Check — Verify Everything
CRITICAL: Run HARNESS_DIR=$(epic-harness path) first. NEVER use .harness/ in the project directory.
Execution Modes
This skill has 3 internal modes that run in parallel:
- check:code — Code quality, logic, style, test coverage, spec coverage
- check:security — OWASP Top 10 + performance (N+1, leaks)
- check:test — Full test suite, AC verification, coverage delta
Process
Step 0: Prerequisites
Confirm go has run:
git symbolic-ref --short HEAD # must NOT be main/master
Load the spec to know what was supposed to be built:
ls -t $HARNESS_DIR/specs/SPEC-*.md | head -1
Read the Requirements and Acceptance Criteria sections.
Step 1: Gather Scope
git diff --stat $(git merge-base HEAD main)
git diff --name-only $(git merge-base HEAD main)
Step 2: Scope Detection
| Pattern |
Scope |
Extra checks |
*.api.*, *route*, *controller*, *handler* |
API |
+ Contract testing, request validation |
*.tsx, *.jsx, *.vue, *.svelte, *.css |
Frontend |
+ Accessibility, semantic HTML |
*.sql, *migration*, *schema* |
Database |
+ Migration safety, rollback plan |
*.rs, Cargo.toml, *.go, go.mod |
Backend |
+ Build verification, type safety |
*.test.*, *.spec.*, __tests__/ |
Tests |
+ Coverage delta, flaky test detection |
Dockerfile*, *.yml, *.yaml, Makefile |
Infra |
+ Config validation, secret detection |
*.md, *.txt |
Docs |
+ Link checking, freshness |
Step 3: Run Checks in Parallel
Launch all 3 modes with run_in_background: true.
Mode: check:code (Review)
Review Dimensions
- Correctness: Does the code do what it claims? Edge cases handled?
- Logic: Race conditions, off-by-one, null pointer risks?
- Style: Consistent with project conventions? Readable?
- Tests: Changes covered by tests? Tests meaningful?
- Naming: Do names clearly convey intent?
- Spec coverage: Each Requirement addressed in the diff?
Output Format
## Code Review: <file or area>
- [BLOCKER] <description> (line X)
- [WARN] <description> (line Y)
- [NIT] <description> (line Z)
## Summary
- Blockers: N
- Warnings: N
- Verdict: APPROVE / REQUEST_CHANGES
Mode: check:security (Audit)
Security Checklist (OWASP Top 10)
- Injection (SQL, XSS, command)
- Broken authentication
- Sensitive data exposure
- Access control failures
- Security misconfiguration
Performance Checklist
- N+1 queries
- Unbounded data loading
- Missing indexes
- Memory leaks (event listeners, growing caches)
- Blocking main thread
Output Format
## Security Audit
- [CRITICAL] SQL injection risk in <file>:<line>
- [HIGH] Hardcoded secret in <file>:<line>
- [MEDIUM] Missing rate limit on <endpoint>
## Performance Audit
- [HIGH] N+1 query in <file>:<line>
- [MEDIUM] Unbounded array growth in <file>:<line>
## Summary
- Security: PASS / FAIL (N critical, N high)
- Performance: PASS / WARN (N issues)
Mode: check:test (Test Runner)
- Run the full test suite
- Verify each Acceptance Criterion is demonstrably met
- Report coverage delta
- Flag any flaky tests
Step 4: Synthesize
Combine all findings into a single report:
## Check Report
- Spec: SPEC-{timestamp} ({goal_slug})
- Branch: {current branch}
### Change Scope
- Scopes detected: [API, Frontend, Backend, Database, Infra, Docs, Tests]
- Scope-specific checks: [list what ran]
### Code Quality: [PASS/WARN/FAIL]
### Security: [PASS/WARN/FAIL]
### Performance: [PASS/WARN/FAIL]
### Tests: [X/Y passing, Z% coverage]
### Spec Coverage
- R1: ✅/❌ addressed in diff
- R2: ✅/❌ addressed in diff
- AC1: ✅/❌ verified by test
- AC2: ✅/❌ verified by test
### Action Items
1. [blocker or warning]
Step 5: Act
- All PASS + all AC verified: "Check passed. Run
/ship to create a PR."
- WARN: Show warnings, ask if user wants to fix before shipping
- FAIL or AC missing: List each blocker with a one-line fix hint. "Fix with
/go, then re-run /check."
