| name | validation-gates |
| description | Defines 10 sequential validation gates: secret scanning, lint/test/build checks, blast radius analysis, dependency auditing, browser testing, cache management, regression checks, smoke tests. Use when running pre-deploy validation or CI checks, CI/CD pipelines, deployment pipeline validation, pre-merge checks, continuous integration, or pull request validation. |
Validation Gates
| Gate | Name | Runs When |
|---|
| 1 | Secret Scanning | Every delegation |
| 2 | Deterministic Checks | Every delegation |
| 3 | Blast Radius Check | Every delegation |
| 4 | Dependency Audit | When package.json or lockfiles change |
| 5 | Fast Review | Every delegation (with auto-PASS exceptions) |
| 6 | Cache Clearing | Before browser testing |
| 7 | Browser Testing | UI changes |
| 8 | Regression Testing | Every delegation |
| 9 | Panel Review | High-stakes changes only |
| 10 | Final Smoke Test | Feature completion (after all tasks Done) |
Gate 1: Secret Scanning
Inherits: never-expose-secrets
Scan every diff before any other gate.
Example tool: gitleaks detect --source . --verbosity warn (or CI equivalent) — fail on findings matching secrets rules.
Gate 2: Deterministic Checks
Run for every affected project (resolve exact commands via codebase-tool skill): lint (with auto-fix), test, build. All must pass with zero errors.
Example (project with npm scripts):
npm run lint && npm test --silent && npm run build
Gate 3: Blast Radius Check
| Metric | Normal | Warning | Escalate |
|---|
| Lines changed | ≤200 | 201–500 | >500 |
| Files changed | ≤5 | 6–10 | >10 |
| Projects affected | ≤1 | 2 | >2 |
- Normal — proceed
- Warning — log; investigate partition drift
- Escalate — STOP; verify partition; split or revert; no auto-PASS
Sensitive files (always Warning): **/auth/**, DB migrations, next.config.*, .env*, .github/workflows/**, lockfiles — also triggers Gate 4.
Gate 4: Dependency Audit
Runs only when package.json, yarn.lock, package-lock.json, pnpm-lock.yaml, or similar lockfiles are modified.
| Check | Tool / Example Command | Pass Criteria | On Failure |
|---|
| Vulnerability | npm audit --audit-level=moderate | No new high/critical | BLOCK — use patched version or alternative |
| Bundle size | npx source-map-explorer dist/*.js or npx bundlesize | Frontend pkgs ≤50KB gzipped (project policy) | SHOULD-FIX; blocking if >200KB |
See REFERENCE.md for full dependency-audit checklist (license, duplicates, maintenance, additional checks).
Gate 5: Fast Review
Spawn reviewer sub-agent (load fast-review skill). PASS → proceed; FAIL → re-delegate (max 2); 3× FAIL → Gate 9. Auto-PASS rules: see fast-review skill.
Gate 6: Cache Clearing
rm -rf node_modules/.cache .next/cache .astro/ dist/
Gate 7: Browser Testing
UI changes require Chrome screenshots. Start dev server → verify ACs → responsive breakpoints → capture screenshots. Load browser-testing skill.
{ "tool": "browser-testing/capture_screenshot", "url": "http://localhost:3000", "viewports": ["mobile", "desktop"] }
Additional options: see REFERENCE.md.
Gate 8: Regression Testing
npm test -- --runInBand for all affected projects- Browser-test adjacent pages (navigation, routing, back-button). Identify adjacent pages by searching for route imports or links to changed path (e.g.,
rg "href=\"/changed-path|import .*from '@/components/changed'").
- Check consuming apps / packages importing changed files: search repo for component or package name (e.g.,
rg "from '@/components/PriceRange'|@my-org/ui-package") and run their tests or quick smoke builds.
Gate 9: Panel Review
Load panel-majority-vote skill — spawns 3 isolated reviewers, majority (2/3) wins. Use for: security-sensitive changes, DB migrations, architecture decisions.
runSubagent({ agentName: 'Reviewer', prompt: `Panel review 1/3: ${criteria}` });
Gate 10: Final Smoke Test
Runs once after ALL tasks are Done.
npm run build && npm test && npx playwright test
Full build + test from clean state → E2E browser walkthrough → cross-task integration check → responsive sweep (if UI). On failure: re-delegate specific failing integration only.
