| name | verify |
| description | Run full repo verification (lint, typecheck, test, security, diff review) and fix failures. |
| disable-model-invocation | true |
Verify
Run comprehensive verification across the entire monorepo with a structured pass/fail report.
Phases
Phase 1 — Lint
pnpm lint
If failures: fix the root cause, re-run until clean.
Phase 2 — Type Check
pnpm typecheck
If failures: fix type errors, re-run until clean.
Phase 3 — Tests
pnpm test
If failures: fix failing tests, re-run until clean.
Phase 4 — Format
pnpm format:check
If failures: run pnpm format to auto-fix, then re-check.
Phase 5 — Security Scan
Run these checks manually (grep/glob — no external tools needed):
-
Hardcoded secrets: Search all staged/modified .ts, .tsx, .js files for patterns:
- API keys:
OANDA_API_KEY, OANDA_TOKEN, FRED_API_KEY, ALPHA_VANTAGE_KEY, ANTHROPIC_API_KEY
- Literal key patterns: strings matching
/[A-Za-z0-9]{32,}/ near key, token, secret, password assignments
.env references hardcoded as string literals (not process.env.*)
-
Console.log in production code: Search apps/ and packages/ for console.log( — flag any not inside test files (*.test.*, *.spec.*) or explicitly marked // keep: debug.
-
Webhook token exposure: Check that CF Worker webhook tokens are never logged or returned in responses.
-
OANDA credentials: Verify packages/db/src/encryption.ts is used for all credential storage — no plaintext API keys in DB service files.
If any findings: report them with file paths and line numbers. Fix critical issues (hardcoded secrets) immediately. Flag console.log instances for review.
Phase 6 — Diff Review
If there are uncommitted changes (staged or unstaged):
- Run
git diff --stat to see scope of changes
- Review changes against FXFlow rules:
- Import boundaries: No cross-app imports, packages don't import apps
- File size: Components ≤150 LOC, services ≤300 LOC
- Trading domain: Source/metadata pattern respected, OANDA as repository
- Accessibility: New UI components have proper ARIA, keyboard nav, focus management
- Flag any violations with file path and specific concern
Report
After all phases complete, output a structured report:
## Verification Report
| Phase | Status |
|----------------|--------|
| Lint | ✅/❌ |
| Type Check | ✅/❌ |
| Tests | ✅/❌ |
| Format | ✅/❌ |
| Security Scan | ✅/❌ |
| Diff Review | ✅/❌ |
**Verdict: READY / NOT READY**
### Findings (if any)
- [severity] description (file:line)
Only report "READY" when ALL phases pass with zero findings.