The contract every new or modified API endpoint must follow so it is correct for the public OpenAPI spec, the MCP server (npm @trycompai/mcp-server), the ValidationPipe, and the docs. Triggers on "new endpoint", "add API", "new DTO", "@Body", "@RequirePermission", "MCP tool", "edit controller in apps/api", "OpenAPI", or whenever editing controllers under apps/api/src/.
MUST run after writing or modifying code — reviews changed files for verbose patterns, inconsistencies, and readability issues before considering work done
Use when changing Comp AI billing, Stripe products/prices, subscription checkout, org payment methods, entitlements, usage ledgers, invoices, or billing webhooks.
Audit & fix design system usage — migrate @trycompai/ui and lucide-react to @trycompai/design-system
Audit & fix hooks and API usage patterns — eliminate server actions, raw fetch, and stale patterns
Audit & fix RBAC and audit log compliance in API endpoints and frontend components
| name | audit-tests |
| description | Audit & fix unit tests for permission-gated components |
Check that unit tests exist and pass for permission-gated components. Write missing tests immediately.
@testing-library/react + @testing-library/jest-domapps/app/src/test-utils/setup.tsapps/app/src/test-utils/mocks/permissions.tscd apps/app && bunx vitest runEvery component importing usePermissions MUST have tests covering:
Use setMockPermissions, ADMIN_PERMISSIONS, AUDITOR_PERMISSIONS from test utils.
usePermissions in $ARGUMENTS.test.tsx filescd apps/app && bunx vitest run