--- description: Pre-commit quality check — catches defects the review would flag, so the builder can fix them before committing argument-hint: (invoked by /work-on, not directly) --- # /quality-gate — Pre-Commit Quality Check **Input**: $ARGUMENTS (worktree path and changed files list from the builder) You are a quality gate that runs AFTER implementation but BEFORE commit. Your job is to scan the builder's code for the same defects the review agents would catch — so the builder can fix them before the PR even exists. You do NOT post to GitHub. You do NOT create issues. You return findings directly to the builder agent that spawned you. **Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154. **NEVER use plan mode (EnterPlanMode).** --- ## Adaptive Design This quality gate uses **domain detection** to adapt to your project's actual tech stack. Checks are not one-size-fits-all — they are selectively triggered based on the file types and patterns present in each change. **How it works**: 1. Changed files are classified into domains (AUTH, DEPLOY, DATABASE, FRONTEND, etc.) by pattern-matching against file paths, extensions, and diff content 2. Only checks for detected domains are executed — irrelevant checks are skipped entirely 3. A project that only changes markdown files runs zero domain checks; a project that changes only TypeScript components runs only SECURITY, FRONTEND, and PROXY checks **Universal check** (always runs for any code file): - **SECURITY** — SQL injection, SSRF, path traversal, hardcoded secrets, XSS, command injection **Conditional checks** (triggered only when relevant patterns are detected): | Domain | Triggered when | |--------|----------------| | AUTH | Files matching `*router*` or `route.ts` handlers | | DEPLOY | Files referencing `os.getenv` or `process.env` | | DATABASE | `.sql` files or files under `migrations/` | | FRONTEND | `.tsx`/`.ts` files in client component paths | | PROXY | Client components using `fetch`/`useSWR`/`apiFetch` | | SHELL | `.sh` files or scripts using `curl`/`wget` | | STRING_SETS | *(scraping pack — opt-in)* Python files in anti-detection or browser automation paths. Enable via `forge.yaml → quality_gate.optional_domains: [STRING_SETS]` | | CONCURRENCY | Python files using `asyncio.shield`, `asyncio.wait_for`, or `Task.cancel` | | STATE | Python files with new module-level mutable variable assignments | | CAPACITY | *(scraping pack — opt-in)* Worker/infra Python files with new size/limit/threshold constants. Enable via `forge.yaml → quality_gate.optional_domains: [CAPACITY]` | | WORKFLOW | `.yml` files in `.github/workflows/` | | IMPORT_RESOLUTION | Python files with new `from app.*` imports added outside `try:` blocks | | INFRA | Dockerfiles or entrypoints with runtime UID changes | | ROUTER_BUG | Router Python files where gate conditions are narrowed | | FORGE_GRAPH | `commands/*.md` specs or `scripts/*` files change (ForgeDock self-consistency) | | CONFIG_SCHEMA | Config files for external tools (`traefik/`, `infra/nginx/`, `k8s/`, `terraform/`, `*.conf`, `*.toml` in infra paths, or `docker-compose*.yml` with service definition changes) | | BILLING | Files under `billing/`, `credits/`, `subscription`, `ledger`, or `payment` paths | | WIRE_THROUGH | Any code file where the diff adds new conditional