메뉴
Deep quality-control audit to run after major features, migrations, or integrations land — covers engineering best practices, security, docs, architecture, test coverage, supply chain, UX, and operational readiness
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/briandenicola/Aurearia --skill post-major-work-qc-audit명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Ensuring SQLite in-memory databases are truly isolated per Go test when using glebarez/sqlite
Handle mixed legacy/new set-type contracts without writing deprecated values.
Reuse the shared museum tray renderer across authenticated and public coin presentations.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | post-major-work-qc-audit |
| description | Deep quality-control audit to run after major features, migrations, or integrations land — covers engineering best practices, security, docs, architecture, test coverage, supply chain, UX, and operational readiness |
| domain | quality-assurance |
| confidence | low |
| source | manual |
| tools | [{"name":"grep / glob / view","description":"Navigate changed files, read specs, ADRs, CI config, and dependency manifests","when":"All investigation phases — always prefer direct reading over inference"},{"name":"git diff / git log","description":"Identify the exact changeset and authorship boundary for the audit","when":"Opening step to bound the scope of the audit"}] |
Run this skill when a significant batch of work has landed: a large feature, a security-sensitive change, a cross-cutting refactor, a new integration, or a migration that touches schema/API/contracts. Normal CI and per-PR review catch local defects; this skill catches systemic gaps — spec drift, missing regression coverage, deployment blind spots, and cross-cutting concerns that only surface when the whole change is viewed together.
Trigger conditions (any one suffices):
Portability note: Sections marked [REPO-HOOK] contain hooks specific to repositories that use a constitution/Quality Gate/Squad governance model. Skip or adapt those hooks when running in other repos.
Run a post-major-work QC audit on [feature/PR/branch description].
Scope: [list of changed files, or "git diff main..branch"].
Spec/design docs: [path(s) to spec.md, plan.md, ADRs, PRD sections].
Prior decisions: [path to decisions.md or ADR index, if present].
Before writing a single finding, complete the full Investigation Protocol below. Do not skip phases to save time.
Perform every phase in order. Record what you read, not what you assume.
git diff --name-only <base>..<head> (or equivalent) to enumerate every changed file.[REPO-HOOK] Check .specify/memory/constitution.md §0 hierarchy: Constitution → PRD → spec → plan → tasks → decisions.[REPO-HOOK] Read .github/pull_request_template.md DoD checklist to understand what the author self-certified.Check against the actual diff:
if err != nil { return } without log/wrap.[REPO-HOOK] Verify Go package import rules: handlers→services→repository→models. Run go test -run TestNoDirectDatabase ./... if applicable.For each changed auth, permission, secret-handling, or data-access path:
.Where("user_id = ?", userID) or equivalent.[REPO-HOOK] Verify GORM scopes (OwnedBy, OwnedByID) are used instead of raw .Where().latest).[REPO-HOOK] Flag violations of the constitution hierarchy (§0). A lower-ranked artefact that contradicts a higher-ranked one is a blocker.docs/, README.md, or equivalent that describe components changed by this work but were not updated in the diff.[REPO-HOOK] Run go test -run TestRegisteredAPIRoutesAreDocumentedInOpenAPI ./... if applicable.ALTER TABLE that would cause a destructive rebuild.[REPO-HOOK] Run npm run type-check and npx vue-tsc --noEmit.go.mod, package.json, pyproject.toml, or equivalent:
go.sum, package-lock.json, uv.lock) reflect the pin?(Skip or reduce scope if the changeset contains no frontend changes.)
variables.css (or equivalent).[REPO-HOOK] Enforce global CSS classes (.chip, .btn, .badge) and typography scale from the project constitution.fmt.Println or print() in production paths.Produce a single structured report. Every finding must reference a specific file path (and line number where possible) and quote or describe the exact evidence from the diff or referenced document. Do not generalize.
