Phase 1: enforce the workflow across the team (verify auditor + Gate Checks) - #2
Merged
Merged
Conversation
…Checks) - Import + modernize the verify (QA Auditor) agent under quality/verify; it owns the APPROVAL_GATE (pre-impl readiness) and VERIFIED (final audit) hard gates. - Add /verify command. - Wire the standard Gate Check into the gate-owning agents: /arch (ARCH_APPROVED), /secops (SECOPS_APPROVED, safety-override), /rev (CODE_REVIEWED), /qa (after CODE_REVIEWED), /ui (DESIGN_APPROVED) - each consults the workflow-engine and refuses to cross an unmet hard gate. Part of Phase 1; later PRs extend Gate Checks to the rest of the roster and do the progressive-disclosure refactor. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR operationalizes the Phase 0 workflow by introducing a new /verify QA-auditor agent (owning APPROVAL_GATE and VERIFIED) and embedding “Gate Check” workflow enforcement sections into several gate-owning agents so they consult workflow-engine and enforce required gates via the ledger.
Changes:
- Added the new
verifyskill with proposal/devdoc/code audit checkpoints, placeholder detection, traceability requirements, and a mandatory audit output format. - Added
/verifycommand wiring and supporting reference docs (checklists, placeholder patterns, traceability template). - Updated
/arch,/secops,/rev,/qa, and/uiskills with workflow Gate Check sections aligned to gate ownership.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| claude/skills/quality/verify/SKILL.md | New /verify auditor skill including gate ownership + audit protocols. |
| claude/skills/quality/verify/references/traceability-template.md | Traceability matrix template for audits. |
| claude/skills/quality/verify/references/placeholder-patterns.md | Central placeholder patterns + suggested search approach. |
| claude/skills/quality/verify/references/checkpoint-1-proposal.md | CP1 proposal audit checklist. |
| claude/skills/quality/verify/references/checkpoint-2-devdoc.md | CP2 dev doc audit checklist. |
| claude/skills/quality/verify/references/checkpoint-3-implementation.md | CP3 implementation audit checklist (code-vs-spec, tests, security, ops). |
| claude/skills/quality/testing/tester/SKILL.md | Adds Gate Check guidance for /qa (after CODE_REVIEWED). |
| claude/skills/quality/review/reviewer/SKILL.md | Adds Gate Check guidance for /rev and CODE_REVIEWED. |
| claude/skills/operations/secops/secops-engineer/SKILL.md | Adds Gate Check guidance for /secops and SECOPS_APPROVED (safety override). |
| claude/skills/design/ui-designer/SKILL.md | Adds Gate Check guidance for /ui and DESIGN_APPROVED (soft). |
| claude/skills/architecture/solution-architect/SKILL.md | Adds Gate Check guidance for /arch and ARCH_APPROVED. |
| claude/commands/verify.md | Adds /verify command entry pointing to the new skill and gates. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+72
to
+76
| 1. Check if argument specifies a file path → read that file | ||
| 2. Check for `proposal.md`, `PROPOSAL.md`, `devdoc.md`, `DEVDOC.md`, `feature-*.md` in working directory → read automatically | ||
| 3. Check if document content was pasted in conversation → use that | ||
| 4. Check if a Confluence page URL or ID was provided → fetch via Atlassian MCP | ||
| 5. If none found → ask the user to provide the document |
| ``` | ||
| e.g., | ||
| ``` | ||
| **Note:** `e.g.,` in table cells is almost always template example text that wasn't replaced. In prose paragraphs it may be legitimate — use judgment, but flag it. |
- verify: state the VERIFIED precondition (runs after QA / CODE_REVIEWED). - verify: make Confluence/Jira input optional (file-based markdown is the default). - verify + placeholder-patterns: fix placeholder counting (grep -oF | wc -l, not grep -c or unescaped regex) and include INSTRUCTION:. - placeholder-patterns: split hard placeholders (auto-FAIL) vs soft signals (e.g. / [e.g. - flag for judgment), resolving the threshold inconsistency. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Comment on lines
+11
to
+14
| ## Gate Check (workflow) | ||
| Consult the **`workflow-engine`** skill first. `/secops` owns **`SECOPS_APPROVED`** (`hard`, **safety-override**). | ||
| - **Trigger:** auth, secrets, PII, file upload, external input, network, or crypto — and it **cannot be downgraded or skipped for being a "small" change**. | ||
| - **On pass:** record `SECOPS_APPROVED` + findings in the ledger. On unresolved high/critical issues: **block** and name them. |
Comment on lines
+275
to
+277
| # §6.3 Configuration — verify properties exist | ||
| grep -r "property-name" application.yml config/ *.el | ||
|
|
