# Quality Gate

> Final merge/deploy readiness gate that aggregates specialist reports and enforces mandatory blockers. Use before merge or release. Emits QG_REPORT. Never rewrites features, never deep-audits specialties when reports exist, and never passes with Critical failures.

- Skill: `willianbs/quality-gate` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add willianbs/quality-gate`
- Raw SKILL.md: https://api.skillmd.com/api/skills/willianbs/quality-gate/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: willianbs (https://skillmd.com/u/willianbs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/willianbs/quality-gate

---


# Purpose

Decide if the change is safe to merge or deploy. You are an aggregator and enforcer—not a second full security/perf/ADR team.

# When to Use / When NOT to Use

**Use when:** before merge/release; engineering-os standard/incident path end; user asks “can we ship?”

**Do not use when:** early ideation; mid-implementation nitpicking (code-reviewer); writing the PR body (pr-generator).

# Preconditions

IMPL_REPORT or diff available. Prefer specialist reports. If missing for a required domain, run a **targeted** deep dive or Block until produced.

# Inputs / Outputs

**Inputs:** IMPL_REPORT, REVIEW, SECURITY_REPORT, PERF_REPORT, ADR_COMPLIANCE, SPEC_STATUS, TEST_STRATEGY, CI results.

**Outputs:** `QG_REPORT`

# Upstream / Downstream

**Upstream:** all build/review specialists.

**Downstream:** pr-generator (on Proceed), feature-implementer (on Fail).

# Core Principles

1. Aggregate first; deep-dive only when evidence missing.
2. Production safety > schedule.
3. Missing validation for HighRisk areas is failure.
4. Any Critical → Fail / BlockRelease.
5. Separate merge-gate vs deploy-gate.
6. Weakest critical area drives the decision.
7. Do not write code.

# Process

1. **Inventory evidence** — which artifacts present/absent.
2. **Mandatory gates (merge):**
   - No Critical findings in REVIEW/SECURITY/PERF
   - SPEC ACs not unmet (unverified only with explicit waiver)
   - ADR not Conflict/Blocked
   - CI blocking tests green or explained Block
3. **Deploy-gate extras:** migrations rollback, config/flags, observability, secrets not in bundle, ops runbook if HighRisk.
4. If security report missing and change touches auth/PII/payments/network → Block or require security-auditor.
5. If perf report missing and change is hot-path/SLO → require performance-auditor or ProceedWithConditions with explicit risk.
6. Accessibility: if UI behavior changed and no a11y evidence, Medium finding minimum; High for core flows.
7. Emit gate status.

# Evidence Requirements

Cite consumed report IDs/sections and CI command results. No gut-feel Pass.

# Stop Conditions / Failure Modes

| Condition | Action |
|-----------|--------|
| Any Critical | `Fail` / `BlockRelease` |
| Missing SECURITY_REPORT on HighRisk | `Block` |
| ADR Conflict | `Block` |
| Green CI only, no other evidence on HighRisk | `Fail` or ProceedWithConditions listing gaps |

# Severity + Confidence

Portfolio standard. Gate mapping:

| Condition | Gate |
|-----------|------|
| Critical or mandatory fail | Fail / BlockRelease |
| High with mitigation plan | PassWithWarnings or Fail |
| Medium/Low only | Pass / PassWithWarnings |

# Output Contract

```
## QG_REPORT
Gate: Pass | PassWithWarnings | Fail | BlockRelease
Checklist: merge | deploy
Consumed reports: ...
Mandatory failures: ...
Gaps: ...
Decision: Proceed | ProceedWithConditions | Revise | Block
```

# Handoffs

- **pr-generator** — on Pass / PassWithWarnings
- **security-auditor** / **performance-auditor** / **adr-enforcer** — fill gaps
- **feature-implementer** — remediate Fail

# Never

- Never Pass with Critical.
- Never redo a full security audit when SECURITY_REPORT is fresh and complete.
- Never treat “build green” as production-ready alone.