## Post-Major-Work QC Audit — [Feature / PR / Branch]
**Audited by:** [Agent name]
**Date:** [ISO 8601]
**Changeset:** [git diff base..head, or PR number]
**Spec / design doc:** [path or URL]
### Scope Summary
[2–4 sentences: what changed, which layers, which domains are in scope]
### Artifact Checklist
- [ ] Diff read (all N changed files)
- [ ] Authorizing spec / PRD section read
- [ ] Relevant ADRs read
- [ ] CI workflow read
- [ ] [REPO-HOOK] Constitution and DoD checklist reviewed
- [ ] All 8 Audit Domains traversed
### Blockers ← Must be resolved before merge / deploy
| ID | Domain | File : Line | Finding | Required Remediation |
|----|--------|-------------|---------|----------------------|
| B1 | Security | src/api/handlers/foo.go:42 | Missing userID scope on DB query | Add `.Where("user_id = ?", uid)` before `.Find()` |
### Follow-Ups ← Recommended but not merge-blocking
| ID | Domain | File : Line | Finding | Suggested Remediation |
|----|--------|-------------|---------|----------------------|
| F1 | Test Coverage | src/api/services/bar.go:88 | No test for nil-repo error path | Add unit test case with mock returning `ErrNotFound` |
### Positive Observations
[Optional: note design decisions or test patterns that are worth reusing]
### Confidence Notes
[Note any area where evidence was ambiguous, files were inaccessible, or a domain was partially skipped and why]
Severity rules:
[REPO-HOOK] Any finding that would fail §17 Quality Gate or violate a constitution Principle is automatically a Blocker.Do not do these:
Checklist-from-memory audit — Listing general best practices ("ensure proper error handling") without citing a specific file and line from the diff. Every finding must be grounded in observed evidence.
Inventing facts — Claiming a test is missing without first reading the test files; claiming a dependency is unpinned without reading the lock file; claiming an endpoint is unauthenticated without reading the middleware chain.
Skipping the diff — Starting with domain checklists before completing the Investigation Protocol. Phase 0–2 are not optional.
Escalating style to blocker — Naming a follow-up a blocker because it violates a preference rather than a security, correctness, or contract requirement.
Collapsing all findings into prose — Narrative descriptions of many issues in a paragraph. Every issue must appear as a row in the Blockers or Follow-Ups table with a file path.
Re-auditing what CI already gates — If go vet, ruff, or vue-tsc already runs in CI and passes, do not re-raise issues those tools would have caught. Focus on what CI cannot see: cross-cutting spec alignment, deployment implications, threat model, and emergent interactions.
Scope creep into unrelated files — The audit covers the changeset plus directly referenced dependencies. Do not audit the entire codebase.
Hedging every finding — "This might be an issue depending on context." If confidence is insufficient to make a clear call, note it in the Confidence Notes section and exclude it from the tables.
Run a post-major-work QC audit on the OIDC Phase 1–5 implementation.
Scope: git diff main..oidc-mvp
Spec: specs/335-oidc-login/spec.md
Prior decisions: .squad/decisions.md (OIDC sections)
Constitution: .specify/memory/constitution.md
Run a post-major-work QC audit on the payment-gateway integration.
Scope: PR #412 (files: src/payments/, src/api/routes/checkout.ts, migrations/20260720_add_payment_methods.sql)
Design doc: docs/design/payment-gateway.md
No governance model — skip REPO-HOOK steps.
B1 | Security | src/api/handlers/coins.go:134
GetCoinByIDcallscoinRepo.FindByID(id)without scoping to the authenticated user's ID. Any authenticated user can fetch any coin by guessing an integer ID.
Remediation: Replace withcoinRepo.FindByIDForUser(id, userID)using theOwnedByIDscope, consistent withUpdateCoinat line 198.
F1 | Test Coverage | src/api/services/payment_service.go:88
ChargeCardhas no test case for theErrProviderTimeoutpath. Happy-path andErrCardDeclinedpaths are covered.
Suggested: Add a unit test with a mock that returnsErrProviderTimeout; confirm the service wraps it as a 503 to the caller.