[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71AY5AMQKZZVVPF9708Y75W":3,"skill-same:01M71AY5AMQKZZVVPF9708Y75W":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":29,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":76,"commitSha":77,"skillDirectory":78,"forksCount":79,"repositoryHtmlUrl":80,"repositoryHomepageUrl":81,"ownerHtmlUrl":82,"ownerBlogUrl":83,"ownerDescription":84,"updatedAt":85,"install":86,"resources":99},"01M71AY5AMQKZZVVPF9708Y75W","qa-full",null,"Full per-feature QA pipeline: audit → fix → verify. Runs the complete\nmulti-dimensional fan-out (tests, correctness, security, DB, frontend perf,\nbrowser QA, design, accessibility, coverage) scoped to the current branch's\ndiff, FIXES what each check finds, re-verifies the fixes, then emits a\npass\u002Ffail ship-readiness verdict on the repaired branch. Run it when a\nfeature is finished, before \u002Ffinish-branch and \u002Fship. Use when asked to\n\"run full QA\", \"qa-full\", \"feature done — check it\", \"is this ready to\nship\", \"pre-ship check\", \"full quality gate\", or \"fix everything before\nship\".","ariadoss\u002Fsuperskills","ariadoss","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F414341?v=4","01M71AC7383PT6JCRZSQJ4AVTM","Danilo Stern-Sapad","01M71AC73Y7NTBTJ9KQYNENRRE",12,"MIT","https:\u002F\u002Fgithub.com\u002Fariadoss\u002Fsuperskills\u002Fblob\u002Fmain\u002Fskills\u002Fqa-full\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",[30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"qa","qa full","full","security","finish","paths","edit","write","read","run","auto","auto-detect","design","frontend","fix","ship check","re","db","branch","ready","2026-11-10 10:12:30",false,"---\nname: qa-full\nversion: 2.0.1\ndescription: |\n  Full per-feature QA pipeline: audit → fix → verify. Runs the complete\n  multi-dimensional fan-out (tests, correctness, security, DB, frontend perf,\n  browser QA, design, accessibility, coverage) scoped to the current branch's\n  diff, FIXES what each check finds, re-verifies the fixes, then emits a\n  pass\u002Ffail ship-readiness verdict on the repaired branch. Run it when a\n  feature is finished, before \u002Ffinish-branch and \u002Fship. Use when asked to\n  \"run full QA\", \"qa-full\", \"feature done — check it\", \"is this ready to\n  ship\", \"pre-ship check\", \"full quality gate\", or \"fix everything before\n  ship\".\ntriggers:\n  - run full qa\n  - qa full\n  - feature done check it\n  - is this ready to ship\n  - pre-ship check\n  - full quality gate\n  - fix everything before ship\nargument-hint: '\u003Coptional: base branch (default auto-detect) or --scope \u003Cpaths>>'\nallowed-tools:\n  - Bash\n  - Read\n  - Edit\n  - Write\n  - Grep\n  - Glob\n  - Task\n  - Skill\n  - WebFetch\n  - AskUserQuestion\n---\n\n# \u002Fqa-full\n\nThe per-feature QA **pipeline**. Where `\u002Fdaily-qa` is the unattended, repo-wide,\ntime-windowed **background** sweep that only *reports*, `\u002Fqa-full` is the\n**present-human, branch-scoped, audit → fix → verify** pipeline you run the\nmoment a feature is done — before `\u002Ffinish-branch` and `\u002Fship`.\n\n```\nimplement → \u002Fqa-full → \u002Ffinish-branch → \u002Fship\n            (audit → fix → verify)\n```\n\nIt reuses `\u002Fdaily-qa`'s trigger matrix (which checks to run based on what\nchanged) with three deliberate differences:\n\n- **Scope is the branch diff** (`base..HEAD` + working tree), not a time window.\n- **It fixes, not just reports.** Every check runs in three phases — **audit**\n  (report-only discovery is fine here), **fix** (apply the smallest correct fix,\n  one atomic commit per fix — except `\u002Freview`'s bundled output, see Hard\n  rules), **verify** (re-run the same check plus the test\n  suite and prove the fix holds). The final verdict is on the *repaired* branch.\n- **Interactive checks actually run.** Because a human is present, the checks\n  `\u002Fdaily-qa` only *recommends* — `\u002Fqa`, `\u002Fweb-perf`, `\u002Fdesign-review`, the\n  dynamic `\u002Fa11y` pass — run here when their triggers fire.\n\nThis is not an audit skill. It is a full security pipeline, a full performance\npipeline, a full correctness\u002Ftest pipeline, and a full browser\u002Fdesign pipeline,\nselected per-diff and driven to green.\n\n## How sub-skills run\n\nEach `\u002Fname` in the steps below is a skill. Run it by invoking it with the\nSkill tool (for example `Skill(defense)`), then follow the instructions it\nloads. A check counts as run only when that call is in the session; doing the\ncheck's work by hand from memory is not running it. If a skill cannot be\ninvoked here, the check is SKIPPED with the reason. For a triggered `\u002Fqa` that\ncannot be loaded, inspect the installed gstack\u002Fsuperskills setup, run its\navailable setup step, and retry the Skill call. Ask the user for any setup\ndetail only they can provide. If `\u002Fqa` remains unavailable, record SKIPPED\nwith that evidence and NOT READY.\n\n## Hard rules\n\n- **The bar is the superskills quality standard** — TDD\u002FDRY\u002FSOLID\u002FYAGNI\n  (applied in every step's fix phase: test first, no duplicated logic, small\n  single-purpose units, nothing speculative) plus the hard-gate list, which is\n  spelled out in full in Step 10's Blocker set. The canonical written copy is\n  `ENGINEERING_STANDARDS.md` in the superskills install (a plugin install exposes\n  it at `${CLAUDE_PLUGIN_ROOT}\u002FENGINEERING_STANDARDS.md`); it is **not** expected\n  to exist in the project you're reviewing, so don't flag it as missing. Every\n  fix you land must meet that bar too — a fix that adds untested public surface\n  or duplicates logic is not a fix.\n- **Audit → fix → verify, per check.** For every check whose trigger fires:\n  1. **Audit** — run the sub-skill (its normal report-only output is the\n     discovery pass).\n  2. **Fix** — for each CRITICAL\u002FHIGH finding (and MEDIUM where the fix is\n     small and safe), root-cause it (`\u002Fdebug` discipline: no symptom patches),\n     write the failing test first when it's a logic bug (`\u002Ftdd`), apply the\n     smallest correct fix, and commit it atomically with a message naming the\n     check and finding.\n  3. **Verify** — re-run the *same* sub-skill on the diff and re-run the test\n     suite. A fix is only \"fixed\" when the re-audit no longer reports it and\n     tests are green. Never claim a fix without this fresh evidence (`\u002Fverify`\n     discipline).\n  A finding you could not fix (needs a product decision, external service,\n  credentials, or an architectural change beyond the diff) is an **UNFIXED\n  blocker**: record what you tried and why it's out of reach. Do not quietly\n  downgrade it to a warning.\n- **Fix only what the diff and the findings justify.** Do not refactor\n  untouched code, upgrade dependencies, or \"improve\" unrelated modules while\n  you're in there. Scope stays on the branch diff plus the exact lines a finding\n  points at.\n- **Commit, but never push or open a PR.** Each fix lands as its own commit on\n  the current branch so the user can review\u002Frevert individually. Exception:\n  `\u002Freview` exposes no per-finding boundary, so its output lands as one commit\n  per invocation (Step 3). Integration and shipping belong to `\u002Ffinish-branch`\n  and `\u002Fship`.\n- **Ground every finding and every fix in concrete evidence**: file:line,\n  failing test name, log snippet, severity as the underlying tool produced it,\n  and the commit SHA of the fix. No speculation.\n- **Separate blockers from warnings.** Only test\u002Fbuild failures and\n  CRITICAL\u002FHIGH findings block. Everything else is a warning — fix it when the\n  fix is cheap and safe, otherwise ship it with a follow-up note.\n- **Bounded loops.** At most **two** fix rounds per check, then one final\n  verification pass (Step 10). If something is still red after that, it's an\n  UNFIXED blocker with the attempts documented — not a third round.\n- **Never claim SHIP-READY without receipts.** The verdict must cite the exact\n  checks that ran, what they found, what was fixed (with commits), what was\n  re-verified, and what was skipped (and why).\n- **An unknown dev URL is a question, not a reason to refuse browser QA.**\n  When `\u002Fqa` is triggered, invoke it even if no URL is known. Follow the\n  target-resolution flow below, including local setup or a question to the\n  user, and resume the same run when the target is available. A triggered\n  `\u002Fqa` check that cannot run is NOT READY, never SHIP-READY.\n- **No silent skips — mandatory accounting.** Every check must resolve to\n  exactly one of: **RAN-CLEAN** (ran, nothing to fix), **FIXED(n)** (ran, n\n  findings fixed and re-verified — list commits), **UNFIXED** (ran, at least one\n  blocker could not be fixed — reason), **SKIPPED** (stated reason — e.g. \"no\n  reachable dev server and none could be started\", \"scanner not authorized in\n  this env\"), **NOT-TRIGGERED** (its diff trigger didn't fire), or\n  **MANDATORY-FAIL** (a `CLAUDE.md`-mandatory check that was skipped). A check whose\n  trigger fired but that neither ran nor was explicitly skipped-with-reason is an\n  **unaccounted check ⇒ NOT READY**. \"Recommend-only\" is not an allowed resting\n  state for a *triggered* check. A RAN-CLEAN, FIXED or UNFIXED row stands on\n  the Skill call that ran it; a row with no such call is unaccounted too. The\n  superskills ledger hook (`hooks\u002Fhooks.json` for plugin installs,\n  `scripts\u002Finstall-qa-full-ledger-hook.sh` otherwise) checks this when the\n  session stops and sends you back to invoke any check it can't find. Projects may mark specific checks **MANDATORY**\n  in `CLAUDE.md` (e.g. `\u002Fpentest` on a payments service), and for those, SKIPPED\n  is itself a blocker.\n- **Money and authorization still need a human yes.** `\u002Fcode-review ultra` is a\n  billed cloud run, and `\u002Freview`'s Codex passes spend OpenAI tokens — ask\n  before launching either, never assume. `\u002Fpentest`'s in-harness default costs\n  nothing beyond this session, but the skill still requires the user to\n  confirm authorization before it scans — ask, then run. Its clearwing modes\n  bill a separate LLM provider and stay ask-first. \"Ask, then run\" is still\n  running; it is not report-only.\n\n## Project configuration (`CLAUDE.md`)\n\nThis pipeline reads the project's root `CLAUDE.md` for a few optional settings.\nThey are plain prose (CLAUDE.md is agent instructions, not a config file) — look\nfor a `## qa-full` section and honor whatever it states. Example:\n\n```markdown\n## qa-full\n\n- Mandatory checks (must RUN with evidence — a skip is a blocker): `\u002Fpentest`, `\u002Fdefense`\n- Hard perf gate: LCP ≤ 2.5s and INP ≤ 200ms on `\u002F` and `\u002Fcheckout` (breach blocks)\n- Design: skip `\u002Fdesign-review` (design is owned by the design team, do not auto-fix visuals)\n- Dev URL: http:\u002F\u002Flocalhost:3000   (for `\u002Fweb-perf`, `\u002Fqa`, `\u002Fa11y`, `\u002Ffuzz`)\n- Test\u002Fbuild: `pnpm test` and `pnpm build`\n- QA tier: exhaustive\n```\n\nRecognized settings (all optional; absence = the defaults in the steps below):\n- **Mandatory checks** — listed commands must read RAN-CLEAN or FIXED in the\n  ledger; SKIPPED is a blocker (any step; Step 10 enforces it). MANDATORY\n  overrides the check's own diff trigger: run it on the diff even when the\n  trigger didn't fire, so NOT-TRIGGERED is not an acceptable state either. Use\n  for compliance-critical surfaces (payments, auth, PII).\n- **Hard perf gate** — turns a `\u002Fweb-perf` budget breach that survives the fix\n  round from a warning into a blocker (Step 6).\n- **Design: skip `\u002Fdesign-review`** — opt *out* of the visual-fix pass (Step 8)\n  entirely; by default it runs on any UI change. This skips the check (ledger:\n  SKIPPED(\"project opt-out\")) — it does not turn it into a report-only run.\n- **Test\u002Fbuild commands** — feed Steps 2 and 10. **Dev URL** — feeds Steps 4\n  (`\u002Ffuzz`), 6, 7 and 8. **QA tier** — feeds Step 7; defaults to `standard`.\n\nIf there is no `## qa-full` section, run with the built-in defaults — nothing here\nis required.\n\n## Resolve a dev target for browser checks\n\nUse this flow when a triggered `\u002Ffuzz`, `\u002Fweb-perf`, `\u002Fqa`, `\u002Fdesign-review`, or\ndynamic `\u002Fa11y` check needs a running app. Resolve the target once and reuse it;\nkeep any server you start alive through the final browser check.\n\n1. Read the project's `CLAUDE.md` `Dev URL`, `AGENTS.md`, `README.md`, and\n   development\u002Fsetup docs. Check the project's declared `dev`\u002F`start` script or\n   equivalent and probe documented local ports. A responding localhost port is\n   usable only after you verify it serves this project, not another app.\n2. If the app is not running, follow the project's setup instructions. Install\n   its declared dependencies when needed, start its documented dev command,\n   and wait for a reachable URL. Record the command, URL, and startup result in\n   the ledger. Do not invent a port, command, credential, or external service.