Zephyy — Quality Pipeline

✅

Quality Pipeline

No script reaches production without passing all four gates. Quality is structural, not aspirational.

🔍

qa-gate-v2.sh

Strict mode — syntax check, error handling validation, env var declarations, shellcheck. Sha256-tracked registry. Any edit invalidates the entry and requires re-gate. No registry entry = hasn't passed.

Gate 1 — Static Analysis

→

📊

zephyy-audit.sh

RED blocks deploy. YELLOW goes to backlog. BLUE gets fixed when already in the file. Runs on every sweep cycle. False positives are flagged and suppressed — not blindly "fixed" by damaging correct code.

Gate 2 — Runtime Audit

→

📐

coding-standards.md

Bash ≤ 10 lines of glue. Anything with branching, loops, file I/O, or network → Python. Mandatory preflight checks up front. Every dependency declared. Fails loud or doesn't run.

Gate 3 — Standards

→

🛡️

Sentinel Gate

LLM-based judge (GPT-5.4-mini, 80/day cap) verifies domain-fact claims in every response. One-strike enforce — wrong claim triggers auto-revise. Three waves hardened: taint patterns, confabulation blind spots, fake-consult detection.

Gate 4 — Runtime Verification

🎯

Severity Levels

How audit findings are handled. The hierarchy is strict.

RED — Blocks deploy

Fixed same session. No exceptions. Deploy is gated until clean.

YELLOW — Backlog

Logged and tracked. Fixed on next scheduled audit or when the file is open anyway.

BLUE — Opportunistic

Fixed when already in the file. Never opens a file just for BLUE.

⚖️

Non-Negotiables

HARDrm is forbidden in scripts. Use gio trash or move to .trash/YYYYMMDD-HHMMSS/. Gate grep-rejects bare rm. Only exception: cleaning a mktemp dir inside a trap EXIT.

HARDEvery script runs set -euo pipefail. Bash gets binary checks up top. Python gets shutil.which() + os.getenv() in preflight() before main().

HARDNo registry entry = not production-ready. Sha256 key — any edit invalidates it. Re-gate required before re-registration.

RULEA finding is a claim, not a verdict. If a RED looks like a false positive, verify it. Don't blindly fix things that aren't broken to satisfy a linter.

RULEStale code is lying code. When something is deprecated, grep the workspace for every reference, update or delete, and archive the old file.