verify

name	verify
description	Run full verification pipeline (lint, format, test, security) before committing

Verify — Pre-Commit Quality Gate

Run this before every commit to ensure code quality and security.

When to Activate

• Before creating a commit
• Before pushing to remote
• After making significant code changes
• When asked to "verify", "check", or "validate" the code

Verification Pipeline

Run all steps in order. Stop on first failure.

Step 1: Lint

uv run ruff check c_lord/

If there are auto-fixable issues:

uv run ruff check --fix c_lord/

Step 2: Format

uv run ruff format --check c_lord/

If formatting is needed:

uv run ruff format c_lord/

Step 3: Tests

uv run pytest tests/ -v --cov=c_lord --cov-report=term-missing

All tests must pass. Review coverage for newly added code.

Step 4: Security Audit

Before committing, check for these security concerns specific to this project:

1. No shell=True: Search for shell=True in any subprocess call — this is forbidden
2. No hardcoded secrets: Search for patterns like token, secret, password, api_key with string literal values
3. Session ID validation: Any new code accepting session IDs must validate with ^[a-f0-9\-]+$
4. Subprocess arguments: All user input passed to Claude CLI must use -- separator
5. Environment stripping: _STRIPPED_ENV_KEYS must include any new secret env vars

# Quick security grep
uv run ruff check c_lord/ --select S  # bandit rules via ruff

Step 5: Import Check

Verify the public API still works:

python -c "from c_lord import ClaudeRunner, ClaudeChatCog, SkillCommandCog, SessionRepository"

Failure Protocol

• Lint/Format failures: Fix automatically, re-run
• Test failures: Fix the code (not the test, unless the test is wrong)
• Security failures: STOP. Do not commit. Fix the vulnerability first
• Import failures: Check __init__.py exports match actual module structure