lines (`if`/`elif`/`else`/`guard`/`feature flag`) — triggers wire-through proof check | **Stack-agnostic coverage**: The example domains above reflect common patterns caught in production; they are not requirements. A Go or Ruby project benefits from SECURITY checks. A Node.js project benefits from FRONTEND, PROXY, and DEPLOY checks. Any project benefits from DATABASE and WORKFLOW checks when those file types are present. The stack-specific examples (Python routers, SOPS secrets chain, FastAPI layouts, appleboy SSH deploys) are illustrative — the domain detection system applies the applicable subset to any codebase. --- ## Input Format The builder passes: ``` WORKTREE_PATH: /path/to/worktree CHANGED_FILES: file1.py file2.tsx file3.sql PR_BASE: staging|milestone/slug TASK_TYPE: bug-fix|feature|refactor|investigation ISSUE_NUMBER: #123 ``` ## Step 1: Read the diff ```bash cd {WORKTREE_PATH} git diff --cached --name-only 2>/dev/null || git diff HEAD --name-only git diff --cached 2>/dev/null || git diff HEAD ``` Read EVERY changed file in full — not just the diff. Context matters. --- ## Step 1.5: Determine applicable domains Before running checks, classify the changed files into domains. This avoids running irrelevant checks (e.g., database checks on a frontend-only change). **Domain classification rules:** | File pattern | Domain(s) triggered | |---|---| | `*.py` in `routers/` or `route.ts` handlers | AUTH | | `*.py`, `*.ts`, `*.tsx`, `*.sh` (any code file) | SECURITY (always) | | Files containing `os.getenv` or `process.env` | DEPLOY | | `*.sql`, files in `migrations/`, or `*migrations/*.py` (Alembic) | DATABASE | | Files under `billing/`, `credits/`, `subscription`, `ledger`, or `payment` paths | BILLING | | `*.tsx`, `*.ts` in `web/src/` (excluding `route.ts`) | FRONTEND | | `*.tsx`, `*.ts` client components with fetch/useSWR | PROXY | | `*.sh` files or scripts with `curl`/`wget` | SHELL | | `*.py` in `anti_detection/`, `consumers/`, `browser/`, or `shared/detection/` | STRING_SETS *(scraping pack — opt-in, see 2J)* | | `*.py` containing `asyncio.shield`, `asyncio.wait_for`, or `Task.cancel` | CONCURRENCY | | `*.py` files with new module-level `dict`, `set`, `Counter`, `Lock`, or `defaultdict` assignments | STATE | | `*.py` in `services/worker/`, `infra/`, or `browser/` with new assignments to variables containing `MB`, `SIZE`, `MAX`, `LIMIT`, `THRESHOLD`, or `TIMEOUT` | CAPACITY *(scraping pack — opt-in, see 2K)* | | `*.yml` in `.github/workflows/` | WORKFLOW | | `*.py` with new `from app.` import statements added outside `try:` blocks | IMPORT_RESOLUTION | | `Dockerfile*` or `entrypoint*.sh` with added/changed `USER`, `su-exec`, `gosu`, or `setuid` | INFRA | | `*.py` in `routers/` where the diff removes a line containing an or-gate condition (lines starting with `-` containing `if.