All rules

Behavioral Change Detection

Detects removed logic (Warn), incompatible method signature changes (Block), backward-compatible extensions (Info), and cryptographic boundary changes (Block).

Why this rule exists

A line removed from production code is a behavior change. If no test changed in the same diff, either the removed line was untested (silent regression risk) or the test it broke was deleted to make CI green.

Code example

Triggers the rule
// Removes a guard clause without touching tests
- if (user is null) throw new ArgumentNullException(nameof(user));
  return user.Email;
Passes the rule
// Removes the guard AND adds a test asserting the new contract
- if (user is null) throw new ArgumentNullException(nameof(user));
  return user.Email;
+ // tests/UserTests.cs
+ [Fact] public void GetEmail_NullUser_Throws_NullReference() { ... }

Configuration

Disable or adjust the severity of this rule in .gauntletci.json:

{
  "rules": {
    "GCI0003": { "enabled": true, "severity": "Block" }
  }
}

See Configuration for the full schema.

Related rules

Discussed in

The Asymmetry of Change: Why Your Tests Are Looking the Wrong Way

Why passing tests don't guarantee correct behavior. How diff-scanning can close the gap between code changes and test validation.

Why Tests Miss Bugs

Tests pass but bugs still reach production. The categories of risk that escape test suites and why a green build is not the same as safe code.

Why Code Review Misses Bugs

Code review catches style and obvious logic errors. It routinely misses behavioral drift, contract changes, and implicit assumptions.

A Formal Framework for Behavioral Change Risk

A structured taxonomy for behavioral, contract, concurrency, and side-effect risk in code diffs.

What Is Diff-Based Analysis?

Diff-based analysis evaluates only what changed in a commit. Why that scope is the right unit of risk for pre-commit checks.

How Azure SDK PR #57223 Introduced 6,650+ Unique Risk Signals

Azure SDK PR #57223 generated 6,650+ unique behavioral risk signals across 3 framework versions. See why traditional tools missed them.

Beyond SonarQube: A Behavioral Alternative to Code Smell Detection

Why linter rules and code smells miss behavioral regressions. A case for deterministic behavioral analysis as a gating criterion instead of counting violations.

log4net PR #201: 3,753+ Risk Signals in a Major Enterprise Refactor

Large-scale logging framework refactoring introducing thousands of behavioral changes across multiple code paths.

Google API PR #3150 Analysis

Behavioral risk analysis of a major Google API library pull request.

StackExchange.Redis PR #3028 Analysis

Behavioral change risk in a critical infrastructure library pull request.

gRPC .NET PR #2531 Analysis

Behavioral risk signals in a fundamental RPC framework pull request.

AngleSharp PR #1159 Analysis

HTML parser library pull request introducing behavioral changes.

State of Behavioral Change Risk in .NET

A field report from 610 merged C# PRs across 61 repositories, with raw findings, high-confidence findings, and outlier disclosure.

Best AI Code Review Tools for Pull Requests

How to evaluate AI code review tools by evidence quality, repeatability, CI fit, noise control, and merge-gate safety.

What Is Pull Request Risk Analysis?

Pull request risk analysis evaluates how a diff changes behavior, contracts, tests, runtime safety, and production blast radius before merge.

CI Quality Gate for Pull Requests

A practical framework for designing CI quality gates that block risky pull requests instead of only enforcing style, coverage, and known vulnerabilities.

Automated Code Review Tools for GitHub Pull Requests

How GitHub teams should choose automated code review tools for PR comments, required checks, Actions workflows, and deterministic merge protection.

Best Code Review Tools for GitHub

A GitHub-focused guide to choosing code review tools across human review, AI assistants, security scanners, static analysis, and PR risk gates.

CodeRabbit Alternative: Deterministic Pull Request Risk Analysis

A buyer-focused comparison for teams evaluating AI pull request reviewers and deterministic PR risk analysis before merge.

Real-world evidence

Implemented in src/GauntletCI.Core/Rules/Implementations/GCI0003_*.cs.

About the author

Eric Cogen -- Founder, GauntletCI

Twenty years as a senior technical consultant building and modernizing enterprise platforms across .NET, AWS, serverless, microservices, and AI-driven systems.