\n3. If the URL or startup command is still unknown, or startup needs user-owned\n   configuration, **ask the user** for the dev\u002Fpreview URL or the missing setup\n   detail. Tell them what you already checked. Let the user configure secrets\n   locally; never request credentials in chat. Pause the affected check and\n   resume it after their answer. An unanswered question is pending context,\n   not a SKIPPED check or a final refusal.\n4. If a documented start fails, inspect its error and attempt a bounded fix to\n   the local setup. If it still cannot run, ask for the missing information or\n   user action. Only record SKIPPED after documenting discovery and startup\n   attempts and the user confirms there is no runnable target or declines the\n   needed setup. For a triggered `\u002Fqa`, that SKIPPED result is a NOT READY\n   blocker: the feature has not been browser-tested.\n\n`\u002Fqa` has its own diff-aware target discovery and browser setup. Invoke it\nwithout a URL when this flow has not resolved one; follow its question or\nsetup path rather than replacing browser testing with unit tests or `curl`.\n\n## Step 1: Establish the diff scope and a clean tree\n\n1. Detect the base branch: `gh repo view --json defaultBranchRef -q .defaultBranchRef.name`,\n   else `git symbolic-ref refs\u002Fremotes\u002Forigin\u002FHEAD`, else fall back to `main`\u002F`master`.\n2. If `$ARGUMENTS` names a base branch or `--scope \u003Cpaths>`, use it.\n3. Resolve the **diff ref**: `git fetch origin \u003Cbase>` and use `origin\u002F\u003Cbase>`\n   when that ref exists, else local `\u003Cbase>`. This is what `\u002Freview` and `\u002Fqa`\n   diff against too, and it stays correct after Step 1.5 creates a working\n   branch (local `\u003Cbase>` would then equal HEAD and the set would be empty).\n   Compute the changed-file set: `git diff --name-only \u003Cdiff-ref>...HEAD -- \u003Cscope paths>`\n   (drop the `--` part when no `--scope` was given) plus\n   uncommitted changes (`git status --porcelain`). This set drives every\n   trigger below. **Fix commits made by this pipeline extend the set** — later\n   steps and the final pass (Step 10) audit the fixes too.\n4. **Clean-tree precondition.** The fixers (`\u002Fqa`, `\u002Fdesign-review`) need each\n   fix to be its own atomic commit, so they stop on a dirty tree. Handle it\n   once, here: if `git status --porcelain` is non-empty, ask the user (via\n   AskUserQuestion) whether to **commit the in-progress work now** (recommended\n   — a descriptive commit so the feature is preserved before fixes land) or\n   **stash it**. Do not proceed with a dirty tree.\n5. **Never run on the base branch itself.** The sub-skills' diff-aware modes\n   (`\u002Freview`, `\u002Fqa`, `\u002Fdesign-review`) key off \"current branch ≠ base\" and\n   diff against `merge-base(origin\u002F\u003Cbase>, HEAD)`. If `git branch\n   --show-current` equals the base and there are unpushed commits, create a\n   working branch at HEAD first — `git switch -c qa-full\u002F\u003Cbase>-\u003CYYYY-MM-DD>`\n   (reuse it if a same-day branch already exists from an aborted run) — and\n   run the whole pipeline there. Step 10 folds it back: fast-forward the\n   base to the working branch (`git switch \u003Cbase> && git merge --ff-only\n   qa-full\u002F...`) and delete the working branch. No history is rewritten; the\n   base just gains the fix commits. If there are no unpushed commits either,\n   there is nothing to QA.\n6. Record at the top of the report: base branch, diff ref, working branch (if\n   created), commit range, changed-file count, and the HEAD SHA before any fixes.\n\nIf there is no diff against base, stop and say so — there is nothing to QA.\n\n## Step 2: Tests & build (always — audit → fix → verify)\n\n1. Find the project's test\u002Fbuild commands from `CLAUDE.md`; if absent, infer\n   from `package.json` scripts, `Makefile`, `pyproject.toml`, etc. If you\n   cannot determine them, **ask** rather than guess.\n2. **Audit:** run the test suite and the build. Capture exact failures (test\n   name + verbatim error in a code block).\n3. **Fix:** for each failing test or build error, follow `\u002Fdebug` — reproduce,\n   root-cause, then fix the cause (not the assertion). Commit each fix.\n4. **Verify:** re-run the full suite and build. Green ⇒ FIXED(n). Still red\n   after two rounds ⇒ UNFIXED blocker with the failing test and what was tried.\n\nIf this step ends UNFIXED after two rounds, **stop here** and report NOT READY\nwith the failing test. Every later step's verify phase depends on a green\nsuite — running fixers on a red suite is fix → hope, not fix → verify. Mark\nevery downstream ledger row `SKIPPED(\"pipeline halted at Step 2\")`. A working\nbranch from Step 1.5 stays as-is (base untouched) so the fix commits are there\nfor the user.\n\n## Step 3: Correctness + quality — `\u002Freview` then `\u002Fclean-code` (always)\n\nTwo halves. Both sub-skills are in-tree, so they are invocable from inside any\nsession or tool, and Step 1.5 guarantees you are on a non-base branch, which\n`\u002Freview`'s own branch guard requires.\n\n**Correctness — `\u002Freview`.** `\u002Freview` is not a report-only audit: one\ninvocation reads the diff, auto-applies its mechanical (AUTO-FIX) findings to\nthe working tree, asks you about the rest (ASK items) via its own\nAskUserQuestion, and never commits. Treat one call as one atomic\naudit + fix + ask unit:\n1. **Run `\u002Freview`** against the base this pipeline resolved in Step 1. It has\n   no argument channel, so it always diffs `merge-base(origin\u002F\u003Cbase>, HEAD)` —\n   if Step 1 resolved a non-default base or a `--scope`, say so in the ledger\n   evidence: `\u002Freview` reviewed the full default-base diff.\n2. **Commit what it changed** as one commit attributed to `\u002Freview` (e.g.\n   `review: apply AUTO-FIX + approved ASK findings`), so the tree is clean\n   before `\u002Fclean-code` and nothing `\u002Freview` fixed can be lost by a later\n   revert. If `--scope` was given, stage and commit only files under scope;\n   any out-of-scope edits `\u002Freview` made stay uncommitted (stash them so the\n   tree is clean, noting the stash ref) and are flagged in the ledger with that\n   ref for the user — never silently committed. For any CRITICAL it reported but could not fix, root-cause\n   (`\u002Fdebug`), write the failing test first (`\u002Ftdd`), fix, commit atomically.\n3. **Verify:** run `\u002Freview` once more. It re-scans the full base diff\n   including the fix commits — that's the point. A CRITICAL still present ⇒\n   UNFIXED blocker. Commit anything this second pass auto-fixed the same way.\n   Do not run it a third time in this step.\n\n`\u002Freview`'s adversarial section runs a free Claude subagent **and**, when the\nCodex CLI is installed and enabled, `codex exec` \u002F `codex review` passes that\nspend OpenAI tokens. Those Codex passes are **ask-first** under the money rule.\nYou are the one executing `\u002Freview`'s instructions, so no config change is\nneeded: when its Codex preflight says Codex would run — `CODEX_MODE: ready`\nin current gstack, `CODEX_AVAILABLE` with `OLD_CFG` not `disabled` in older\nversions — ask the user once whether to spend on Codex for this run; if\ndeclined, do not run the `codex exec` \u002F `codex review` commands and proceed\nexactly as the section's disabled\u002Funavailable branch describes (Claude\nadversarial subagent still runs). Record\nthe Codex state and the user's answer in the ledger. Never flip the global\n`codex_reviews` config on the user's behalf.\n\n`CODEX_MODE: not_authed` can be a false negative: gstack's preflight only\nrecognises a Codex login, so a Codex CLI configured for a custom provider\n(e.g. `model_provider = \"azure\"` with an API key in the environment) reads as\nunauthenticated while working fine. When the preflight says `not_authed` but\n`${CODEX_HOME:-$HOME\u002F.codex}\u002Fconfig.toml` sets a `model_provider`:\n\n1. **Ask first** — fold it into the one Codex question above: the probe is\n   itself a billed call on the user's provider. Declined ⇒ skip the probe and\n   the passes.\n2. **Probe the model the passes will use**, bounded, so a working default\n   model cannot hide an unusable review model and a stalled endpoint cannot\n   hang the pipeline:\n\n   ```bash\n   source ~\u002F.claude\u002Fskills\u002Fgstack\u002Fbin\u002Fgstack-codex-probe 2>\u002Fdev\u002Fnull\n   if ! command -v _gstack_codex_timeout_wrapper >\u002Fdev\u002Fnull 2>&1 \\\n      || ! command -v _gstack_codex_select_model >\u002Fdev\u002Fnull 2>&1; then\n     echo \"CODEX_PROBE: broken_install (gstack-codex-probe helper not found)\"\n   elif _gstack_codex_select_model exec; then\n     # gstack's own resolver: GSTACK_CODEX_MODEL, then the model in config.toml,\n     # then gstack's default, so the probe tests the model the passes will use.\n     echo \"CODEX_MODEL: $_GSTACK_CODEX_SEL ($_GSTACK_CODEX_SEL_SRC)\"\n     _gstack_codex_timeout_wrapper 120 codex exec -s read-only \\\n       -c \"model=\\\"$_GSTACK_CODEX_SEL\\\"\" \"Reply with exactly: PONG\" \u003C \u002Fdev\u002Fnull\n   fi\n   ```\n\n3. Answers `PONG` ⇒ treat Codex as `ready` and run the passes with that\n   provider and model. `CODEX_PROBE: broken_install`, or exit code 126\u002F127 ⇒\n   treat it as `broken_install` (gstack's branch: reinstall advice, no model\n   advice). Any other error, timeout or text ⇒ `model_unusable`: skip the\n   passes, tell the user to set `GSTACK_CODEX_MODEL` (or `model` in config.toml)\n   to a deployment their provider serves. A `CODEX_MODEL: invalid` line from the\n   resolver means the same: no call was made.\n\nRecord the probe command, model and result in the ledger either way.\n\n**If `\u002Freview` is unavailable** (gstack is not installed, the Skill tool cannot\nload `review`, or its preamble fails), do not skip the correctness step. Run the\nin-tree fallback, `\u002Fbasic-review \u003Cdiff-ref>...HEAD`, instead:\n1. **Audit:** invoke `\u002Fbasic-review` with the diff ref Step 1 resolved. It is\n   read-only and reports findings as `file:line` with severity.\n2. **Fix:** for each CRITICAL\u002FHIGH (and cheap MEDIUM) finding, root-cause it\n   (`\u002Fdebug`), write the failing test first (`\u002Ftdd`), apply the smallest fix,\n   and commit it atomically, naming `basic-review` and the finding.\n3. **Verify:** run `\u002Fbasic-review` once more on the same range; a CRITICAL\n   still reported is an UNFIXED blocker.\n\nName both in the ledger row's first cell, `\u002Freview (fallback: \u002Fbasic-review)`,\nand put the reason `\u002Freview` was unavailable in its evidence. The row's status\nis the fallback's result (RAN-CLEAN, FIXED(n) or UNFIXED), never SKIPPED: the\ncorrectness check ran.\n\n**Quality — `\u002Fclean-code`.** After correctness is green and committed, run\n`\u002Fclean-code \u003Cdiff-ref> [--scope \u003Cpaths>]` with the diff ref and scope this\npipeline resolved. It audits KISS \u002F DRY \u002F SOLID \u002F YAGNI against `ENGINEERING_STANDARDS.md`,\napplies the smallest safe refactor per finding under a green suite\n(characterization test first where none exists), commits each atomically,\nre-audits, and reverts a failed refactor with `git checkout` on only the files\nit touched. Its findings left UNFIXED are warnings here, not blockers — quality\ndebt ships with a note; bugs don't.\n\n`\u002Fcode-review ultra` (deep multi-agent cloud review) is **billed** — when a\n`\u002Freview` finding is high-stakes (payments, auth, data loss, concurrency), ask\nthe user whether to launch it. Do not launch it unasked. Claude Code's\nbuilt-in `\u002Fcode-review` and `\u002Fsimplify` are not part of this step: `\u002Freview`\nalready covers correctness here, and an optional extra pass would have no\nledger row.\n\n## Step 4: Security pipeline — `\u002Fdefense`, `\u002Fiac-scan`, `\u002Fpentest`, `\u002Ffuzz`\n\n**`\u002Fdefense` (always).**\n1. **Audit:** run `\u002Fdefense` scoped to the changed files (OWASP Top 10 \u002F\n   secrets \u002F auth \u002F crypto \u002F data-protection).\n2. **Fix:** remediate every CRITICAL\u002FHIGH (and cheap MEDIUMs): remove or\n   rotate-and-externalize hardcoded secrets, add the missing authz check,\n   parameterize the query, escape the output, switch the weak primitive, add\n   the validation. Each fix gets a regression test where a test can express it\n   (e.g. \"unauthenticated request to X returns 401\"). Commit atomically.\n3. **Verify:** re-run `\u002Fdefense` on the same files; the finding must be gone.\n\n**`\u002Fiac-scan` (when infra\u002Fdeploy config changed).** Trigger on `Dockerfile`,\n`docker-compose*`, `*.tf`\u002F`*.tfvars`, k8s\u002FHelm manifests, `.github\u002Fworkflows\u002F**`,\n`.gitlab-ci.yml`, `Jenkinsfile`, nginx\u002Fcloud config (see `\u002Fiac-scan`'s trigger\nsection for the authoritative list). Audit with the local static linters, **fix**\nCRITICAL\u002FHIGH misconfigs (root container → non-root user, `0.0.0.0\u002F0` ingress →\nscoped CIDR, wildcard IAM → least privilege, privileged pod → dropped, untrusted\nCI trigger → pinned\u002Fguarded, baked-in secret → injected), re-scan to verify.