The load-bearing reframe of vibe-linter. A CI pipeline is a driver: it scripts the agent step by step, so every model upgrade obsoletes the script. vibe-linter is a gatekeeper: there are no steps, only locked doors. The AI acts freely, in any order — but commit needs an "all-tests-green" key, and writing source needs a "tests-written-and-actually-went-red" key. Keys are issued only by the checker, never by the AI's say-so.
The graph isn't the AI's route — it's a list of which door needs which keys. "Non-deterministic steps" really means there are no steps, only checkpoints.
Why this beats a driver: scripts fight the model (each upgrade breaks them); locks don't — a stronger model just does better in front of the same lock. So the tool doesn't depreciate with the model, which is its entire reason to exist (the constitutive side of prosthetic-vs-constitutive-scaffolding).
The one hard engineering problem: the door seal. A lock only works if its door is the unique passage — string-matching "git commit" is decorative (sh -c, aliases bypass). The door must sit at the physical chokepoint: the harness tool-call layer, default-deny + allowlist, real commit power only inside the harness.
Up: vibe-linter