Comment on lines
+24
to
+26
| # Verify config properties exist | ||
| grep -rn "property.name" src/ config/ *.yml *.el *.json | ||
| ``` |
- secops: reconcile 'mandatory for ALL features' with the proportional model — /secops is a safety-override gate (required on triggers; always in regulated preset), not forced for trivial changes. - verify: APPROVAL_GATE no longer hard-requires the soft DESIGN_APPROVED; tie each gate to its matching /verify subcommand; VERIFIED requires concrete QA evidence in the ledger, not just CODE_REVIEWED + CI pass. - tester: replace undefined 'Required Dev Attention' with the canonical Dev/Implementation stage + ledger note. - verify + checkpoint-3: fix fragile grep globs (use -r --include); drop Emacs-specific (*.el / Cask) examples. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Comment on lines
+11
to
+14
| ## Gate Check (workflow) | ||
| Consult the **`workflow-engine`** skill first. `/secops` owns **`SECOPS_APPROVED`** (`hard`, **safety-override**). | ||
| - **Trigger:** auth, secrets, PII, file upload, external input, network, or crypto — and it **cannot be downgraded or skipped for being a "small" change**. | ||
| - **On pass:** record `SECOPS_APPROVED` + findings in the ledger. On unresolved high/critical issues: **block** and name them. |
| Consult the **`workflow-engine`** skill first — it decides *which* gates this ticket requires. `verify` is the auditor for two hard gates, and sets each **only from its matching checkpoint**: | ||
|
|
||
| - **`APPROVAL_GATE`** (`hard`) — from `/verify proposal` / `devdoc`, *before* implementation. Confirm the ticket is ready: behavioral AC present, no placeholder content, and the **hard** upstream gates that apply are `passed` (`ARCH_APPROVED`, `SECOPS_APPROVED` when triggered). `DESIGN_APPROVED` is a **soft** gate — record a missing design sign-off as an observation, but do **not** fail `APPROVAL_GATE` on it alone. On pass → set `APPROVAL_GATE`; on fail → **refuse and list exactly what's missing**. | ||
| - **`VERIFIED`** (`hard`) — from `/verify code` / `all`, *before* Done. **Precondition: QA actually ran** — require concrete evidence in the ledger (a `/qa` outcome / test report), not merely `CODE_REVIEWED` + a unit/CI pass. Confirm the implementation matches the AC, tests exist and pass, and there is no specification drift. On pass → set `VERIFIED`; otherwise **block**. |
Comment on lines
+132
to
+136
| # 2. Hardcoded secrets (MUST find 0 results) | ||
| grep -rni "password\s*=\|secret\s*=\|api.key\s*=\|api_key\s*=\|token\s*=" src/ *.el \ | ||
| --include="*.java" --include="*.el" --include="*.ts" --include="*.py" \ | ||
| | grep -v test | grep -v ".class" | grep -v "node_modules" | ||
|
|
Comment on lines
+129
to
+131
| # 1. Auth on endpoints | ||
| grep -rn "@PreAuthorize\|@Secured\|@RolesAllowed\|auth.*middleware\|:auth" src/ *.el | ||
|
|
Comment on lines
+140
to
+142
| # 4. SQL injection risk (string concatenation in queries) | ||
| grep -rn "\".*+.*sql\|format.*sql\|concat.*query\|string-append.*sql" src/ *.el | ||
| ``` |
- Genericize all imported grep examples: drop Emacs-specific *.el / Cask / Makefile, use -r --include so commands are robust in any repo. - secops: reconcile the frontmatter description with the proportional model (safety-override gate, not 'mandatory for ALL features'). - Make [e.g. a soft signal consistently (placeholder-patterns + checkpoint-1). - ledger: add a qa outcome field so VERIFIED's 'evidence in the ledger' is satisfiable. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Comment on lines
+8
to
+11
| ## Gate Check (workflow) | ||
| Consult the **`workflow-engine`** skill first. `/qa` runs after **`CODE_REVIEWED`** is `passed`. | ||
| - **Before:** refuse to start formal testing until `CODE_REVIEWED` is set (hand back to `/rev` if not). | ||
| - **On completion:** record the test outcome in the ledger/ticket note. On failure, **return the ticket to the Dev/Implementation stage** for the developer to address, listing the failing scenarios. Final sign-off is `/verify`'s `VERIFIED` gate. |
Comment on lines
+37
to
+40
| ``` | ||
| Discussion → Proposal → /verify proposal → Agent Reviews → Human Approval | ||
| → Dev Feature Doc → /verify devdoc → Implementation → /verify code → Done | ||
| ``` |
Comment on lines
+20
to
+23
| Consult the **`workflow-engine`** skill first — it decides *which* gates this ticket requires. `verify` is the auditor for two hard gates, and sets each **only from its matching checkpoint**: | ||
|
|
||
