Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/KtKID/x-dev-pipelinenpx agentmods add skills/ktkid/x-dev-pipeline/x-qa-gateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-qa-gate)<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-qa-gate"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-qa-gate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-qa-gate"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-qa-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00140 | $0.01344 |
| Opus 5.5 | $0.00056 | $0.00538 |
| Sonnet 5.5 | $0.00028 | $0.00269 |
| Haiku 4.5 | $0.00014 | $0.00134 |
Grade A, and why
x-qa-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
verify 后续质量审查
路由
verify exit 0 后进入质量审查。读取 task dev-checklist.md 头部的 risk::
- Q0和Q1 risk串行检查 :三个 reviewer agent 并行完成 q1-intent、q2-correctness、q3-evidence。
三类审查
q1-intent
检查实现是否对齐用户意图、已确认需求、验收 Scenario、既有公开契约和声明的改动范围。
q2-correctness
检查非法输入、边界条件、失败路径、状态转换、缓存、并发、幂等性和资源清理是否正确。
q3-evidence
检查测试和 verify 证据是否真实触达改动路径,断言是否独立于实现,mock 是否保留真实契约,证据是否能击穿错误实现。
事实源
- 用户原始请求、已确认 spec、既有公开契约。
- 真实调用方、schema/数据约束、改动前测试契约。
- spec2 的 Requirement/Scenario、系统不变量、modules/design;或 spec3 的目标、影响边界与不变量、判断依据、建模覆盖和直接 Scenarios。
- dev-report verify 块、verify JSON 或失败报告、当前 diff。
输入裁剪
| Reviewer | 必读输入 |
|---|---|
| 综合 reviewer | diff + task 引用的 Scenario + 相关边界/不变量 + dev-report + 测试文件 |
| q1-intent | diff + 目标/Requirement + task 引用的 Scenario |
| q2-correctness | diff + 影响边界、不变量、建模覆盖及相关 modules/design |
| q3-evidence | diff + dev-report verify 块 + 测试文件 |
主 agent 提供文件路径、节名、git diff --stat、git diff --name-only 和按需 diff 命令。reviewer 按需读取源代码与测试文件。
Review 纪律
- 每个 reviewer 独立、只读,只返回 review 回执;x-fix 负责改动。
- 每轮穷尽检查范围后一次返回全部问题候选,并声明“已检查范围内无其他 P0/P1”。
- 每条候选固定提供
task、severity、loc、msg;task可为T2,T3,severity为 P0/P1/P2,loc为file:line,msg为单条问题描述。 - reviewer 省略 issue ID。主 agent 调用
flag后使用其 JSONissue字段建立编号映射。 - P0 需要位置与可复现依据;证据不完整时降级。P0 或未处置 P1 使本轮 fail;P2 登记且保持非阻塞。
issue 登记
主 agent 按 reviewer 返回顺序逐条执行:
python3 tools/xdev.py flag <task-dir> --task T2,T3 --severity P0 \
--loc src/a.py:10 --msg "空输入未处理" [--new-round] --json
- 本轮第一条候选添加
--new-round;后续候选追加到同一 ledger。 - 保存 JSON 返回的
issue、downgraded、report、recovered,把 issue ID 回填到交给 x-fix 的问题映射。 recovered:true表示命令完成了上一笔 pending 事务;主 agent 使用原参数再次调用,完成本条候选登记。flag是 issue ledger 与 P0/P1 checklist 降级的唯一写入口。reviewer、子 agent 与 x-fix 保持这两处原样。- 本轮无问题时省略 ledger 创建,直接输出通过回执。
回流
本轮存在 P0/P1 时,主 agent 把带 issue-<n> 的完整问题映射交给 x-fix 批量修复。修复后复审对应 issue 与 fix diff;fix 扩大到新文件时纳入新文件,公开 API 签名变化时重做相关意图和契约对照。reports/.fix-counter 记录 verify 与质量审查共享的批量修复轮数,保留三轮上限;质量审查最终通过后写回 0。
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +15 lines · +71 tokens per session b7bc67b59581
- 2mo ago First seen · 78 lines · 69 tokens per session scan A 159b66cab6c3
x-qa-gate is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed 17d ago), licensed MIT. It adds 140 tokens to every session and 1,344 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
test-audit
Audit test suites for T1-T4 violations using AST analysis, mock detection, and multi-stage synthesis. Invoke when user asks to audit tests, check test quality, find mock violations, review test effectiveness, or inspect test suites for over-mocking. Triggers automatic rewrites when quality gates fail.
holdout-validation
Cross-reference agent self-review claims and evidence-bundle entries against actual file state using hidden holdout scenarios, producing P1/P2/P3 findings mapped to visible acceptance criteria only. Checks that every expected value in the tests has the source the bundle claims and that every risk-map row has a…
review
Holistic review of all changes — correctness, consistency, style, test coverage. Runs tests, checks console, verifies integration. Returns pass/fail report.
pocket-planning
Converts a pocket-grinding spec into a TDD-structured execution plan of full Pocket Packets. Use when pocket-grinding handoff arrives (spec path + acceptance criteria). Trigger on "create plan", "build plan", "pocket-planning", or when pocket-grinding skill invokes this. Outputs tasks ready to dispatch via…
validate-plan
Validate implementation plans against DRY, YAGNI, TDD principles and best practices. Use when reviewing plans from pocket-planning or another planning workflow to identify gaps, anti-patterns, and improvement opportunities before execution.
coding-standards
Quality gates, prohibited patterns, verification discipline, and self-audit rules for all code generation and review sessions.