Menú
Ship workflow: detect + merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Fast headless browser for QA testing and site dogfooding. Navigate any URL, interact with elements, verify page state, diff before/after actions, take annotated screenshots, check responsive layouts, test forms and uploads, handle dialogs, and assert element states. ~100ms per command.
Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs.
CEO/founder-mode plan review. Rethink the problem, find the 10-star product, challenge premises, expand scope when it creates a better product. Four modes: SCOPE EXPANSION (dream big), SELECTIVE EXPANSION (hold scope + cherry-pick expansions), HOLD SCOPE (maximum rigor), SCOPE REDUCTION (strip to essentials).
Update the installed vibestack pack to the latest release — detect the install (global git checkout or a project-local vendored copy), run the upgrade, run version migrations, and show what changed.
Safety guardrails for destructive commands. Warns before rm -rf, DROP TABLE, force-push, git reset --hard, kubectl delete, and similar destructive operations. User can override each warning.
Generate missing documentation from scratch for a feature, module, or entire project. Uses the Diataxis framework (tutorial / how-to / reference / explanation) to produce complete, structured documentation. Can be invoked standalone or called by /document-release when it finds coverage gaps.
Basado en la clasificación ocupacional SOC
| name | ship |
| description | Ship workflow: detect + merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR. |
| allowed-tools | ["Bash","Read","Write","Edit","Grep","Glob","Agent","AskUserQuestion","WebSearch"] |
| triggers | ["ship it","create a pr","push to main","deploy this"] |
Use when asked to "ship", "deploy", "push to main", "create a PR", "merge and push", or "get it deployed". Proactively invoke this skill (do NOT push/PR directly) when the user says code is ready, asks about deploying, wants to push code up, or asks to create a PR.
eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
_LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
echo "LEARNINGS: $_LEARN_COUNT entries loaded"
if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
~/.vibestack/bin/vibe-learnings-search --limit 5 2>/dev/null || true
fi
else
echo "LEARNINGS: none yet"
fi
{{include lib/snippets/session-host.md}}
{{include lib/snippets/decision-brief.md}}
{{include lib/snippets/working-protocols.md}}
{{include lib/snippets/state-protocols.md}}
First, detect the git hosting platform from the remote URL:
git remote get-url origin 2>/dev/null
gh auth status 2>/dev/null succeeds → platform is GitHub (covers GitHub Enterprise)glab auth status 2>/dev/null succeeds → platform is GitLab (covers self-hosted)Determine which branch this PR/MR targets, or the repo's default branch if no PR/MR exists. Use the result as "the base branch" in all subsequent steps.
If GitHub:
gh pr view --json baseRefName -q .baseRefName — if succeeds, use itgh repo view --json defaultBranchRef -q .defaultBranchRef.name — if succeeds, use itIf GitLab:
glab mr view -F json 2>/dev/null and extract the target_branch field — if succeeds, use itglab repo view -F json 2>/dev/null and extract the default_branch field — if succeeds, use itGit-native fallback (if unknown platform, or CLI commands fail):
git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|refs/remotes/origin/||'git rev-parse --verify origin/main 2>/dev/null → use maingit rev-parse --verify origin/master 2>/dev/null → use masterIf all fail, fall back to main.
Print the detected base branch name. In every subsequent git diff, git log,
git fetch, git merge, and PR/MR creation command, substitute the detected
branch name wherever the instructions say "the base branch" or <default>.
You are running the /ship workflow. This is a non-interactive, fully automated workflow. Do NOT ask for confirmation at any step. The user said /ship which means DO IT. Run straight through and output the PR URL at the end.
Only stop for:
Never stop for:
Re-run behavior (idempotency):
Re-running /ship means "run the whole checklist again." Every verification step
(tests, coverage audit, plan completion, pre-landing review, adversarial review,
VERSION/CHANGELOG check, TODOS, document-release) runs on every invocation.
Only actions are idempotent:
/ship run already performed it.Check the current branch. If on the base branch or the repo's default branch, abort: "You're on the base branch. Ship from a feature branch."
Run git status (never use -uall). Uncommitted changes are always included — no need to ask.
Run git diff <base>...HEAD --stat and git log <base>..HEAD --oneline to understand what's being shipped.
Check review readiness:
After completing the review, read the review log and config to display the dashboard.
~/.vibestack/bin/vibe-review-read --json 2>/dev/null
Parse the output. Find the most recent entry for each skill (plan-ceo-review, plan-eng-review, review, plan-design-review, design-review-lite, adversarial-review, codex-review, codex-plan-review). Ignore entries with timestamps older than 7 days. For the Eng Review row, show whichever is more recent between review (diff-scoped pre-landing review) and plan-eng-review (plan-stage architecture review). Append "(DIFF)" or "(PLAN)" to the status to distinguish. For the Adversarial row, show whichever is more recent between adversarial-review (new auto-scaled) and codex-review (legacy). For Design Review, show whichever is more recent between plan-design-review (full visual audit) and design-review-lite (code-level check). Append "(FULL)" or "(LITE)" to the status to distinguish. For the Outside Voice row, show the most recent codex-plan-review entry — this captures outside voices from both /plan-ceo-review and /plan-eng-review.
Source attribution: If the most recent entry for a skill has a `"via"` field, append it to the status label in parentheses. Examples: plan-eng-review with via:"autoplan" shows as "CLEAR (PLAN via /autoplan)". review with via:"ship" shows as "CLEAR (DIFF via /ship)". Entries without a via field show as "CLEAR (PLAN)" or "CLEAR (DIFF)" as before.
Note: autoplan-voices and design-outside-voices entries are audit-trail-only (forensic data for cross-model consensus analysis). They do not appear in the dashboard and are not checked by any consumer.
Display:
+====================================================================+
| REVIEW READINESS DASHBOARD |
+====================================================================+
| Review | Runs | Last Run | Status | Required |
|-----------------|------|---------------------|-----------|----------|
| Eng Review | 1 | 2026-03-16 15:00 | CLEAR | YES |
| CEO Review | 0 | — | — | no |
| Design Review | 0 | — | — | no |
| Adversarial | 0 | — | — | no |
| Outside Voice | 0 | — | — | no |
+--------------------------------------------------------------------+
| VERDICT: CLEARED — Eng Review passed |
+====================================================================+
Review tiers:
Verdict logic:
Staleness detection: After displaying the dashboard, check if any existing reviews may be stale:
If the Eng Review is NOT "CLEAR":
Print: "No prior eng review found — ship will run its own pre-landing review in Step 9."
Check diff size: git diff <base>...HEAD --stat | tail -1. If the diff is >200 lines, add: "Note: This is a large diff. Consider running /plan-eng-review or /autoplan for architecture-level review before shipping."