\n\n**`\u002Fpentest` (triggered when `\u002Fdefense` found CRITICAL\u002FHIGH, or the diff touches\nauth\u002Fcrypto\u002Fsession\u002Ftoken\u002Fdeserialization\u002Ffile-upload paths).** Its default mode\nhunts in this harness — the session's own model reads the code and reports\nfindings with evidence levels; no external scanner, no spend beyond the\nsession. **Confirm authorization with the user first** (the skill's own\nquestions), then run it; the in-harness hunt is the check, not a stand-in.\nFix CRITICAL\u002FHIGH it surfaces, re-run to verify. clearwing appears only\nbehind its ask-first gate: the user names it, asks for a network probe, or\nwants SARIF\u002FCI output — and its pipeline can run agent-driven on this session\nvia the bundled bridge (no provider, no spend) instead of provider-driven.\nProvider-driven runs configure their own LLM provider and bill it per run —\ndeclining clearwing means run the in-harness mode, not skip the check.\nIf the user declines the check itself (no authorization) ⇒ SKIPPED(reason). If\n`CLAUDE.md` marks `\u002Fpentest` MANDATORY, SKIPPED is a blocker.\n\n**`\u002Ffuzz` (triggered when the diff adds or changes endpoints, input parsing,\nfile-upload handling, or deserialization).** Needs a running target: find the dev\nURL with the target-resolution flow, then run `\u002Ffuzz` against the new surface;\n**fix** crashes, injections, and auth bypasses it surfaces (with a regression\ntest); re-fuzz to verify. If no target is possible after that flow ⇒\nSKIPPED(reason). If `CLAUDE.md` marks `\u002Ffuzz` MANDATORY, SKIPPED is a blocker.\n\n**`\u002Fcso` backstop.** If the diff crosses a *new* trust boundary (new auth\npath\u002Fendpoint\u002Fexternal input\u002Fdeserialization) and there's no evidence a threat\nmodel was done at plan time, run `\u002Fcso` on that boundary and fold any\nCRITICAL\u002FHIGH into the `\u002Fdefense` fix round. Threat modeling belongs in\n`\u002Fwrite-plan`; this is the late catch, not a substitute.\n\n## Step 5: Database pipeline — `\u002Fdb-optimize` (auto-run if triggered)\n\nTrigger when changed files match ORM models, migrations, query builders\n(`**\u002Fmodels\u002F**`, `**\u002Fmigrations\u002F**`, `**\u002Fqueries\u002F**`, `**\u002F*repository*`,\n`**\u002F*.sql`), raw SQL in the diff, or new ORM calls (`.find`, `.where`,\n`.includes`, `.join`, `.preload`).\n\n1. **Audit:** run `\u002Fdb-optimize` scoped to matched files (run `\u002Fdbmap` first if\n   it asks for a schema map).\n2. **Fix:** N+1s on hot paths → eager-load\u002Fbatch (`includes`\u002F`preload`\u002F\n   `select_related`\u002Fdataloader); missing indexes on hot paths → add a migration\n   for the index; obviously-redundant queries → dedupe. Add a test that asserts\n   the query count where the ORM supports it. Commit atomically.\n3. **Verify:** re-run `\u002Fdb-optimize`; the hot-path findings must be gone and\n   the migration must apply cleanly in the test run.\n\nNon-hot-path suggestions are warnings (fix if trivial). No trigger ⇒\nNOT-TRIGGERED.\n\n## Step 6: Frontend perf pipeline — `\u002Fweb-perf` (+ `\u002Fperf-profile`)\n\nTrigger when the diff includes frontend code (`**\u002F*.tsx`, `**\u002F*.jsx`,\n`**\u002F*.vue`, `**\u002F*.svelte`, `**\u002Fcomponents\u002F**`, `**\u002Fpages\u002F**`, `**\u002Fstyles\u002F**`,\n`**\u002F*.css`, `**\u002F*.scss`), new images\u002Ffonts\u002Fassets, or bundler config\n(`next.config.*`, `vite.config.*`, `webpack.config.*`).\n\n1. Resolve the dev URL with the target-resolution flow above; start the dev\n   server if needed. If the flow establishes that no target is possible ⇒\n   SKIPPED with the startup error and the user's answer in the ledger.\n2. **Audit:** run `\u002Fweb-perf` against the affected routes. Record Core Web\n   Vitals (LCP, INP, CLS) vs. any known budget.\n3. **Fix:** address the measured regressions attributable to the diff —\n   render-blocking imports → defer\u002Flazy, oversized image\u002Ffont → optimize or\n   preload, layout shift → reserve dimensions, long task → split\u002Fmemoize.\n   Commit atomically.\n4. **Verify:** re-run `\u002Fweb-perf` on the same routes; report before\u002Fafter\n   numbers.\n\n- A budget breach that survives the fix round is a **warning** by default,\n  unless `CLAUDE.md` defines a hard perf gate — then it blocks.\n- **`\u002Fperf-profile`** (triggered when the diff touches hot server-side paths, the\n  change is pre-launch, or `\u002Fdb-optimize`\u002F`\u002Fweb-perf` point at a server-side\n  bottleneck): run it against the affected endpoint\u002Fjob, **fix** the localized\n  bottleneck (cache, batch, move off the request path), re-profile to verify.\n  Needs a representative workload — if none is available ⇒ SKIPPED(reason).\n\n## Step 7: Browser QA pipeline — `\u002Fqa` (auto-run if triggered)\n\n> Run **`\u002Fqa`** — the full test → fix → re-verify loop — not `\u002Fqa-only`. This is\n> the check that replaces manual click-through QA, and a human is present.\n\nTrigger when the diff includes anything a human would manually QA in a browser:\nUI\u002Ffrontend code, pages\u002Froutes, forms, route handlers serving HTML, API\nendpoints the UI consumes, auth\u002Fsession flows, or config that changes\nuser-facing behavior.\n\n1. **Invoke `\u002Fqa` whenever this trigger fires, even if no dev URL is known.**\n   Give it the resolved URL if Step 4 or 6 found one; otherwise invoke it\n   without a URL so its diff-aware mode can discover the app or ask. Scope it\n   to the affected surface at the project's **QA tier** (`CLAUDE.md`, default\n   `standard`: critical + high + medium). If it needs a server, follow the\n   target-resolution flow above and resume `\u002Fqa` after setup or the user's\n   answer. A missing URL alone never justifies SKIPPED, stopping the pipeline,\n   or declaring browser QA complete. Let `\u002Fqa` finish its audit → fix →\n   re-verify loop with atomic commits and before\u002Fafter health scores.\n2. Fold its before\u002Fafter health score, fixed-bug list (with commits), and any\n   bugs it could not fix into the ledger.\n\n- User-facing CRITICAL\u002FHIGH bugs that `\u002Fqa` could not fix ⇒ UNFIXED blocker.\n- If the target-resolution flow ends without a runnable app, record\n  SKIPPED(reason) and a NOT READY blocker. Say what setup was attempted and\n  what the user needs to provide before browser QA can run.\n\n## Step 8: Design + accessibility pipeline — `\u002Fdesign-review`, `\u002Fa11y`\n\n**`\u002Fdesign-review` (when the diff includes UI changes, unless `CLAUDE.md` opts\nout).** Run `\u002Fdesign-review` against the changed screens — it audits visual\nconsistency, hierarchy, spacing, AI-slop tells and slow interactions, then\n**fixes them with atomic commits and before\u002Fafter screenshots**. Let it complete.\nVisual findings it can't fix are warnings, not blockers. If the project opted\nout in `CLAUDE.md`, record SKIPPED(\"project opt-out\") and move on.\n\n**`\u002Fa11y` (when the UI change is heavy and likely to affect assistive tech —\nnew\u002Fchanged interactive components, forms, ARIA\u002F`role`\u002F`tabindex`,\nfocus\u002Fkeyboard handling, images, color\u002Fcontrast, motion; see `\u002Fa11y`'s trigger\nsection).**\n1. **Audit:** run the static pass on the diff, and the **dynamic axe pass** when\n   the dev URL is reachable (it is, if Step 6\u002F7 ran).\n2. **Fix:** every CRITICAL\u002FSERIOUS — native element over ARIA-on-a-div, missing\n   label\u002Fname, unreachable-by-keyboard control, focus trap, contrast below\n   ratio, missing reduced-motion guard. Commit atomically.\n3. **Verify:** re-run the same pass; CRITICAL that survive ⇒ UNFIXED blocker.\n\nScope split: `\u002Fdesign-review` owns *visual* quality; `\u002Fa11y` owns WCAG \u002F\nassistive-tech correctness. They overlap on contrast — `\u002Fa11y`'s measured\ncontrast finding is authoritative.\n\n## Step 9: Coverage pipeline — `\u002Ftest-coverage` + `\u002Fplaywright`\n\n1. **Audit:** for each changed file (including this pipeline's fix commits),\n   locate its test (sibling `*.test.*`, parallel `tests\u002F`). Use coverage data if\n   present (`coverage\u002F`, `lcov.info`, `.coverage`); else do a structural check\n   for new exported functions \u002F branches \u002F error paths without an assertion.\n2. **Fix:** run `\u002Ftest-coverage` on the diff — it writes and applies the missing\n   unit tests (and integration tests where risk crosses a boundary), enforcing\n   Google's Testing-on-the-Toilet practices. For **user-facing flows** with no\n   e2e coverage, run `\u002Fplaywright` to generate and run the e2e test so a\n   regression test is left behind. Commit atomically.\n3. **Verify:** run the full suite; the new tests must pass, and the structural\n   check must show no new **public** surface with zero tests.\n\nNew public surface still untested after this step ⇒ UNFIXED blocker. Internal\nhelpers without tests are warnings.\n\n## Step 9b: Prose quality pipeline — `\u002Fhumanize` (auto-run if triggered)\n\n**Trigger:** the diff adds or modifies user-facing copy: documentation, help\nprose, marketing pages, locale strings, or visible UI text, in any file type\n`python3 skills\u002Fhumanize\u002Ftoolkit\u002Fuserfacing.py classify \u003Cpath>` does not call\n`none`. NOT-TRIGGERED when no user-facing copy changed.\nInternal prompts, agent instructions, plans, and code comments are out of scope.\nRun the Markdown normalizer only on `markdown`\u002F`text` files; other types get the\nscan on the extraction and surgical in-place edits (see `\u002Fhumanize`).\n\n**Scope rules:**\n\n- Exclude prose the project does not own (vendored, mirrored, or generated\n  trees) and historical records (`CHANGELOG.md` and the like): that wording is\n  deliberate or upstream's, and rewriting it falsifies provenance.\n- **Warnings tier.** A prose-slop flag is style, not correctness: it never\n  enters the blocker set below. A flag that survives the fix rounds ships as a\n  warning with a follow-up note.\n\n1. **Audit:** run `\u002Fhumanize`'s deterministic scan (its toolkit's\n   `slop_report.py`) over each in-scope changed prose file and read the report.\n2. **Fix:** invoke `\u002Fhumanize` and apply it surgically to flagged spans only —\n   its own contract (deterministic fixes, subtractive edits, re-scan as the\n   gate; never a whole-document rewrite) is the fix policy here too. Commit\n   atomically like any other fix.\n3. **Verify:** re-scan the edited files and re-run the test suite. Repos often\n   pin exact doc strings in tests; a humanize edit that touched pinned prose\n   must break here, loudly, not silently ship.\n\nThe ledger row resolves to RAN-CLEAN (no flags worth fixing), FIXED(n)\n(flags fixed and re-scanned), SKIPPED(reason), or NOT-TRIGGERED. Remaining\nflags are warnings, never UNFIXED blockers.\n\n## Step 9c: AI-behavior pipeline — `\u002Feval` (ask-first if triggered)\n\n**Trigger:** the diff changes AI behavior. Judge it the way human eyes would:\ndoes the change alter what a model sees, how it is instructed, or how its\noutput is judged or used? A prompt template edited inside source code counts,\nnot just prompt files. The obvious file signals are prompts, agent or skill\ninstructions (`**\u002FSKILL.md`, `.claude\u002Fcommands\u002F**`, `AGENTS.md` \u002F\n`CLAUDE.md` instruction files), and LLM\u002FRAG pipeline code or configuration\n(retrieval parameters, judge rubrics, agent-loop logic). Pure formatting\nchanges to the same files do not count. NOT-TRIGGERED means \"no plausible\nbehavior change,\" never \"no matching filename.\"\n\nAn eval run spends model calls (case runs plus judge votes), so it follows the\nmoney rule: ask the user first, name what it will cost, and run only on an\nexplicit yes. A decline is SKIPPED(reason: not authorized) — a legal skip with\nreason, not a blocker.\n\n1. **Audit:** invoke `\u002Feval`; it builds or reuses the project's synthetic eval\n   set for the changed behavior and reports the behavior's before\u002Fafter\n   system metrics (pass rate per dimension), with the judge's calibration\n   (TPR, TNR, accuracy, precision, plus the bias reading) attached so the\n   numbers are trusted before they are read.\n2. **Fix:** wording first, structure second — the method's fix ladder.\n3. **Verify:** re-run the eval. The changed behavior must be no worse than the\n   baseline on every reported metric, and better on the dimension the change\n   targeted. \"No degradation\" is the floor, not the goal.\n\nA metric regression is a warning unless the project marks evals MANDATORY in\n`CLAUDE.md`; a MANDATORY eval that was declined or never ran is MANDATORY-FAIL.\n\n## Step 10: Final verification pass, ledger, verdict\n\nThe fix rounds changed the branch, so verify the *whole* result once more:\n\n1. **Fresh tests + build** on the final HEAD (Step 2 commands). Stale results\n   ⇒ NOT READY.\n2. **Re-audit the fix commits:** run `\u002Fdefense` scoped to the files the fix\n   commits touched, and read the fix commits themselves\n   (`git show original-HEAD..HEAD`) against `\u002Freview`'s checklist — `\u002Freview`\n   takes no commit range, and Step 3 already re-ran it twice. When `\u002Freview`\n   was unavailable, run `\u002Fbasic-review original-HEAD..HEAD` for this re-audit. The fixes must not\n   introduce a CRITICAL\u002FHIGH. If they did, one more fix + re-verify, then stop.