A check that can't go red proves nothing — so every Heimdall gate can actually fail, is measured honestly, and holds Heimdall to the same bar as your code. Here is the evidence, in full.
Every AI coding tool claims it works. Heimdall measured whether its core actually generalizes — and published the number. The reuse engine was pointed at 8 open-source repos it had never seen, across JS, TS, and Python, on tasks where a competent developer would reuse existing code rather than reinvent it.
The pass thresholds were frozen before the run, so the verdict couldn't be tuned to look good — a low number would have shipped as a finding. The run even surfaced and fixed its own measurement bugs (missing toolchains, a buggy assertion) before reporting, rather than quietly passing. The honesty is the brand. It came back GENERALIZES.
A verification tool that can't hold itself to its own bar is decoration. Agents commit with --no-verify and pre-commit hooks never fire — so Heimdall's real net is a native git pre-push hook that scans the full history, independent of how any commit was authored. The gate that scans your history scans Heimdall's first.
During development, a --no-verify commit tried to slip a live-format key into Heimdall's own repo. The self-scan blocked the push. That's the difference between a gate and a logo — secrets and foreign identities are blocked at the git layer, on every push, agent or human.
The hook runs at pre-push, scanning the full history — not the staged diff. So it doesn't matter how a commit was authored, who set core.hooksPath, or whether someone passed --no-verify at commit time. There is one door, and every push goes through it.
This is the same point as the self-scan above, stated once: a push is proven only when every gate passes — and the gate that proves it can't be the one that decides to skip itself.
A staged failure you watch deny, fix, and pass on the first run — the same loop Heimdall runs on every real push.
The current release ships everything above. Read the source first if you like — what you read is what runs.