| - **`APPROVAL_GATE`** (`hard`) — from `/verify proposal` / `devdoc`, *before* implementation. Confirm the ticket is ready: behavioral AC present, no placeholder content, and the **hard** upstream gates that apply are `passed` (`ARCH_APPROVED`, `SECOPS_APPROVED` when triggered). `DESIGN_APPROVED` is a **soft** gate — record a missing design sign-off as an observation, but do **not** fail `APPROVAL_GATE` on it alone. On pass → set `APPROVAL_GATE`; on fail → **refuse and list exactly what's missing**. | ||
| - **`VERIFIED`** (`hard`) — from `/verify code` / `all`, *before* Done. **Precondition: QA actually ran** — require concrete evidence in the ledger (a `/qa` outcome / test report), not merely `CODE_REVIEWED` + a unit/CI pass. Confirm the implementation matches the AC, tests exist and pass, and there is no specification drift. On pass → set `VERIFIED`; otherwise **block**. |
|
|
||
| After completing the audit, save the report: | ||
| ``` | ||
| audit-report-YYYY-MM-DD-[checkpoint].md |
| ``` | ||
| Example: `audit-report-2026-03-25-proposal.md` | ||
|
|
||
| Place in working directory for version control tracking. |
| | 22 | §15 Open Questions | Populated OR explicitly "None — all resolved" | | ||
| | 23 | §16 Glossary | 3+ domain terms defined | | ||
|
|
||
| **Scoring:** 23/23 = PASS, 20-22 = MINOR GAPS, <20 = FAIL |
- /qa: write canonical qa:{outcome,by,at,evidence} to the ledger.
- verify: fix the Workflow Position diagram to reflect gate order
(arch/secops/design before APPROVAL_GATE; rev/qa before VERIFIED).
- verify: record a skipped soft DESIGN_APPROVED in the ledger with a reason.
- verify: reconcile CP1 scoring with the verdict taxonomy; APPROVAL_GATE
(hard) only on a full PASS.
- verify: save audit reports under the ticket's approvals/ folder, not repo root.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Comment on lines
31
to
33
| - `state`: `passed` | `pending` | `rejected`. | ||
| - `qa`: the recorded QA outcome (`outcome`, `by`, `at`, `evidence`) — `/verify` reads this as proof the `/qa` step actually ran before it sets `VERIFIED`. | ||
| - Every gate decision is appended with `by` (the agent) and `at` (ISO-8601). Soft-gate skips go in `skips[]` with a `reason`. |
Comment on lines
+9
to
+11
| Consult the **`workflow-engine`** skill first. `/rev` owns **`CODE_REVIEWED`** (`hard`). | ||
| - **Before:** code is present and, when triggered, `ARCH_APPROVED` / `SECOPS_APPROVED` are `passed`. | ||
| - **On APPROVED:** set `CODE_REVIEWED` in the ledger. On CHANGES REQUESTED: do **not** set it — return the ticket to the developer with the blocking items. |
|
|
||
| After completing the audit, save the report: | ||
| ``` | ||
| audit-report-YYYY-MM-DD-[checkpoint].md |
| ``` | ||
| audit-report-YYYY-MM-DD-[checkpoint].md | ||
| ``` | ||
| Example: `audit-report-2026-03-25-proposal.md` |
olehsvyrydov
added a commit
that referenced
this pull request
Jun 4, 2026
…/be /e2e) (#3) * Phase 1: wire Gate Checks into the rest of the team Extends workflow enforcement (PR #2) to the remaining core agents, each consulting the workflow-engine: - /po + /ba: produce the ticket + behavioral AC (foundation for APPROVAL_GATE). - /sm: orchestrator/advancer - records gate transitions; only role that sets Done, and only when all required gates pass. - /fe + /be: require APPROVAL_GATE (or triggered ARCH/SECOPS) before implementing; TDD -> hand to /rev for CODE_REVIEWED. - /e2e: runs after CODE_REVIEWED; records the qa outcome /verify reads before VERIFIED. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address Copilot review on PR #3 - /fe + /be: reword Gate Check to require only the hard gates the workflow-engine determines apply (ARCH/SECOPS on trigger; APPROVAL_GATE on the full track), not implying APPROVAL_GATE is universal; DESIGN_APPROVED stays soft. - /e2e: append E2E evidence to the existing ledger qa entry instead of overwriting /qa's outcome. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
olehsvyrydov
added a commit
that referenced
this pull request
Jun 4, 2026
* Phase 1: add 8 new specialist agents + disambiguation matrix New agents (modern SKILL.md + command + Gate Check): - /ai AI/LLM Application Engineer (RAG, agents, prompts, evals, guardrails) - /data Data Engineer (ETL/ELT, dbt, warehouse, streaming, quality) - /sre SRE/Observability (SLOs, monitoring, incidents) - owns RELIABILITY_OK - /ios /android Native Mobile (Swift/SwiftUI, Kotlin/Compose) - /ux UX Researcher (interviews, usability, IA, synthesis) - /perf Performance Engineer (Web Vitals, profiling, budgets) - owns PERF_OK - /dba Database Administrator (schema, indexing, migrations, replication) Plus claude/skills/disambiguation.md so the ~48 agents route correctly. (verify/QA Auditor was added in PR #2.