菜单
TRUST 5 quality principles and how MoAI enforces them through agents, the 3-level harness, /moai gate, and sync-auditor scoring. Use for code review, quality gate checks, coverage targets, or TRUST 5 compliance.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/TuYv/ccpm --skill moai-foundation-quality命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Use when auditing a paid ad account for incremental contribution, wasted spend, or measurement integrity before scaling; runs a typed 20-item ROAS profile with verified vetoes and a SHIP/FIX/BLOCK/UNDECIDED gate on own exported data. Not for campaign structure design — use campaign-architect; not for creative production — use ad-creative-builder. 付费广告账户审计/ROAS评分
Use when the user asks to "write ad copy", "generate RSA headlines", or "build ad creative at volume"; produces ad units — RSA headlines/descriptions, hooks, and an angle matrix — message-matched to the destination landing page. Not for scoring an ad account — use ad-account-auditor; not for the post-click page — use landing-optimizer; not for organic articles — use content-writer. 广告创意/广告文案/RSA标题
Use when the user asks to "design an A/B test", "set up a creative/landing test", "run an incrementality test", or "is this result statistically and practically material?"; produces a hypothesis, variant matrix, sample-size/duration/power plan, and a documented effect/uncertainty read from own exported results. It applies only a precommitted owner-approved action rule; the statistical helper never chooses a business action. Not for producing variants — use ad-creative-builder; not for reading back one shipped change — use paid-measurement-loop. 广告AB测试设计/实验设计/显著性判定/增效测试
| name | moai-foundation-quality |
| description | TRUST 5 quality principles and how MoAI enforces them through agents, the 3-level harness, /moai gate, and sync-auditor scoring. Use for code review, quality gate checks, coverage targets, or TRUST 5 compliance. |
| when_to_use | Use for code-quality guidance: TRUST 5 principles (Tested, Readable, Unified, Secured, Trackable), the 3-level harness (minimal/standard/ thorough), /moai gate (lint+format+type+test), coverage targets, security checks, language-aware toolchains, code-smell detection, and technical-debt triage. |
| license | Apache-2.0 |
| compatibility | Designed for Claude Code |
| allowed-tools | Read, Grep, Glob |
| user-invocable | false |
| metadata | {"version":"3.0.0","category":"foundation","status":"active","updated":"2026-07-10","modularized":"true","tags":"foundation, quality, testing, validation, trust-5, best-practices, code-review","aliases":"moai-foundation-quality"} |
| progressive_disclosure | {"enabled":true,"level1_tokens":100,"level2_tokens":5000} |
This skill provides background knowledge on MoAI's quality model: the five
TRUST 5 principles, how agents enforce them, the 3-level harness, and the
language-aware toolchains that /moai gate runs. MoAI does NOT ship a
quality-validation library — quality is enforced through agents
(manager-develop, sync-auditor), slash commands (/moai gate,
/moai review), and the harness (minimal/standard/thorough).
TRUST 5 Principles (Tested, Readable, Unified, Secured, Trackable) are quality dimensions, not code objects. Every code change is evaluated against all five.
Quality Mechanisms (the real enforcement layer):
/moai gate — runs lint + format + type-check + test in parallel as a
pre-commit quality gate (<30s). Auto-detects the project language and runs
the appropriate toolchain.manager-develop (run-phase) — implements via cycle_type ∈ {tdd, ddd,
autofix}; the chosen cycle shapes how tests and behavior are produced.sync-auditor — independent skeptical quality assessment with 4-dimension
scoring (Functionality, Security, Craft, Consistency), scored as the
harmonic mean of dimensions, not the average.MoAI does not provide a Python SDK or any library for quality validation. Quality is enforced through the workflow, the agents, and the gate commands. This skill documents how those pieces fit together so a Claude invocation can reason about quality correctly.
| Phase | Quality check | Owner |
|---|---|---|
| plan | Capture LSP baseline; identify quality risks in the plan | manager-spec |
| run | Zero errors/type-errors/lint-errors; tests pass; coverage met | manager-develop (cycle_type shapes the approach) |
| sync | Lint clean (≤10 warnings); docs updated; TRUST 5 re-affirmed | manager-docs, then sync-auditor scores |
| audit |
| Independent 4-dimension scoring (Functionality/Security/Craft/Consistency) |
| sync-auditor |
The run-phase cycle_type selects how quality is built in:
/moai fix and regression recovery.See Skill("moai-workflow-tdd"), Skill("moai-workflow-ddd"), and Skill("moai-workflow-loop") for the per-cycle mechanics.
