HOLD / BREACH / UNLOGGED
Every stated rule lands in one of three buckets: enforced by something that runs, stated with nothing behind it, or a gate running that no rule covers.
LIVEOPEN SOURCEstealth design system
hullcheck
Check the hull before you trust the air.
Test coverage told a generation of engineers whether their code runs. Nothing told them whether their policy runs. hullcheck reads the rules a repository states, finds the gates that actually execute in CI, hooks and checker scripts, and reports every rule with nothing behind it. A hull breach in vacuum does not announce itself — the seal looks fine, the reading drifts, and the first hard signal is the one you cannot act on. Policy fails the same way. Apache-2.0, written in Go.
Runs onCLI
github.com/space-pirate-zero/hullcheck● LOCKED
Open source — Apache-2.0, written in Go
Open source — Apache-2.0, written in Go
Separates enforced rules from stated ones: HOLD, BREACH, UNLOGGED
Finds gates running that no written rule covers
Time-to-truth: how long before a breach actually surfaces
WHY THIS EXISTS
Why hullcheck exists
// problem
The world before hullcheck
Manual processes and outdated utilities drain engineering time that should be spent on real problems.
// solution
Enter hullcheck
Test coverage told a generation of engineers whether their code runs. Nothing told them whether their policy runs. hullcheck reads the rules a repository states, finds the gates that actually execute in CI, hooks and checker scripts, and reports every rule with nothing behind it. A hull breach in vacuum does not announce itself — the seal looks fine, the reading drifts, and the first hard signal is the one you cannot act on. Policy fails the same way. Apache-2.0, written in Go.
CAPABILITIES
What hullcheck can do
Purpose-built capabilities engineered to deliver on every promise.
Gate coverage
Coverage weighted by severity, so a missing gate on the rule that matters does not average away against a dozen that do not.
Time-to-truth
p50, p90 and worst case for how long a breach takes to surface. A gate that only runs nightly is not the same as one that runs on the pull request.
Apache-2.0, in Go
One binary, no daemon, no account. Reads the repo it is pointed at and prints a reading.
FREE AS IN FREEDOM
hullcheck is open source
The full source lives on GitHub under the Apache-2.0 license. No license fees, no lock-in, no sales team. Read it, run it, fork it — and if it breaks, file an issue and watch it get fixed in the open.
terminal
$ git clone https://github.com/space-pirate-zero/hullcheck.gitApache-2.0 licensed · star it, fork it, ship it
OUR MISSION
A rule that cannot execute is a wish. hullcheck is the difference between a policy document and a policy.
BUILT WITH
Tech Stack
GoCIGit hooks
AVAILABLE ON
Get hullcheck
CLI
Follow the Commits
hullcheck is open source — the code is already yours. Drop your email for release notes, roadmap drops, and breaking-change warnings.
MORE FROM THE FLEET
Related Products
👻LIVE
GhostDeck
The open-source VM manager that makes Docker Desktop look expensive.
Open-source macOS VM orchestration using Apple's Virtualization.framework. MIT-licensed on GitHub, with 89 MCP tools for AI automation, Bonjour mesh networking, and sub-100ms snapshots.
🛡️IN DEVELOPMENT
TradeCraft
They watch everything. Now you watch back.
Counter-surveillance: 85+ tools, 12 domains. RF analysis, IMSI detection, encrypted mesh, evidence preservation. Zero-knowledge.