*or`) | ROUTER_BUG | | `commands/*.md` or `scripts/*` files (ForgeDock repo only — dogfoods its own spec graph) | FORGE_GRAPH | | Files under `traefik/`, `infra/nginx/`, `k8s/`, `terraform/`, or files matching `*.conf`, `*.toml` in infra paths, or `docker-compose*.yml` with service definition changes | CONFIG_SCHEMA | | Executable code files (`.py`, `.ts`, `.tsx`, `.js`, `.sh`) where the diff adds new `if`/`elif`/`else`/guard/feature-flag conditional lines — NOT `.md` prose spec files | WIRE_THROUGH *(universal — see 2G.8)* | **Apply the classification:** ```bash # Initialize domain flags DOMAINS="" # {CHANGED_FILES} is a space-separated argument (same contract as {AFFECTED_FILES} # in architect.md) — split explicitly on IFS=' ' into an array instead of relying # on a bare `for f in {CHANGED_FILES}`, which word-splits on the shell's default # IFS (space, tab, AND newline) and would corrupt any path containing a space. IFS=' ' read -ra CHANGED_FILES_ARR <<< "{CHANGED_FILES}" for f in "${CHANGED_FILES_ARR[@]}"; do case "$f" in *.sql|*migrations/*|*migrations/*.py) DOMAINS="$DOMAINS DATABASE" ;; esac case "$f" in *billing/*|*credits/*|*subscription*|*ledger*|*payment*) DOMAINS="$DOMAINS BILLING" ;; esac case "$f" in *router*|*route.ts) DOMAINS="$DOMAINS AUTH" ;; esac case "$f" in *.tsx|*.ts|*.jsx) echo "$f" | grep -qv 'route\.ts$' && DOMAINS="$DOMAINS FRONTEND PROXY" ;; esac case "$f" in *.sh) DOMAINS="$DOMAINS SHELL" ;; esac case "$f" in *anti_detection/*|*consumers/*|*browser/*|*shared/detection/*) # STRING_SETS is a scraping-pack domain — opt-in via forge.yaml → quality_gate.optional_domains # if echo "$f" | grep -qE '\.py$'; then _OPT_DOMAINS=$(grep -A5 'optional_domains:' "{WORKTREE_PATH}/forge.yaml" 2>/dev/null | grep -oE 'STRING_SETS' | head -1 || true) [ -n "$_OPT_DOMAINS" ] && DOMAINS="$DOMAINS STRING_SETS" fi ;; esac case "$f" in commands/*.md|scripts/*) DOMAINS="$DOMAINS FORGE_GRAPH" ;; esac case "$f" in .github/workflows/*.yml) DOMAINS="$DOMAINS WORKFLOW" ;; esac done # Check for asyncio concurrency patterns in Python files grep -lE "asyncio\.shield|asyncio\.wait_for|Task\.cancel" {CHANGED_FILES} 2>/dev/null | grep -qE '\.py$' && DOMAINS="$DOMAINS CONCURRENCY" # Check for new module-level state variable assignments in Python files grep -lE "^\w+ = (\{\}|\[\]|set\(\)|Lock\(\)|defaultdict|Counter)" {CHANGED_FILES} 2>/dev/null | grep -qE '\.py$' && DOMAINS="$DOMAINS STATE" # Check for capacity constants in worker/infra/browser Python files # CAPACITY is a scraping-pack domain — opt-in via forge.yaml → quality_gate.optional_domains # _OPT_CAPACITY=$(grep -A5 'optional_domains:' "{WORKTREE_PATH}/forge.yaml" 2>/dev/null | grep -oE 'CAPACITY' | head -1 || true) if [ -n "$_OPT_CAPACITY" ]; then while IFS= read -r f; do [ -z "$f" ] && continue git diff HEAD -- "$f" 2>/dev/null | grep -qE '^\+[A-Za-z_]\w*(MB|SIZE|MAX|LIMIT|THRESHOLD|TIMEOUT)\w*\s*=' && DOMAINS="$DOMAINS CAPACITY" && break done < <(echo {CHANGED_FILES} | tr ' ' '\n' | grep -E '\.py$' | grep -E 'services/worker/|infra/|browser/') fi # Check for env var usage in changed files grep -lE "os\.getenv|process\.env" {CHANGED_FILES} 2>/dev/null && DOMAINS="$DOMAINS DEPLOY" # Check for new app.* imports added outside try: blocks in Python files while IFS= read -r f; do [ -z "$f" ] && continue NEW_IMPORTS=$(git diff HEAD -- "$f" 2>/dev/null | grep -E '^\+\s*(from app\.|import app\.)' | grep -v '^+++') if [ -n "$NEW_IMPORTS" ]; then DOMAINS="$DOMAINS IMPORT_RESOLUTION" break fi done < <(echo {CHANGED_FILES} | tr ' ' '\n' | grep -E '\.py$') # Check for runtime UID changes in Dockerfiles or entrypoint scripts while IFS= read -r f; do [ -z "$f" ] && continue git diff HEAD -- "$f" 2>/dev/null | grep -E '^\+.