qa

---
name: qa
description: Run the full end-of-contribution QA review over the current change (the qa-checklist gate plus a coverage fan-out and the domain reviewers it names).
user-invocable: true
---

You are running the project's end-of-contribution QA gate. Do this now, before the change is
called done.

1. Scope the review from the diff: `git diff --name-only` for uncommitted work. For committed
   work, merge-base against the branch's own base, never `main` (work is based off the latest
   release branch and `main` trails it, so a merge-base against `main` sweeps the whole release
   into scope). Fallback chain: the upstream, else the newest `origin/release/*` branch, else
   `origin/main`:

   ```sh
   base=$(git rev-parse --abbrev-ref '@{upstream}' 2>/dev/null) ||
     base=$(git for-each-ref --sort=-creatordate --format='%(refname:short)' \
       'refs/remotes/origin/release/*' | head -1)
   git diff --name-only "$(git merge-base HEAD "${base:-origin/main}")"..HEAD
   ```

   If the user passed an argument (a feature name, phase, or file list), use it to focus the
   scope.

2. Dispatch the `qa-checklist` agent over that scope. It is the read-only gate: it scales its
   own depth to the size of the change, checks every repo invariant in play, and ends with an
   adversarial "what is missing" pass. Let it run; do not duplicate its work inline.

3. If the change is more than a trivial single-surface edit, also fan out a small coverage
   pass in parallel: one agent for correctness, one for test coverage, one for dead code, each
   prompted for COVERAGE (report every gap with confidence and severity), not filtering.

4. Dispatch the domain reviewer agents that `qa-checklist` names for the surfaces this diff
   touches (for example `privacy-security-review`, `migration-safety`,
   `database-performance-reviewer` for SQL, indexes, query call sites, pool or lock behavior,
   timeout policy, or stored-data growth, `cross-platform-sync`,
   `architecture-reviewer`, and on a release branch `release-malware-audit`). Spawn them fresh;
   never have the implementer review its own work.

5. Run the deterministic floor yourself so the verdict rests on green checks, not only agent
   reasoning: `npm run ci:changed` (Biome on the changed files), `npx tsc --noEmit`, and
   `npx vitest run tests/architecture.test.ts tests/localization_fixes.test.ts`. Report any red.

6. Adversarially confirm each consequential finding before acting on it (about half of raw
   findings do not survive a second look). Then fix every BLOCKING and SHOULD-FIX finding, in
   focused commits. Report what you fixed and what remains as VERIFY (needs a run or E2E) or
   NICE-TO-HAVE.

End with a one-line verdict: READY or NOT READY, and the list of any VERIFY items the maintainer
still has to run by hand (for example `npm run perf:tour`, `npm run test:browser`, or the mobile
E2E scripts). READY is advisory judgment; `node scripts/gate_select.mjs` is the deterministic
pre-merge contract (same step list as `npm run gate` with a selective test substitution; release
tier on `release/**`; see `docs/qa-gate.md`), so if it has not run green this session, list it as
the first VERIFY item. `npm run gate` remains the deeper full-suite check when you want it.

More agent context in levy-street/world-of-claudecraft

36 other files this repository gives its agents.