If CEO Review is missing, mention as informational ("CEO Review not run — recommended for product changes") but do NOT block.
For Design Review: run eval "$(~/.vibestack/bin/vibe-diff-scope <base> 2>/dev/null || true)". If SCOPE_FRONTEND=true and no design review (plan-design-review or design-review-lite) exists in the dashboard, mention: "Design Review not run — this PR changes frontend code. The lite design check will run automatically in Step 9, but consider running /design-review for a full visual audit post-implementation." Still never block.
Continue to Step 2 — do NOT block or ask. Ship runs its own review in Step 9.
If the diff introduces a new standalone artifact (CLI binary, library package, tool) — not a web service with existing deployment — verify that a distribution pipeline exists.
Check if the diff adds a new cmd/ directory, main.go, or bin/ entry point:
git diff $(git merge-base origin/<base> HEAD) --name-only | grep -E '(cmd/.*/main\.go|bin/|Cargo\.toml|setup\.py|package\.json)' | head -5
If new artifact detected, check for a release workflow:
ls .github/workflows/ 2>/dev/null | grep -iE 'release|publish|dist'
grep -qE 'release|publish|deploy' .gitlab-ci.yml 2>/dev/null && echo "GITLAB_CI_RELEASE"
If no release pipeline exists and a new artifact was added: Use AskUserQuestion:
If release pipeline exists: Continue silently.
If no new artifact detected: Skip silently.
Fetch and merge the base branch into the feature branch so tests run against the merged state:
git fetch origin <base> && git merge origin/<base> --no-edit
If there are merge conflicts: Try to auto-resolve if they are simple (VERSION, schema.rb, CHANGELOG ordering). If conflicts are complex or ambiguous, STOP and show them.
If already up to date: Continue silently.
Detect existing test framework and project runtime:
setopt +o nomatch 2>/dev/null || true # zsh compat
# Detect project runtime
[ -f Gemfile ] && echo "RUNTIME:ruby"
[ -f package.json ] && echo "RUNTIME:node"
[ -f requirements.txt ] || [ -f pyproject.toml ] && echo "RUNTIME:python"
[ -f go.mod ] && echo "RUNTIME:go"
[ -f Cargo.toml ] && echo "RUNTIME:rust"
[ -f composer.json ] && echo "RUNTIME:php"
[ -f mix.exs ] && echo "RUNTIME:elixir"
# Detect sub-frameworks
[ -f Gemfile ] && grep -q "rails" Gemfile 2>/dev/null && echo "FRAMEWORK:rails"
[ -f package.json ] && grep -q '"next"' package.json 2>/dev/null && echo "FRAMEWORK:nextjs"
# Check for existing test infrastructure
ls jest.config.* vitest.config.* playwright.config.* .rspec pytest.ini pyproject.toml phpunit.xml 2>/dev/null
ls -d test/ tests/ spec/ __tests__/ cypress/ e2e/ 2>/dev/null
# Check opt-out marker
[ -f .vibestack/no-test-bootstrap ] && echo "BOOTSTRAP_DECLINED"
If test framework detected (config files or test directories found): Print "Test framework detected: {name} ({N} existing tests). Skipping bootstrap." Read 2-3 existing test files to learn conventions (naming, imports, assertion style, setup patterns). Store conventions as prose context for use in Phase 8e.5 or Step 7. Skip the rest of bootstrap.
If BOOTSTRAP_DECLINED appears: Print "Test bootstrap previously declined — skipping." Skip the rest of bootstrap.
If NO runtime detected (no config files found): Use AskUserQuestion:
"I couldn't detect your project's language. What runtime are you using?"
Options: A) Node.js/TypeScript B) Ruby/Rails C) Python D) Go E) Rust F) PHP G) Elixir H) This project doesn't need tests.
If user picks H → write .vibestack/no-test-bootstrap and continue without tests.
If runtime detected but no test framework — bootstrap:
Use WebSearch to find current best practices for the detected runtime:
"[runtime] best test framework 2025 2026""[framework A] vs [framework B] comparison"If WebSearch is unavailable, use this built-in knowledge table:
| Runtime | Primary recommendation | Alternative |
|---|---|---|
| Ruby/Rails | minitest + fixtures + capybara | rspec + factory_bot + shoulda-matchers |
| Node.js | vitest + @testing-library | jest + @testing-library |
| Next.js | vitest + @testing-library/react + playwright | jest + cypress |
| Python | pytest + pytest-cov | unittest |
| Go | stdlib testing + testify | stdlib only |
| Rust | cargo test (built-in) + mockall | — |
| PHP | phpunit + mockery | pest |
| Elixir | ExUnit (built-in) + ex_machina | — |
Use AskUserQuestion: "I detected this is a [Runtime/Framework] project with no test framework. I researched current best practices. Here are the options: A) [Primary] — [rationale]. Includes: [packages]. Supports: unit, integration, smoke, e2e B) [Alternative] — [rationale]. Includes: [packages] C) Skip — don't set up testing right now RECOMMENDATION: Choose A because [reason based on project context]"
If user picks C → write .vibestack/no-test-bootstrap. Tell user: "If you change your mind later, delete .vibestack/no-test-bootstrap and re-run." Continue without tests.
If multiple runtimes detected (monorepo) → ask which runtime to set up first, with option to do both sequentially.
If package installation fails → debug once. If still failing → revert with git checkout -- package.json package-lock.json (or equivalent for the runtime). Warn user and continue without tests.
Generate 3-5 real tests for existing code:
git log --since=30.days --name-only --format="" | sort | uniq -c | sort -rn | head -10expect(x).toBeDefined() — test what the code DOES.Never import secrets, API keys, or credentials in test files. Use environment variables or test fixtures.
# Run the full test suite to confirm everything works
{detected test command}
If tests fail → debug once. If still failing → revert all bootstrap changes and warn user.
# Check CI provider
ls -d .github/ 2>/dev/null && echo "CI:github"
ls .gitlab-ci.yml .circleci/ bitrise.yml 2>/dev/null
If .github/ exists (or no CI detected — default to GitHub Actions):
Create .github/workflows/test.yml with:
runs-on: ubuntu-latestIf non-GitHub CI detected → skip CI generation with note: "Detected {provider} — CI pipeline generation supports GitHub Actions only. Add test step to your existing pipeline manually."
First check: If TESTING.md already exists → read it and update/append rather than overwriting. Never destroy existing content.
Write TESTING.md with:
First check: If CLAUDE.md already has a ## Testing section → skip. Don't duplicate.
Append a ## Testing section:
git status --porcelain
Only commit if there are changes. Stage all bootstrap files (config, test directory, TESTING.md, CLAUDE.md, .github/workflows/test.yml if created):
git commit -m "chore: bootstrap test framework ({framework name})"
Do NOT run RAILS_ENV=test bin/rails db:migrate — bin/test-lane already calls
db:test:prepare internally, which loads the schema into the correct lane database.