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address Copilot review on PR #4 - Use concrete skill names everywhere (mlops-engineer / devops-engineer / flutter-developer) instead of free-text roles, for unambiguous routing. - /perf (PERF_OK) and /sre (RELIABILITY_OK) are soft gates - follow the soft-gate policy (warn + record skip), don't hard-block; note how to make them hard via the regulated preset. - native-mobile: reword to 'required upstream gates' (DESIGN_APPROVED is soft). - Drop the unbacked /ada alias. - Add the 8 new agents to /agents (discoverability) + link the disambiguation matrix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address Copilot re-review (round 2) on PR #4 - ai/data/native: add APPROVAL_GATE (full track) to the implementation Gate Checks, matching /fe and /be. - sre: correct the config note - refusal (hard/soft) is a gate property in workflow.yaml, not a preset setting. - mlops-engineer: narrow its description to ML/inference ops and defer app-level LLM features + prompt engineering to /ai (resolves the disambiguation overlap). - disambiguation: use flutter-developer in the rule-of-thumb too. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address Copilot re-review (round 3) on PR #4 - sre: reword the config note to reference the RELIABILITY_OK gate entry's refusal field under the gates: mapping (not a dotted path). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address Copilot re-review (round 4) on PR #4 - ai-engineer: fix mismatched bold/paren formatting in the Gate Check bullet. - mlops-engineer: reconcile the Trigger list with the new routing - app-level LLM features (RAG/agents/prompt eng/evals) route to /ai; MLOps keeps the inference-ops layer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
olehsvyrydov
added a commit
that referenced
this pull request
Jun 5, 2026
…Checks) (#2) * Phase 1: enforce the workflow across the team (verify auditor + Gate Checks) - Import + modernize the verify (QA Auditor) agent under quality/verify; it owns the APPROVAL_GATE (pre-impl readiness) and VERIFIED (final audit) hard gates. - Add /verify command. - Wire the standard Gate Check into the gate-owning agents: /arch (ARCH_APPROVED), /secops (SECOPS_APPROVED, safety-override), /rev (CODE_REVIEWED), /qa (after CODE_REVIEWED), /ui (DESIGN_APPROVED) - each consults the workflow-engine and refuses to cross an unmet hard gate. Part of Phase 1; later PRs extend Gate Checks to the rest of the roster and do the progressive-disclosure refactor. * Address Copilot review on PR #2 - verify: state the VERIFIED precondition (runs after QA / CODE_REVIEWED). - verify: make Confluence/Jira input optional (file-based markdown is the default). - verify + placeholder-patterns: fix placeholder counting (grep -oF | wc -l, not grep -c or unescaped regex) and include INSTRUCTION:. - placeholder-patterns: split hard placeholders (auto-FAIL) vs soft signals (e.g. / [e.g. - flag for judgment), resolving the threshold inconsistency. * Address Copilot re-review (round 2) on PR #2 - secops: reconcile 'mandatory for ALL features' with the proportional model — /secops is a safety-override gate (required on triggers; always in regulated preset), not forced for trivial changes. - verify: APPROVAL_GATE no longer hard-requires the soft DESIGN_APPROVED; tie each gate to its matching /verify subcommand; VERIFIED requires concrete QA evidence in the ledger, not just CODE_REVIEWED + CI pass. - tester: replace undefined 'Required Dev Attention' with the canonical Dev/Implementation stage + ledger note. - verify + checkpoint-3: fix fragile grep globs (use -r --include); drop Emacs-specific (*.el / Cask) examples. * Address Copilot re-review (round 3) on PR #2 - Genericize all imported grep examples: drop Emacs-specific *.el / Cask / Makefile, use -r --include so commands are robust in any repo. - secops: reconcile the frontmatter description with the proportional model (safety-override gate, not 'mandatory for ALL features'). - Make [e.g. a soft signal consistently (placeholder-patterns + checkpoint-1). - ledger: add a qa outcome field so VERIFIED's 'evidence in the ledger' is satisfiable. * Address Copilot re-review (round 4): verify polish - /qa: write canonical qa:{outcome,by,at,evidence} to the ledger. - verify: fix the Workflow Position diagram to reflect gate order (arch/secops/design before APPROVAL_GATE; rev/qa before VERIFIED). - verify: record a skipped soft DESIGN_APPROVED in the ledger with a reason. - verify: reconcile CP1 scoring with the verdict taxonomy; APPROVAL_GATE (hard) only on a full PASS. - verify: save audit reports under the ticket's approvals/ folder, not repo root.