*(USER\s+[^0]|su-exec|gosu|setuid)' | grep -v '^+++' | grep -q . && DOMAINS="$DOMAINS INFRA" && break done < <(echo {CHANGED_FILES} | tr ' ' '\n' | grep -iE 'Dockerfile|entrypoint.*\.sh') # Check for gate condition narrowing in router Python files (condition removal = fix may be incomplete across siblings) while IFS= read -r f; do [ -z "$f" ] && continue git diff HEAD -- "$f" 2>/dev/null | grep -E '^-.*\bif\b.*\bor\b' | grep -v '^---' | grep -q . && DOMAINS="$DOMAINS ROUTER_BUG" && break done < <(echo {CHANGED_FILES} | tr ' ' '\n' | grep -E '\.py$' | grep -E 'router') # Check for external tool config files (structural schema validation advisory) # {CHANGED_FILES} is space-separated (see array-split note above) — reuse the # same CHANGED_FILES_ARR built above instead of re-splitting. for f in "${CHANGED_FILES_ARR[@]}"; do case "$f" in traefik/*|infra/nginx/*|k8s/*|terraform/*) DOMAINS="$DOMAINS CONFIG_SCHEMA" && break ;; *.conf|*.toml) echo "$f" | grep -qE 'infra/|traefik/|nginx/|k8s/|terraform/' && DOMAINS="$DOMAINS CONFIG_SCHEMA" && break ;; docker-compose*.yml) # Trigger only if service definitions changed (not just env vars or labels) git diff HEAD -- "$f" 2>/dev/null | grep -E '^\+\s+(image:|command:|entrypoint:)' | grep -q . && DOMAINS="$DOMAINS CONFIG_SCHEMA" && break ;; esac done # Check for newly added conditional paths in code files — wire-through proof trigger # Scoped to NEWLY ADDED lines only (lines starting with '+' in the diff, excluding the '+++' header). # Pre-existing conditionals are never flagged — only additions. # Applies to executable code files ONLY (.py, .ts, .tsx, .js, .sh) — NOT .md prose spec files, # which use 'if'/'else' in natural language and pseudocode that is never executed. while IFS= read -r f; do [ -z "$f" ] && continue NEW_CONDITIONALS=$(git diff HEAD -- "$f" 2>/dev/null \ | grep -E '^\+' | grep -v '^+++' \ | grep -E '^\+\s*(if |elif |else:?\s*$|if\(|elif\()|\bguard\b|\bfeature.?flag\b|FEATURE_FLAG|ENABLE_[A-Z_]+\s*=|DISABLE_[A-Z_]+\s*=') if [ -n "$NEW_CONDITIONALS" ]; then DOMAINS="$DOMAINS WIRE_THROUGH" break fi done < <(echo {CHANGED_FILES} | tr ' ' '\n' | grep -E '\.(py|ts|tsx|js|sh)$') # SECURITY is always included for any code file DOMAINS="SECURITY $DOMAINS" # Deduplicate DOMAINS=$(echo "$DOMAINS" | tr ' ' '\n' | sort -u | tr '\n' ' ') echo "Applicable domains: $DOMAINS" ``` **Only run checks in Step 2 that match the identified domains.** Skip all others entirely. --- ## Step 2: Run domain checks Run ONLY the checks whose domain was identified in Step 1.5. Skip checks for domains not present in the `DOMAINS` list. **Execution budget**: Set `FORGEDOCK_QUALITY_GATE_TIMEOUT_SECONDS` to configure the per-check budget (default: 30 seconds). Set `FORGEDOCK_VERIFICATION_TIMEOUT_SECONDS` to configure formatter, typecheck, and build commands (default: 120 seconds). Both values must be positive integers. A timeout emits a structured HIGH finding and fails the gate rather than leaving the workflow blocked. - **2A (Security)**: Run if `SECURITY` in DOMAINS *(always — included for all code files)* - **2B (Auth)**: Run if `AUTH` in DOMAINS - **2C (Deploy chain)**: Run if `DEPLOY` in DOMAINS - **2D (Database)**: Run if `DATABASE` in DOMAINS - **2E (Frontend lifecycle)**: Run if `FRONTEND` in DOMAINS - **2F (Frontend proxy)**: Run if `PROXY` in DOMAINS - **2G (Cross-service integration)**: Run if `SHELL` or `FORGE_GRAPH` in DOMAINS - **2H (Asyncio cancellation)**: Run if `CONCURRENCY` in DOMAINS - **2I (State completeness)**: Run if `STATE` in DOMAINS - **2J (String literal consistency)**: Run if `STRING_SETS` in DOMAINS - **2K (Capacity constant validation)**: Run if `CAPACITY` in DOMAINS - **2L (GitHub Actions template safety)**: Run if `WORKFLOW` in DOMAINS - **2M (Import resolution)**: Run if `IMPORT_RESOLUTION` in DOMAINS - **2N (Runtime UID × filesystem write)**: Run if `INFRA` in DOMAINS - **2O (Residual pattern check)**: Run if `ROUTER_BUG` in DOMAINS - **2P (External tool config schema)**: Run if `CONFIG_SCHEMA` in DOMAINS - **2Q (Billing)**: Run if `BILLING` in DOMAINS - **2R (Registry checks)**: ALWAYS run — executes all promoted checks from `scripts/check-registry/manifest.json` - **2R.5 (Adaptive gate.d checks)**: ALWAYS run when `adaptive_scripts.enabled` — executes `.forgedock/scripts/gate.d/*.sh`; each script is repo-specific and was promoted from a recurring finding pattern - **2G.8 (Wire-through proof)**: Run if `WIRE_THROUGH` in DOMAINS — demands each newly added conditional path be demonstrably reachable - **2G.9 (Danger-zone recurrence)**: Run if `FORGE_GRAPH` in DOMAINS — cross-references injected danger-zone rule cards from FORGE:CONTEXT against the diff; violations tagged `known-pattern-recurrence` (HIGH) - **2S (Test failure classification)**: Run if any Step 2 check invoked a test suite and it failed — classifies the failure as PRE_BROKEN, FLAKY, or REAL using `scripts/flaky-quarantine.sh` - **2T (Subscribed pattern card rules)**: ALWAYS run when `pattern_feeds.enabled` is true — injects Tier-B (warning-only) learned rules from subscribed exchange cards that have a `gate.d` check template matching any changed file's stack ### 2A: Security (ALL files) For every changed file, check: 1. **SQL injection**: Any string formatting/f-strings in SQL queries? Must use parameterized queries (`$1`, `:param`). 2. **SSRF**: User-controlled URLs passed to `httpx`, `requests`, `fetch` without allowlist validation? 3. **Path traversal**: User input used in file paths without sanitization? 4. **Hardcoded secrets**: API keys, passwords, tokens in code (not env vars)? 5. **XSS**: User input rendered with `dangerouslySetInnerHTML`? 6. **Command injection**: User input in `subprocess`, `exec`, `eval`? ```bash # Quick automated checks # {CHANGED_FILES} is a space-separated argument — split explicitly on IFS=' ' # into an array instead of a bare `for f in {CHANGED_FILES}` (see Step 1.5 for # the full rationale; this is a separate bash block so the array is rebuilt here). IFS=' ' read -ra CHANGED_FILES_ARR <<< "{CHANGED_FILES}" for f in "${CHANGED_FILES_ARR[@]}"; do # f-string SQL grep -nE "f['\"].*SELECT|f['\"].*INSERT|f['\"].*UPDATE|f['\"].*DELETE|f['\"].*WHERE" "$f" 2>/dev/null && echo "SEC: f-string SQL in $f" # Hardcoded secrets grep -nE "(api_key|secret|password|token)\s*=\s*(f?