Running bare test migrations without INSTANCE hits an orphan DB and corrupts structure.sql.
Run both test suites in parallel:
bin/test-lane 2>&1 | tee /tmp/ship_tests.txt &
npm run test 2>&1 | tee /tmp/ship_vitest.txt &
wait
After both complete, read the output files and check pass/fail.
If any test fails: Do NOT immediately stop. Apply the Test Failure Ownership Triage:
When tests fail, do NOT immediately stop. First, determine ownership:
For each failing test:
Get the files changed on this branch:
git diff origin/<base>...HEAD --name-only
Classify the failure:
This classification is heuristic — use your judgment reading the diff and the test output. You do not have a programmatic dependency graph.
STOP. These are your failures. Show them and do not proceed. The developer must fix their own broken tests before shipping.
Check REPO_MODE from the preamble output.
If REPO_MODE is solo:
Use AskUserQuestion:
These test failures appear pre-existing (not caused by your branch changes):
[list each failure with file:line and brief error description]
Since this is a solo repo, you're the only one who will fix these.
RECOMMENDATION: Choose A — fix now while the context is fresh. Completeness: 9/10. A) Investigate and fix now (human: ~2-4h / CC: ~15min) — Completeness: 10/10 B) Add as P0 TODO — fix after this branch lands — Completeness: 7/10 C) Skip — I know about this, ship anyway — Completeness: 3/10
If REPO_MODE is collaborative or unknown:
Use AskUserQuestion:
These test failures appear pre-existing (not caused by your branch changes):
[list each failure with file:line and brief error description]
This is a collaborative repo — these may be someone else's responsibility.
RECOMMENDATION: Choose B — assign it to whoever broke it so the right person fixes it. Completeness: 9/10. A) Investigate and fix now anyway — Completeness: 10/10 B) Blame + assign GitHub issue to the author — Completeness: 9/10 C) Add as P0 TODO — Completeness: 7/10 D) Skip — ship anyway — Completeness: 3/10
If "Investigate and fix now":
git commit -m "fix: pre-existing test failure in <test-file>"If "Add as P0 TODO":
TODOS.md exists, add the entry following the format in review/TODOS-format.md (or .claude/skills/review/TODOS-format.md).TODOS.md does not exist, create it with the standard header and add the entry.If "Blame + assign GitHub issue" (collaborative only):
# Who last touched the failing test?
git log --format="%an (%ae)" -1 -- <failing-test-file>
# Who last touched the production code the test covers? (often the actual breaker)
git log --format="%an (%ae)" -1 -- <source-file-under-test>
gh issue create \
--title "Pre-existing test failure: <test-name>" \
--body "Found failing on branch <current-branch>. Failure is pre-existing.\n\n**Error:**\n```\n<first 10 lines>\n```\n\n**Last modified by:** <author>\n**Noticed by:** vibestack /ship on <date>" \
--assignee "<github-username>"
glab issue create \
-t "Pre-existing test failure: <test-name>" \
-d "Found failing on branch <current-branch>. Failure is pre-existing.\n\n**Error:**\n```\n<first 10 lines>\n```\n\n**Last modified by:** <author>\n**Noticed by:** vibestack /ship on <date>" \
-a "<gitlab-username>"
--assignee/-a fails (user not in org, etc.), create the issue without assignee and note who should look at it in the body.If "Skip":
After triage: If any in-branch failures remain unfixed, STOP. Do not proceed. If all failures were pre-existing and handled (fixed, TODOed, assigned, or skipped), continue to Step 6.
If all pass: Continue silently — just note the counts briefly.
Evals are mandatory when prompt-related files change. Skip this step entirely if no prompt files are in the diff.
1. Check if the diff touches prompt-related files:
git diff $(git merge-base origin/<base> HEAD) --name-only
Match against these patterns (from CLAUDE.md):
app/services/*_prompt_builder.rbapp/services/*_generation_service.rb, *_writer_service.rb, *_designer_service.rbapp/services/*_evaluator.rb, *_scorer.rb, *_classifier_service.rb, *_analyzer.rbapp/services/concerns/*voice*.rb, *writing*.rb, *prompt*.rb, *token*.rbapp/services/chat_tools/*.rb, app/services/x_thread_tools/*.rbconfig/system_prompts/*.txttest/evals/**/* (eval infrastructure changes affect all suites)If no matches: Print "No prompt-related files changed — skipping evals." and continue to Step 9.
2. Identify affected eval suites:
Each eval runner (test/evals/*_eval_runner.rb) declares PROMPT_SOURCE_FILES listing which source files affect it. Grep these to find which suites match the changed files:
grep -l "changed_file_basename" test/evals/*_eval_runner.rb
Map runner → test file: post_generation_eval_runner.rb → post_generation_eval_test.rb.
Special cases:
test/evals/judges/*.rb, test/evals/support/*.rb, or test/evals/fixtures/ affect ALL suites that use those judges/support files. Check imports in the eval test files to determine which.config/system_prompts/*.txt — grep eval runners for the prompt filename to find affected suites.3. Run affected suites at EVAL_JUDGE_TIER=full:
/ship is a pre-merge gate, so always use full tier (Sonnet structural + Opus persona judges).
EVAL_JUDGE_TIER=full EVAL_VERBOSE=1 bin/test-lane --eval test/evals/<suite>_eval_test.rb 2>&1 | tee /tmp/ship_evals.txt
If multiple suites need to run, run them sequentially (each needs a test lane). If the first suite fails, stop immediately — don't burn API cost on remaining suites.
4. Check results:
5. Save eval output — include eval results and cost dashboard in the PR body (Step 19).
Tier reference (for context — /ship always uses full):
| Tier | When | Speed (cached) | Cost |
|---|---|---|---|
fast (Haiku) | Dev iteration, smoke tests | ~5s (14x faster) | ~$0.07/run |
standard (Sonnet) | Default dev, bin/test-lane --eval | ~17s (4x faster) | ~$0.37/run |
full (Opus persona) | /ship and pre-merge | ~72s (baseline) | ~$1.27/run |
Dispatch this step as a subagent using the Agent tool with subagent_type: "general-purpose". The subagent runs the coverage audit in a fresh context window — the parent only sees the conclusion, not intermediate file reads. This is context-rot defense.
Subagent prompt: Pass the following instructions to the subagent, with <base> substituted with the base branch:
You are running a ship-workflow test coverage audit. Run
git diff <base>...HEADas needed. Do not commit or push — report only.100% coverage is the goal — every untested path is a path where bugs hide and vibe coding becomes yolo coding. Evaluate what was ACTUALLY coded (from the diff), not what was planned.