olehsvyrydov
added a commit
that referenced
this pull request
Jun 5, 2026
…/be /e2e) (#3) * Phase 1: wire Gate Checks into the rest of the team Extends workflow enforcement (PR #2) to the remaining core agents, each consulting the workflow-engine: - /po + /ba: produce the ticket + behavioral AC (foundation for APPROVAL_GATE). - /sm: orchestrator/advancer - records gate transitions; only role that sets Done, and only when all required gates pass. - /fe + /be: require APPROVAL_GATE (or triggered ARCH/SECOPS) before implementing; TDD -> hand to /rev for CODE_REVIEWED. - /e2e: runs after CODE_REVIEWED; records the qa outcome /verify reads before VERIFIED. * Address Copilot review on PR #3 - /fe + /be: reword Gate Check to require only the hard gates the workflow-engine determines apply (ARCH/SECOPS on trigger; APPROVAL_GATE on the full track), not implying APPROVAL_GATE is universal; DESIGN_APPROVED stays soft. - /e2e: append E2E evidence to the existing ledger qa entry instead of overwriting /qa's outcome.
olehsvyrydov
added a commit
that referenced
this pull request
Jun 5, 2026
* Phase 1: add 8 new specialist agents + disambiguation matrix New agents (modern SKILL.md + command + Gate Check): - /ai AI/LLM Application Engineer (RAG, agents, prompts, evals, guardrails) - /data Data Engineer (ETL/ELT, dbt, warehouse, streaming, quality) - /sre SRE/Observability (SLOs, monitoring, incidents) - owns RELIABILITY_OK - /ios /android Native Mobile (Swift/SwiftUI, Kotlin/Compose) - /ux UX Researcher (interviews, usability, IA, synthesis) - /perf Performance Engineer (Web Vitals, profiling, budgets) - owns PERF_OK - /dba Database Administrator (schema, indexing, migrations, replication) Plus claude/skills/disambiguation.md so the ~48 agents route correctly. (verify/QA Auditor was added in PR #2.) * Address Copilot review on PR #4 - Use concrete skill names everywhere (mlops-engineer / devops-engineer / flutter-developer) instead of free-text roles, for unambiguous routing. - /perf (PERF_OK) and /sre (RELIABILITY_OK) are soft gates - follow the soft-gate policy (warn + record skip), don't hard-block; note how to make them hard via the regulated preset. - native-mobile: reword to 'required upstream gates' (DESIGN_APPROVED is soft). - Drop the unbacked /ada alias. - Add the 8 new agents to /agents (discoverability) + link the disambiguation matrix. * Address Copilot re-review (round 2) on PR #4 - ai/data/native: add APPROVAL_GATE (full track) to the implementation Gate Checks, matching /fe and /be. - sre: correct the config note - refusal (hard/soft) is a gate property in workflow.yaml, not a preset setting. - mlops-engineer: narrow its description to ML/inference ops and defer app-level LLM features + prompt engineering to /ai (resolves the disambiguation overlap). - disambiguation: use flutter-developer in the rule-of-thumb too. * Address Copilot re-review (round 3) on PR #4 - sre: reword the config note to reference the RELIABILITY_OK gate entry's refusal field under the gates: mapping (not a dotted path). * Address Copilot re-review (round 4) on PR #4 - ai-engineer: fix mismatched bold/paren formatting in the Gate Check bullet. - mlops-engineer: reconcile the Trigger list with the new routing - app-level LLM features (RAG/agents/prompt eng/evals) route to /ai; MLOps keeps the inference-ops layer.
