code is functionally correct but structurally deviates from the original design.

Examples:

• The blueprint specifies that APIs live under app/api/, but the AI puts new APIs under pages/api/
• The blueprint specifies using the Prisma ORM, but the AI uses raw SQL directly in a feature
• The blueprint specifies that components live under components/, but the AI places components inside page files

The Harm of Architecture Drift

A single instance of architecture drift may seem trivial ("it's just a file in the wrong place"), but accumulated, it will:

1. Make the code structure chaotic and hard for new members to understand
2. Raise maintenance costs—every change requires extra time
3. Degrade the quality of AI coding—the AI generates more chaotic code on top of already chaotic code
4. Eventually lead to "code decay"—the system descends from order to disorder

How to Detect Architecture Drift

Automated detection:

• Use git diff to check whether new or modified files fall under the agreed directories
• Check whether newly added dependencies are on the allowlist
• Check whether individual file length exceeds the threshold

Manual detection:

• Focus on architecture issues during code review
• Conduct periodic architecture audits

4.5 Quality Reports

Produce quality reports on a regular basis so the team and management can understand the health of the codebase.

Report Template

# Monthly Code Quality Report

## Overview
- Projects: 5
- Blueprint coverage: 80% (4/5)
- Inspection execution rate: 85%
- Architecture drift rate: 12%

## Detailed Data
| Project | Blueprint | Inspection Rate | Drift Rate | Health |
|:---|:---:|:---:|:---:|:---:|
| Project A | ✅ | 95% | 5% | Healthy |
| Project B | ✅ | 90% | 8% | Good |
| Project C | ❌ | 60% | 25% | Needs attention |
| Project D | ✅ | 100% | 3% | Excellent |
| Project E | ✅ | 80% | 15% | Needs attention |

## Projects Needing Attention
- Project C: No blueprint, low inspection rate, high architecture drift rate
  - Suggestion: Pause new feature development; first build the blueprint and enforce inspection

## Improvement Suggestions
1. Add architecture drift detection to the CI/CD pipeline
2. Organize a dedicated training session on architecture drift
3. Update the inspection template to include architecture check items

Chapter Summary

Quality governance isn't "a single checkpoint"—it's "three layers": prevention, inspection, and audit. Each layer covers the blind spots the layer above cannot. The three disciplines (No Blueprint No Coding, No Inspection No Commit, When in Chaos Rebuild) correspond to the three core risks of AI coding. The four quality gates each solve a different problem—from "was it done carefully" to "can it go live." Architecture drift is an implicit "chronic disease," more destructive than explicit bugs. Regular quality reports keep the team informed of the codebase's health. In the next chapter, we'll learn how to measure the effectiveness of AI coding.