\n3. **Diff sanity:** `git log --oneline \u003Cbase>..HEAD` — every pipeline commit\n   should name its check\u002Ffinding; nothing outside the diff scope was touched.\n4. **Fold back the working branch** if Step 1.5 created one: `git switch\n   \u003Cbase> && git merge --ff-only qa-full\u002F\u003C...> && git branch -d qa-full\u002F\u003C...>`.\n   If the fast-forward fails, the base moved underneath you — stop and report;\n   never force.\n\nThen build the **accounting ledger** — a row per check, each resolved to\nRAN-CLEAN \u002F FIXED(n) \u002F UNFIXED \u002F SKIPPED(reason) \u002F NOT-TRIGGERED \u002F\nMANDATORY-FAIL. **The verdict cannot be SHIP-READY while any triggered check is\nunaccounted or UNFIXED.**\n\n**Phase-5 accounting (honest scope):** `\u002Fqa-full` *is* the entry to Phase 5, so it\ncan only enforce the **pre-ship** half. It **cannot** verify `\u002Ffinish-branch`,\n`\u002Fship`, or `\u002Fland-and-deploy` — those run *after* this pipeline, so do not claim\nthey're done. A passing verdict is the **hard precondition** for ship: only on\nSHIP-READY do you hand off *\"Proceed to `\u002Ffinish-branch` then `\u002Fship`.\"*\n\nThen the verdict:\n\n- **SHIP-READY** — zero blockers remaining **and** every triggered check\n  accounted for **and** the final pass is green. List what was fixed (commits),\n  warnings + follow-ups, then hand off to `\u002Ffinish-branch` → `\u002Fship`.\n- **NOT READY** — one or more blockers survived the fix rounds (or a check is\n  unaccounted \u002F MANDATORY-FAIL). List each with its file:line\u002Ftest-name\n  evidence, **what was tried**, and what the user needs to decide or provide.\n  Tell the user to resolve and re-run `\u002Fqa-full`.\n\nBlocker set (any one ⇒ NOT READY — this is the authoritative list for the\nverdict; it mirrors the superskills `ENGINEERING_STANDARDS.md` hard gates, kept\nin sync by the maintainer). Each is evaluated **after** the fix rounds:\n- failing test or broken build, or test\u002Fbuild not freshly run on final HEAD (Step 2\u002F10)\n- `\u002Freview` CRITICAL correctness finding still present (Step 3)\n- `\u002Fdefense` CRITICAL\u002FHIGH security finding still present (Step 4)\n- `\u002Ffuzz` CRITICAL\u002FHIGH — crash, injection, or auth bypass — still reproducible (Step 4)\n- `\u002Fpentest` CRITICAL\u002FHIGH vulnerability still present, when it ran (Step 4)\n- `\u002Fiac-scan` CRITICAL\u002FHIGH infra misconfig still present (Step 4)\n- N+1 \u002F missing index on a hot path still present (Step 5)\n- CRITICAL\u002FHIGH browser-QA bug in a user-facing flow `\u002Fqa` could not fix (Step 7)\n- triggered `\u002Fqa` SKIPPED because its skill could not be loaded or no runnable\n  app was available after target resolution (Step 7); browser QA remains\n  unverified\n- `\u002Fa11y` CRITICAL — a control unusable by screen-reader\u002Fkeyboard — still present (Step 8)\n- new public surface with zero tests after `\u002Ftest-coverage` (Step 9)\n- a hard perf gate breach after the fix round, only if `CLAUDE.md` defines one (Step 6)\n- **a triggered check left unaccounted** — neither run nor SKIPPED with a reason\n- **a `CLAUDE.md`-MANDATORY check that was SKIPPED** rather than run\n\n## Report format\n\nWrite to `qa-full-reports\u002F\u003Cbranch>-\u003CYYYY-MM-DD>.md` (create dir; add to\n`.gitignore`). Structure:\n\n```markdown\n# QA-Full — \u003Cbranch> @ \u003CYYYY-MM-DD>\n\nBase: \u003Cbase>  Range: \u003Cbase>..HEAD  Changed files: N (+M from fixes)\nHEAD before fixes: \u003Csha>  HEAD after: \u003Csha>  Fix commits: K\n\n## VERDICT: SHIP-READY ✅ | NOT READY ⛔\n\n### Fixed (audit → fix → verify, each with its commit)\n1. \u003Ccheck> — \u003Cfile:line> — \u003Cfinding> — fixed in \u003Csha> — re-verified by \u003Cevidence>\n- (or) None needed.\n\n### Blockers remaining (must resolve before \u002Ffinish-branch)\n1. \u003Cfile:line> — \u003Cevidence> — \u003Cwhat was tried> — \u003Cwhat's needed from you>\n- (or) None.\n\n### Warnings (ship with a follow-up note)\n- …\n\n## Accounting ledger (RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED \u002F SKIPPED(reason) \u002F NOT-TRIGGERED \u002F MANDATORY-FAIL)\n| Check | Status | Evidence \u002F fixes \u002F reason |\n|-------|--------|---------------------------|\n| Tests & build (Step 2)   | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | exact command + result, fix SHAs |\n| \u002Freview (Step 3)         | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | N findings, fix SHAs, 2nd-run result, Codex passes on\u002Foff, base used, out-of-scope stash ref if any |\n| \u002Fclean-code (Step 3)     | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | KISS\u002FDRY\u002FSOLID\u002FYAGNI findings, fix SHAs, deferred-with-reason |\n| \u002Fdefense (Step 4)        | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | N findings, fix SHAs |\n| \u002Fiac-scan (Step 4)       | … \u002F NOT-TRIGGERED | infra\u002Fdeploy files changed? |\n| \u002Fpentest (Step 4)        | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | authorized? findings? |\n| \u002Ffuzz (Step 4)           | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | target URL, findings |\n| \u002Fcso (Step 4)            | … \u002F NOT-TRIGGERED | new trust boundary? threat-model evidence |\n| \u002Fdb-optimize (Step 5)    | … \u002F NOT-TRIGGERED | N+1 \u002F index fixes, migration |\n| \u002Fweb-perf (Step 6)       | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | before\u002Fafter LCP\u002FINP\u002FCLS |\n| \u002Fperf-profile (Step 6)   | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | bottleneck, before\u002Fafter |\n| \u002Fqa (Step 7)             | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | tier, health before\u002Fafter, fix SHAs |\n| \u002Fdesign-review (Step 8)  | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | screens, fix SHAs |\n| \u002Fa11y (Step 8)           | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | static + dynamic, fix SHAs |\n| \u002Ftest-coverage + \u002Fplaywright (Step 9) | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | tests added, suite result |\n| \u002Fhumanize (Step 9b)      | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | prose files in scope, flags fixed (SHAs), warnings carried |\n| \u002Feval (Step 9c)          | … \u002F SKIPPED(reason: not authorized) \u002F NOT-TRIGGERED | behavior files in scope, before\u002Fafter metrics or the ask-first outcome |\n| Final pass (Step 10)     | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | fresh test\u002Fbuild + re-audit of fix commits |\n\n> No row may be blank or \"recommend\" for a check whose trigger fired — that is an\n> unaccounted-check blocker. `CLAUDE.md`-MANDATORY checks must read RAN-CLEAN or FIXED.\n\n## Ask-first \u002F follow-up commands\n- `\u002Fcode-review ultra` — (billed; offer when a high-stakes correctness concern remains)\n- `\u002Freview` Codex passes — (OpenAI tokens; ask before enabling them for a run)\n- `\u002Fpentest` — (if it was SKIPPED for authorization and the user now wants it)\n- `\u002Ffuzz` — (if SKIPPED for lack of a target and one is now available)\n- `\u002Fperf-profile` — (if SKIPPED for lack of a representative workload)\n- `\u002Ffinish-branch` → `\u002Fship` — (only if VERDICT is SHIP-READY)\n```\n\nPrint the verdict, the fixed count, the remaining-blocker count, and a 5-line\nsummary to the chat.\n\n## Anti-patterns (do not do)\n\n- Stopping at the report. A triggered check that found something and did not\n  attempt a fix has not run `\u002Fqa-full`.\n- Running `\u002Fqa-only` or `\u002Fdesign-audit` where `\u002Fqa` \u002F `\u002Fdesign-review` are\n  specified. Report-only is for discovery inside a step, never the step's end.\n- Claiming a finding is fixed without re-running the check that found it and\n  the test suite (fresh evidence, not assertion).\n- Pushing, opening PRs, or merging — that's `\u002Ffinish-branch` \u002F `\u002Fship`.\n- Fixing outside the diff: refactoring untouched modules, bumping deps, or\n  \"while I'm here\" changes. Every commit must trace to a finding.\n- Landing a fix that itself breaks the bar — untested public surface, a\n  duplicated helper, a symptom patch over an unknown root cause.\n- Looping without bound. Two fix rounds per check, one final pass, then report\n  what's left honestly.\n- Launching a billed run (`\u002Fcode-review ultra`, `\u002Freview`'s Codex passes,\n  `\u002Fpentest`'s clearwing modes) or any scan without authorization, without\n  the user's explicit yes.\n- Declaring SHIP-READY while a check was skipped without saying which and why,\n  or while any UNFIXED blocker remains.\n- Running any sub-check against the whole repo instead of the diff.\n- Treating MEDIUM\u002FLOW findings as blockers (noise) or hiding CRITICAL\u002FHIGH in\n  the warnings list.\n\n## Related commands\n\nReuses the trigger matrix from `\u002Fdaily-qa` (see `skills\u002Fdaily-qa\u002FSKILL.md`\nStep 7 for the canonical globs). Differences: branch-scoped, present-human,\nand it **fixes and verifies** instead of recommending.\n\nAuto-run (diff-scoped; audit → fix → verify):\n- Tests & build — always; failures root-caused via `\u002Fdebug`, proven via `\u002Fverify` (Step 2).\n- `\u002Freview` — staff-level correctness review; findings fixed by the pipeline (Step 3).\n- `\u002Fbasic-review` — in-tree correctness review, run in `\u002Freview`'s place when gstack is unavailable (Step 3).\n- `\u002Fclean-code` — KISS\u002FDRY\u002FSOLID\u002FYAGNI refactors on the diff, test-verified (Step 3).\n- `\u002Fdefense` — OWASP\u002Fsecrets\u002Fauth\u002Fcrypto; findings fixed by the pipeline (Step 4).\n- `\u002Fiac-scan` — when infra\u002Fdeploy config changed; misconfigs fixed (Step 4).\n- `\u002Ffuzz` — when the diff adds endpoints\u002Finput parsing and a target is reachable (Step 4).\n- `\u002Fcso` — backstop when a new trust boundary reached the pipeline unmodeled (Step 4).\n- `\u002Fdb-optimize` — when DB\u002FORM\u002FSQL changed; N+1\u002Findex fixes applied (Step 5).\n- `\u002Fweb-perf` — when frontend changed; dev server started if needed; regressions fixed (Step 6).\n- `\u002Fperf-profile` — when hot server paths changed \u002F pre-launch; bottleneck fixed (Step 6).\n- `\u002Fqa` — when anything user-facing changed; full test → fix → re-verify loop (Step 7).\n- `\u002Fdesign-review` — when UI changed; fixes + commits visual issues (Step 8).\n- `\u002Fa11y` — static + dynamic pass when heavy UI changed; findings fixed (Step 8).\n- `\u002Ftest-coverage` + `\u002Fplaywright` — write and apply the missing tests (Step 9).\n- `\u002Ftdd`, `\u002Fdebug`, `\u002Fverify` — the discipline every fix in the pipeline follows.\n\nAsk-first (need the user's explicit yes):\n- `\u002Fcode-review ultra` — billed multi-agent cloud review.\n- `\u002Freview`'s Codex passes — OpenAI tokens; per-run yes required (Step 3).\n- `\u002Fpentest` — authorization confirmation, then it runs; in-harness by\n  default, clearwing modes are the billed ask-first option (Step 4).\n\nFollow-up (outside the pipeline):\n- `\u002Fcode-review` \u002F `\u002Fsimplify` — Claude Code built-ins overlapping Step 3; use\n  them by hand, the pipeline uses the in-tree `\u002Freview` + `\u002Fclean-code`.\n\nHand-off (only when SHIP-READY):\n- `\u002Ffinish-branch` — choose how to integrate the work.\n- `\u002Fship` — sync, bump VERSION, changelog, PR.\n","# \u002Fqa-full\n\nThe per-feature QA **pipeline**. Where `\u002Fdaily-qa` is the unattended, repo-wide,\ntime-windowed **background** sweep that only *reports*, `\u002Fqa-full` is the\n**present-human, branch-scoped, audit → fix → verify** pipeline you run the\nmoment a feature is done — before `\u002Ffinish-branch` and `\u002Fship`.\n\n```\nimplement → \u002Fqa-full → \u002Ffinish-branch → \u002Fship\n            (audit → fix → verify)\n```\n\nIt reuses `\u002Fdaily-qa`'s trigger matrix (which checks to run based on what\nchanged) with three deliberate differences:\n\n- **Scope is the branch diff** (`base..HEAD` + working tree), not a time window.\n- **It fixes, not just reports.** Every check runs in three phases — **audit**\n  (report-only discovery is fine here), **fix** (apply the smallest correct fix,\n  one atomic commit per fix — except `\u002Freview`'s bundled output, see Hard\n  rules), **verify** (re-run the same check plus the test\n  suite and prove the fix holds). The final verdict is on the *repaired* branch.\n- **Interactive checks actually run.** Because a human is present, the checks\n  `\u002Fdaily-qa` only *recommends* — `\u002Fqa`, `\u002Fweb-perf`, `\u002Fdesign-review`, the\n  dynamic `\u002Fa11y` pass — run here when their triggers fire.\n\nThis is not an audit skill. It is a full security pipeline, a full performance\npipeline, a full correctness\u002Ftest pipeline, and a full browser\u002Fdesign pipeline,\nselected per-diff and driven to green.