olehsvyrydov
added a commit
that referenced
this pull request
Jun 5, 2026
…Checks) (#2) * Phase 1: enforce the workflow across the team (verify auditor + Gate Checks) - Import + modernize the verify (QA Auditor) agent under quality/verify; it owns the APPROVAL_GATE (pre-impl readiness) and VERIFIED (final audit) hard gates. - Add /verify command. - Wire the standard Gate Check into the gate-owning agents: /arch (ARCH_APPROVED), /secops (SECOPS_APPROVED, safety-override), /rev (CODE_REVIEWED), /qa (after CODE_REVIEWED), /ui (DESIGN_APPROVED) - each consults the workflow-engine and refuses to cross an unmet hard gate. Part of Phase 1; later PRs extend Gate Checks to the rest of the roster and do the progressive-disclosure refactor. * Address Copilot review on PR #2 - verify: state the VERIFIED precondition (runs after QA / CODE_REVIEWED). - verify: make Confluence/Jira input optional (file-based markdown is the default). - verify + placeholder-patterns: fix placeholder counting (grep -oF | wc -l, not grep -c or unescaped regex) and include INSTRUCTION:. - placeholder-patterns: split hard placeholders (auto-FAIL) vs soft signals (e.g. / [e.g. - flag for judgment), resolving the threshold inconsistency. * Address Copilot re-review (round 2) on PR #2 - secops: reconcile 'mandatory for ALL features' with the proportional model — /secops is a safety-override gate (required on triggers; always in regulated preset), not forced for trivial changes. - verify: APPROVAL_GATE no longer hard-requires the soft DESIGN_APPROVED; tie each gate to its matching /verify subcommand; VERIFIED requires concrete QA evidence in the ledger, not just CODE_REVIEWED + CI pass. - tester: replace undefined 'Required Dev Attention' with the canonical Dev/Implementation stage + ledger note. - verify + checkpoint-3: fix fragile grep globs (use -r --include); drop Emacs-specific (*.el / Cask) examples. * Address Copilot re-review (round 3) on PR #2 - Genericize all imported grep examples: drop Emacs-specific *.el / Cask / Makefile, use -r --include so commands are robust in any repo. - secops: reconcile the frontmatter description with the proportional model (safety-override gate, not 'mandatory for ALL features'). - Make [e.g. a soft signal consistently (placeholder-patterns + checkpoint-1). - ledger: add a qa outcome field so VERIFIED's 'evidence in the ledger' is satisfiable. * Address Copilot re-review (round 4): verify polish - /qa: write canonical qa:{outcome,by,at,evidence} to the ledger. - verify: fix the Workflow Position diagram to reflect gate order (arch/secops/design before APPROVAL_GATE; rev/qa before VERIFIED). - verify: record a skipped soft DESIGN_APPROVED in the ledger with a reason. - verify: reconcile CP1 scoring with the verdict taxonomy; APPROVAL_GATE (hard) only on a full PASS. - verify: save audit reports under the ticket's approvals/ folder, not repo root.
olehsvyrydov
added a commit
that referenced
this pull request
Jun 5, 2026
…/be /e2e) (#3) * Phase 1: wire Gate Checks into the rest of the team Extends workflow enforcement (PR #2) to the remaining core agents, each consulting the workflow-engine: - /po + /ba: produce the ticket + behavioral AC (foundation for APPROVAL_GATE). - /sm: orchestrator/advancer - records gate transitions; only role that sets Done, and only when all required gates pass. - /fe + /be: require APPROVAL_GATE (or triggered ARCH/SECOPS) before implementing; TDD -> hand to /rev for CODE_REVIEWED. - /e2e: runs after CODE_REVIEWED; records the qa outcome /verify reads before VERIFIED. * Address Copilot review on PR #3 - /fe + /be: reword Gate Check to require only the hard gates the workflow-engine determines apply (ARCH/SECOPS on trigger; APPROVAL_GATE on the full track), not implying APPROVAL_GATE is universal; DESIGN_APPROVED stays soft. - /e2e: append E2E evidence to the existing ledger qa entry instead of overwriting /qa's outcome.
