Evyasys Build
ASecurityUse this skill to build a planned story end to end in one command. Starts development (approval moves the story to In Progress), writes the code following every loaded standard, writes and executes unit tests when the user opts in (the choice is asked up front), runs an independent code review with one bounded auto-fix pass, then runs the project's real format / lint / type-check / build / test commands and records the results as evidence. The hook re-derives the verdict from that evidence — ...
- 7 stars
- 0 votes
- 0 copies
- 1 view
- Added October 11, 2026
Works with
Security analysis
100/100Pro scans all 2 files and shows the line behind each finding
npx -y skills add Evyasys-Software-Solutions/EvyaGovernance --skill evyasys-build --agent claude-codeAre you the author of Evyasys Build?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/evyasys-software-solutions-evyasys-build)---
name: evyasys-build
description: Use this skill to build a planned story end to end in one command. Starts development (approval moves the story to In Progress), writes the code following every loaded standard, writes and executes unit tests when the user opts in (the choice is asked up front), runs an independent code review with one bounded auto-fix pass, then runs the project's real format / lint / type-check / build / test commands and records the results as evidence. The hook re-derives the verdict from that evidence — check results fingerprinted to the changed files, a static test-quality scan, AC → test citations, file existence and syntax — and keeps the worse of its verdict and the agent's. Writes TechBrainstorm, DevSummary (with a generated Verification section), CodeReview and TestPlan, then — when Setup configured git — raises a pull request if (and only if) the full test run is green and the delivery report is complete, comments the report on the story and moves the story and its tasks; otherwise it raises nothing and tells you what to fix. An independent reviewer pass runs automatically as part of the same run and its findings go on the PR and the story. main / release / develop are never written to; nothing is merged for you. Without git configured: no git by default; opt-in `--commit` makes a local commit, never pushed. Accepts story IDs, an epic ID, or a mix. Triggered by `/evyasys:Build`. Replaces the former `/evyasys:Deliver`.
trigger: /evyasys:Build
---
# Skill: evyasys-build
`/evyasys:Build` covers start of development, coding, unit tests, independent review and sign-off in one run and adds what none of them had:
checks that actually execute and a verdict that cannot outrun the evidence. It supersedes `/evyasys:Deliver`, whose full
feature set it keeps.
## Flow
| Phase | Action | Autonomous? |
|---|---|---|
| 0 | Load story, subtasks, knowledge base, standards, templates; detect the project's checks | Yes |
| 1 | Probe + **Gate 1**: all questions and the **unit-test choice** in one message | Gate |
| 2 | Reference scan + approach; **Gate 2** — approval also sets *In Progress* | Gate |
| 3 | Change plan, code, and tests (if opted in) | Yes |
| 4 | Independent review, ≤ 1 auto-fix iteration for Critical findings | Yes |
| 5 | **Verify**: format · lint · type-check · build · tests, ≤ 3 fix iterations, one final full run, verifier fact-check | Yes |
| 6–8 | TestPlan, docs-to-update queue, DevSummary, **Gate 3** review | Gate |
| 4b | **Reviewer pass** over the final diff (pull-request flow only) | Yes |
| 7b | **Delivery report**: deployment notes, regression compared with the new feature, risks, skipped, not done | Yes |
| 9 | Hook: re-verify, **final confirmation**, write artefacts, then **pull request** (ready) or **"fix first"** (not ready), notify, traceability | Hook |
## Why the verdict can be trusted
- The agent never reports a check from memory: `scripts/lib/project-checks.js` runs the project's own commands
(package.json scripts, pytest, dotnet, go, maven/gradle, cargo, composer, or `.evyasys/checks.json`) and records exit codes,
durations and output tails in `.evyasys/.cache/build/` (git-ignored), plus a **fingerprint** of every uncommitted file and every
check-configuration file.
- The hook recomputes the verdict from that evidence. Editing anything after a check ran — including a file the agent did not list —
makes it **stale** and is treated as unrun. `ok` is recomputed from the recorded exit code; a runner that finds no tests is not a pass.
- Check-configuration edits (package.json, tool configs, `.evyasys/checks.json`) are surfaced: undeclared → Critical, declared → Important.
- **Limits:** the evidence is local and unsigned — it stops inflated *claims*, not a deliberately forged file. What the agent merely asserts on
your behalf (accepted failures, skipped checks, opting out of tests) is printed verbatim at the final confirmation so you can decline;
`--tests` / `--no-tests` / `--commit` are read from your command arguments and override the manifest.
