NFRGate Rubric — Rule Reference

How it works

The same loop SonarQube popularized for code quality — applied to non-functional requirements, with every confidence number measured, not guessed.

1

A pull request opens

The CI job reads only the diff — changed lines in Python, Java, Go, and Rust (preview) files.

2

Every change is checked

Static rules for logs, metrics, traces, and reliability, plus an optional LLM review for what no static rule can see.

3

Each finding is routed

By measured confidence and the service's criticality — a merge is only blocked at 0.85+ confidence.

Auto-passHuman reviewBlock merge

See it catch real problems

Ordinary code with common observability gaps — and exactly what NFRGate reports on it.

payments/client.py

1import logging2import requests34logger = logging.getLogger(__name__)567def charge(order):8    try:9        resp = requests.post("https://api.example.com/charge", json=order)10        return resp.json()11    except Exception:12        pass

FAILL1No swallowed exceptionsline 11
Empty or pass-through handler (bare `pass` or a no-op re-raise) — the exception is swallowed with no log entry.
confidence 0.71→ Flagged for human review
FAILL2Structured error logsline 11
No logging call found in this except block.
confidence 0.78→ Flagged for human review

src/main/java/com/example/PaymentClient.java

1package com.example;23public class PaymentClient {4    public void charge(Order order) {5        try {6            gateway.submit(order);7        } catch (Exception e) {8        }9    }10}

FAILL1No swallowed exceptionsline 7
Empty catch block or a bare re-throw with nothing else — the exception is swallowed with no log entry.
confidence 0.71→ Flagged for human review
FAILL2Structured error logsline 7
No logging call found in this catch block.
confidence 0.08→ Flagged for human review

payments/client.go

1package payments23import "net/http"45func Charge(url string) error {6	resp, err := http.Get(url)7	if err != nil {8		return nil9	}10	defer resp.Body.Close()11	return nil12}

FAILR1Timeouts are explicitline 6
No context.WithTimeout()/WithDeadline() call found earlier in the enclosing function.
confidence 0.15→ Flagged for human review
FAILT1Spans on external callsline 6
No tracer.Start(...) call found earlier in the enclosing function.
confidence 0.15→ Flagged for human review
UNCLEART3Context propagatesline 6
No propagator .Inject(...) call found in the enclosing function — can't confirm trace context is propagated from syntax alone (a wrapped transport that injects automatically wouldn't show this either).
confidence 0.40→ Flagged for human review
FAILL1No swallowed exceptionsline 7
Returns without including the error and without logging it — the failure is discarded; the caller has no way to know it happened.
confidence 0.71→ Flagged for human review
FAILL2Structured error logsline 7
No logging call found in this error-check block — note error wrapping/propagation without logging can be intentional in Go; confirm the caller logs it.
confidence 0.78→ Flagged for human review

src/payments.rs

1use reqwest::Client;23pub async fn charge(client: &Client, order: &Order) -> Option<Receipt> {4    match client.post(CHARGE_URL).json(order).send().await {5        Ok(resp) => resp.json().await.ok(),6        Err(_) => None,7    }8}

UNCLEARR1Timeouts are explicitline 4
No timeout on this call, and the client is constructed outside this file — confirm it's built with .timeout(..).
confidence 0.40→ Flagged for human review
FAILT1Spans on external callsline 4
No #[instrument] on the enclosing fn and no span created before this call.
confidence 0.30→ Flagged for human review
UNCLEART3Context propagatesline 4
No trace-context propagation (TracingMiddleware, HeaderInjector, inject_context) found in this file — it may be configured where the client is built.
confidence 0.40→ Flagged for human review
FAILL1No swallowed exceptionsline 6
`Err(_)` ignores the error and substitutes a value with no log entry — the failure becomes invisible.
confidence 0.60→ Flagged for human review

Not a mock-up: these findings were produced by running NFRGate's own analyzer on this code when this page was built, and routed as they would be for a tier1 service. The tick on each confidence bar marks the 0.85 blocking threshold.

See what your team sees

One comment per PR/MR, updated on every push — not a wall of separate bot comments.

Pull Request #482 · payments-service Example

🤖 nfrgate-bot commented

NFR Gate — Static Analysis

2 fail (2 blocking) · 6 pass · 1 unclear across 4 changed files.

CRITICALR1payments/client.py:88outbound call has no timeout configured

HIGHT1payments/client.py:88call not wrapped in a trace span

PASSL2payments/client.py:102structured error log present

Drops into the CI you already run

Complete, runnable job definitions — not just the invocation line. Both read the diff, post the comment, and fail the job on a blocking violation.

.github/workflows/nfrgate.yml

name: NFRGate

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write   # needed to post/update the PR comment

jobs:
  nfrgate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # full history -- pr_gate.py diffs base...head, a shallow clone can't resolve an arbitrary base SHA

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - run: pip install nfrgate

      - name: Run NFRGate
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python -m nfr_gate.ci.pr_gate

.gitlab-ci.yml

nfrgate:
  stage: test
  image: python:3.12-slim
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  variables:
    GIT_DEPTH: 0   # full history, same reason as the GitHub Actions example
  script:
    - pip install nfrgate
    - python -m nfr_gate.ci.mr_gate

Coverage at a glance

Static rules implemented per language and category — computed from the rule registry itself.

Language	📝 Logs	📊 Metrics	🛡️ Reliability	🔍 Traces
Python	4/4	3/4	3/4	4/4
Java	4/4	3/4	3/4	4/4
Go	4/4	3/4	3/4	4/4
Rust preview	4/4	3/4	3/4	4/4

M4, R4 are judged by the LLM review from the PR/MR text, in every language.

Frequently asked questions

What does NFRGate check?

16 rules across logs, metrics, traces, and reliability — things like swallowed exceptions, missing timeouts, and external calls without trace spans. Every rule has its own page in the rule reference.

Which languages does it support?

Static analysis covers Python, Java, and Go, plus Rust in preview: Rust findings aren't calibrated yet, so every one is routed to a human reviewer rather than blocking. A few judgment-call criteria are assessed by the optional LLM review from the PR/MR text, regardless of language.

Will it block my merges?

Only when a check fails with at least 0.85 measured confidence, on a medium, high, critical-severity rule, for a service that isn't tier0. Everything else is posted as a finding for human review — nothing is silently dropped. A tier0 (customer-critical) service always goes to a human.

Do I need an LLM or an API key?

No. Static analysis, routing, and blocking work out of the box. The LLM review is optional: it defaults to a local Ollama model, or you can set NFR_GATE_LLM_BACKEND=anthropic with an ANTHROPIC_API_KEY.

Is my code sent anywhere?

Static analysis runs entirely inside your own CI job — no code leaves it.

The LLM review defaults to a local Ollama model, so nothing leaves your infrastructure either. Only if you set NFR_GATE_LLM_BACKEND=anthropic are the diff and the PR/MR title and description sent to Anthropic's API for assessment.

Findings go only where you point them: the comment on your own PR/MR, your own findings database (NFR_GATE_DATABASE_URL), and Slack or Jira if you configure those.

Does it work on GitHub-hosted and GitLab shared runners?

Yes — the job definitions in the guide run on standard hosted runners. A hosted runner can't reach a local Ollama model, so for the LLM review there use the Anthropic backend or a self-hosted runner.

How do I try it?

pip install nfrgate, then add the GitHub Actions or GitLab CI job from the user guide — or click Setup help at the bottom right for a step-by-step walkthrough.

Every rule your merges are held to.