olehsvyrydov
added a commit
that referenced
this pull request
Jun 5, 2026
* Phase 1: add 8 new specialist agents + disambiguation matrix New agents (modern SKILL.md + command + Gate Check): - /ai AI/LLM Application Engineer (RAG, agents, prompts, evals, guardrails) - /data Data Engineer (ETL/ELT, dbt, warehouse, streaming, quality) - /sre SRE/Observability (SLOs, monitoring, incidents) - owns RELIABILITY_OK - /ios /android Native Mobile (Swift/SwiftUI, Kotlin/Compose) - /ux UX Researcher (interviews, usability, IA, synthesis) - /perf Performance Engineer (Web Vitals, profiling, budgets) - owns PERF_OK - /dba Database Administrator (schema, indexing, migrations, replication) Plus claude/skills/disambiguation.md so the ~48 agents route correctly. (verify/QA Auditor was added in PR #2.) * Address Copilot review on PR #4 - Use concrete skill names everywhere (mlops-engineer / devops-engineer / flutter-developer) instead of free-text roles, for unambiguous routing. - /perf (PERF_OK) and /sre (RELIABILITY_OK) are soft gates - follow the soft-gate policy (warn + record skip), don't hard-block; note how to make them hard via the regulated preset. - native-mobile: reword to 'required upstream gates' (DESIGN_APPROVED is soft). - Drop the unbacked /ada alias. - Add the 8 new agents to /agents (discoverability) + link the disambiguation matrix. * Address Copilot re-review (round 2) on PR #4 - ai/data/native: add APPROVAL_GATE (full track) to the implementation Gate Checks, matching /fe and /be. - sre: correct the config note - refusal (hard/soft) is a gate property in workflow.yaml, not a preset setting. - mlops-engineer: narrow its description to ML/inference ops and defer app-level LLM features + prompt engineering to /ai (resolves the disambiguation overlap). - disambiguation: use flutter-developer in the rule-of-thumb too. * Address Copilot re-review (round 3) on PR #4 - sre: reword the config note to reference the RELIABILITY_OK gate entry's refusal field under the gates: mapping (not a dotted path). * Address Copilot re-review (round 4) on PR #4 - ai-engineer: fix mismatched bold/paren formatting in the Gate Check bullet. - mlops-engineer: reconcile the Trigger list with the new routing - app-level LLM features (RAG/agents/prompt eng/evals) route to /ai; MLOps keeps the inference-ops layer.
olehsvyrydov
added a commit
that referenced
this pull request
Jun 6, 2026
…Checks) (#2) * Phase 1: enforce the workflow across the team (verify auditor + Gate Checks) - Import + modernize the verify (QA Auditor) agent under quality/verify; it owns the APPROVAL_GATE (pre-impl readiness) and VERIFIED (final audit) hard gates. - Add /verify command. - Wire the standard Gate Check into the gate-owning agents: /arch (ARCH_APPROVED), /secops (SECOPS_APPROVED, safety-override), /rev (CODE_REVIEWED), /qa (after CODE_REVIEWED), /ui (DESIGN_APPROVED) - each consults the workflow-engine and refuses to cross an unmet hard gate. Part of Phase 1; later PRs extend Gate Checks to the rest of the roster and do the progressive-disclosure refactor. * Address Copilot review on PR #2 - verify: state the VERIFIED precondition (runs after QA / CODE_REVIEWED). - verify: make Confluence/Jira input optional (file-based markdown is the default). - verify + placeholder-patterns: fix placeholder counting (grep -oF | wc -l, not grep -c or unescaped regex) and include INSTRUCTION:. - placeholder-patterns: split hard placeholders (auto-FAIL) vs soft signals (e.g. / [e.g. - flag for judgment), resolving the threshold inconsistency. * Address Copilot re-review (round 2) on PR #2 - secops: reconcile 'mandatory for ALL features' with the proportional model — /secops is a safety-override gate (required on triggers; always in regulated preset), not forced for trivial changes. - verify: APPROVAL_GATE no longer hard-requires the soft DESIGN_APPROVED; tie each gate to its matching /verify subcommand; VERIFIED requires concrete QA evidence in the ledger, not just CODE_REVIEWED + CI pass. - tester: replace undefined 'Required Dev Attention' with the canonical Dev/Implementation stage + ledger note. - verify + checkpoint-3: fix fragile grep globs (use -r --include); drop Emacs-specific (*.el / Cask) examples. * Address Copilot re-review (round 3) on PR #2 - Genericize all imported grep examples: drop Emacs-specific *.el / Cask / Makefile, use -r --include so commands are robust in any repo. - secops: reconcile the frontmatter description with the proportional model (safety-override gate, not 'mandatory for ALL features'). - Make [e.g. a soft signal consistently (placeholder-patterns + checkpoint-1). - ledger: add a qa outcome field so VERIFIED's 'evidence in the ledger' is satisfiable. * Address Copilot re-review (round 4): verify polish - /qa: write canonical qa:{outcome,by,at,evidence} to the ledger. - verify: fix the Workflow Position diagram to reflect gate order (arch/secops/design before APPROVAL_GATE; rev/qa before VERIFIED). - verify: record a skipped soft DESIGN_APPROVED in the ledger with a reason. - verify: reconcile CP1 scoring with the verdict taxonomy; APPROVAL_GATE (hard) only on a full PASS. - verify: save audit reports under the ticket's approvals/ folder, not repo root.