TRUST 5 is a mnemonic for five quality dimensions. Treat each as a question to ask of any change, not a score to compute.
For the per-principle assessment checklist and the "not applicable" guard, see TRUST 5 Principles.
The harness level controls how deep quality validation goes. It is auto-determined by the Complexity Estimator based on SPEC scope.
| Level | What runs | When |
|---|---|---|
| minimal | Fast validation only (lint + type + test) | Small SPECs, low risk |
| standard | Default checks (lint + type + test + format) | Most SPECs |
| thorough | Full sync-auditor + 4-dimension TRUST 5 scoring | Large SPECs, high risk |
/moai gate is the lightweight pre-commit entry point: it runs lint +
format + type-check + test in parallel and applies no fixes. It is the
fastest way to get a quality signal. For deeper review use /moai review.
The quality gate auto-detects the project language and runs the appropriate toolchain. Tools that are not installed are skipped gracefully; projects with no recognized language marker pass the gate silently. This skill is language-neutral — the 16 supported languages are treated equally.
| Language | Lint | Format | Test |
|---|---|---|---|
| Go | go vet → golangci-lint | gofmt | go test |
| Python | ruff | black | pytest |
| TypeScript / JavaScript | eslint | prettier | jest / mocha |
| Rust | cargo clippy | rustfmt | cargo test |
| Java / Kotlin | (per project linter) | (per project) | junit |
| Ruby | rubocop | rubocop | rspec |
| PHP | phpstan / phpcs | php-cs-fixer | pest / phpunit |
| ... | (16 languages supported; auto-detected) |
For the full toolchain mapping and how /moai gate detects the language,
see Language-Aware Toolchains.
Each module is loaded on demand. Load the one relevant to the current task.
/moai gate,
/moai review, and /moai loop surface quality issues proactively, and
how to triage findings.Agents (see CLAUDE.md §4 for the 11-agent catalog):
manager-develop — run-phase implementation; owns the Tested and Unified
principles through cycle_type.sync-auditor — independent 4-dimension quality scoring (Functionality /
Security / Craft / Consistency).Explore (Anthropic built-in) — read-only codebase exploration before
assessing quality.Skills:
moai-foundation-core — TRUST 5 framework cross-reference and SPEC
workflow foundations.moai-ref-testing-pyramid — test-pyramid strategy, coverage targets, and
test patterns.moai-ref-owasp-checklist — OWASP Top 10 security checklist for the
Secured principle.moai-workflow-tdd / moai-workflow-ddd / moai-workflow-loop — the
cycle_type workflows that manager-develop uses.Commands:
/moai gate — pre-commit quality gate (lint + format + type + test)./moai review — code review with security and MX-tag compliance./moai fix — auto-detect and fix LSP/lint/type errors./moai loop — iterative fix loop until resolved or max iterations.| Rationalization | Reality |
|---|---|
| "The linter warnings are false positives" | False positives should be suppressed with inline comments. Ignoring them trains the team to ignore real issues. |
| "Security scanning can wait until before release" | Security vulnerabilities compound. Late discovery means expensive rework. Scan continuously. |
| "Coverage is high enough, the remaining 15% is edge cases" | Edge cases are where production bugs live. The uncovered code is the riskiest code. |
| "Code review is subjective, automation is sufficient" | Automation catches syntax and patterns. Reviews catch design flaws, naming confusion, and missing abstractions. |
| "TRUST 5 is too bureaucratic for a hotfix" | Hotfixes without quality gates introduce the next hotfix. TRUST 5 on a hotfix is the minimum, not the maximum. |
Chesterton's Fence: Before removing a quality check, understand why it was added. Removing a gate without understanding its history repeats the failure it was designed to prevent.
Shift Left: The earlier a defect is found, the cheaper it is to fix. Quality checks belong in the development loop, not at the end of it.