\n\n## How sub-skills run\n\nEach `\u002Fname` in the steps below is a skill. Run it by invoking it with the\nSkill tool (for example `Skill(defense)`), then follow the instructions it\nloads. A check counts as run only when that call is in the session; doing the\ncheck's work by hand from memory is not running it. If a skill cannot be\ninvoked here, the check is SKIPPED with the reason. For a triggered `\u002Fqa` that\ncannot be loaded, inspect the installed gstack\u002Fsuperskills setup, run its\navailable setup step, and retry the Skill call. Ask the user for any setup\ndetail only they can provide. If `\u002Fqa` remains unavailable, record SKIPPED\nwith that evidence and NOT READY.\n\n## Hard rules\n\n- **The bar is the superskills quality standard** — TDD\u002FDRY\u002FSOLID\u002FYAGNI\n  (applied in every step's fix phase: test first, no duplicated logic, small\n  single-purpose units, nothing speculative) plus the hard-gate list, which is\n  spelled out in full in Step 10's Blocker set. The canonical written copy is\n  `ENGINEERING_STANDARDS.md` in the superskills install (a plugin install exposes\n  it at `${CLAUDE_PLUGIN_ROOT}\u002FENGINEERING_STANDARDS.md`); it is **not** expected\n  to exist in the project you're reviewing, so don't flag it as missing. Every\n  fix you land must meet that bar too — a fix that adds untested public surface\n  or duplicates logic is not a fix.\n- **Audit → fix → verify, per check.** For every check whose trigger fires:\n  1. **Audit** — run the sub-skill (its normal report-only output is the\n     discovery pass).\n  2. **Fix** — for each CRITICAL\u002FHIGH finding (and MEDIUM where the fix is\n     small and safe), root-cause it (`\u002Fdebug` discipline: no symptom patches),\n     write the failing test first when it's a logic bug (`\u002Ftdd`), apply the\n     smallest correct fix, and commit it atomically with a message naming the\n     check and finding.\n  3. **Verify** — re-run the *same* sub-skill on the diff and re-run the test\n     suite. A fix is only \"fixed\" when the re-audit no longer reports it and\n     tests are green. Never claim a fix without this fresh evidence (`\u002Fverify`\n     discipline).\n  A finding you could not fix (needs a product decision, external service,\n  credentials, or an architectural change beyond the diff) is an **UNFIXED\n  blocker**: record what you tried and why it's out of reach. Do not quietly\n  downgrade it to a warning.\n- **Fix only what the diff and the findings justify.** Do not refactor\n  untouched code, upgrade dependencies, or \"improve\" unrelated modules while\n  you're in there. Scope stays on the branch diff plus the exact lines a finding\n  points at.\n- **Commit, but never push or open a PR.** Each fix lands as its own commit on\n  the current branch so the user can review\u002Frevert individually. Exception:\n  `\u002Freview` exposes no per-finding boundary, so its output lands as one commit\n  per invocation (Step 3). Integration and shipping belong to `\u002Ffinish-branch`\n  and `\u002Fship`.\n- **Ground every finding and every fix in concrete evidence**: file:line,\n  failing test name, log snippet, severity as the underlying tool produced it,\n  and the commit SHA of the fix. No speculation.\n- **Separate blockers from warnings.** Only test\u002Fbuild failures and\n  CRITICAL\u002FHIGH findings block. Everything else is a warning — fix it when the\n  fix is cheap and safe, otherwise ship it with a follow-up note.\n- **Bounded loops.** At most **two** fix rounds per check, then one final\n  verification pass (Step 10). If something is still red after that, it's an\n  UNFIXED blocker with the attempts documented — not a third round.\n- **Never claim SHIP-READY without receipts.** The verdict must cite the exact\n  checks that ran, what they found, what was fixed (with commits), what was\n  re-verified, and what was skipped (and why).\n- **An unknown dev URL is a question, not a reason to refuse browser QA.**\n  When `\u002Fqa` is triggered, invoke it even if no URL is known. Follow the\n  target-resolution flow below, including local setup or a question to the\n  user, and resume the same run when the target is available. A triggered\n  `\u002Fqa` check that cannot run is NOT READY, never SHIP-READY.\n- **No silent skips — mandatory accounting.** Every check must resolve to\n  exactly one of: **RAN-CLEAN** (ran, nothing to fix), **FIXED(n)** (ran, n\n  findings fixed and re-verified — list commits), **UNFIXED** (ran, at least one\n  blocker could not be fixed — reason), **SKIPPED** (stated reason — e.g. \"no\n  reachable dev server and none could be started\", \"scanner not authorized in\n  this env\"), **NOT-TRIGGERED** (its diff trigger didn't fire), or\n  **MANDATORY-FAIL** (a `CLAUDE.md`-mandatory check that was skipped). A check whose\n  trigger fired but that neither ran nor was explicitly skipped-with-reason is an\n  **unaccounted check ⇒ NOT READY**. \"Recommend-only\" is not an allowed resting\n  state for a *triggered* check. A RAN-CLEAN, FIXED or UNFIXED row stands on\n  the Skill call that ran it; a row with no such call is unaccounted too. The\n  superskills ledger hook (`hooks\u002Fhooks.json` for plugin installs,\n  `scripts\u002Finstall-qa-full-ledger-hook.sh` otherwise) checks this when the\n  session stops and sends you back to invoke any check it can't find. Projects may mark specific checks **MANDATORY**\n  in `CLAUDE.md` (e.g. `\u002Fpentest` on a payments service), and for those, SKIPPED\n  is itself a blocker.\n- **Money and authorization still need a human yes.** `\u002Fcode-review ultra` is a\n  billed cloud run, and `\u002Freview`'s Codex passes spend OpenAI tokens — ask\n  before launching either, never assume. `\u002Fpentest`'s in-harness default costs\n  nothing beyond this session, but the skill still requires the user to\n  confirm authorization before it scans — ask, then run. Its clearwing modes\n  bill a separate LLM provider and stay ask-first. \"Ask, then run\" is still\n  running; it is not report-only.\n\n## Project configuration (`CLAUDE.md`)\n\nThis pipeline reads the project's root `CLAUDE.md` for a few optional settings.\nThey are plain prose (CLAUDE.md is agent instructions, not a config file) — look\nfor a `## qa-full` section and honor whatever it states. Example:\n\n```markdown\n## qa-full\n\n- Mandatory checks (must RUN with evidence — a skip is a blocker): `\u002Fpentest`, `\u002Fdefense`\n- Hard perf gate: LCP ≤ 2.5s and INP ≤ 200ms on `\u002F` and `\u002Fcheckout` (breach blocks)\n- Design: skip `\u002Fdesign-review` (design is owned by the design team, do not auto-fix visuals)\n- Dev URL: http:\u002F\u002Flocalhost:3000   (for `\u002Fweb-perf`, `\u002Fqa`, `\u002Fa11y`, `\u002Ffuzz`)\n- Test\u002Fbuild: `pnpm test` and `pnpm build`\n- QA tier: exhaustive\n```\n\nRecognized settings (all optional; absence = the defaults in the steps below):\n- **Mandatory checks** — listed commands must read RAN-CLEAN or FIXED in the\n  ledger; SKIPPED is a blocker (any step; Step 10 enforces it). MANDATORY\n  overrides the check's own diff trigger: run it on the diff even when the\n  trigger didn't fire, so NOT-TRIGGERED is not an acceptable state either. Use\n  for compliance-critical surfaces (payments, auth, PII).\n- **Hard perf gate** — turns a `\u002Fweb-perf` budget breach that survives the fix\n  round from a warning into a blocker (Step 6).\n- **Design: skip `\u002Fdesign-review`** — opt *out* of the visual-fix pass (Step 8)\n  entirely; by default it runs on any UI change. This skips the check (ledger:\n  SKIPPED(\"project opt-out\")) — it does not turn it into a report-only run.\n- **Test\u002Fbuild commands** — feed Steps 2 and 10. **Dev URL** — feeds Steps 4\n  (`\u002Ffuzz`), 6, 7 and 8. **QA tier** — feeds Step 7; defaults to `standard`.\n\nIf there is no `## qa-full` section, run with the built-in defaults — nothing here\nis required.\n\n## Resolve a dev target for browser checks\n\nUse this flow when a triggered `\u002Ffuzz`, `\u002Fweb-perf`, `\u002Fqa`, `\u002Fdesign-review`, or\ndynamic `\u002Fa11y` check needs a running app. Resolve the target once and reuse it;\nkeep any server you start alive through the final browser check.\n\n1. Read the project's `CLAUDE.md` `Dev URL`, `AGENTS.md`, `README.md`, and\n   development\u002Fsetup docs. Check the project's declared `dev`\u002F`start` script or\n   equivalent and probe documented local ports. A responding localhost port is\n   usable only after you verify it serves this project, not another app.\n2. If the app is not running, follow the project's setup instructions. Install\n   its declared dependencies when needed, start its documented dev command,\n   and wait for a reachable URL. Record the command, URL, and startup result in\n   the ledger. Do not invent a port, command, credential, or external service.\n3. If the URL or startup command is still unknown, or startup needs user-owned\n   configuration, **ask the user** for the dev\u002Fpreview URL or the missing setup\n   detail. Tell them what you already checked. Let the user configure secrets\n   locally; never request credentials in chat. Pause the affected check and\n   resume it after their answer. An unanswered question is pending context,\n   not a SKIPPED check or a final refusal.\n4. If a documented start fails, inspect its error and attempt a bounded fix to\n   the local setup. If it still cannot run, ask for the missing information or\n   user action. Only record SKIPPED after documenting discovery and startup\n   attempts and the user confirms there is no runnable target or declines the\n   needed setup. For a triggered `\u002Fqa`, that SKIPPED result is a NOT READY\n   blocker: the feature has not been browser-tested.\n\n`\u002Fqa` has its own diff-aware target discovery and browser setup. Invoke it\nwithout a URL when this flow has not resolved one; follow its question or\nsetup path rather than replacing browser testing with unit tests or `curl`.\n\n## Step 1: Establish the diff scope and a clean tree\n\n1. Detect the base branch: `gh repo view --json defaultBranchRef -q .defaultBranchRef.name`,\n   else `git symbolic-ref refs\u002Fremotes\u002Forigin\u002FHEAD`, else fall back to `main`\u002F`master`.\n2. If `$ARGUMENTS` names a base branch or `--scope \u003Cpaths>`, use it.\n3. Resolve the **diff ref**: `git fetch origin \u003Cbase>` and use `origin\u002F\u003Cbase>`\n   when that ref exists, else local `\u003Cbase>`. This is what `\u002Freview` and `\u002Fqa`\n   diff against too, and it stays correct after Step 1.5 creates a working\n   branch (local `\u003Cbase>` would then equal HEAD and the set would be empty).\n   Compute the changed-file set: `git diff --name-only \u003Cdiff-ref>...HEAD -- \u003Cscope paths>`\n   (drop the `--` part when no `--scope` was given) plus\n   uncommitted changes (`git status --porcelain`). This set drives every\n   trigger below. **Fix commits made by this pipeline extend the set** — later\n   steps and the final pass (Step 10) audit the fixes too.\n4. **Clean-tree precondition.** The fixers (`\u002Fqa`, `\u002Fdesign-review`) need each\n   fix to be its own atomic commit, so they stop on a dirty tree. Handle it\n   once, here: if `git status --porcelain` is non-empty, ask the user (via\n   AskUserQuestion) whether to **commit the in-progress work now** (recommended\n   — a descriptive commit so the feature is preserved before fixes land) or\n   **stash it**. Do not proceed with a dirty tree.\n5. **Never run on the base branch itself.** The sub-skills' diff-aware modes\n   (`\u002Freview`, `\u002Fqa`, `\u002Fdesign-review`) key off \"current branch ≠ base\" and\n   diff against `merge-base(origin\u002F\u003Cbase>, HEAD)`. If `git branch\n   --show-current` equals the base and there are unpushed commits, create a\n   working branch at HEAD first — `git switch -c qa-full\u002F\u003Cbase>-\u003CYYYY-MM-DD>`\n   (reuse it if a same-day branch already exists from an aborted run) — and\n   run the whole pipeline there. Step 10 folds it back: fast-forward the\n   base to the working branch (`git switch \u003Cbase> && git merge --ff-only\n   qa-full\u002F...`) and delete the working branch. No history is rewritten; the\n   base just gains the fix commits. If there are no unpushed commits either,\n   there is nothing to QA.\n6. Record at the top of the report: base branch, diff ref, working branch (if\n   created), commit range, changed-file count, and the HEAD SHA before any fixes.\n\nIf there is no diff against base, stop and say so — there is nothing to QA.\n\n## Step 2: Tests & build (always — audit → fix → verify)\n\n1. Find the project's test\u002Fbuild commands from `CLAUDE.md`; if absent, infer\n   from `package.json` scripts, `Makefile`, `pyproject.toml`, etc. If you\n   cannot determine them, **ask** rather than guess.\n2. **Audit:** run the test suite and the build. Capture exact failures (test\n   name + verbatim error in a code block).\n3. **Fix:** for each failing test or build error, follow `\u002Fdebug` — reproduce,\n   root-cause, then fix the cause (not the assertion). Commit each fix.\n4. **Verify:** re-run the full suite and build. Green ⇒ FIXED(n). Still red\n   after two rounds ⇒ UNFIXED blocker with the failing test and what was tried.