Anti-Rationalization
| Excuse |
Rebuttal |
What to do instead |
| "It's a small change, skip security" |
Small changes introduce big vulnerabilities |
Always run the security checklist |
| "Tests are passing, that's enough" |
Tests don't catch security or performance issues |
Run all 3 modes |
| "I'll fix the warnings later" |
Later never comes |
Fix blockers now, warnings before merge |
Evidence Required
Red Flags
- Skipping security review for "small changes"
- Approving code with failing tests
- Ignoring performance warnings in hot paths
- Marking check PASS when any AC is unverified
1---2name: check3description: Check phase. Launches parallel review (code quality + security + tests) with scope-based extras (API contract, accessibility, migration safety). Outputs PASS/WARN/FAIL per dimension with spec coverage verification.4---56# Check — Verify Everything78**CRITICAL**: Run `HARNESS_DIR=$(epic-harness path)` first. NEVER use `.harness/` in the project directory.910## Execution Modes1112This skill has 3 internal modes that run in parallel:13141. **check:code** — Code quality, logic, style, test coverage, spec coverage152. **check:security** — OWASP Top 10 + performance (N+1, leaks)163. **check:test** — Full test suite, AC verification, coverage delta1718---1920## Process2122### Step 0: Prerequisites2324Confirm go has run:25```bash26git symbolic-ref --short HEAD # must NOT be main/master27```2829Load the spec to know what was supposed to be built:30```bash31ls -t $HARNESS_DIR/specs/SPEC-*.md | head -132```33Read the Requirements and Acceptance Criteria sections.3435### Step 1: Gather Scope3637```bash38git diff --stat $(git merge-base HEAD main)39git diff --name-only $(git merge-base HEAD main)40```4142### Step 2: Scope Detection4344| Pattern | Scope | Extra checks |45|---------|-------|-------------|46| `*.api.*`, `*route*`, `*controller*`, `*handler*` | API | + Contract testing, request validation |47| `*.tsx`, `*.jsx`, `*.vue`, `*.svelte`, `*.css` | Frontend | + Accessibility, semantic HTML |48| `*.sql`, `*migration*`, `*schema*` | Database | + Migration safety, rollback plan |49| `*.rs`, `Cargo.toml`, `*.go`, `go.mod` | Backend | + Build verification, type safety |50| `*.test.*`, `*.spec.*`, `__tests__/` | Tests | + Coverage delta, flaky test detection |51| `Dockerfile*`, `*.yml`, `*.yaml`, `Makefile` | Infra | + Config validation, secret detection |52| `*.md`, `*.txt` | Docs | + Link checking, freshness |5354### Step 3: Run Checks in Parallel5556Launch all 3 modes with `run_in_background: true`.5758---5960## Mode: check:code (Review)6162### Review Dimensions63641. **Correctness**: Does the code do what it claims? Edge cases handled?652. **Logic**: Race conditions, off-by-one, null pointer risks?663. **Style**: Consistent with project conventions? Readable?674. **Tests**: Changes covered by tests? Tests meaningful?685. **Naming**: Do names clearly convey intent?696. **Spec coverage**: Each Requirement addressed in the diff?7071### Output Format7273```74## Code Review: <file or area>75- [BLOCKER] <description> (line X)76- [WARN] <description> (line Y)77- [NIT] <description> (line Z)7879## Summary80- Blockers: N81- Warnings: N82- Verdict: APPROVE / REQUEST_CHANGES83```8485---8687## Mode: check:security (Audit)8889### Security Checklist (OWASP Top 10)90911. Injection (SQL, XSS, command)922. Broken authentication933. Sensitive data exposure944. Access control failures955. Security misconfiguration9697### Performance Checklist98991. N+1 queries1002. Unbounded data loading1013. Missing indexes1024. Memory leaks (event listeners, growing caches)1035. Blocking main thread104105### Output Format106107```108## Security Audit109- [CRITICAL] SQL injection risk in <file>:<line>110- [HIGH] Hardcoded secret in <file>:<line>111- [MEDIUM] Missing rate limit on <endpoint>112113## Performance Audit114- [HIGH] N+1 query in <file>:<line>115- [MEDIUM] Unbounded array growth in <file>:<line>116117## Summary118- Security: PASS / FAIL (N critical, N high)119- Performance: PASS / WARN (N issues)120```121122---123124## Mode: check:test (Test Runner)1251261. Run the full test suite1272. Verify each Acceptance Criterion is demonstrably met1283. Report coverage delta1294. Flag any flaky tests130131---132133### Step 4: Synthesize134135Combine all findings into a single report:136137```138## Check Report139- Spec: SPEC-{timestamp} ({goal_slug})140- Branch: {current branch}141142### Change Scope143- Scopes detected: [API, Frontend, Backend, Database, Infra, Docs, Tests]144- Scope-specific checks: [list what ran]145146### Code Quality: [PASS/WARN/FAIL]147### Security: [PASS/WARN/FAIL]148### Performance: [PASS/WARN/FAIL]149### Tests: [X/Y passing, Z% coverage]150151### Spec Coverage152- R1: ✅/❌ addressed in diff153- R2: ✅/❌ addressed in diff154- AC1: ✅/❌ verified by test155- AC2: ✅/❌ verified by test156157### Action Items1581. [blocker or warning]159```160161### Step 5: Act162163- **All PASS + all AC verified**: **"Check passed. Run `/ship` to create a PR."**164- **WARN**: Show warnings, ask if user wants to fix before shipping165- **FAIL or AC missing**: List each blocker with a one-line fix hint. **"Fix with `/go`, then re-run `/check`."**166167## Anti-Rationalization168169| Excuse | Rebuttal | What to do instead |170|--------|----------|-------------------|171| "It's a small change, skip security" | Small changes introduce big vulnerabilities | Always run the security checklist |172| "Tests are passing, that's enough" | Tests don't catch security or performance issues | Run all 3 modes |173| "I'll fix the warnings later" | Later never comes | Fix blockers now, warnings before merge |174175## Evidence Required176177- [ ] All 3 modes (code, security, test) completed178- [ ] Each Requirement has a coverage verdict179- [ ] Each AC has a test/verification verdict180- [ ] No BLOCKER items remain on PASS181182## Red Flags183184- Skipping security review for "small changes"185- Approving code with failing tests186- Ignoring performance warnings in hot paths187- Marking check PASS when any AC is unverified
ConcertoNotes