Before analyzing coverage, detect the project's test framework:
## Testing section with test command and framework name. If found, use that as the authoritative source.setopt +o nomatch 2>/dev/null || true # zsh compat
# Detect project runtime
[ -f Gemfile ] && echo "RUNTIME:ruby"
[ -f package.json ] && echo "RUNTIME:node"
[ -f requirements.txt ] || [ -f pyproject.toml ] && echo "RUNTIME:python"
[ -f go.mod ] && echo "RUNTIME:go"
[ -f Cargo.toml ] && echo "RUNTIME:rust"
# Check for existing test infrastructure
ls jest.config.* vitest.config.* playwright.config.* cypress.config.* .rspec pytest.ini phpunit.xml 2>/dev/null
ls -d test/ tests/ spec/ __tests__/ cypress/ e2e/ 2>/dev/null
0. Before/after test count:
# Count test files before any generation
find . -name '*.test.*' -o -name '*.spec.*' -o -name '*_test.*' -o -name '*_spec.*' | grep -v node_modules | wc -l
Store this number for the PR body.
1. Trace every codepath changed using git diff origin/<base>...HEAD:
Read every changed file. For each one, trace how data flows through the code — don't just list functions, actually follow the execution:
This is the critical step — you're building a map of every line of code that can execute differently based on input. Every branch in this diagram needs a test.
2. Map user flows, interactions, and error states:
Code coverage isn't enough — you need to cover how real users interact with the changed code. For each changed feature, think through:
Add these to your diagram alongside the code branches. A user flow with no test is just as much a gap as an untested if/else.
3. Check each branch against existing tests:
Go through your diagram branch by branch — both code paths AND user flows. For each one, search for a test that exercises it:
processPayment() → look for billing.test.ts, billing.spec.ts, test/billing_test.rbhelperFn() that has its own branches → those branches need tests tooQuality scoring rubric:
When checking each branch, also determine whether a unit test or E2E/integration test is the right tool:
RECOMMEND E2E (mark as [→E2E] in the diagram):
RECOMMEND EVAL (mark as [→EVAL] in the diagram):
STICK WITH UNIT TESTS:
IRON RULE: When the coverage audit identifies a REGRESSION — code that previously worked but the diff broke — a regression test is written immediately. No AskUserQuestion. No skipping. Regressions are the highest-priority test because they prove something broke.
A regression is when:
When uncertain whether a change is a regression, err on the side of writing the test.
Format: commit as test: regression test for {what broke}
4. Output ASCII coverage diagram:
Include BOTH code paths and user flows in the same diagram. Mark E2E-worthy and eval-worthy paths:
CODE PATHS USER FLOWS
[+] src/services/billing.ts [+] Payment checkout
├── processPayment() ├── [★★★ TESTED] Complete purchase — checkout.e2e.ts:15
│ ├── [★★★ TESTED] happy + declined + timeout ├── [GAP] [→E2E] Double-click submit
│ ├── [GAP] Network timeout └── [GAP] Navigate away mid-payment
│ └── [GAP] Invalid currency
└── refundPayment() [+] Error states
├── [★★ TESTED] Full refund — :89 ├── [★★ TESTED] Card declined message
└── [★ TESTED] Partial (non-throw only) — :101 └── [GAP] Network timeout UX
LLM integration: [GAP] [→EVAL] Prompt template change — needs eval test
COVERAGE: 5/13 paths tested (38%) | Code paths: 3/5 (60%) | User flows: 2/8 (25%)
QUALITY: ★★★:2 ★★:2 ★:1 | GAPS: 8 (2 E2E, 1 eval)
Legend: ★★★ behavior + edge + error | ★★ happy path | ★ smoke check [→E2E] = needs integration test | [→EVAL] = needs LLM eval
Fast path: All paths covered → "Step 7: All new code paths have test coverage ✓" Continue.
5. Generate tests for uncovered paths:
If test framework detected (or bootstrapped in Step 4):
test: coverage for {feature}Caps: 30 code paths max, 20 tests generated max (code + user flow combined), 2-min per-test exploration cap.
If no test framework AND user declined bootstrap → diagram only, no generation. Note: "Test generation skipped — no test framework configured."
Diff is test-only changes: Skip Step 7 entirely: "No new application code paths to audit."
6. After-count and coverage summary:
# Count test files after generation
find . -name '*.test.*' -o -name '*.spec.*' -o -name '*_test.*' -o -name '*_spec.*' | grep -v node_modules | wc -l
For PR body: Tests: {before} → {after} (+{delta} new)
Coverage line: Test Coverage Audit: N new code paths. M covered (X%). K tests generated, J committed.
7. Coverage gate:
Before proceeding, check CLAUDE.md for a ## Test Coverage section with Minimum: and Target: fields. If found, use those percentages. Otherwise use defaults: Minimum = 60%, Target = 80%.
Using the coverage percentage from the diagram in substep 4 (the COVERAGE: X/Y (Z%) line):
>= target: Pass. "Coverage gate: PASS ({X}%)." Continue.
>= minimum, < target: Use AskUserQuestion:
< minimum: Use AskUserQuestion:
Coverage percentage undetermined: If the coverage diagram doesn't produce a clear numeric percentage (ambiguous output, parse error), skip the gate with: "Coverage gate: could not determine percentage — skipping." Do not default to 0% or block.
Test-only diffs: Skip the gate (same as the existing fast-path).
100% coverage: "Coverage gate: PASS (100%)." Continue.
After producing the coverage diagram, write a test plan artifact so /qa and /qa-only can consume it:
eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)" && mkdir -p ~/.vibestack/projects/$SLUG
USER=$(whoami)
DATETIME=$(date +%Y%m%d-%H%M%S)
Write to ~/.vibestack/projects/{slug}/{user}-{branch}-ship-test-plan-{datetime}.md:
# Test Plan
Generated by /ship on {date}
Branch: {branch}
Repo: {owner/repo}
## Affected Pages/Routes
- {URL path} — {what to test and why}
## Key Interactions to Verify
- {interaction description} on {page}
## Edge Cases
- {edge case} on {page}
## Critical Paths
- {end-to-end flow that must work}
After your analysis, output a single JSON object on the LAST LINE of your response (no other text after it):
{"coverage_pct":N,"gaps":N,"diagram":"<full markdown coverage diagram for PR body>","tests_added":["path",...]}
Parent processing:
coverage_pct (for Step 20 metrics), gaps (user summary), tests_added (for the commit).diagram verbatim in the PR body's ## Test Coverage section (Step 19).Coverage: {coverage_pct}%, {gaps} gaps. {tests_added.length} tests added.If the subagent fails, times out, or returns invalid JSON: Fall back to running the audit inline in the parent. Do not block /ship on subagent failure — partial results are better than none.