- With tests on: the full suite must pass, test files must contain cases **and** assertions (no `.only`, skips flagged),
and every acceptance criterion must cite a real `path::test name` that exists in the file.
- Every changed file must exist and parse. A check the project has but that was never run blocks the story unless it carries a
concrete `checksSkipped` reason; a failure the user knowingly accepts needs a written reason and is reported as Important.
- Verdicts: **SUCCESS** · **PARTIAL** (only Important issues) · **BLOCKED** (any Critical — never delivered).
## Pull requests (when Setup configured git)
A story becomes a pull request only when **every** line holds — each is computed from recorded evidence, not claimed:
| Needed | Source |
|---|---|
| Verdict SUCCESS — no Critical, no Important finding | `build-gate` |
| The **full** test suite ran green on the final code; every executed test passed; the pass **%** is read from the runner's own output | `project-checks` evidence + `test-summary` |
| The suite did not shrink and the pass rate did not fall against the last delivered baseline (`.evyasys/.cache/build/baseline.json`) | `pr-report` |
| Report complete: deployment / environment notes, ≥ 1 regression area, risks, every skipped item with a real reason, nothing "not done" unless you accepted it | `prReport` in the manifest |
- **Ready** → commit on `feature/<StoryID>` → push *that branch only* (explicit refspec, never forced) → open the PR with the full report → post the same report on the story as a comment (percentage and details, what to take care of in any environment, regression, risks, skipped, not done) → set the story to the configured state (default *Ready for QA*) and its tasks to done → notify (*pr-raised*).
- **Not ready** → no commit, no push, no PR, **no board change**; the numbered list of what to fix is printed and sent (*pr-blocked*). Fix and run Build again — it is idempotent (an open PR for the branch is reused).
- **Reviewer (automatic, same run)** → an independent reviewer subagent reads the final diff against your rules (blockers, quality issues, questions, each with `file:line`); the hook posts the findings on the PR and on the story and sends a *pr-reviewed* notification. Review blockers keep the story and its tasks where they are. A story with no reviewer pass gets no PR. The reviewer can only comment — it cannot approve or merge.
- **Never**: a commit, push, merge, rebase or reset on a protected branch (`main`, `master`, `develop`, `release*`, …) — blocked by a Claude hook, by git hooks and by code; merging a PR (the client has no merge call; `gh pr merge` is blocked).
- `--no-pr` keeps the older behaviour for one run. **A project that never ran Setup's git step is unchanged — the report, the reviewer pass and every pull-request step are skipped.**
## Unit tests (your choice, asked once)
Gate 1 asks whether to **write and run** unit tests (recommended) or **skip** them. `--tests` / `--no-tests` answer it up front.
Skipping still runs format/lint/type-check/build; the summary states that tests were opted out.
## Kept from Deliver
Batch load with `CONTEXT.md` first · idempotency guards · architecture reference scan and brainstorm gate · independent reviewer ·
verifier fact-check · docs-to-update queue · traceability · `CONTEXT.md` refresh · epic expansion (each story announced individually) ·
opt-in `--commit` (branch + local commit of the listed files only; unsafe paths and branch names rejected; never pushed).
## Safety improvements over Deliver
- A story missing from `.ado-map.json` never has its state set (an Evyasys ID would address a different work item).
- Git calls use argument arrays, not shell strings.
- Truncated agent output is detected before anything is written.
## Output
| Artefact | Path |
|---|---|
| TechBrainstorm · DevSummary · CodeReview · TestPlan (written by the agent) | `.evyasys/board/**/{storyId}/{storyId}_<Name>.md` |
| BuildReport (generated by the hook from the recorded evidence; also kept for BLOCKED stories) | `.evyasys/board/**/{storyId}/{storyId}_BuildReport.md` |
| Check evidence (git-ignored) | `.evyasys/.cache/build/{storyId}.json` |
| Source + test files | the feature branch and its pull request (git configured) · otherwise the working tree (uncommitted unless `--commit`) |
| Pull request + story comment | the git host and the board story (git configured; not written when the report is not ready) |
| Traceability | `.evyasys/traceability.json` (verdict, gates, tests mode, files) |
| Context | `.evyasys/CONTEXT.md` refreshed |
Artefact names and locations are unchanged, so `/evyasys:Qa` consumes them as before. Never produces release notes — `/evyasys:Qa` sign-off owns that.
Files in this skill
- SKILL.md
- hooks.js
Attribution
Comments
Loading comments…
Newsletter
Get the weekly list of safe new skills, and the ones we pulled.