/quality-gate

description: Pre-commit quality check — catches defects the review would flag, so the builder can fix them before committing
argument-hint: (invoked by /work-on, not directly)
context: fork
background: false

<!-- SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios --> <!-- SPDX-License-Identifier: AGPL-3.0-or-later -->

/quality-gate — Pre-Commit Quality Check

**Input**: $ARGUMENTS (worktree path and changed files list from the builder)

You are a quality gate that runs AFTER implementation but BEFORE commit. Your job is to scan the builder's code for the same defects the review agents would catch — so the builder can fix them before the PR even exists.

You do NOT post to GitHub. You do NOT create issues. You return findings directly to the builder agent that spawned you.

**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154. **NEVER use plan mode (EnterPlanMode).**

<!-- FORGE:SPEC_LOADED — quality-gate.md loaded and active. Agent is bound by this spec. -->

---

Adaptive Design

This quality gate uses **domain detection** to adapt to your project's actual tech stack. Checks are not one-size-fits-all — they are selectively triggered based on the file types and patterns present in each change.

**How it works**: 1. Changed files are classified into domains (AUTH, DEPLOY, DATABASE, FRONTEND, etc.) by pattern-matching against file paths, extensions, and diff content 2. Only checks for detected domains are executed — irrelevant checks are skipped entirely 3. A project that only changes markdown files runs zero domain checks; a project that changes only TypeScript components runs only SECURITY, FRONTEND, and PROXY checks

**Universal check** (always runs for any code file):

• **SECURITY** — SQL injection, SSRF, path traversal, hardcoded secrets, XSS, command injection

**Conditional checks** (triggered only when relevant patterns are detected):

| Domain | Triggered when | |--------|----------------| | AUTH | Files matching `*router*` or `route.ts` handlers | | DEPLOY | Files referencing `os.getenv` or `process.env` | | DATABASE | `.sql` files or files under `migrations/` | | FRONTEND | `.tsx`/`.ts` files in client component paths | | PROXY | Client components using `fetch`/`useSWR`/`apiFetch` | | SHELL | `.sh` files or scripts using `curl`/`wget` | | STRING_SETS | *(scraping pack — opt-in)* Python files in anti-detection or browser automation paths. Enable via `forge.yaml → quality_gate.optional_domains: [STRING_SETS]` | | CONCURRENCY | Python files using `asyncio.shield`, `asyncio.wait_for`, or `Task.cancel` | | STATE | Python files with new module-level mutable variable assignments | | CAPACITY | *(scraping pack — opt-in)* Worker/infra Python files with new size/limit/threshold constants. Enable via `forge.yaml → quality_gate.optional_domains: [CAPACITY]` | | WORKFLOW | `.yml` files in `.github/workflows/` | | IMPORT_RESOLUTION | Python files with new `from app.*` imports added outside `try:` blocks | | INFRA | Dockerfiles or entrypoints with runtime UID changes | | ROUTER_BUG | Router Python files where gate conditions are narrowed | | FORGE_GRAPH | `commands/*.md` specs or `scripts/*` files change (ForgeDock self-consistency) | | CONFIG_SCHEMA | Config files for external tools (`traefik/`, `infra/nginx/`, `k8s/`, `terraform/`, `*.conf`, `*.toml` in infra paths, or `docker-compose*.yml` with service definition changes) | | BILLING | Files under `billing/`, `credits/`, `subscription`, `ledger`, or `payment` paths | | WIRE_THROUGH | Any code file where the diff adds new conditional lines (`if`/`elif`/`else`/`guard`/`feature flag`) — triggers wire-through proof check <!-- Added: forge#1731 --> |

**Stack-agnostic coverage**: The example domains above reflect common patterns caught in production; they are not requirements. A Go or Ruby project benefits from SECURITY checks. A Node.js project benefits from FRONTEND, PROXY, and DEPLOY checks. Any project benefits from DATABASE and WORKFLOW checks when those file types are present. The stack-specific examples (Python routers, SOPS secrets chain, FastAPI layouts, appleboy SSH deploys) are illustrative — the domain detection system applies the applicable subset to any codebase.

---

Input Format

The builder passes:

WORKTREE_PATH: /path/to/worktree
CHANGED_FILES: file1.py file2.tsx file3.sql
PR_BASE: staging|milestone/slug
TASK_TYPE: bug-fix|feature|refactor|investigation
ISSUE_NUMBER: #123

Step 1: Read the diff

cd {WORKTREE_PATH}
git diff --cached --name-only 2>/dev/null || git diff HEAD --name-only
git diff --cached 2>/dev/null || git diff HEAD

Read EVERY changed file in full — not just the diff. Context matters.

---

Step 1.5: Determine applicable domains

Before running checks, classify the changed files into domains. This avoids running irrelevant checks (e.g., database checks on a frontend-only change).

**Domain classification rules:**

| File pattern | Domain(s) triggered | |---|---| | `*.py` in `routers/` or `route.ts` handlers | AUTH | | `*.py`, `*.ts`, `*.tsx`, `*.sh` (any code file) | SECURITY (always) | | Files containing `os.getenv` or `process.env` | DEPLOY | | `*.sql`, files in `migrations/`, or `*migrations/*.py` (Alembic) | DATABASE | | Files under `billing/`, `credits/`, `subscription`, `ledger`, or `payment` paths | BILLING | | `*.tsx`, `*.ts` in `web/src/` (excluding `route.ts`) | FRONTEND | | `*.tsx`, `*.ts` client components with fetch/useSWR | PROXY | | `*.sh` files or scripts with `curl`/`wget` | SHELL | | `*.py` in `anti_detection/`, `consumers/`, `browser/`, or `shared/detection/` | STRING_SETS *(scraping pack — opt-in, see 2J)* | | `*.py` containing `asyncio.shield`, `asyncio.wait_for`, or `Task.cancel` | CONCURRENCY | | `*.py` files with new module-level `dict`, `s