# Where the gate stands — plain-English status (the earlier "decision" is resolved)

**Bottom line:** the one real, measured hole — "when a bug hides in an imported file, the gate must open that file too" (#36) — is **now built and proven.** The earlier version of this doc framed it as a big, expensive, hard-to-reverse build for a rare bug. That framing was wrong, and you were right to push back. It turned out **moderate, multi-piece, each piece bounded** — and it works.

## What got built and measured

When the gate reviews a file, it now pulls in that file's first-party imports and drops their **actual source** into the **same review**, so a bug hiding in an imported helper is visible. Proven end-to-end on the founding cross-file case: a token-refresh route that *looks* fine but calls an imported `buildSessionPayload` whose default silently drops 2FA. The shipped gate flagged it **`[critical]`, top finding, 3 out of 3 runs.**

Honest limits (not hidden): this is **one** measured case. Precision on a big real repo with many imports isn't measured yet, and imports that go through "barrel" re-export files (common in monorepos) aren't followed yet — that's a small, named follow-up (#36b), not a redo.

## My earlier cost claim was wrong — the correction

I first called this "high cost / hard to reverse / an architectural addition." It wasn't. The honest shape was three bounded pieces: (1) pull all first-party imports, not just payment-named ones; (2) fix the path resolver; (3) feed caller + imported code into one review. The third was the only non-obvious part, and a prior spike had already proven the mechanism. Truth was in the middle — neither "too expensive to bother" nor "trivial one-liner."

## The three "tuned-for-payments" parts — updated

| Part | Status now |
|---|---|
| **Follow-the-imports** (#36) | **DONE + measured.** The real hole, now closed (for direct imports; barrel imports = #36b follow-up). |
| **The AI auditor's instructions** (#16) | **Leave it.** Measured to already find non-payment bugs (tenant/permission bugs in calendar/login/roles code). Rewriting working instructions risks making them worse. |
| **The "self-payment" checker's word list** (oracle) | **Niche, optional.** Only matters for self-dealing bugs outside payments; a later, narrow add if you want it. |

## What's actually left to decide

The big build is no longer a decision — it's done. The residual choices are smaller:
- **Next phase (recommended):** move from "audit one file well" to **mapping a whole codebase's attack surface and delegating an auditor per target** — the gate's original reason to exist. This is the natural next step and it builds directly on the now-cross-file-capable engine. It deserves a proper design pass.
- **Optional, low-priority:** the oracle word-list (niche), and #36b barrel-import following (needed before trusting the gate on a real monorepo).
- **Don't:** auto-rewrite the AI auditor's instructions (#16) — the evidence says they already generalize.