Dispatch this step as a subagent using the Agent tool with subagent_type: "general-purpose". The subagent reads the plan file and every referenced code file in its own fresh context. Parent gets only the conclusion.
Subagent prompt: Pass these instructions to the subagent:
You are running a ship-workflow plan completion audit. The base branch is
<base>. Usegit diff <base>...HEADto see what shipped. Do not commit or push — report only.Plan File Discovery
Conversation context (primary): Check if there is an active plan file in this conversation. The host agent's system messages include plan file paths when in plan mode. If found, use it directly — this is the most reliable signal.
Content-based search (fallback): If no plan file is referenced in conversation context, search by content:
setopt +o nomatch 2>/dev/null || true # zsh compat
BRANCH=$(git branch --show-current 2>/dev/null | tr '/' '-')
REPO=$(basename "$(git rev-parse --show-toplevel 2>/dev/null)")
# Compute project slug for ~/.vibestack/projects/ lookup
_PLAN_SLUG=$(git remote get-url origin 2>/dev/null | sed 's|.*[:/]\([^/]*/[^/]*\)\.git$|\1|;s|.*[:/]\([^/]*/[^/]*\)$|\1|' | tr '/' '-' | tr -cd 'a-zA-Z0-9._-') || true
_PLAN_SLUG="${_PLAN_SLUG:-$(basename "$PWD" | tr -cd 'a-zA-Z0-9._-')}"
# Search common plan file locations (project designs first, then personal/local)
for PLAN_DIR in "$HOME/.vibestack/projects/$_PLAN_SLUG" "$HOME/.claude/plans" "$HOME/.codex/plans" ".vibestack/plans"; do
[ -d "$PLAN_DIR" ] || continue
PLAN=$(ls -t "$PLAN_DIR"/*.md 2>/dev/null | xargs grep -l "$BRANCH" 2>/dev/null | head -1)
[ -z "$PLAN" ] && PLAN=$(ls -t "$PLAN_DIR"/*.md 2>/dev/null | xargs grep -l "$REPO" 2>/dev/null | head -1)
[ -z "$PLAN" ] && PLAN=$(find "$PLAN_DIR" -name '*.md' -mmin -1440 -maxdepth 1 2>/dev/null | xargs ls -t 2>/dev/null | head -1)
[ -n "$PLAN" ] && break
done
[ -n "$PLAN" ] && echo "PLAN_FILE: $PLAN" || echo "NO_PLAN_FILE"
Error handling:
Read the plan file. Extract every actionable item — anything that describes work to be done. Look for:
- [ ] ... or - [x] ...Ignore:
## Context, ## Background, ## Problem)## VIBESTACK REVIEW REPORT)Cap: Extract at most 50 items. If the plan has more, note: "Showing top 50 of N plan items — full list in plan file."
No items found: If the plan contains no extractable actionable items, skip with: "Plan file contains no actionable items — skipping completion audit."
For each item, note:
Before judging completion, classify HOW each item can be verified. The diff alone cannot prove every kind of work — items outside the current repo or system are structurally invisible to git diff.
git diff origin/<base>...HEAD. Examples: "add UserService" (file appears), "validate input X" (validation logic appears), "create users table" (migration appears).~/Development/<other-repo>/docs/dashboard.md). The current diff CANNOT prove this.Verification dispatch:
~/Development/<repo>/, ~/code/<repo>/, the parent of the current repo), run [ -f <path> ]. File exists → DONE (cite path). Missing → NOT DONE (cite path). Path unreachable → UNVERIFIABLE (cite the manual check).package.json for a validate-*/check-docs/lint-* script) before falling back to UNVERIFIABLE. Pass → DONE; fail → NOT DONE (cite output). No validator: UNVERIFIABLE, citing both the path and the convention to confirm.Path concreteness rule. If a plan item names a concrete filesystem path (absolute, ~/..., or <sibling-repo>/<file>), it MUST be classified DONE or NOT DONE based on [ -f <path> ]. UNVERIFIABLE is only valid when the path is genuinely abstract ("DNS record", "managed-DB allowlist") or the sibling root is unreachable on this machine. "I don't want to check" is not unreachable.
Honesty rule. Do NOT classify an item DONE just because related code shipped. Code that handles a deliverable is not the deliverable. When in doubt between DONE and UNVERIFIABLE, prefer UNVERIFIABLE — better to surface a confirmation prompt than silently miss a deliverable.
Run git diff origin/<base>...HEAD and git log origin/<base>..HEAD --oneline to understand what was implemented.
For each extracted plan item, run the verification dispatch above, then classify:
Be conservative with DONE — require clear evidence. A file being touched is not enough; the specific functionality described must be present. Be generous with CHANGED — if the goal is met by different means, that counts as addressed. Be honest with UNVERIFIABLE — better to surface items the user must manually confirm than silently classify them DONE.
PLAN COMPLETION AUDIT
═══════════════════════════════
Plan: {plan file path}
## Implementation Items
[DONE] Create UserService — src/services/user_service.rb (+142 lines)
[PARTIAL] Add validation — model validates but missing controller checks
[NOT DONE] Add caching layer — no cache-related changes in diff
[CHANGED] "Redis queue" → implemented with Sidekiq instead
## Test Items
[DONE] Unit tests for UserService — test/services/user_service_test.rb
[NOT DONE] E2E test for signup flow
## Migration Items
[DONE] Create users table — db/migrate/20240315_create_users.rb
## Cross-Repo / External Items
[DONE] Add dashboard doc — ~/Development/other-repo/docs/dashboard.md (file exists)
[UNVERIFIABLE] DNS-only mode for dashboard.example.com — confirm in your DNS provider
─────────────────────────────────
COMPLETION: 5/9 DONE, 1 PARTIAL, 1 NOT DONE, 1 CHANGED, 1 UNVERIFIABLE
─────────────────────────────────
After producing the completion checklist:
~/Development/other-repo/docs/dashboard.md exist?", not "Have you checked all items?".## Plan Completion — Manual Verifications in the PR body. Items they cannot confirm → carry as still-open manual checks in the PR body.No plan file found: Skip entirely. "No plan file detected — skipping plan completion audit."
Include in PR body (Step 8): Add a ## Plan Completion section with the checklist summary.
After your analysis, output a single JSON object on the LAST LINE of your response (no other text after it):
{"total_items":N,"done":N,"changed":N,"deferred":N,"summary":"<markdown checklist for PR body>"}
Parent processing:
done, deferred for Step 20 metrics; use summary in PR body.deferred > 0 and no user override, present the deferred items via AskUserQuestion before continuing.summary in PR body's ## Plan Completion section (Step 19).If the subagent fails or returns invalid JSON: Fall back to running the audit inline (parent runs the same plan-extraction + classification). If the inline fallback ALSO fails (plan file unreadable, parser error): do NOT silently pass. Surface it as an explicit AskUserQuestion — "Plan Completion audit could not run ({reason}). A) Skip audit and ship anyway (record 'audit skipped' in the PR body + Step 20 metrics), B) Stop and fix the audit." Default and recommended: B. A silent fail-open here is exactly how a missed deliverable ships unnoticed.
