| name | 20-pass-protocol |
| description | Use when creating, reviewing, improving, merging, compressing, or finalizing high-stakes prompts, agents, skills, source files, implementation plans, audit prompts, code changes, release instructions, runbooks, templates, or any artifact where accuracy, attention to detail, source-of-truth discipline, safety, or verification quality is critical. |
| activation | Activate when the description trigger applies to the current task. |
| required_inputs | Task request, relevant repository context, constraints, and authority dependencies. |
| required_outputs | Skill-specific artifact, verification evidence, canonical verdict, and next action. |
| authority_dependencies | 00_start_here/SOURCE_OF_TRUTH.md; 10_governance/APIVR_EXECUTION_LIFECYCLE.md; 10_governance/source_of_truth/Elite_Build_Goals_v3.md. |
| evidence_requirements | Executed checks or an honest Unknown, Not Run, or Blocked state for every material claim. |
20 Pass Protocol
Use this skill when the cost of a sloppy artifact is high. It applies to prompts, agents, skills, source files, plans, audits, release instructions, runbooks, templates, and critical documentation.
Do not claim `20 passes completed` unless the artifact was actually reviewed and improved through all 20 passes.
Each pass must make at least one concrete improvement to the artifact itself. A passive review, agreement, score-only note, or "no change needed" does not count as a pass.
This protocol does not replace APIVR, TDD, code review, security review, release gates, or provider smoke tests. It strengthens them.
Required Inputs
- Artifact type: prompt, agent, skill, source file, plan, audit, runbook, template, report, or other.
- Objective and intended user/operator.
- Canonical source files, paths, repos, or systems.
- Risk level, APIVR tier, and release impact.
- Required evidence or verification standard.
- Non-goals and actions that are not allowed.
When To Use
Use the full 20 passes for:
- production-impacting source files;
- auth, payments, privacy, security, data integrity, migrations, deployment, or external integrations;
- reusable prompts, agents, skills, templates, or runbooks;
- forensic audits and remediation plans;
- launch, release, rollback, or incident instructions;
- anything the user marks as critical, forensic, exact, final, or no-assumptions.
Use a compressed version only when APIVR tier is Rapid and the artifact is low-risk.
20 Passes
Run these passes after the first draft or first implementation.
A pass counts only when it changes the artifact in a useful way: clarifies language, removes ambiguity, tightens scope, adds missing evidence, corrects a source path, improves verification, adds a stop condition, removes duplication, strengthens safety, improves executability, or compresses without losing control.
Do not make fake or cosmetic edits just to count a pass. If no safe, useful improvement remains before pass 20, stop and report the completed pass count instead of claiming all 20.
| Pass | Focus | Required improvement question |
|---|
| 1 | Objective | Is the outcome explicit, measurable, and free of hidden assumptions? |
| 2 | Audience / operator | Does the artifact fit the person or agent who must use it? |
Make this better and be careful.
Run the 20 Pass Protocol on this Stripe webhook plan. Verify route contract, deployed callback URL, sandbox/live env split, no human-login dependency, signature validation, duplicate event handling, database proof, user-visible proof, and final release verdict.