\n\nIf this step ends UNFIXED after two rounds, **stop here** and report NOT READY\nwith the failing test. Every later step's verify phase depends on a green\nsuite — running fixers on a red suite is fix → hope, not fix → verify. Mark\nevery downstream ledger row `SKIPPED(\"pipeline halted at Step 2\")`. A working\nbranch from Step 1.5 stays as-is (base untouched) so the fix commits are there\nfor the user.\n\n## Step 3: Correctness + quality — `\u002Freview` then `\u002Fclean-code` (always)\n\nTwo halves. Both sub-skills are in-tree, so they are invocable from inside any\nsession or tool, and Step 1.5 guarantees you are on a non-base branch, which\n`\u002Freview`'s own branch guard requires.\n\n**Correctness — `\u002Freview`.** `\u002Freview` is not a report-only audit: one\ninvocation reads the diff, auto-applies its mechanical (AUTO-FIX) findings to\nthe working tree, asks you about the rest (ASK items) via its own\nAskUserQuestion, and never commits. Treat one call as one atomic\naudit + fix + ask unit:\n1. **Run `\u002Freview`** against the base this pipeline resolved in Step 1. It has\n   no argument channel, so it always diffs `merge-base(origin\u002F\u003Cbase>, HEAD)` —\n   if Step 1 resolved a non-default base or a `--scope`, say so in the ledger\n   evidence: `\u002Freview` reviewed the full default-base diff.\n2. **Commit what it changed** as one commit attributed to `\u002Freview` (e.g.\n   `review: apply AUTO-FIX + approved ASK findings`), so the tree is clean\n   before `\u002Fclean-code` and nothing `\u002Freview` fixed can be lost by a later\n   revert. If `--scope` was given, stage and commit only files under scope;\n   any out-of-scope edits `\u002Freview` made stay uncommitted (stash them so the\n   tree is clean, noting the stash ref) and are flagged in the ledger with that\n   ref for the user — never silently committed. For any CRITICAL it reported but could not fix, root-cause\n   (`\u002Fdebug`), write the failing test first (`\u002Ftdd`), fix, commit atomically.\n3. **Verify:** run `\u002Freview` once more. It re-scans the full base diff\n   including the fix commits — that's the point. A CRITICAL still present ⇒\n   UNFIXED blocker. Commit anything this second pass auto-fixed the same way.\n   Do not run it a third time in this step.\n\n`\u002Freview`'s adversarial section runs a free Claude subagent **and**, when the\nCodex CLI is installed and enabled, `codex exec` \u002F `codex review` passes that\nspend OpenAI tokens. Those Codex passes are **ask-first** under the money rule.\nYou are the one executing `\u002Freview`'s instructions, so no config change is\nneeded: when its Codex preflight says Codex would run — `CODEX_MODE: ready`\nin current gstack, `CODEX_AVAILABLE` with `OLD_CFG` not `disabled` in older\nversions — ask the user once whether to spend on Codex for this run; if\ndeclined, do not run the `codex exec` \u002F `codex review` commands and proceed\nexactly as the section's disabled\u002Funavailable branch describes (Claude\nadversarial subagent still runs). Record\nthe Codex state and the user's answer in the ledger. Never flip the global\n`codex_reviews` config on the user's behalf.\n\n`CODEX_MODE: not_authed` can be a false negative: gstack's preflight only\nrecognises a Codex login, so a Codex CLI configured for a custom provider\n(e.g. `model_provider = \"azure\"` with an API key in the environment) reads as\nunauthenticated while working fine. When the preflight says `not_authed` but\n`${CODEX_HOME:-$HOME\u002F.codex}\u002Fconfig.toml` sets a `model_provider`:\n\n1. **Ask first** — fold it into the one Codex question above: the probe is\n   itself a billed call on the user's provider. Declined ⇒ skip the probe and\n   the passes.\n2. **Probe the model the passes will use**, bounded, so a working default\n   model cannot hide an unusable review model and a stalled endpoint cannot\n   hang the pipeline:\n\n   ```bash\n   source ~\u002F.claude\u002Fskills\u002Fgstack\u002Fbin\u002Fgstack-codex-probe 2>\u002Fdev\u002Fnull\n   if ! command -v _gstack_codex_timeout_wrapper >\u002Fdev\u002Fnull 2>&1 \\\n      || ! command -v _gstack_codex_select_model >\u002Fdev\u002Fnull 2>&1; then\n     echo \"CODEX_PROBE: broken_install (gstack-codex-probe helper not found)\"\n   elif _gstack_codex_select_model exec; then\n     # gstack's own resolver: GSTACK_CODEX_MODEL, then the model in config.toml,\n     # then gstack's default, so the probe tests the model the passes will use.\n     echo \"CODEX_MODEL: $_GSTACK_CODEX_SEL ($_GSTACK_CODEX_SEL_SRC)\"\n     _gstack_codex_timeout_wrapper 120 codex exec -s read-only \\\n       -c \"model=\\\"$_GSTACK_CODEX_SEL\\\"\" \"Reply with exactly: PONG\" \u003C \u002Fdev\u002Fnull\n   fi\n   ```\n\n3. Answers `PONG` ⇒ treat Codex as `ready` and run the passes with that\n   provider and model. `CODEX_PROBE: broken_install`, or exit code 126\u002F127 ⇒\n   treat it as `broken_install` (gstack's branch: reinstall advice, no model\n   advice). Any other error, timeout or text ⇒ `model_unusable`: skip the\n   passes, tell the user to set `GSTACK_CODEX_MODEL` (or `model` in config.toml)\n   to a deployment their provider serves. A `CODEX_MODEL: invalid` line from the\n   resolver means the same: no call was made.\n\nRecord the probe command, model and result in the ledger either way.\n\n**If `\u002Freview` is unavailable** (gstack is not installed, the Skill tool cannot\nload `review`, or its preamble fails), do not skip the correctness step. Run the\nin-tree fallback, `\u002Fbasic-review \u003Cdiff-ref>...HEAD`, instead:\n1. **Audit:** invoke `\u002Fbasic-review` with the diff ref Step 1 resolved. It is\n   read-only and reports findings as `file:line` with severity.\n2. **Fix:** for each CRITICAL\u002FHIGH (and cheap MEDIUM) finding, root-cause it\n   (`\u002Fdebug`), write the failing test first (`\u002Ftdd`), apply the smallest fix,\n   and commit it atomically, naming `basic-review` and the finding.\n3. **Verify:** run `\u002Fbasic-review` once more on the same range; a CRITICAL\n   still reported is an UNFIXED blocker.\n\nName both in the ledger row's first cell, `\u002Freview (fallback: \u002Fbasic-review)`,\nand put the reason `\u002Freview` was unavailable in its evidence. The row's status\nis the fallback's result (RAN-CLEAN, FIXED(n) or UNFIXED), never SKIPPED: the\ncorrectness check ran.\n\n**Quality — `\u002Fclean-code`.** After correctness is green and committed, run\n`\u002Fclean-code \u003Cdiff-ref> [--scope \u003Cpaths>]` with the diff ref and scope this\npipeline resolved. It audits KISS \u002F DRY \u002F SOLID \u002F YAGNI against `ENGINEERING_STANDARDS.md`,\napplies the smallest safe refactor per finding under a green suite\n(characterization test first where none exists), commits each atomically,\nre-audits, and reverts a failed refactor with `git checkout` on only the files\nit touched. Its findings left UNFIXED are warnings here, not blockers — quality\ndebt ships with a note; bugs don't.\n\n`\u002Fcode-review ultra` (deep multi-agent cloud review) is **billed** — when a\n`\u002Freview` finding is high-stakes (payments, auth, data loss, concurrency), ask\nthe user whether to launch it. Do not launch it unasked. Claude Code's\nbuilt-in `\u002Fcode-review` and `\u002Fsimplify` are not part of this step: `\u002Freview`\nalready covers correctness here, and an optional extra pass would have no\nledger row.\n\n## Step 4: Security pipeline — `\u002Fdefense`, `\u002Fiac-scan`, `\u002Fpentest`, `\u002Ffuzz`\n\n**`\u002Fdefense` (always).**\n1. **Audit:** run `\u002Fdefense` scoped to the changed files (OWASP Top 10 \u002F\n   secrets \u002F auth \u002F crypto \u002F data-protection).\n2. **Fix:** remediate every CRITICAL\u002FHIGH (and cheap MEDIUMs): remove or\n   rotate-and-externalize hardcoded secrets, add the missing authz check,\n   parameterize the query, escape the output, switch the weak primitive, add\n   the validation. Each fix gets a regression test where a test can express it\n   (e.g. \"unauthenticated request to X returns 401\"). Commit atomically.\n3. **Verify:** re-run `\u002Fdefense` on the same files; the finding must be gone.\n\n**`\u002Fiac-scan` (when infra\u002Fdeploy config changed).** Trigger on `Dockerfile`,\n`docker-compose*`, `*.tf`\u002F`*.tfvars`, k8s\u002FHelm manifests, `.github\u002Fworkflows\u002F**`,\n`.gitlab-ci.yml`, `Jenkinsfile`, nginx\u002Fcloud config (see `\u002Fiac-scan`'s trigger\nsection for the authoritative list). Audit with the local static linters, **fix**\nCRITICAL\u002FHIGH misconfigs (root container → non-root user, `0.0.0.0\u002F0` ingress →\nscoped CIDR, wildcard IAM → least privilege, privileged pod → dropped, untrusted\nCI trigger → pinned\u002Fguarded, baked-in secret → injected), re-scan to verify.\n\n**`\u002Fpentest` (triggered when `\u002Fdefense` found CRITICAL\u002FHIGH, or the diff touches\nauth\u002Fcrypto\u002Fsession\u002Ftoken\u002Fdeserialization\u002Ffile-upload paths).** Its default mode\nhunts in this harness — the session's own model reads the code and reports\nfindings with evidence levels; no external scanner, no spend beyond the\nsession. **Confirm authorization with the user first** (the skill's own\nquestions), then run it; the in-harness hunt is the check, not a stand-in.\nFix CRITICAL\u002FHIGH it surfaces, re-run to verify. clearwing appears only\nbehind its ask-first gate: the user names it, asks for a network probe, or\nwants SARIF\u002FCI output — and its pipeline can run agent-driven on this session\nvia the bundled bridge (no provider, no spend) instead of provider-driven.\nProvider-driven runs configure their own LLM provider and bill it per run —\ndeclining clearwing means run the in-harness mode, not skip the check.\nIf the user declines the check itself (no authorization) ⇒ SKIPPED(reason). If\n`CLAUDE.md` marks `\u002Fpentest` MANDATORY, SKIPPED is a blocker.\n\n**`\u002Ffuzz` (triggered when the diff adds or changes endpoints, input parsing,\nfile-upload handling, or deserialization).** Needs a running target: find the dev\nURL with the target-resolution flow, then run `\u002Ffuzz` against the new surface;\n**fix** crashes, injections, and auth bypasses it surfaces (with a regression\ntest); re-fuzz to verify. If no target is possible after that flow ⇒\nSKIPPED(reason). If `CLAUDE.md` marks `\u002Ffuzz` MANDATORY, SKIPPED is a blocker.\n\n**`\u002Fcso` backstop.** If the diff crosses a *new* trust boundary (new auth\npath\u002Fendpoint\u002Fexternal input\u002Fdeserialization) and there's no evidence a threat\nmodel was done at plan time, run `\u002Fcso` on that boundary and fold any\nCRITICAL\u002FHIGH into the `\u002Fdefense` fix round. Threat modeling belongs in\n`\u002Fwrite-plan`; this is the late catch, not a substitute.\n\n## Step 5: Database pipeline — `\u002Fdb-optimize` (auto-run if triggered)\n\nTrigger when changed files match ORM models, migrations, query builders\n(`**\u002Fmodels\u002F**`, `**\u002Fmigrations\u002F**`, `**\u002Fqueries\u002F**`, `**\u002F*repository*`,\n`**\u002F*.sql`), raw SQL in the diff, or new ORM calls (`.find`, `.where`,\n`.includes`, `.join`, `.preload`).\n\n1. **Audit:** run `\u002Fdb-optimize` scoped to matched files (run `\u002Fdbmap` first if\n   it asks for a schema map).\n2. **Fix:** N+1s on hot paths → eager-load\u002Fbatch (`includes`\u002F`preload`\u002F\n   `select_related`\u002Fdataloader); missing indexes on hot paths → add a migration\n   for the index; obviously-redundant queries → dedupe. Add a test that asserts\n   the query count where the ORM supports it. Commit atomically.\n3. **Verify:** re-run `\u002Fdb-optimize`; the hot-path findings must be gone and\n   the migration must apply cleanly in the test run.\n\nNon-hot-path suggestions are warnings (fix if trivial). No trigger ⇒\nNOT-TRIGGERED.\n\n## Step 6: Frontend perf pipeline — `\u002Fweb-perf` (+ `\u002Fperf-profile`)\n\nTrigger when the diff includes frontend code (`**\u002F*.tsx`, `**\u002F*.jsx`,\n`**\u002F*.vue`, `**\u002F*.svelte`, `**\u002Fcomponents\u002F**`, `**\u002Fpages\u002F**`, `**\u002Fstyles\u002F**`,\n`**\u002F*.css`, `**\u002F*.scss`), new images\u002Ffonts\u002Fassets, or bundler config\n(`next.config.*`, `vite.config.*`, `webpack.config.*`).\n\n1. Resolve the dev URL with the target-resolution flow above; start the dev\n   server if needed. If the flow establishes that no target is possible ⇒\n   SKIPPED with the startup error and the user's answer in the ledger.\n2. **Audit:** run `\u002Fweb-perf` against the affected routes. Record Core Web\n   Vitals (LCP, INP, CLS) vs. any known budget.\n3. **Fix:** address the measured regressions attributable to the diff —\n   render-blocking imports → defer\u002Flazy, oversized image\u002Ffont → optimize or\n   preload, layout shift → reserve dimensions, long task → split\u002Fmemoize.\n   Commit atomically.\n4. **Verify:** re-run `\u002Fweb-perf` on the same routes; report before\u002Fafter\n   numbers.\n\n- A budget breach that survives the fix round is a **warning** by default,\n  unless `CLAUDE.md` defines a hard perf gate — then it blocks.\n- **`\u002Fperf-profile`** (triggered when the diff touches hot server-side paths, the\n  change is pre-launch, or `\u002Fdb-optimize`\u002F`\u002Fweb-perf` point at a server-side\n  bottleneck): run it against the affected endpoint\u002Fjob, **fix** the localized\n  bottleneck (cache, batch, move off the request path), re-profile to verify.