/ia-verify

name: ia-verify
description: "Run pre-PR verification chain: build, types, lint, tests, security scan, diff review"
argument-hint: "[mode: quick|full|pre-commit|pre-pr]"

Verify

Run a structured verification pipeline and produce a single READY / NOT READY report.

**Boundary vs `/ia-review`:** `/ia-verify` is the pre-PR static gate (pass/fail on build/types/lint/tests/security). `/ia-review` is the multi-agent code review with findings synthesis. Use `/ia-verify` first to confirm shippable; use `/ia-review` for design-level assessment.

Mode

`$ARGUMENTS` -- defaults to `full` if omitted.

| Mode | What runs | |------|-----------| | `quick` | Build + type check only | | `full` | Build + types + lint + tests | | `pre-commit` | Build + types + lint + tests + console.log audit | | `pre-pr` | Build + types + lint + tests + console.log audit + security scan + performance + accessibility + infrastructure + documentation + diff review |

Applicability Detection

Before running the pipeline, classify the change scope from the diff:

1. Run `git diff --name-only` (or `git diff --cached --name-only` for pre-commit) to get changed files. 2. Classify:

• **frontend** -- files under `src/components/`, `src/pages/`, `app/`, `*.tsx`, `*.jsx`, `*.vue`, `*.svelte`, `*.css`, `*.scss`, templates
• **backend** -- files under `src/api/`, `routes/`, `controllers/`, `services/`, `*.php`, `*.py` (non-frontend), `*.go`, server-side TS
• **infrastructure** -- migration files, Dockerfiles, terraform/ansible, CI configs, env templates, k8s manifests
• **docs-only** -- only `.md`, `.txt`, `CHANGELOG`, `README` files changed

3. Apply phase filters (pre-pr mode only):

• **Performance** -- skip for docs-only changes
• **Accessibility** -- skip for backend-only or docs-only changes
• **Infrastructure** -- skip for pure frontend changes (no migrations, no env changes, no CI changes)
• **Documentation** -- always run when user-facing files changed; skip for internal refactors with no API/behavior change

Log which phases were skipped and why in the report.

Pipeline

Run each phase in order. Stop on the first failure unless the mode skips that phase.

1. Build

Detect and run the project's build command:

• `package.json` → `npm run build` (or pnpm/yarn/bun equivalent)
• `Makefile` → `make build`
• `pyproject.toml` → `python -m build` or framework-specific
• `mix.exs` → `mix compile --warnings-as-errors`
• `go.mod` → `go build ./...`
• `composer.json` → `composer install`

Record: pass/fail + error output.

2. Type Check (skip for dynamically typed projects without type tooling)

• TypeScript → `npx tsc --noEmit`
• Python with mypy/pyright → run the configured checker
• Go → already covered by build

Record: pass/fail + error count.

3. Lint

Detect and run the project's linter:

• Biome, ESLint, Prettier → whichever is configured
• Ruff, Flake8 → for Python
• `golangci-lint run` → for Go
• PHPStan, PHP-CS-Fixer → for PHP

Compare warning counts against the base branch when possible (`git stash && lint && git stash pop` or lint the base ref). Flag any net-new warnings even if the overall run passes.

Record: pass/fail + warning/error counts + new warnings introduced (if measurable).

4. Tests

Run the project's test suite:

• `npm test`, `pytest`, `go test ./...`, `php artisan test`, `mix test`, etc.

Record: pass/fail + test count + coverage if available.

5. Console.log / Debug Audit (pre-commit and pre-pr only)

Search staged or changed files for debug statements that shouldn't ship:

• `console.log`, `console.debug`, `debugger` (JS/TS)
• `print(`, `breakpoint()`, `pdb.set_trace()` (Python)
• `dd(`, `dump(`, `ray(` (PHP)
• `fmt.Println` used for debugging (Go)

Report: file:line for each occurrence. These are warnings, not blockers.

6. Security Scan (pre-pr only)

**6a. Dependency audit** -- run the project's dependency auditor:

• `npm audit` / `pnpm audit` / `yarn audit` (JS/TS)
• `pip-audit` or `safety check` (Python)
• `composer audit` (PHP)
• `govulncheck ./...` (Go)

Flag critical/high vulnerabilities as blockers. Moderate/low are warnings.

**6b. Secrets in diff** -- search changed files for:

• Hardcoded secrets (API keys, tokens, passwords in string literals)
• `.env` files staged for commit
• `dangerouslySetInnerHTML`, `eval()`, raw SQL string concatenation

**6c. Auth/authz review** -- if the diff touches authentication or authorization code (middleware, guards, policies, permission checks, token handling, session management), flag for manual review. Check that:

• No auth bypass paths introduced (missing middleware on new routes)
• Permission checks not weakened or removed
• Token/session expiry not extended without justification

Report: file:line for each finding. Secrets and critical dependency vulnerabilities ARE blockers. Auth changes are warnings requiring human sign-off.

7. Performance (pre-pr only, skip for docs-only changes)

Scan the diff for common performance regressions:

• **N+1 queries** -- loops containing database calls where a batch/join/eager-load would work. Look for ORM calls inside `foreach`/`for`/`map`/`array_map` or equivalent.
• **Unbounded queries** -- `SELECT` without `LIMIT`, `findAll()` without pagination, collection fetches with no ceiling. Flag when the table could grow large.
• **Bundle size** (frontend changes) -- check if new dependencies were added (`package.json` diff). For large additions (>50KB gzipped), flag for justification. Run `npm run build` and compare output size if a build-stats script exists.
• **Missing indexes** -- if new queries filter or join on columns, check that indexes exist (or are added in accompanying migrations).

Report: file:line for each concern. These are warnings, not blockers, unless an unbounded query hits a table known to be large.

8. Accessibility (pre-pr only, skip for backend-only and docs-only changes)

If the diff includes frontend markup or component changes:

• *