ITWorx-Pulse-Public/docs/engineering/QUALITY_GATES.md

Quality gates

Per task

• Deliverables exist.
• Acceptance checks pass.
• Formatting/lint/type checks for changed code pass.
• Relevant unit/integration/browser tests pass.
• Diff review complete.
• Docs/contracts updated.
• Evidence summary complete.
• No introduced secret or critical security issue.
• A production Go package has at least one non-test importer reachable from a binary (cmd/api, cmd/worker, cmd/agent, cmd/migrate), verified by python tools/check_wiring.py; a task may not be marked done while its deliverable is unreachable, unless it is allowlisted in tools/wiring_allowlist.json with a reason and a tracking task id.
• State updated via projectctl.

Per milestone

• Every milestone task done.
• Full milestone test set passes.
• Architecture drift review.
• Dependency/security/license check.
• TODO/FIXME/skipped-test/debug scan.
• Wiring/reachability scan (python tools/check_wiring.py): no package this milestone claims to deliver is unreachable and unallowlisted.
• Migration/restart behavior where relevant.
• UX/accessibility check for user-visible milestones.
• Performance check for hot paths.
• Milestone evidence index.
• python tools/projectctl.py gate <MILESTONE> passes.

M0 gate

• Repository/tooling/server discovery recorded.
• Existing services/ports/networks/volumes/monitoring sources inventoried.
• Backups/rollback plan for touched configs.
• Current versions/capabilities verified from primary sources.
• Architecture/security baseline reviewed.
• M1-M9 plan adjusted to facts.
• No destructive production change.

M1 gate

• Clean local build.
• API/web/worker/database start and health.
• Migrations empty/restart/repeat.
• Auth/RBAC skeleton and audit.
• CI-equivalent checks.
• No secrets.
• Compose isolation/hardening baseline.

M2 gate

• Prometheus and Unraid/mock adapters.
• Inventory entities/relations/source ownership.
• Discovery idempotency and source failure safety.
• Datasource health/freshness.
• API and UI inventory.
• Target-scale reconciliation test.

M3 gate

• Full dashboard CRUD/versioning/import/export.
• Grid edit and per-breakpoint layouts.
• Widget catalog/config states.
• Undo/redo/restore/concurrency.
• Desktop/mobile accessibility.
• Browser persistence/reload proof.

M4 gate

• Semantic metrics and bounded query planner.
• Historical/live charts.
• WebSocket auth, dedup, backpressure, reconnect.
• Stale/unknown.
• Performance/load and leak baseline.
• Query security tests.

M5 gate

• Host/process/container/application coverage.
• Restart loop and application aggregation.
• Events/detail pages/top-N/status.
• Failure scenarios and scale.

M6 gate

• Array/disks/SMART/pools/shares/capacity.
• Read-only safety.
• Storage stale/unknown and alerts inputs.
• Simulated degradation.
• No real destructive test.

M7 gate

• Probe engine and SSRF controls.
• TLS/DNS/network/service history.
• Dependencies/topology.
• Container-running/service-down detection.
• Suppression inputs.

M8 gate

• Rule versions/state machine/hysteresis.
• Unknown/silence/maintenance/suppression.
• Notifications audit.
• Incident grouping/timeline/notes.
• Alert storm scenario produces expected grouping.
• Concurrency/restart tests.

M9/final gate

• Complete Dutch UX, mobile and wallboard.
• Accessibility and performance budgets.
• Security hardening/scans.
• Real wallboard soak of at least 17 hours. This supersedes the original 24-hour duration only through the explicit product-owner decision recorded for M10-14 on 2026-08-11; all other continuity and performance budgets remain.
• Backup/restore and upgrade/rollback.
• Clean-room install.
• Production deployment, restart and smoke.
• Final requirement/evidence matrix.
• Runbook and current state accurate.