メニュー
Deep quality-control audit to run after major features, migrations, or integrations land — covers engineering best practices, security, docs, architecture, test coverage, supply chain, UX, and operational readiness
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/briandenicola/Aurearia --skill post-major-work-qc-auditコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Ensuring SQLite in-memory databases are truly isolated per Go test when using glebarez/sqlite
Handle mixed legacy/new set-type contracts without writing deprecated values.
Reuse the shared museum tray renderer across authenticated and public coin presentations.
| name | post-major-work-qc-audit |
| description | Deep quality-control audit to run after major features, migrations, or integrations land — covers engineering best practices, security, docs, architecture, test coverage, supply chain, UX, and operational readiness |
| domain | quality-assurance |
| confidence | low |
| source | manual |
| tools | [{"name":"grep / glob / view","description":"Navigate changed files, read specs, ADRs, CI config, and dependency manifests","when":"All investigation phases — always prefer direct reading over inference"},{"name":"git diff / git log","description":"Identify the exact changeset and authorship boundary for the audit","when":"Opening step to bound the scope of the audit"}] |
Run this skill when a significant batch of work has landed: a large feature, a security-sensitive change, a cross-cutting refactor, a new integration, or a migration that touches schema/API/contracts. Normal CI and per-PR review catch local defects; this skill catches systemic gaps — spec drift, missing regression coverage, deployment blind spots, and cross-cutting concerns that only surface when the whole change is viewed together.
Trigger conditions (any one suffices):
Portability note: Sections marked [REPO-HOOK] contain hooks specific to repositories that use a constitution/Quality Gate/Squad governance model. Skip or adapt those hooks when running in other repos.
Run a post-major-work QC audit on [feature/PR/branch description].
Scope: [list of changed files, or "git diff main..branch"].
Spec/design docs: [path(s) to spec.md, plan.md, ADRs, PRD sections].
Prior decisions: [path to decisions.md or ADR index, if present].
Before writing a single finding, complete the full Investigation Protocol below. Do not skip phases to save time.
Perform every phase in order. Record what you read, not what you assume.
git diff --name-only <base>..<head> (or equivalent) to enumerate every changed file.[REPO-HOOK] Check .specify/memory/constitution.md §0 hierarchy: Constitution → PRD → spec → plan → tasks → decisions.[REPO-HOOK] Read .github/pull_request_template.md DoD checklist to understand what the author self-certified.Check against the actual diff:
if err != nil { return } without log/wrap.[REPO-HOOK] Verify Go package import rules: handlers→services→repository→models. Run go test -run TestNoDirectDatabase ./... if applicable.For each changed auth, permission, secret-handling, or data-access path:
.Where("user_id = ?", userID) or equivalent.[REPO-HOOK] Verify GORM scopes (OwnedBy, OwnedByID) are used instead of raw .Where().latest).[REPO-HOOK] Flag violations of the constitution hierarchy (§0). A lower-ranked artefact that contradicts a higher-ranked one is a blocker.docs/, README.md, or equivalent that describe components changed by this work but were not updated in the diff.[REPO-HOOK] Run go test -run TestRegisteredAPIRoutesAreDocumentedInOpenAPI ./... if applicable.ALTER TABLE that would cause a destructive rebuild.[REPO-HOOK] Run npm run type-check and npx vue-tsc --noEmit.go.mod, package.json, pyproject.toml, or equivalent:
go.sum, package-lock.json, uv.lock) reflect the pin?(Skip or reduce scope if the changeset contains no frontend changes.)
variables.css (or equivalent).[REPO-HOOK] Enforce global CSS classes (.chip, .btn, .badge) and typography scale from the project constitution.fmt.Println or print() in production paths.Produce a single structured report. Every finding must reference a specific file path (and line number where possible) and quote or describe the exact evidence from the diff or referenced document. Do not generalize.