\n  Needs a representative workload — if none is available ⇒ SKIPPED(reason).\n\n## Step 7: Browser QA pipeline — `\u002Fqa` (auto-run if triggered)\n\n> Run **`\u002Fqa`** — the full test → fix → re-verify loop — not `\u002Fqa-only`. This is\n> the check that replaces manual click-through QA, and a human is present.\n\nTrigger when the diff includes anything a human would manually QA in a browser:\nUI\u002Ffrontend code, pages\u002Froutes, forms, route handlers serving HTML, API\nendpoints the UI consumes, auth\u002Fsession flows, or config that changes\nuser-facing behavior.\n\n1. **Invoke `\u002Fqa` whenever this trigger fires, even if no dev URL is known.**\n   Give it the resolved URL if Step 4 or 6 found one; otherwise invoke it\n   without a URL so its diff-aware mode can discover the app or ask. Scope it\n   to the affected surface at the project's **QA tier** (`CLAUDE.md`, default\n   `standard`: critical + high + medium). If it needs a server, follow the\n   target-resolution flow above and resume `\u002Fqa` after setup or the user's\n   answer. A missing URL alone never justifies SKIPPED, stopping the pipeline,\n   or declaring browser QA complete. Let `\u002Fqa` finish its audit → fix →\n   re-verify loop with atomic commits and before\u002Fafter health scores.\n2. Fold its before\u002Fafter health score, fixed-bug list (with commits), and any\n   bugs it could not fix into the ledger.\n\n- User-facing CRITICAL\u002FHIGH bugs that `\u002Fqa` could not fix ⇒ UNFIXED blocker.\n- If the target-resolution flow ends without a runnable app, record\n  SKIPPED(reason) and a NOT READY blocker. Say what setup was attempted and\n  what the user needs to provide before browser QA can run.\n\n## Step 8: Design + accessibility pipeline — `\u002Fdesign-review`, `\u002Fa11y`\n\n**`\u002Fdesign-review` (when the diff includes UI changes, unless `CLAUDE.md` opts\nout).** Run `\u002Fdesign-review` against the changed screens — it audits visual\nconsistency, hierarchy, spacing, AI-slop tells and slow interactions, then\n**fixes them with atomic commits and before\u002Fafter screenshots**. Let it complete.\nVisual findings it can't fix are warnings, not blockers. If the project opted\nout in `CLAUDE.md`, record SKIPPED(\"project opt-out\") and move on.\n\n**`\u002Fa11y` (when the UI change is heavy and likely to affect assistive tech —\nnew\u002Fchanged interactive components, forms, ARIA\u002F`role`\u002F`tabindex`,\nfocus\u002Fkeyboard handling, images, color\u002Fcontrast, motion; see `\u002Fa11y`'s trigger\nsection).**\n1. **Audit:** run the static pass on the diff, and the **dynamic axe pass** when\n   the dev URL is reachable (it is, if Step 6\u002F7 ran).\n2. **Fix:** every CRITICAL\u002FSERIOUS — native element over ARIA-on-a-div, missing\n   label\u002Fname, unreachable-by-keyboard control, focus trap, contrast below\n   ratio, missing reduced-motion guard. Commit atomically.\n3. **Verify:** re-run the same pass; CRITICAL that survive ⇒ UNFIXED blocker.\n\nScope split: `\u002Fdesign-review` owns *visual* quality; `\u002Fa11y` owns WCAG \u002F\nassistive-tech correctness. They overlap on contrast — `\u002Fa11y`'s measured\ncontrast finding is authoritative.\n\n## Step 9: Coverage pipeline — `\u002Ftest-coverage` + `\u002Fplaywright`\n\n1. **Audit:** for each changed file (including this pipeline's fix commits),\n   locate its test (sibling `*.test.*`, parallel `tests\u002F`). Use coverage data if\n   present (`coverage\u002F`, `lcov.info`, `.coverage`); else do a structural check\n   for new exported functions \u002F branches \u002F error paths without an assertion.\n2. **Fix:** run `\u002Ftest-coverage` on the diff — it writes and applies the missing\n   unit tests (and integration tests where risk crosses a boundary), enforcing\n   Google's Testing-on-the-Toilet practices. For **user-facing flows** with no\n   e2e coverage, run `\u002Fplaywright` to generate and run the e2e test so a\n   regression test is left behind. Commit atomically.\n3. **Verify:** run the full suite; the new tests must pass, and the structural\n   check must show no new **public** surface with zero tests.\n\nNew public surface still untested after this step ⇒ UNFIXED blocker. Internal\nhelpers without tests are warnings.\n\n## Step 9b: Prose quality pipeline — `\u002Fhumanize` (auto-run if triggered)\n\n**Trigger:** the diff adds or modifies user-facing copy: documentation, help\nprose, marketing pages, locale strings, or visible UI text, in any file type\n`python3 skills\u002Fhumanize\u002Ftoolkit\u002Fuserfacing.py classify \u003Cpath>` does not call\n`none`. NOT-TRIGGERED when no user-facing copy changed.\nInternal prompts, agent instructions, plans, and code comments are out of scope.\nRun the Markdown normalizer only on `markdown`\u002F`text` files; other types get the\nscan on the extraction and surgical in-place edits (see `\u002Fhumanize`).\n\n**Scope rules:**\n\n- Exclude prose the project does not own (vendored, mirrored, or generated\n  trees) and historical records (`CHANGELOG.md` and the like): that wording is\n  deliberate or upstream's, and rewriting it falsifies provenance.\n- **Warnings tier.** A prose-slop flag is style, not correctness: it never\n  enters the blocker set below. A flag that survives the fix rounds ships as a\n  warning with a follow-up note.\n\n1. **Audit:** run `\u002Fhumanize`'s deterministic scan (its toolkit's\n   `slop_report.py`) over each in-scope changed prose file and read the report.\n2. **Fix:** invoke `\u002Fhumanize` and apply it surgically to flagged spans only —\n   its own contract (deterministic fixes, subtractive edits, re-scan as the\n   gate; never a whole-document rewrite) is the fix policy here too. Commit\n   atomically like any other fix.\n3. **Verify:** re-scan the edited files and re-run the test suite. Repos often\n   pin exact doc strings in tests; a humanize edit that touched pinned prose\n   must break here, loudly, not silently ship.\n\nThe ledger row resolves to RAN-CLEAN (no flags worth fixing), FIXED(n)\n(flags fixed and re-scanned), SKIPPED(reason), or NOT-TRIGGERED. Remaining\nflags are warnings, never UNFIXED blockers.\n\n## Step 9c: AI-behavior pipeline — `\u002Feval` (ask-first if triggered)\n\n**Trigger:** the diff changes AI behavior. Judge it the way human eyes would:\ndoes the change alter what a model sees, how it is instructed, or how its\noutput is judged or used? A prompt template edited inside source code counts,\nnot just prompt files. The obvious file signals are prompts, agent or skill\ninstructions (`**\u002FSKILL.md`, `.claude\u002Fcommands\u002F**`, `AGENTS.md` \u002F\n`CLAUDE.md` instruction files), and LLM\u002FRAG pipeline code or configuration\n(retrieval parameters, judge rubrics, agent-loop logic). Pure formatting\nchanges to the same files do not count. NOT-TRIGGERED means \"no plausible\nbehavior change,\" never \"no matching filename.\"\n\nAn eval run spends model calls (case runs plus judge votes), so it follows the\nmoney rule: ask the user first, name what it will cost, and run only on an\nexplicit yes. A decline is SKIPPED(reason: not authorized) — a legal skip with\nreason, not a blocker.\n\n1. **Audit:** invoke `\u002Feval`; it builds or reuses the project's synthetic eval\n   set for the changed behavior and reports the behavior's before\u002Fafter\n   system metrics (pass rate per dimension), with the judge's calibration\n   (TPR, TNR, accuracy, precision, plus the bias reading) attached so the\n   numbers are trusted before they are read.\n2. **Fix:** wording first, structure second — the method's fix ladder.\n3. **Verify:** re-run the eval. The changed behavior must be no worse than the\n   baseline on every reported metric, and better on the dimension the change\n   targeted. \"No degradation\" is the floor, not the goal.\n\nA metric regression is a warning unless the project marks evals MANDATORY in\n`CLAUDE.md`; a MANDATORY eval that was declined or never ran is MANDATORY-FAIL.\n\n## Step 10: Final verification pass, ledger, verdict\n\nThe fix rounds changed the branch, so verify the *whole* result once more:\n\n1. **Fresh tests + build** on the final HEAD (Step 2 commands). Stale results\n   ⇒ NOT READY.\n2. **Re-audit the fix commits:** run `\u002Fdefense` scoped to the files the fix\n   commits touched, and read the fix commits themselves\n   (`git show original-HEAD..HEAD`) against `\u002Freview`'s checklist — `\u002Freview`\n   takes no commit range, and Step 3 already re-ran it twice. When `\u002Freview`\n   was unavailable, run `\u002Fbasic-review original-HEAD..HEAD` for this re-audit. The fixes must not\n   introduce a CRITICAL\u002FHIGH. If they did, one more fix + re-verify, then stop.\n3. **Diff sanity:** `git log --oneline \u003Cbase>..HEAD` — every pipeline commit\n   should name its check\u002Ffinding; nothing outside the diff scope was touched.\n4. **Fold back the working branch** if Step 1.5 created one: `git switch\n   \u003Cbase> && git merge --ff-only qa-full\u002F\u003C...> && git branch -d qa-full\u002F\u003C...>`.\n   If the fast-forward fails, the base moved underneath you — stop and report;\n   never force.\n\nThen build the **accounting ledger** — a row per check, each resolved to\nRAN-CLEAN \u002F FIXED(n) \u002F UNFIXED \u002F SKIPPED(reason) \u002F NOT-TRIGGERED \u002F\nMANDATORY-FAIL. **The verdict cannot be SHIP-READY while any triggered check is\nunaccounted or UNFIXED.**\n\n**Phase-5 accounting (honest scope):** `\u002Fqa-full` *is* the entry to Phase 5, so it\ncan only enforce the **pre-ship** half. It **cannot** verify `\u002Ffinish-branch`,\n`\u002Fship`, or `\u002Fland-and-deploy` — those run *after* this pipeline, so do not claim\nthey're done. A passing verdict is the **hard precondition** for ship: only on\nSHIP-READY do you hand off *\"Proceed to `\u002Ffinish-branch` then `\u002Fship`.\"*\n\nThen the verdict:\n\n- **SHIP-READY** — zero blockers remaining **and** every triggered check\n  accounted for **and** the final pass is green. List what was fixed (commits),\n  warnings + follow-ups, then hand off to `\u002Ffinish-branch` → `\u002Fship`.\n- **NOT READY** — one or more blockers survived the fix rounds (or a check is\n  unaccounted \u002F MANDATORY-FAIL). List each with its file:line\u002Ftest-name\n  evidence, **what was tried**, and what the user needs to decide or provide.\n  Tell the user to resolve and re-run `\u002Fqa-full`.\n\nBlocker set (any one ⇒ NOT READY — this is the authoritative list for the\nverdict; it mirrors the superskills `ENGINEERING_STANDARDS.md` hard gates, kept\nin sync by the maintainer). Each is evaluated **after** the fix rounds:\n- failing test or broken build, or test\u002Fbuild not freshly run on final HEAD (Step 2\u002F10)\n- `\u002Freview` CRITICAL correctness finding still present (Step 3)\n- `\u002Fdefense` CRITICAL\u002FHIGH security finding still present (Step 4)\n- `\u002Ffuzz` CRITICAL\u002FHIGH — crash, injection, or auth bypass — still reproducible (Step 4)\n- `\u002Fpentest` CRITICAL\u002FHIGH vulnerability still present, when it ran (Step 4)\n- `\u002Fiac-scan` CRITICAL\u002FHIGH infra misconfig still present (Step 4)\n- N+1 \u002F missing index on a hot path still present (Step 5)\n- CRITICAL\u002FHIGH browser-QA bug in a user-facing flow `\u002Fqa` could not fix (Step 7)\n- triggered `\u002Fqa` SKIPPED because its skill could not be loaded or no runnable\n  app was available after target resolution (Step 7); browser QA remains\n  unverified\n- `\u002Fa11y` CRITICAL — a control unusable by screen-reader\u002Fkeyboard — still present (Step 8)\n- new public surface with zero tests after `\u002Ftest-coverage` (Step 9)\n- a hard perf gate breach after the fix round, only if `CLAUDE.md` defines one (Step 6)\n- **a triggered check left unaccounted** — neither run nor SKIPPED with a reason\n- **a `CLAUDE.md`-MANDATORY check that was SKIPPED** rather than run\n\n## Report format\n\nWrite to `qa-full-reports\u002F\u003Cbranch>-\u003CYYYY-MM-DD>.md` (create dir; add to\n`.gitignore`). Structure:\n\n```markdown\n# QA-Full — \u003Cbranch> @ \u003CYYYY-MM-DD>\n\nBase: \u003Cbase>  Range: \u003Cbase>..HEAD  Changed files: N (+M from fixes)\nHEAD before fixes: \u003Csha>  HEAD after: \u003Csha>  Fix commits: K\n\n## VERDICT: SHIP-READY ✅ | NOT READY ⛔\n\n### Fixed (audit → fix → verify, each with its commit)\n1. \u003Ccheck> — \u003Cfile:line> — \u003Cfinding> — fixed in \u003Csha> — re-verified by \u003Cevidence>\n- (or) None needed.\n\n### Blockers remaining (must resolve before \u002Ffinish-branch)\n1. \u003Cfile:line> — \u003Cevidence> — \u003Cwhat was tried> — \u003Cwhat's needed from you>\n- (or) None.