/ia-verify

name: ia-verify
description: Run pre-PR verification chain -- build, types, lint, tests, security scan, diff review
argument-hint: "[mode: quick|full|pre-commit|pre-pr]"

Verify

Run a structured verification pipeline and produce a single READY / NOT READY report.

**Boundary vs `/ia-review`:** `/ia-verify` is the pre-PR static gate (pass/fail on build/types/lint/tests/security). `/ia-review` is the multi-agent code review with findings synthesis. Use `/ia-verify` first to confirm shippable; use `/ia-review` for design-level assessment.

Mode

`$ARGUMENTS` -- defaults to `full` if omitted.

| Mode | What runs | |------|-----------| | `quick` | Build + type check only | | `full` | Build + types + lint + tests | | `pre-commit` | Build + types + lint + tests + console.log audit | | `pre-pr` | Project-declared gates + build + types + lint + tests + console.log audit + security scan + performance + accessibility + infrastructure + documentation + diff review |

Project-declared gates (phase 0) also run before any push, regardless of mode.

Applicability Detection

Resolve one verification scope before classifying or scanning changes:

1. In `pre-pr` mode, resolve the PR base (`gh pr view --json baseRefName -q .baseRefName`) or the repository's verified default branch, and freeze the current HEAD SHA. Resolve the merge-base against the available base ref, then use `git diff --no-textconv --no-ext-diff <merge-base-sha> <head-sha>` for content and its `--name-only` form for file lists in every diff-based phase below (metadata-only forms such as `--name-only` and `--stat` render no content and need no such flags). If the base cannot be resolved, report NOT READY with that missing input; do not silently substitute an empty working-tree diff. For a dirty checkout, either verify the committed head in isolation or explicitly include and identify local changes; do not claim tests of a different tree verify the frozen PR head. 2. In `pre-commit` mode, use the staged diff (`git diff --no-textconv --no-ext-diff --cached`) and state that scope. In `quick`/`full` mode, use the caller's selected scope, defaulting to tracked staged and unstaged changes (`git diff --no-textconv --no-ext-diff HEAD`) plus explicitly enumerated untracked files. Record the selected scope and tested tree in the report. An empty selected diff is not evidence that a feature branch is unchanged. 3. Classify the selected files:

• **frontend** -- files under `src/components/`, `src/pages/`, `app/`, `*.tsx`, `*.jsx`, `*.vue`, `*.svelte`, `*.css`, `*.scss`, templates
• **backend** -- files under `src/api/`, `routes/`, `controllers/`, `services/`, `*.php`, `*.py` (non-frontend), `*.go`, server-side TS
• **infrastructure** -- migration files, Dockerfiles, terraform/ansible, CI configs, env templates, k8s manifests
• **docs-only** -- passive prose only; agent instructions, executable snippets, and configuration embedded in Markdown must be classified by the behavior they drive

4. Apply phase filters (pre-pr mode only):

• **Performance** -- skip for docs-only changes
• **Accessibility** -- skip for backend-only or docs-only changes
• **Infrastructure** -- skip for pure frontend changes (no migrations, no env changes, no CI changes)
• **Documentation** -- always run when user-facing files changed; skip for internal refactors with no API/behavior change

Log which phases were skipped and why in the report.

Pipeline

Run each phase in order. Stop on the first failure unless the mode skips that phase.

0. Project-Declared Gates (runs in pre-pr mode and before any push in every mode)

Run the project-declared gates check from the `ia-verification-before-completion` skill's Gate Function. Stop and report NOT READY if any gate is unmet, naming it.

1. Build

Detect and run the project's build command:

• `package.json` → `npm run build` (or pnpm/yarn/bun equivalent)
• `Makefile` → `make build`
• `pyproject.toml` → `python -m build` or framework-specific
• `mix.exs` → `mix compile --warnings-as-errors`
• `go.mod` → `go build ./...`
• `composer.json` → `composer install`

Record: pass/fail + error output.

2. Type Check (skip for dynamically typed projects without type tooling)

• TypeScript → `npx tsc --noEmit`
• Python with mypy/pyright → run the configured checker
• Go → already covered by build

Record: pass/fail + error count.

3. Lint

Detect and run the project's linter:

• Biome, ESLint, Prettier → whichever is configured
• Ruff, Flake8 → for Python
• `golangci-lint run` → for Go
• PHPStan, PHP-CS-Fixer → for PHP

Compare warning counts against the same explicit base SHA in an isolated checkout when useful. Stashing does not change a committed branch to its base and is not a baseline comparison. Report a skipped baseline comparison directly. Flag net-new warnings even if the overall run passes.

Record: pass/fail + warning/error counts + new warnings introduced (if measurable).

4. Tests

Run the project's test suite:

• `npm test`, `pytest`, `go test ./...`, `php artisan test`, `mix test`, etc.

Record: pass/fail + test count + coverage if available.

5. Console.log / Debug Audit (pre-commit and pre-pr only)

Search staged or changed files for debug statements that shouldn't ship:

• `console.log`, `console.debug`, `debugger` (JS/TS)
• `print(`, `breakpoint()`, `pdb.set_trace()` (Python)
• `dd(`, `dump(`, `ray(` (PHP)
• `fmt.Println` used for debugging (Go)

Report: file:line for each occurrence. These are warnings, not blockers.

6. Security Scan (pre-pr only)

**6a. Dependency audit** -- run the project's dependency auditor:

• `npm audit` / `pnpm audit` / `yarn audit` (JS/TS)
• `pip-audit` or `safety check` (Python)
• `composer audit` (PHP)
• `govulncheck ./...` (Go)

Flag critical/high vulnerabilities as blockers. Moderate/low are warnings.

**6b. Secrets in diff** -- search changed files for:

• Hardcoded secrets (API keys, tokens, passwords in string literals)
• `.env`