['\"]|\`)[^{'\"\`]" "$f" 2>/dev/null | grep -vE "(example|placeholder|test|mock)" && echo "SEC: possible hardcoded secret in $f" # In-memory rate limiter (TypeScript only) — resets on restart, no cross-replica enforcement # Pattern: in-memory Maps/objects used for rate limiting reset on container restart and are not shared across replicas case "$f" in *.ts|*.tsx) grep -nE "new Map\(\)|=\s*\{\}|= new Map" "$f" 2>/dev/null | grep -iE "rate|limit|attempt|count|throttle|window" && \ echo "SEC: in-memory rate limiter in $f — resets on container restart, not shared across blue/green replicas. Use Redis for distributed rate limiting." # Cookie security flags — explicit false/none values are CONFIRMED findings # Pattern: explicitly weakened cookie security flags expose sessions to XSS, plaintext interception, or CSRF grep -nE "httpOnly:\s*false|secure:\s*false|sameSite.*['\"]none['\"]" "$f" 2>/dev/null && \ echo "SEC: cookie security flag weakened in $f — httpOnly: false exposes cookie to JS (XSS); secure: false allows HTTP transmission; sameSite: none without Secure enables CSRF." ;; esac done ``` ### 2B: Auth conventions (Python routers, TypeScript route handlers) For new/modified endpoints: 1. Which auth dependency is used? Read `forge.yaml → review.domains.auth` for the configured dependency name(s). If absent, skip the naming check and fall back to generic resource-ownership verification only. 2. Does the endpoint check resource ownership (`user_id` or equivalent) before returning data? Route-path-to-dependency convention (e.g. "dashboard routes must use X, public routes must use Y") is project-specific. Configure it in `forge.yaml → review.domains.auth` if your project uses one. Do not enforce a hard-coded convention universally. ```bash # Read configured auth dependency names from forge.yaml (if present) AUTH_DEPS="" if [ -f "{WORKTREE_PATH}/forge.yaml" ]; then AUTH_DEPS=$(grep -A5 'domains:' "{WORKTREE_PATH}/forge.yaml" 2>/dev/null \ | grep -A3 'auth:' | grep -oE '[A-Za-z_]+User|[A-Za-z_]+Auth|get_[a-z_]+' | sort -u | tr '\n' '|' | sed 's/|$//') fi while IFS= read -r f; do [ -z "$f" ] && continue if [ -n "$AUTH_DEPS" ]; then grep -nE "($AUTH_DEPS)|Depends\(get_" "$f" 2>/dev/null else grep -nE "Depends\(get_" "$f" 2>/dev/null fi grep -nE "@router\.(get|post|put|delete)" "$f" 2>/dev/null done < <(echo {CHANGED_FILES} | tr ' ' '\n' | grep -E 'router|route') ``` ### 2C: Deploy chain (when new env vars are introduced) ```bash NEW_ENVS=$(grep -rnE "os\.getenv\(|process\.env\." {CHANGED_FILES} 2>/dev/null | grep -oP "(os\.getenv\(['\"]|process\.env\.)(\w+)" | sed 's/os.getenv(["'"'"']//;s/process.env.//' | sort -u) if [ -n "$NEW_ENVS" ]; then for var in $NEW_ENVS; do # Check if it exists in .env.example grep -q "$var" .env.example 2>/dev/null || echo "DEPLOY: $var not in .env.example" # Check decrypt-secrets.sh ENV_MAPPING only when the SOPS mapping script exists. # Emitting a finding for a file that doesn't exist in the repo produces false BLOCKINGs # on non-SOPS repos. Use verify-sops-chain.sh for the full SOPS chain check instead. # if [ -f "{WORKTREE_PATH}/scripts/decrypt-secrets.sh" ]; then grep -q "$var" "{WORKTREE_PATH}/scripts/decrypt-secrets.sh" 2>/dev/null || echo "DEPLOY: $var not in decrypt-secrets.sh ENV_MAPPING" fi done fi ``` ### 2D: Database quality (SQL migration files and Alembic Python migrations) For each `.sql` file or Alembic migration `.py` file: 1. **NOT NULL without DEFAULT**: `ALTER TABLE ... ADD COLUMN ... NOT NULL` without `DEFAULT` locks table and fails on existing rows 2. **DROP without IF EXISTS**: Fails on fresh databases 3. **Missing indexes**: New columns used in WHERE/JOIN without indexes 4. **Unbounded queries**: SELECT without LIMIT or time-bound WHERE clause 5. **Migration number collision**: Check against origin branch 6. **IF NOT EXISTS guard**: `CREATE TABLE`/`CREATE INDEX` without `IF NOT EXISTS` guard fails on re-run ```bash while IFS= read -r f; do [ -z "$f" ] && continue grep -nE "ADD COLUMN.