Zephyy — Quality Pipeline

✅

Quality Pipeline

No script reaches production without passing all four gates. Quality is structural, not aspirational.

🔍

qa-gate.sh

Strict mode — syntax check, error handling validation, env var declarations; shellcheck for Bash, ruff and a complexity ratchet for Python. Sha256-tracked registry. Any edit invalidates the entry and requires re-gate. No registry entry = hasn't passed.

Gate 1 — Static Analysis

→

📊

zephyy-audit.sh

Walks the whole script corpus with qa-gate's rules. RED blocks the commit. YELLOW goes to backlog. BLUE gets fixed when already in the file. False positives are flagged and suppressed — not blindly "fixed" by damaging correct code.

Gate 2 — Runtime Audit

→

📐

coding-standards.md

Bash for one-liners, Python for logic, Bun for our own JavaScript. Anything with branching, loops, file I/O, or network → Python. Mandatory preflight checks up front. Every dependency declared. Fails loud or doesn't run.

Gate 3 — Standards

→

🛡️

Sentinel Gate

LLM-based judge (free models first, 80/day cap) reads each assertive reply for claims no tool call backed that turn. Running in shadow: it logs every verdict and blocks nothing yet; enforce sends a flagged reply back for revision. Three waves hardened: taint patterns, confabulation blind spots, fake-consult detection.

Gate 4 — Runtime Verification

🎯

Severity Levels

How audit findings are handled. The hierarchy is strict.

RED — Blocks deploy

Fixed same session. No exceptions. The commit is refused until clean.

YELLOW — Backlog

Logged and tracked. Fixed on next scheduled audit or when the file is open anyway.

BLUE — Opportunistic

Fixed when already in the file. Never opens a file just for BLUE.

⚖️

Non-Negotiables

HARDDeletes are recoverable. Use trash.py, never a bare rm. The gate rejects a recursive rm without a ${VAR:?} guard.

HARDEvery script runs set -euo pipefail. Bash gets binary checks up top. Python gets shutil.which() + os.getenv() in preflight() before main().

HARDNo registry entry = not production-ready. Sha256 key — any edit invalidates it. Re-gate required before re-registration.

RULEA finding is a claim, not a verdict. If a RED looks like a false positive, verify it. Don't blindly fix things that aren't broken to satisfy a linter.

RULEStale code is lying code. When something is deprecated, grep the workspace for every reference, update or delete, and archive the old file.