Automatically verify the plan's testing/verification steps using the /qa-only skill.
Using the plan file already discovered in Step 8, look for a verification section. Match any of these headings: ## Verification, ## Test plan, ## Testing, ## How to test, ## Manual testing, or any section with verification-flavored items (URLs to visit, things to check visually, interactions to test).
If no verification section found: Skip with "No verification steps found in plan — skipping auto-verification." If no plan file was found in Step 8: Skip (already handled).
Before invoking browse-based verification, check if a dev server is reachable:
curl -s -o /dev/null -w '%{http_code}' http://localhost:3000 2>/dev/null || \
curl -s -o /dev/null -w '%{http_code}' http://localhost:8080 2>/dev/null || \
curl -s -o /dev/null -w '%{http_code}' http://localhost:5173 2>/dev/null || \
curl -s -o /dev/null -w '%{http_code}' http://localhost:4000 2>/dev/null || echo "NO_SERVER"
If NO_SERVER: Skip with "No dev server detected — skipping plan verification. Run /qa separately after deploying."
Read the /qa-only skill from disk:
cat ${CLAUDE_SKILL_DIR:-$HOME/.claude/skills/ship}/../qa-only/SKILL.md
If unreadable: Skip with "Could not load /qa-only — skipping plan verification."
Follow the /qa-only workflow with these modifications:
Add a ## Verification Results section to the PR body (Step 19):
{{include lib/snippets/prior-learnings.md}}
Before reviewing code quality, check: did they build what was requested — nothing more, nothing less?
Read TODOS.md (if it exists). Read PR description (gh pr view --json body --jq .body 2>/dev/null || true).
Read commit messages (git log origin/<base>..HEAD --oneline).
If no PR exists: rely on commit messages and TODOS.md for stated intent — this is the common case since /review runs before /ship creates the PR.
Identify the stated intent — what was this branch supposed to accomplish?
Run git diff origin/<base>...HEAD --stat and compare the files changed against the stated intent.
Evaluate with skepticism (incorporating plan completion results if available from an earlier step or adjacent section):
SCOPE CREEP detection:
MISSING REQUIREMENTS detection:
Output (before the main review begins): ``` Scope Check: [CLEAN / DRIFT DETECTED / REQUIREMENTS MISSING] Intent: <1-line summary of what was requested> Delivered: <1-line summary of what the diff actually does> [If drift: list each out-of-scope change] [If missing: list each unaddressed requirement] ```
This is INFORMATIONAL — does not block the review. Proceed to the next step.
Review the diff for structural issues that tests don't catch.
Read .claude/skills/review/checklist.md. If the file cannot be read, STOP and report the error.
Run git diff $(git merge-base origin/<base> HEAD) to get the full diff (scoped to feature changes against the freshly-fetched base branch).
Apply the review checklist in two passes:
Every finding MUST include a confidence score (1-10):
| Score | Meaning | Display rule |
|---|---|---|
| 9-10 | Verified by reading specific code. Concrete bug or exploit demonstrated. | Show normally |
| 7-8 | High confidence pattern match. Very likely correct. | Show normally |
| 5-6 | Moderate. Could be a false positive. | Show with caveat: "Medium confidence, verify this is actually an issue" |
| 3-4 | Low confidence. Pattern is suspicious but may be fine. | Suppress from main report. Include in appendix only. |
| 1-2 | Speculation. | Only report if severity would be P0. |
Finding format:
`[SEVERITY] (confidence: N/10) file:line — description`
Example: `[P1] (confidence: 9/10) app/models/user.rb:42 — SQL injection via string interpolation in where clause` `[P2] (confidence: 5/10) app/controllers/api/v1/users_controller.rb:18 — Possible N+1 query, verify with production logs`
Before any finding is promoted to the report, the gate requires:
Quote the specific code line that motivates the finding — file:line plus the verbatim text of the line(s) that triggered it. If the finding is "field X doesn't exist on model Y", quote the lines of class Y where the field would live. If "dict.get() might return None", quote the dict initialization. If "race condition between A and B", quote both A and B.
If you cannot quote the motivating line(s), the finding is unverified. Force its confidence to 4-5 (suppressed from the main report). It still goes into the appendix so reviewers can audit calibration, but the user does NOT see it in the critical-pass output. Do not work around this by inventing speculative confidence 7+ — that defeats the gate.
Framework-meta nudge: When the symbol is generated by a framework
metaclass, descriptor, ORM Meta inner-class, or migration history (Django
Meta, Rails has_many/scope, SQLAlchemy relationship/Column,
TypeORM decorators, Sequelize init/belongsTo, Prisma generated client),
quote the meta-construct (the Meta block, the migration, the decorator,
the schema file) instead of expecting the literal name in the class body.
The verification is "I read the source that creates this symbol", not "I
grep'd for the name and didn't find it." Deeper framework-aware verification
(model introspection, migration-history-aware checks, ORM dialect detection)
is deliberately out of scope for this lighter gate.
Calibration learning: If you report a finding with confidence < 7 and the user confirms it IS a real issue, that is a calibration event. Your initial confidence was too low. Log the corrected pattern as a learning so future reviews catch it with higher confidence.
Check if the diff touches frontend files:
eval "$(~/.vibestack/bin/vibe-diff-scope <base> 2>/dev/null || true)"
echo "SCOPE_FRONTEND=${SCOPE_FRONTEND:-false}"
If SCOPE_FRONTEND=false: Skip design review silently. No output.
If SCOPE_FRONTEND=true:
Check for DESIGN.md. If DESIGN.md or design-system.md exists in the repo root, read it. All design findings are calibrated against it — patterns blessed in DESIGN.md are not flagged. If not found, use universal design principles.
Read .claude/skills/review/design-checklist.md. If the file cannot be read, skip design review with a note: "Design checklist not found — skipping design review."
Read each changed frontend file (full file, not just diff hunks). Frontend files are identified by the patterns listed in the checklist.
Apply the design checklist against the changed files. For each item:
outline: none, !important, font-size < 16px): classify as AUTO-FIXInclude findings in the review output under a "Design Review" header, following the output format in the checklist. Design findings merge with code review findings into the same Fix-First flow.