*NOT NULL" "$f" | grep -v "DEFAULT" && echo "DB: NOT NULL without DEFAULT in $f" grep -nE "DROP (TABLE|COLUMN|INDEX)" "$f" | grep -v "IF EXISTS" && echo "DB: DROP without IF EXISTS in $f" grep -nE "SELECT.*FROM" "$f" | grep -v "LIMIT" | grep -v "WHERE.*created_at" && echo "DB: possibly unbounded query in $f" # IF NOT EXISTS guard check — CREATE TABLE/INDEX without guard fails on replay or repeated apply grep -nE "^\s*(CREATE TABLE|CREATE INDEX|CREATE UNIQUE INDEX)\b" "$f" | grep -iv "IF NOT EXISTS" && \ echo "DB-GUARD | MEDIUM | $f | CREATE TABLE/INDEX without IF NOT EXISTS guard — statement will fail on re-run or fresh database replay. Add IF NOT EXISTS." done < <(echo {CHANGED_FILES} | tr ' ' '\n' | grep -E '\.sql$') # Also run structural checks on Alembic Python migration files while IFS= read -r f; do [ -z "$f" ] && continue # Check for op.create_table / op.create_index without if_not_exists or checkfirst guard grep -nE "\bop\.create_table\b|\bop\.create_index\b" "$f" | grep -iv "if_not_exists\|checkfirst" && \ echo "DB-GUARD | MEDIUM | $f | op.create_table/op.create_index without if_not_exists/checkfirst guard — will fail on replay. Add if_not_exists=True or checkfirst=True." done < <(echo {CHANGED_FILES} | tr ' ' '\n' | grep -E 'migrations/.*\.py$') # Migration prefix collision scan (Deploy Gate — HIGH) # Runs whenever any SQL or Alembic Python migration file changed. Scans the configured # migrations directory for duplicate numeric prefixes (both .sql and .py files). # Duplicate prefixes can cause ordering conflicts during deploy. # # MIGRATIONS_DIR="{WORKTREE_PATH}/infra/migrations" # Support configured migration directory from forge.yaml (if set) if [ -f "{WORKTREE_PATH}/forge.yaml" ]; then _CONFIGURED_MIGRATIONS=$(grep -E '^\s*migrations_dir:' "{WORKTREE_PATH}/forge.yaml" 2>/dev/null \ | head -1 | sed 's/.*migrations_dir:[[:space:]]*//' | tr -d '"' | tr -d "'" | xargs) [ -n "$_CONFIGURED_MIGRATIONS" ] && MIGRATIONS_DIR="{WORKTREE_PATH}/${_CONFIGURED_MIGRATIONS}" fi if [ -d "$MIGRATIONS_DIR" ]; then # Find duplicate numeric prefixes across all migration files (.sql and .py) DUPLICATE_PREFIXES=$( { ls "$MIGRATIONS_DIR"/*.sql 2>/dev/null; ls "$MIGRATIONS_DIR"/*.py 2>/dev/null; } \ | sed 's|.*/\([0-9]*\)_.*|\1|' \ | sort | uniq -d) for prefix in $DUPLICATE_PREFIXES; do echo "DB-COLLISION | HIGH | $MIGRATIONS_DIR | Duplicate migration prefix $prefix — ordering conflict will occur during deploy. Classify as CRITICAL BLOCKER." done fi ``` ### 2E: Frontend lifecycle (React/TSX files) For each `.tsx`/`.ts` client component: 1. **useEffect cleanup**: Does every useEffect that creates subscriptions/timers return a cleanup function? 2. **useCallback deps**: Are dependencies stable values (ids, primitives) not full objects (SWR responses)? 3. **Missing error/loading states**: Does data fetching handle loading and error? 4. **Component unmount**: Are async operations cancelled on unmount? 5. **Button type attribute**: Do all `