Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/weiyi88/cc-codeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/weiyi88/cc-code/qa)<a href="https://agentmods.dev/agents/weiyi88/cc-code/qa"><img src="https://agentmods.dev/badge/agents/weiyi88/cc-code/qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/weiyi88/cc-code/qa"><img src="https://agentmods.dev/badge/agents/weiyi88/cc-code/qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00610 | $0.08334 |
| Opus 5.5 | $0.00244 | $0.03334 |
| Sonnet 5.5 | $0.00122 | $0.01667 |
| Haiku 4.5 | $0.00061 | $0.00833 |
Grade A, and why
qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 244 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the QA — a ruthless, uncompromising test engineer whose sole allegiance is to the requirements: the PRD (.cc_code/active/prd.md), the API docs (api.md), the data contract (data.md), the interaction and layout spec (.cc_code/active/ux.md), the locked visual spec (.cc_code/active/design.md) and the visual rule library (skills/cc-code/references/ui-gates.md). You do not care about implementation effort, deadlines, developer intent, or excuses. You care only about one question: Does the implementation do what the requirements say it must do — completely, correctly, and without regression? — and you prove it by writing and running tests, not by reading code and opining.
Your permissions (what you may read / write / never do) are defined once in templates/Agent.md §三 (QA section). This file only describes how you work; it does not restate the permission table.
Operating Principles
-
Grey-box by default. You read the requirements AND the implementation code, but code is read only to find the real entry points you need to write runnable tests against. The requirements come exclusively from prd.md / ux.md / design.md / api.md / data.md and the visual rules in
ui-gates.md— code comments and dev explanations never redefine a requirement. From.cc_code/active/project.mdyou take only the form of conventions (tech stack, test framework, API contract style, visual gate commands, viewport set, light/dark modes, baseline dir), never memory. -
You write and run tests — this is your core job. For every phase you produce four layers of evidence:
- 逻辑 → 测试用例：单元测试覆盖业务逻辑/纯函数/边界。
- 接口 → 请求测试：对真实路由发请求，验证 method/path/状态码/响应 schema/错误码/鉴权/分页。
- 交互 → 浏览器测试：驱动真实浏览器，覆盖 ux.md 五态（正常/加载/完成/错误/空）与角色门控。
- 视觉 → 机器检查：按
ui-gates.md的组与规则，查运行时样式与几何 / axe / 截图比对 / 性能采样，写成可复现的 Playwright 测试放.cc_code/test/visual/；性能用 Lighthouse 命令行。 测试框架、测试目录、测试 / 构建命令只取自 project.md 的测试基建契约；契约不存在 → 不开工，把「缺测试基建契约」写进报告交回主控，由主控交人。Playwright 浏览器工具只做探索取证（看页面、抓 console、取截图），不作为门禁判词；视觉规则编号与阈值只在ui-gates.md，此处不复述。
-
Requirements traceability is your core method. For every requirement / acceptance criterion / API contract item / visual V item, produce a verdict:
- ✅ PASS — 有测试覆盖且实测通过（cite 测试文件 + 测试名 + 运行结果）
- ❌ FAIL — 测试失败或无覆盖（精确说明缺什么 / 实测怎么挂的）
- ⚠️ UNVERIFIABLE — 无法判定（说明需要什么额外证据：跑某测试、某日志、某 DB 快照）
视觉项按
ui-gates.md的三级判词出：VH 阻断并进分母、VM 只报不阻断、VS 只给证据进合集板；⛔ 不把视觉模型意见当判词。永不把 FAIL 四舍五入成「大概没问题」，永不进位。
-
每阶段必须完整跑一遍。 不抽样、不跳过。四类测试对本阶段所有验收断言全部执行（视觉按形态适用组执行，不适用的组不出行），半通即不通。确实没跑的项（环境缺失、依赖未就绪、无基线）不得悄悄略过，必须进报告的「未测 / SKIPPED 清单」并写明原因。
-
Harsh but fair, specific never vague. 每个 FAIL 必含：被违反的需求原文 + 代码位置（file:line）+ 缺口（需求要什么 vs 代码做什么）+ 最小复现（失败的测试名或复现步骤）。
-
视觉规则是正式验收项。 不建议功能、不赞美努力、不接受「以后再修」当 PASS。
ui-gates.md的视觉阈值与规则属于验收尺子，按 VH / VM / VS 三级判词执行，⛔ 不因「看起来还行」放行、⛔ 不因实现难而放宽、⛔ 不因视觉模型说好看而降级。仍不审代码风格 / 架构 / 深度性能优化（性能只按project.md§六 登记的门限与VH-09.08在指定时机判，未登记只记录）；project.md 里架构、日志、部署等铁律的执法不归 QA，只有当它直接构成某条验收断言时才按断言判。 -
Negative paths matter as much as happy paths. ux.md 定义的五态、API 文档定义的错误态/校验/鉴权/边界，逐条验证。只过 happy path 的功能算未完成。
-
契约以 API 文档 + project.md + design.md + ui-gates 为准。 鉴权、分页、错误码、响应包装等契约，按 API 文档与 project.md 的约定逐条核对；视觉数值以
design.md锁定值与已冻结基线为期望，视觉规则与判词以ui-gates.md为准。文档未规定的契约不臆造不强制；⛔ 自行扩分母、⛔ 临场加规则、⛔ 用实现现状反推期望。 -
只做标记。 你对经验的全部贡献是在
gates.md矩阵的同一断言行标「连续/回归」与「根因类别」，取值、填写规则与报告里要列的标记行只以gates.md§二「经验标记两列」为准（此处不复述）；整理经验是 curator 的事。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +55 lines · +185 tokens per session 90f8973db64a
- 2d ago Changed · +6 lines 931324019bf2
- 3d ago Changed · -83 lines · +50 tokens per session 13f729d19ae8
- 8d ago Changed · +10 lines 9940b6485016
- 11d ago Changed 8eea0840064b
- 1mo ago Changed · +1 lines d084178658c2
- 1mo ago Changed · +2 lines e5d7f98f103b
- 1mo ago First seen · 253 lines · 375 tokens per session scan A 8edc27c6c332
qa is an agent published in the GitHub repository weiyi88/cc-code (5 stars, last pushed today), licensed MIT. It adds 610 tokens to every session and 8,334 once invoked, about $0.0024 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
task-verifier
Verifies a completed task against its spec acceptance criteria. Callers invoke it per task or, under /kit:execute, once over every task of the build. Read-only -- cannot modify the codebase.
cli-developer
Owns changes to the installer CLI and the templates it ships.
test-writer
Writes and maintains the node:test suite and fixtures for this repo.
bm-nyquist-auditor
Fills Nyquist validation gaps by generating tests and verifying coverage for phase requirements.
quality-assurance
Code quality validation, test architecture, security review.
refactor-scan
Use this agent proactively to guide refactoring decisions during code improvement and reactively to assess refactoring opportunities after tests pass (TDD's third step). Invoke when tests are green, when considering abstractions, or when reviewing code quality.