## Post-Major-Work QC Audit — [Feature / PR / Branch]
**Audited by:** [Agent name]
**Date:** [ISO 8601]
**Changeset:** [git diff base..head, or PR number]
**Spec / design doc:** [path or URL]
### Scope Summary
[2–4 sentences: what changed, which layers, which domains are in scope]
### Artifact Checklist
- [ ] Diff read (all N changed files)
- [ ] Authorizing spec / PRD section read
- [ ] Relevant ADRs read
- [ ] CI workflow read
- [ ] [REPO-HOOK] Constitution and DoD checklist reviewed
- [ ] All 8 Audit Domains traversed
### Blockers ← Must be resolved before merge / deploy
| ID | Domain | File : Line | Finding | Required Remediation |
|----|--------|-------------|---------|----------------------|
| B1 | Security | src/api/handlers/foo.go:42 | Missing userID scope on DB query | Add `.Where("user_id = ?", uid)` before `.Find()` |
### Follow-Ups ← Recommended but not merge-blocking
| ID | Domain | File : Line | Finding | Suggested Remediation |
|----|--------|-------------|---------|----------------------|
| F1 | Test Coverage | src/api/services/bar.go:88 | No test for nil-repo error path | Add unit test case with mock returning `ErrNotFound` |
### Positive Observations
[Optional: note design decisions or test patterns that are worth reusing]
### Confidence Notes
[Note any area where evidence was ambiguous, files were inaccessible, or a domain was partially skipped and why]
Severity rules:
[REPO-HOOK] Any finding that would fail §17 Quality Gate or violate a constitution Principle is automatically a Blocker.Do not do these:
Checklist-from-memory audit — Listing general best practices ("ensure proper error handling") without citing a specific file and line from the diff. Every finding must be grounded in observed evidence.
Inventing facts — Claiming a test is missing without first reading the test files; claiming a dependency is unpinned without reading the lock file; claiming an endpoint is unauthenticated without reading the middleware chain.
Skipping the diff — Starting with domain checklists before completing the Investigation Protocol. Phase 0–2 are not optional.
Escalating style to blocker — Naming a follow-up a blocker because it violates a preference rather than a security, correctness, or contract requirement.
Collapsing all findings into prose — Narrative descriptions of many issues in a paragraph. Every issue must appear as a row in the Blockers or Follow-Ups table with a file path.
Re-auditing what CI already gates — If go vet, ruff, or vue-tsc already runs in CI and passes, do not re-raise issues those tools would have caught. Focus on what CI cannot see: cross-cutting spec alignment, deployment implications, threat model, and emergent interactions.
Scope creep into unrelated files — The audit covers the changeset plus directly referenced dependencies. Do not audit the entire codebase.
Hedging every finding — "This might be an issue depending on context." If confidence is insufficient to make a clear call, note it in the Confidence Notes section and exclude it from the tables.
Run a post-major-work QC audit on the OIDC Phase 1–5 implementation.
Scope: git diff main..oidc-mvp
Spec: specs/335-oidc-login/spec.md
Prior decisions: .squad/decisions.md (OIDC sections)
Constitution: .specify/memory/constitution.md
Run a post-major-work QC audit on the payment-gateway integration.
Scope: PR #412 (files: src/payments/, src/api/routes/checkout.ts, migrations/20260720_add_payment_methods.sql)
Design doc: docs/design/payment-gateway.md
No governance model — skip REPO-HOOK steps.
B1 | Security | src/api/handlers/coins.go:134
GetCoinByIDcallscoinRepo.FindByID(id)without scoping to the authenticated user's ID. Any authenticated user can fetch any coin by guessing an integer ID.
Remediation: Replace withcoinRepo.FindByIDForUser(id, userID)using theOwnedByIDscope, consistent withUpdateCoinat line 198.
F1 | Test Coverage | src/api/services/payment_service.go:88
ChargeCardhas no test case for theErrProviderTimeoutpath. Happy-path andErrCardDeclinedpaths are covered.
Suggested: Add a unit test with a mock that returnsErrProviderTimeout; confirm the service wraps it as a 503 to the caller.