Log the result for the Review Readiness Dashboard:
~/.vibestack/bin/vibe-review-log '{"skill":"design-review-lite","timestamp":"TIMESTAMP","status":"STATUS","findings":N,"auto_fixed":M,"commit":"COMMIT"}'
Substitute: TIMESTAMP = ISO 8601 datetime, STATUS = "clean" if 0 findings or "issues_found", N = total findings, M = auto-fixed count, COMMIT = output of git rev-parse --short HEAD.
command -v codex >/dev/null 2>&1 && echo "CODEX_AVAILABLE" || echo "CODEX_NOT_AVAILABLE"
If Codex is available, run a lightweight design check on the diff:
TMPERR_DRL=$(mktemp /tmp/codex-drl-XXXXXXXX)
_REPO_ROOT=$(git rev-parse --show-toplevel) || { echo "ERROR: not in a git repo" >&2; exit 1; }
command -v codex >/dev/null 2>&1 && codex exec "Review the git diff on this branch. Run 7 litmus checks (YES/NO each): 1. Brand/product unmistakable in first screen? 2. One strong visual anchor present? 3. Page understandable by scanning headlines only? 4. Each section has one job? 5. Are cards actually necessary? 6. Does motion improve hierarchy or atmosphere? 7. Would design feel premium with all decorative shadows removed? Flag any hard rejections: 1. Generic SaaS card grid as first impression 2. Beautiful image with weak brand 3. Strong headline with no clear action 4. Busy imagery behind text 5. Sections repeating same mood statement 6. Carousel with no narrative purpose 7. App UI made of stacked cards instead of layout 5 most important design findings only. Reference file:line." -C "$_REPO_ROOT" -s read-only -c 'model_reasoning_effort="high"' --enable web_search_cached < /dev/null 2>"$TMPERR_DRL"
Use a 5-minute timeout (timeout: 300000). After the command completes, read stderr:
cat "$TMPERR_DRL" && rm -f "$TMPERR_DRL"
Error handling: All errors are non-blocking. On auth failure, timeout, or empty response — skip with a brief note and continue.
Present Codex output under a CODEX (design): header, merged with the checklist findings above.
Include any design findings alongside the code review findings. They follow the same Fix-First flow below.
# Compute SCOPE_* from the diff (conditional specialist dispatch). All-false
# fallback if the binary is absent — runs the always-on specialists, never errors.
eval "$(~/.vibestack/bin/vibe-diff-scope <base> 2>/dev/null || true)"
echo "SCOPE_FRONTEND=${SCOPE_FRONTEND:-false} SCOPE_BACKEND=${SCOPE_BACKEND:-false} SCOPE_AUTH=${SCOPE_AUTH:-false} SCOPE_MIGRATIONS=${SCOPE_MIGRATIONS:-false} SCOPE_API=${SCOPE_API:-false}"
# Detect stack for specialist context
STACK=""
[ -f Gemfile ] && STACK="${STACK}ruby "
[ -f package.json ] && STACK="${STACK}node "
[ -f requirements.txt ] || [ -f pyproject.toml ] && STACK="${STACK}python "
[ -f go.mod ] && STACK="${STACK}go "
[ -f Cargo.toml ] && STACK="${STACK}rust "
echo "STACK: ${STACK:-unknown}"
DIFF_INS=$(git diff $(git merge-base origin/<base> HEAD) --stat | tail -1 | grep -oE '[0-9]+ insertion' | grep -oE '[0-9]+' || echo "0")
DIFF_DEL=$(git diff $(git merge-base origin/<base> HEAD) --stat | tail -1 | grep -oE '[0-9]+ deletion' | grep -oE '[0-9]+' || echo "0")
DIFF_LINES=$((DIFF_INS + DIFF_DEL))
echo "DIFF_LINES: $DIFF_LINES"
# Detect test framework for specialist test stub generation
TEST_FW=""
{ [ -f jest.config.ts ] || [ -f jest.config.js ]; } && TEST_FW="jest"
[ -f vitest.config.ts ] && TEST_FW="vitest"
{ [ -f spec/spec_helper.rb ] || [ -f .rspec ]; } && TEST_FW="rspec"
{ [ -f pytest.ini ] || [ -f conftest.py ]; } && TEST_FW="pytest"
[ -f go.mod ] && TEST_FW="go-test"
echo "TEST_FW: ${TEST_FW:-unknown}"
~/.vibestack/bin/vibe-specialist-stats 2>/dev/null || true
Each line tags a specialist GATE_CANDIDATE (dispatched 10+ times, never found
anything — safe to skip), NEVER_GATE (security / data-migration insurance —
always run), or active. Fresh project → everything active, full set runs.
Based on the scope signals above, select which specialists to dispatch.
Always-on (dispatch on every review with 50+ changed lines):
~/.claude/skills/review/specialists/testing.md~/.claude/skills/review/specialists/maintainability.mdIf DIFF_LINES < 50: Skip all specialists. Print: "Small diff ($DIFF_LINES lines) — specialists skipped." Continue to the Fix-First flow (item 4).
Conditional (dispatch if the matching scope signal is true):
3. Security — if SCOPE_AUTH=true, OR if SCOPE_BACKEND=true AND DIFF_LINES > 100. Read ~/.claude/skills/review/specialists/security.md
4. Performance — if SCOPE_BACKEND=true OR SCOPE_FRONTEND=true. Read ~/.claude/skills/review/specialists/performance.md
5. Data Migration — if SCOPE_MIGRATIONS=true. Read ~/.claude/skills/review/specialists/data-migration.md
6. API Contract — if SCOPE_API=true. Read ~/.claude/skills/review/specialists/api-contract.md
7. Design — if SCOPE_FRONTEND=true. Use the existing design review checklist at ~/.claude/skills/review/design-checklist.md
After scope-based selection, apply adaptive gating based on specialist hit rates:
For each conditional specialist that passed scope gating, check the specialist stats output above:
[GATE_CANDIDATE] (0 findings in 10+ dispatches): skip it. Print: "[specialist] auto-gated (0 findings in N reviews)."[NEVER_GATE]: always dispatch regardless of hit rate. Security and data-migration are insurance policy specialists — they should run even when silent.Force flags: If the user's prompt includes --security, --performance, --testing, --maintainability, --data-migration, --api-contract, --design, or --all-specialists, force-include that specialist regardless of gating.
Note which specialists were selected, gated, and skipped. Print the selection: "Dispatching N specialists: [names]. Skipped: [names] (scope not detected). Gated: [names] (0 findings in N+ reviews)."
For each selected specialist, launch an independent subagent via the Agent tool. Launch ALL selected specialists in a single message (multiple Agent tool calls) so they run in parallel. Each subagent has fresh context — no prior review bias.
Each specialist subagent prompt:
Construct the prompt for each specialist. The prompt includes:
~/.vibestack/bin/vibe-learnings-search --type pitfall --query "{specialist domain}" --limit 5 2>/dev/null || true
If learnings are found, include them: "Past learnings for this domain: {learnings}"
"You are a specialist code reviewer. Read the checklist below, then run
git diff $(git merge-base origin/<base> HEAD) to get the full diff. Apply the checklist against the diff.