olehsvyrydov
added a commit
that referenced
this pull request
Jun 6, 2026
…/be /e2e) (#3) * Phase 1: wire Gate Checks into the rest of the team Extends workflow enforcement (PR #2) to the remaining core agents, each consulting the workflow-engine: - /po + /ba: produce the ticket + behavioral AC (foundation for APPROVAL_GATE). - /sm: orchestrator/advancer - records gate transitions; only role that sets Done, and only when all required gates pass. - /fe + /be: require APPROVAL_GATE (or triggered ARCH/SECOPS) before implementing; TDD -> hand to /rev for CODE_REVIEWED. - /e2e: runs after CODE_REVIEWED; records the qa outcome /verify reads before VERIFIED. * Address Copilot review on PR #3 - /fe + /be: reword Gate Check to require only the hard gates the workflow-engine determines apply (ARCH/SECOPS on trigger; APPROVAL_GATE on the full track), not implying APPROVAL_GATE is universal; DESIGN_APPROVED stays soft. - /e2e: append E2E evidence to the existing ledger qa entry instead of overwriting /qa's outcome.
olehsvyrydov
added a commit
that referenced
this pull request
Jun 6, 2026
* Phase 1: add 8 new specialist agents + disambiguation matrix New agents (modern SKILL.md + command + Gate Check): - /ai AI/LLM Application Engineer (RAG, agents, prompts, evals, guardrails) - /data Data Engineer (ETL/ELT, dbt, warehouse, streaming, quality) - /sre SRE/Observability (SLOs, monitoring, incidents) - owns RELIABILITY_OK - /ios /android Native Mobile (Swift/SwiftUI, Kotlin/Compose) - /ux UX Researcher (interviews, usability, IA, synthesis) - /perf Performance Engineer (Web Vitals, profiling, budgets) - owns PERF_OK - /dba Database Administrator (schema, indexing, migrations, replication) Plus claude/skills/disambiguation.md so the ~48 agents route correctly. (verify/QA Auditor was added in PR #2.) * Address Copilot review on PR #4 - Use concrete skill names everywhere (mlops-engineer / devops-engineer / flutter-developer) instead of free-text roles, for unambiguous routing. - /perf (PERF_OK) and /sre (RELIABILITY_OK) are soft gates - follow the soft-gate policy (warn + record skip), don't hard-block; note how to make them hard via the regulated preset. - native-mobile: reword to 'required upstream gates' (DESIGN_APPROVED is soft). - Drop the unbacked /ada alias. - Add the 8 new agents to /agents (discoverability) + link the disambiguation matrix. * Address Copilot re-review (round 2) on PR #4 - ai/data/native: add APPROVAL_GATE (full track) to the implementation Gate Checks, matching /fe and /be. - sre: correct the config note - refusal (hard/soft) is a gate property in workflow.yaml, not a preset setting. - mlops-engineer: narrow its description to ML/inference ops and defer app-level LLM features + prompt engineering to /ai (resolves the disambiguation overlap). - disambiguation: use flutter-developer in the rule-of-thumb too. * Address Copilot re-review (round 3) on PR #4 - sre: reword the config note to reference the RELIABILITY_OK gate entry's refusal field under the gates: mapping (not a dotted path). * Address Copilot re-review (round 4) on PR #4 - ai-engineer: fix mismatched bold/paren formatting in the Gate Check bullet. - mlops-engineer: reconcile the Trigger list with the new routing - app-level LLM features (RAG/agents/prompt eng/evals) route to /ai; MLOps keeps the inference-ops layer.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Operationalizes the Phase 0 workflow spine by wiring it into the agents.
verify(QA Auditor) underclaude/skills/quality/verify/— adversarial completeness auditor that owns two hard gates:APPROVAL_GATE(pre-implementation readiness) andVERIFIED(final audit). Adds/verifycommand.workflow-engineand refusing to cross an unmethardgate:/arch→ARCH_APPROVED/secops→SECOPS_APPROVED(safety-override — can't be skipped for being 'small')/rev→CODE_REVIEWED/qa→ runs afterCODE_REVIEWED/ui→DESIGN_APPROVEDWhy
Phase 0 added a proportional, file-based workflow (
claude/workflow/workflow.yaml+ theworkflow-engineskill). This PR makes it enforced per-agent so it holds without an orchestrator and in any editor.Scope / follow-ups
First slice of Phase 1. Later PRs: extend Gate Checks to the rest of the roster, build the remaining new agents, and do the progressive-disclosure refactor of the large skills.
Review focus
claude/workflow/workflow.yamlandclaude/skills/workflow-engine/references/gate-check.md?verifyagent's gate logic sound?