| name | orbit-gauntlet |
| description | Run the full Orbit gauntlet — 11 sequential checks on a WordPress plugin (PHP lint, PHPCS, PHPStan, asset weight, i18n, Playwright, Lighthouse, DB profile, competitor compare, UI perf, AI skill audits, PM UX). Three modes — `quick` (3-5 min, dev loop), `full` (30-45 min, RC pass), `release` (45-60 min, WP.org submission). Use when the user says "run gauntlet", "audit my plugin", "full QA", "before release", or any unscoped "check my plugin" request. |
| argument-hint | --plugin <path> --mode quick|full|release |
🪐 orbit-gauntlet — The full pipeline
The flagship Orbit command. One invocation, every quality angle.
Smart-agentic mandate. --mode full and --mode release run every step end-to-end, no cherry-picking. --skip N is debug-only — using it for any release-track run requires a brain note (orbit/08-release) recording the reason. Smart-agentic = aggressive; conservative shipped 5 RankReady i18n bugs. See agents/_SMART-AGENTIC-MANDATE.md.
Quick start
bash scripts/gauntlet.sh --plugin ~/plugins/my-plugin --mode quick
bash scripts/gauntlet.sh --plugin ~/plugins/my-plugin --mode full
bash scripts/gauntlet.sh --plugin ~/plugins/my-plugin --mode release
Exit code: 0 = release ready · 1 = blockers found.
Mode comparison
| Step | quick | full | release |
|---|
| 1. PHP lint | ✓ | ✓ | ✓ |
| 1a. Release metadata | ✓ | ✓ | ✓ |
| 1b. Zip hygiene | — | ✓ | ✓ |
| 2. PHPCS (WPCS + VIP) | ✓ | ✓ | ✓ |
| 3. PHPStan level 5 | ✓ | ✓ | ✓ |
| 4. Asset weight | ✓ | ✓ | ✓ |
| 5. i18n + POT (gettext) | — | ✓ | ✓ |
| 5a. i18n runtime (UNESCAPED_UNICODE) | — | ✓ | ✓ |
| 5b. i18n JS parity (wp_localize_script) | — | ✓ | ✓ |
| 5c. i18n translator currency (.po drift) | — | ✓ | ✓ |
| 5d. Polylang + WPML endpoint awareness | — | ✓ | ✓ |
| 6. Playwright (smoke) | ✓ | full suite | full suite |
| 7. Lighthouse | — | ✓ | ✓ |
| 8. DB profiling | — | ✓ | ✓ |
| 9. Competitor compare | — | ✓ | ✓ |
| 10. UI / editor perf | — | ✓ | ✓ |
| 11. 6 AI skill audits | — | ✓ | ✓ |
| 12. PM UX (spell + label) | — | ✓ | ✓ |
| WP.org plugin-check | — | — | ✓ |
| Live CVE feed | — | — | ✓ |
| Ownership-transfer detect | — | — | ✓ |
Reading the output
After every run:
reports/
├── qa-report-<timestamp>.md ← markdown summary (start here)
├── playwright-html/index.html ← interactive E2E report
├── skill-audits/index.html ← tabbed AI audit (full + release only)
├── lighthouse/lh-<timestamp>.json ← performance data
└── pm-ux/pm-ux-report-<timestamp>.html ← PM-friendly view
Open the master index:
python3 scripts/generate-reports-index.py
open reports/index.html
Severity triage
| Level | Action |
|---|
| Critical | Block release. Fix today. |
| High | Block release. Fix in this PR. |
| Medium | Fix if <30 min. Otherwise log. |
| Low / Info | Log. Defer. |
Any Critical or High in modes full / release → exit code 1.
Common failures
wp-env not running on port 8881
Site isn't up. Run /orbit-docker-site first.
phpcs: command not found
Power tools not installed. Run /orbit-install.
Playwright tests failed — auth.setup.js
Admin cookies expired. Re-run:
WP_TEST_URL=http://localhost:8881 npx playwright test \
tests/playwright/auth.setup.js --project=setup
qa.config.json not found
First-time setup needed. Run /orbit-setup.
Step hangs > 10 min
Probably the AI skill audits in --mode full waiting on Claude Code. Check reports/skill-audits/*.md to see if any wrote partial output. Kill + re-run.
What each step actually does
Detailed in docs/04-gauntlet.md. Quick reference:
Step 1 PHP Lint → syntax errors in every .php file (~10s)
Step 1a Release Metadata → header, readme.txt, version parity, license, HPOS, WP compat (~20s)
Step 1b Zip Hygiene → dev files, forbidden functions, supply-chain audit (~30s)
Step 2 PHPCS → WordPress + VIP coding standards (~30s)
Step 3 PHPStan → static analysis (level 5) (~45s)
Step 4 Asset Weight → JS/CSS bundle sizes (~5s)
Step 5 i18n / POT → translatable strings + text domain check (~20s)
Step 5a i18n runtime → JSON_UNESCAPED_UNICODE in storage + REST charset (~10s)
Step 5b i18n JS parity → PHP wp_localize_script keys vs JS reads (~10s)
Step 5c i18n translator → per-locale .po staleness vs current POT (~15s)
Step 5d Multilingual compat→ Polylang + WPML language-aware custom endpoints (~20s)
Step 6 Playwright Tests → functional + visual regression + flow videos (~3 min)
Step 7 Lighthouse → Core Web Vitals scores (~1 min)
Step 8 DB Profiling → query count + slow query log + memory + cron + GDPR (~2 min)
Step 9 Competitor → side-by-side comparison of competitor plugins (~3 min)
Step 10 UI Performance → editor load time (Elementor/Gutenberg) + frontend TTFB (~2 min)
Step 11 Claude Skills → 6 parallel AI audits (security, perf, DB, a11y, standards, quality)
Step 12 PM UX Audit → spell-check + guided experience score + label benchmarking
After failure — drill into a specific layer
| Layer that failed | Skill |
|---|
| PHPCS / WPCS | /orbit-wp-standards |
| Security / SAST | /orbit-wp-security |
| Performance | /orbit-wp-performance |
| Database | /orbit-wp-database |
| Accessibility | /orbit-accessibility |
| i18n (gettext) | /orbit-i18n |
| i18n runtime (Unicode encoding) | /orbit-i18n-runtime |
| i18n JS parity (silent English fallback) | /orbit-i18n-js-parity |
| i18n translator currency (.po drift) | /orbit-i18n-translator-currency |
| Polylang compat (incl. custom endpoints) | /orbit-compat-polylang |
| WPML compat (incl. wpml-config.xml currency) | /orbit-compat-wpml |
| Playwright | /orbit-playwright |
| Lighthouse | /orbit-lighthouse |
| Editor perf | /orbit-editor-perf |
| PM UX (spell + label) | /orbit-pm-ux-audit |
| WP.org plugin-check | /orbit-plugin-check |
Each sub-skill goes deeper than the gauntlet step.
Variations
WP_TEST_URL=http://localhost:8888 bash scripts/gauntlet.sh --plugin . --mode full
bash scripts/gauntlet.sh --plugin . --mode full --skip 9
bash scripts/gauntlet.sh --plugin . --mode quick --only 1-5
bash scripts/gauntlet.sh --plugin . --mode full --format json
CI / GitHub Actions
gauntlet.sh is CI-ready out of the box — exit 0/1, deterministic output:
- name: Orbit gauntlet
run: bash scripts/gauntlet.sh --plugin . --mode full
- name: Upload reports
if: always()
uses: actions/upload-artifact@v4
with: { name: orbit-reports, path: reports/ }
Full template: docs/15-ci-cd.md.