For each finding, output a JSON object on its own line: {"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"category","summary":"description","fix":"recommended fix","fingerprint":"path:line:category","specialist":"name"}
Required fields: severity, confidence, path, category, summary, specialist. Optional: line, fix, fingerprint, evidence, test_stub.
If you can write a test that would catch this issue, include it in the test_stub field.
Use the detected test framework ({TEST_FW}). Write a minimal skeleton — describe/it/test
blocks with clear intent. Skip test_stub for architectural or design-only findings.
If no findings: output NO FINDINGS and nothing else.
Do not output anything else — no preamble, no summary, no commentary.
Stack context: {STACK} Past learnings: {learnings or 'none'}
CHECKLIST: {checklist content}"
Subagent configuration:
subagent_type: "general-purpose"run_in_background — all specialists must complete before mergeAfter all specialist subagents complete, collect their outputs.
Parse findings: For each specialist's output:
Fingerprint and deduplicate: For each finding, compute its fingerprint:
fingerprint field is present, use it{path}:{line}:{category} (if line is present) or {path}:{category}Group findings by fingerprint. For findings sharing the same fingerprint:
Apply confidence gates:
Compute PR Quality Score:
After merging, compute the quality score:
quality_score = max(0, 10 - (critical_count * 2 + informational_count * 0.5))
Cap at 10. Log this in the review result at the end.
Output merged findings: Present the merged findings in the same format as the current review:
SPECIALIST REVIEW: N findings (X critical, Y informational) from Z specialists
[For each finding, in order: CRITICAL first, then INFORMATIONAL, sorted by confidence descending]
[SEVERITY] (confidence: N/10, specialist: name) path:line — summary
Fix: recommended fix
[If MULTI-SPECIALIST CONFIRMED: show confirmation note]
PR Quality Score: X/10
These findings flow into the Fix-First flow (item 4) alongside the checklist pass (Step 9). The Fix-First heuristic applies identically — specialist findings follow the same AUTO-FIX vs ASK classification.
Compile per-specialist stats:
After merging findings, compile a specialists object for the review-log persist.
For each specialist (testing, maintainability, security, performance, data-migration, api-contract, design, red-team):
{"dispatched": true, "findings": N, "critical": N, "informational": N}{"dispatched": false, "reason": "scope"}{"dispatched": false, "reason": "gated"}Include the Design specialist even though it uses design-checklist.md instead of the specialist schema files.
Remember these stats — you will need them for the review-log entry in Step 5.8.
Activation: Only if DIFF_LINES > 200 OR any specialist produced a CRITICAL finding.
If activated, dispatch one more subagent via the Agent tool (foreground, not background).
The Red Team subagent receives:
~/.claude/skills/review/specialists/red-team.mdPrompt: "You are a red team reviewer. The code has already been reviewed by N specialists
who found the following issues: {merged findings summary}. Your job is to find what they
MISSED. Read the checklist, run git diff $(git merge-base origin/<base> HEAD), and look for gaps.
Output findings as JSON objects (same schema as the specialists). Focus on cross-cutting
concerns, integration boundary issues, and failure modes that specialist checklists
don't cover."
If the Red Team finds additional issues, merge them into the findings list before
the Fix-First flow (item 4). Red Team findings are tagged with "specialist":"red-team".
If the Red Team returns NO FINDINGS, note: "Red Team review: no additional issues found." If the Red Team subagent fails or times out, skip silently and continue.
Before classifying findings, check if any were previously skipped by the user in a prior review on this branch.
~/.vibestack/bin/vibe-review-read --json 2>/dev/null
Parse the output: only lines BEFORE ---CONFIG--- are JSONL entries (the output also contains ---CONFIG--- and ---HEAD--- footer sections that are not JSONL — ignore those).
For each JSONL entry that has a findings array:
action: "skipped"commit field from that entryIf skipped fingerprints exist, get the list of files changed since that review:
git diff --name-only <prior-review-commit> HEAD
For each current finding (from both the checklist pass (Step 9) and specialist review (Step 9.1-9.2)), check:
If both conditions are true: suppress the finding. It was intentionally skipped and the relevant code hasn't changed.
Print: "Suppressed N findings from prior reviews (previously skipped by user)"
Only suppress skipped findings — never fixed or auto-fixed (those might regress and should be re-checked).
If no prior reviews exist or none have a findings array, skip this step silently.
Output a summary header: Pre-Landing Review: N issues (X critical, Y informational)
Classify each finding from both the checklist pass and specialist review (Step 9.1-Step 9.2) as AUTO-FIX or ASK per the Fix-First Heuristic in checklist.md. Critical findings lean toward ASK; informational lean toward AUTO-FIX.
Auto-fix all AUTO-FIX items. Apply each fix. Output one line per fix:
[AUTO-FIXED] [file:line] Problem → what you did
If ASK items remain, present them in ONE AskUserQuestion:
After all fixes (auto + user-approved):
git add <fixed-files> && git commit -m "fix: pre-landing review fixes"), then STOP and tell the user to run /ship again to re-test.Output summary: Pre-Landing Review: N issues — M auto-fixed, K asked (J fixed, L skipped)
If no issues found: Pre-Landing Review: No issues found.
Persist the review result to the review log:
~/.vibestack/bin/vibe-review-log '{"skill":"review","timestamp":"TIMESTAMP","status":"STATUS","issues_found":N,"critical":N,"informational":N,"quality_score":SCORE,"specialists":SPECIALISTS_JSON,"findings":FINDINGS_JSON,"commit":"'"$(git rev-parse --short HEAD)"'","via":"ship"}'
Substitute TIMESTAMP (ISO 8601), STATUS ("clean" if no issues, "issues_found" otherwise),
and N values from the summary counts above. The via:"ship" distinguishes from standalone /review runs.
quality_score = the PR Quality Score computed in Step 9.2 (e.g., 7.5). If specialists were skipped (small diff), use 10.0specialists = the per-specialist stats object compiled in Step 9.2. Each specialist that was considered gets an entry: {"dispatched":true/false,"findings":N,"critical":N,"informational":N} if dispatched, or {"dispatched":false,"reason":"scope|gated"} if skipped. Example: {"testing":{"dispatched":true,"findings":2,"critical":0,"informational":2},"security":{"dispatched":false,"reason":"scope"}}findings = array of per-finding records. For each finding (from checklist pass and specialists), include: {"fingerprint":"path:line:category","severity":"CRITICAL|INFORMATIONAL","action":"ACTION"}. ACTION is "auto-fixed", "fixed" (user approved), or "skipped" (user chose Skip).Save the review output — it goes into the PR body in Step 19.