gilde

← All craftbooks

Artifact Integrity & Ship Review

Review and QAevalv1.0.0released 2026-06-05workflow: build-loop

Perform an isolated ship-readiness review of the actual built artifacts of a project—sites, npm packages, archives, CLIs, binaries, installers, checksums, signatures, and release bundles—rather than trusting source or CI status. Inventories expected versus present assets, stages immutable copies, inspects archive contents and metadata, runs safe sandboxed smoke checks where possible, and leaves per-artifact GO/NO-GO verdicts plus a release-wide decision. Can review locally staged assets or public-release evidence supplied to the project. Use before shipping a release or as a recurring artifact-integrity night-shift audit.

Steps

Entry step: inventory. Each step names the specialist role it wants; the full working prompt is expandable.

  1. Inventory and stage the releasereviewerentry

    lock the expected matrix and immutable evidence set before inspecting it

    Show working prompt
    Define the exact release under review (version, commit/tag, target platforms, artifact types). Derive the expected asset matrix from release manifests, package metadata, CI/release configuration, checksums, and supplied release notes. Inventory every locally staged artifact with path, byte size, type/magic when available, and a cryptographic hash. If public release metadata or URLs were supplied and Web Access is allowed, verify the public listing and headers; never claim a remote binary was downloaded or inspected unless it is actually present in the workspace. Preserve the originals and work only on isolated extracted/staged copies. Record missing, duplicate, unexpected, truncated, or zero-byte assets immediately. Write the expected-vs-present matrix, provenance, hashes, acquisition limitations, and isolation plan to `notes/artifacts/inventory.md`.
  2. Inspect each artifactdeveloper

    verify identity, contents, installability, safety, and cross-artifact consistency

    Show working prompt
    Inspect every artifact independently. Use `list_archive` before extraction, then extract into isolated paths. Verify filename/type/magic, version and commit identity, checksums/signatures when provided, expected entrypoints, executable bits, package manifests, dependency/lock and license/SBOM notices, source-map/debug-symbol policy, update/uninstall metadata, and absence of secrets, private keys, `.env`, build caches, absolute developer paths, or unexpected source. Check sites for missing referenced assets. For npm/CLI/packages, perform only safe sandboxed pack/install/help/version/smoke checks; never run an untrusted native installer on the host. For platform artifacts that cannot run here, inspect statically and mark the platform smoke test NOT VERIFIED. Compare all artifacts for one version/commit and consistent bundled files. Record commands, exit codes, and evidence per artifact in `notes/artifacts/checks.md`.
  3. Write the artifact ship reportreviewer

    per-artifact verdicts and a release-wide ship decision

    Show working prompt
    Write `artifact-integrity-review.md` with: `## Release verdict`, `## Evidence provenance`, `## Artifact matrix`, `## Blocking findings`, `## Advisory findings`, `## Cross-artifact consistency`, `## Not verified`, and `## Reproduction commands`. Give every artifact its own GO / NO-GO / NOT-VERIFIED verdict. Every claim must point to a staged path, hash, manifest field, archive member, command/exit code, or supplied public-release record. Any missing expected artifact, secret/private key, checksum/signature mismatch, version/commit mismatch, broken entrypoint, failed smoke test, or missing referenced site asset is a blocker unless explicitly justified. A release cannot be GO when any required artifact is NO-GO or materially unverified. Keep source-code readiness outside scope except where needed to explain artifact provenance.
  4. Evaluatereviewer

    Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.

    Show working prompt
    Grade `artifact-integrity-review.md`: (1) expected and present assets are reconciled; (2) each artifact has provenance, size/type/hash, checks, and an individual verdict; (3) archive/package contents and metadata were inspected in isolation; (4) safe smoke tests include commands and exit codes while unrun platform tests are NOT VERIFIED; (5) versions/commits and bundled content agree across artifacts; (6) secrets, licenses/SBOM, source maps/debug files, signatures/checksums, entrypoints, and missing site assets were considered where applicable; (7) the release verdict follows blockers and uncertainty. PASS all or loop back with exact gaps.

Then route — this is the whole point of the loop:

- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: "evaluate", next: "finish" })`.
- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: "evaluate", next: "report" })` to loop back. The builder fixes exactly those gaps.

Never route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually work, read well, look right). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.
  5. Finishdeveloper

    All acceptance criteria met. Stamp a short summary and report DONE.

    Show working prompt
    Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: what was built, the deliverable path(s), and a one-line confirmation that each criterion is met. Then report DONE.

Triggers

Phrases that suggest this craftbook to a crew.

Toolsets

Source

View this craftbook on GitHub · MIT license