\n\n### Warnings (ship with a follow-up note)\n- …\n\n## Accounting ledger (RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED \u002F SKIPPED(reason) \u002F NOT-TRIGGERED \u002F MANDATORY-FAIL)\n| Check | Status | Evidence \u002F fixes \u002F reason |\n|-------|--------|---------------------------|\n| Tests & build (Step 2)   | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | exact command + result, fix SHAs |\n| \u002Freview (Step 3)         | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | N findings, fix SHAs, 2nd-run result, Codex passes on\u002Foff, base used, out-of-scope stash ref if any |\n| \u002Fclean-code (Step 3)     | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | KISS\u002FDRY\u002FSOLID\u002FYAGNI findings, fix SHAs, deferred-with-reason |\n| \u002Fdefense (Step 4)        | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | N findings, fix SHAs |\n| \u002Fiac-scan (Step 4)       | … \u002F NOT-TRIGGERED | infra\u002Fdeploy files changed? |\n| \u002Fpentest (Step 4)        | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | authorized? findings? |\n| \u002Ffuzz (Step 4)           | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | target URL, findings |\n| \u002Fcso (Step 4)            | … \u002F NOT-TRIGGERED | new trust boundary? threat-model evidence |\n| \u002Fdb-optimize (Step 5)    | … \u002F NOT-TRIGGERED | N+1 \u002F index fixes, migration |\n| \u002Fweb-perf (Step 6)       | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | before\u002Fafter LCP\u002FINP\u002FCLS |\n| \u002Fperf-profile (Step 6)   | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | bottleneck, before\u002Fafter |\n| \u002Fqa (Step 7)             | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | tier, health before\u002Fafter, fix SHAs |\n| \u002Fdesign-review (Step 8)  | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | screens, fix SHAs |\n| \u002Fa11y (Step 8)           | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | static + dynamic, fix SHAs |\n| \u002Ftest-coverage + \u002Fplaywright (Step 9) | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | tests added, suite result |\n| \u002Fhumanize (Step 9b)      | … \u002F SKIPPED(reason) \u002F NOT-TRIGGERED | prose files in scope, flags fixed (SHAs), warnings carried |\n| \u002Feval (Step 9c)          | … \u002F SKIPPED(reason: not authorized) \u002F NOT-TRIGGERED | behavior files in scope, before\u002Fafter metrics or the ask-first outcome |\n| Final pass (Step 10)     | RAN-CLEAN \u002F FIXED(n) \u002F UNFIXED | fresh test\u002Fbuild + re-audit of fix commits |\n\n> No row may be blank or \"recommend\" for a check whose trigger fired — that is an\n> unaccounted-check blocker. `CLAUDE.md`-MANDATORY checks must read RAN-CLEAN or FIXED.\n\n## Ask-first \u002F follow-up commands\n- `\u002Fcode-review ultra` — (billed; offer when a high-stakes correctness concern remains)\n- `\u002Freview` Codex passes — (OpenAI tokens; ask before enabling them for a run)\n- `\u002Fpentest` — (if it was SKIPPED for authorization and the user now wants it)\n- `\u002Ffuzz` — (if SKIPPED for lack of a target and one is now available)\n- `\u002Fperf-profile` — (if SKIPPED for lack of a representative workload)\n- `\u002Ffinish-branch` → `\u002Fship` — (only if VERDICT is SHIP-READY)\n```\n\nPrint the verdict, the fixed count, the remaining-blocker count, and a 5-line\nsummary to the chat.\n\n## Anti-patterns (do not do)\n\n- Stopping at the report. A triggered check that found something and did not\n  attempt a fix has not run `\u002Fqa-full`.\n- Running `\u002Fqa-only` or `\u002Fdesign-audit` where `\u002Fqa` \u002F `\u002Fdesign-review` are\n  specified. Report-only is for discovery inside a step, never the step's end.\n- Claiming a finding is fixed without re-running the check that found it and\n  the test suite (fresh evidence, not assertion).\n- Pushing, opening PRs, or merging — that's `\u002Ffinish-branch` \u002F `\u002Fship`.\n- Fixing outside the diff: refactoring untouched modules, bumping deps, or\n  \"while I'm here\" changes. Every commit must trace to a finding.\n- Landing a fix that itself breaks the bar — untested public surface, a\n  duplicated helper, a symptom patch over an unknown root cause.\n- Looping without bound. Two fix rounds per check, one final pass, then report\n  what's left honestly.\n- Launching a billed run (`\u002Fcode-review ultra`, `\u002Freview`'s Codex passes,\n  `\u002Fpentest`'s clearwing modes) or any scan without authorization, without\n  the user's explicit yes.\n- Declaring SHIP-READY while a check was skipped without saying which and why,\n  or while any UNFIXED blocker remains.\n- Running any sub-check against the whole repo instead of the diff.\n- Treating MEDIUM\u002FLOW findings as blockers (noise) or hiding CRITICAL\u002FHIGH in\n  the warnings list.\n\n## Related commands\n\nReuses the trigger matrix from `\u002Fdaily-qa` (see `skills\u002Fdaily-qa\u002FSKILL.md`\nStep 7 for the canonical globs). Differences: branch-scoped, present-human,\nand it **fixes and verifies** instead of recommending.\n\nAuto-run (diff-scoped; audit → fix → verify):\n- Tests & build — always; failures root-caused via `\u002Fdebug`, proven via `\u002Fverify` (Step 2).\n- `\u002Freview` — staff-level correctness review; findings fixed by the pipeline (Step 3).\n- `\u002Fbasic-review` — in-tree correctness review, run in `\u002Freview`'s place when gstack is unavailable (Step 3).\n- `\u002Fclean-code` — KISS\u002FDRY\u002FSOLID\u002FYAGNI refactors on the diff, test-verified (Step 3).\n- `\u002Fdefense` — OWASP\u002Fsecrets\u002Fauth\u002Fcrypto; findings fixed by the pipeline (Step 4).\n- `\u002Fiac-scan` — when infra\u002Fdeploy config changed; misconfigs fixed (Step 4).\n- `\u002Ffuzz` — when the diff adds endpoints\u002Finput parsing and a target is reachable (Step 4).\n- `\u002Fcso` — backstop when a new trust boundary reached the pipeline unmodeled (Step 4).\n- `\u002Fdb-optimize` — when DB\u002FORM\u002FSQL changed; N+1\u002Findex fixes applied (Step 5).\n- `\u002Fweb-perf` — when frontend changed; dev server started if needed; regressions fixed (Step 6).\n- `\u002Fperf-profile` — when hot server paths changed \u002F pre-launch; bottleneck fixed (Step 6).\n- `\u002Fqa` — when anything user-facing changed; full test → fix → re-verify loop (Step 7).\n- `\u002Fdesign-review` — when UI changed; fixes + commits visual issues (Step 8).\n- `\u002Fa11y` — static + dynamic pass when heavy UI changed; findings fixed (Step 8).\n- `\u002Ftest-coverage` + `\u002Fplaywright` — write and apply the missing tests (Step 9).\n- `\u002Ftdd`, `\u002Fdebug`, `\u002Fverify` — the discipline every fix in the pipeline follows.\n\nAsk-first (need the user's explicit yes):\n- `\u002Fcode-review ultra` — billed multi-agent cloud review.\n- `\u002Freview`'s Codex passes — OpenAI tokens; per-run yes required (Step 3).\n- `\u002Fpentest` — authorization confirmation, then it runs; in-harness by\n  default, clearwing modes are the billed ask-first option (Step 4).\n\nFollow-up (outside the pipeline):\n- `\u002Fcode-review` \u002F `\u002Fsimplify` — Claude Code built-ins overlapping Step 3; use\n  them by hand, the pipeline uses the in-tree `\u002Freview` + `\u002Fclean-code`.\n\nHand-off (only when SHIP-READY):\n- `\u002Ffinish-branch` — choose how to integrate the work.\n- `\u002Fship` — sync, bump VERSION, changelog, PR.\n",{"name":5,"version":55,"triggers":56,"description":63,"allowed-tools":64,"argument-hint":75},"2.0.1",[57,31,58,59,60,61,62],"run full qa","feature done check it","is this ready to ship","pre-ship check","full quality gate","fix everything before ship","Full per-feature QA pipeline: audit → fix → verify. Runs the complete\nmulti-dimensional fan-out (tests, correctness, security, DB, frontend perf,\nbrowser QA, design, accessibility, coverage) scoped to the current branch's\ndiff, FIXES what each check finds, re-verifies the fixes, then emits a\npass\u002Ffail ship-readiness verdict on the repaired branch. Run it when a\nfeature is finished, before \u002Ffinish-branch and \u002Fship. Use when asked to\n\"run full QA\", \"qa-full\", \"feature done — check it\", \"is this ready to\nship\", \"pre-ship check\", \"full quality gate\", or \"fix everything before\nship\".\n",[65,66,67,68,69,70,71,72,73,74],"Bash","Read","Edit","Write","Grep","Glob","Task","Skill","WebFetch","AskUserQuestion","\u003Coptional: base branch (default auto-detect) or --scope \u003Cpaths>>","main","c7ec8d78e5dc37484c2cfe90ab04de163d97dd41","skills\u002Fqa-full",0,"https:\u002F\u002Fgithub.com\u002Fariadoss\u002Fsuperskills","https:\u002F\u002Fhyperion360.com\u002Fblog\u002Fparallel-ai-agents-engineering-workflow\u002F","https:\u002F\u002Fgithub.com\u002Fariadoss","https:\u002F\u002Fdanilosapad.com\u002F","CEO & Founder of @Hyperion360","2026-11-01 12:36:50",{"source":8,"skillName":5,"commands":87,"prompt":97,"zipAvailable":98},[88,91,94],{"tool":89,"command":90},"npx","npx skills add ariadoss\u002Fsuperskills --skill qa-full",{"tool":92,"command":93},"bunx","bunx skills add ariadoss\u002Fsuperskills --skill qa-full",{"tool":95,"command":96},"pnpm","pnpm dlx skills add ariadoss\u002Fsuperskills --skill qa-full","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fariadoss\u002Fsuperskills\u002Fblob\u002Fmain\u002Fskills\u002Fqa-full\u002FSKILL.md",true,[],[101,125,149,168,195,211],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":110,"publishedAt":50},"01M71AZE3MPF891RM354EMRYA1","youtube","Download YouTube video transcripts when user provides a YouTube URL or asks to download\u002Fget\u002Ffetch a transcript from YouTube. Also use when user wants to transcribe or get captions\u002Fsubtitles from a YouTube video.","https:\u002F\u002Fgithub.com\u002Fariadoss\u002Fsuperskills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube\u002FSKILL.md",[107],{"categoryNo":108,"categoryName":109,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[103,111,112,113,37,114,115,65,116,117,118,119,120,121,38,122,123,124],"user","download","transcribe","transcript","video transcripts","URL","when","Captions","get","fetch","Video","use","subtitles","transcripts",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":50},"01M71AZAYR85PW6BJGSQXS4BN2","write-plan","Use when you have a spec or requirements for a multi-step task, before touching code. Produces an engineering plan complete with TDD tasks, DRY\u002FSOLID\u002FYAGNI principles, a required Test Plan & Verification section, and a coverage target — then auto-runs \u002Fplan-eng-review as an independent double-check before execution.","https:\u002F\u002Fgithub.com\u002Fariadoss\u002Fsuperskills\u002Fblob\u002Fmain\u002Fskills\u002Fwrite-plan\u002FSKILL.md",[],[132,133,37,134,135,136,137,138,139,117,40,140,141,142,143,144,145,146,147,148],"write plan","plan","dry","verification","review","tasks","code","you","eng","coverage","complete","section","for","test plan","target","as","yagni",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":50},"01M71AZ8NDDP5ZMGEE6FSC4FKR","worktrees","Use when starting feature work that needs isolation from current workspace or before executing implementation plans - creates isolated git worktrees with smart directory selection and safety verification","https:\u002F\u002Fgithub.com\u002Fariadoss\u002Fsuperskills\u002Fblob\u002Fmain\u002Fskills\u002Fworktrees\u002FSKILL.md",[],[151,156,157,158,122,159,160,161,162,163,164,135,165,117,166,167],"implementation","workspace","with","plans","feature","isolation","git","directory","work","git worktrees","selection","Safety",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":177,"publishedAt":50},"01M71AZ4ZQHTNWFRZVYHKQFP08","web-perf","Analyzes web performance using Chrome DevTools MCP. Measures Core Web Vitals (LCP, INP, CLS) and supplementary metrics (FCP, TBT, Speed Index), identifies render-blocking resources, network dependency chains, layout shifts, caching issues, and accessibility gaps. Use when asked to audit, profile, debug, or optimize page load performance, Lighthouse scores, or site speed. Biases towards retrieval from current documentation over pre-trained knowledge.","https:\u002F\u002Fgithub.com\u002Fariadoss\u002Fsuperskills\u002Fblob\u002Fmain\u002Fskills\u002Fweb-perf\u002FSKILL.md",[174],{"categoryNo":175,"categoryName":176,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[178,179,180,181,182,183,184,185,186,117,30,187,188,189,190,46,191,192,193,194],"web","perf","web perf","resources","MCP","layout","optimize","documentation","caching","knowledge","devtools","issues","render","performance","chrome devtools","vitals","never",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":50},"01M71AZ2KZNWYEGKKRMJH8PYG2","verify","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002Fariadoss\u002Fsuperskills\u002Fblob\u002Fmain\u002Fskills\u002Fverify\u002FSKILL.md",[],[197,142,202,203,164,135,204,205,117,206,122,207,208,209,210],"commands","about","claims","output","assertions","claim","prs","evidence","running",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":217,"publishedAt":50},"01M71AZ0ACCK7N1QMWQK1FV2HJ","validate-idea","Validate a business idea using the minimalist entrepreneur framework. Use when someone has a business idea and wants to test if it's worth pursuing before building anything.","https:\u002F\u002Fgithub.com\u002Fariadoss\u002Fsuperskills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidate-idea\u002FSKILL.md",[],[218,219,220,221,222,223,224,117,225,122,226],"validate","idea","validate idea","framework","it","minimalist","test","business","before building"]