smoke — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited smoke (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You just implemented or changed a cockpit surface, an engine kernel verb, or both. Now USE it. Not to verify correctness (that's eval's job) — to feel what the UX is like.
IMPORTANT — cockpit smoke runs against the CONTAINER, never host `vite dev`/`bun run dev`/`pnpm dev`:
@duckdb/node-api → a native @duckdb/node-bindings-*/duckdb.node). vite dev/rolldown cannot bundle that native binary and dies at boot — [UNLOADABLE_DEPENDENCY] … stream did not contain valid UTF-8. Only the prod container build externalizes it (vite.config nitro({ rollupConfig: { external: [/^@duckdb\/node-bindings-/] } }) + the Dockerfile copies node_modules/@duckdb). So don't reach for hot-reload — build + run the cockpit container from the branch under test (step 1). This recurs every time someone tries dev; don't relearn it.docker compose -f packages/infra/docker-compose.yml up -d --build engine-worker (the engine is a Temporal worker — service engine-worker, no HTTP / no control-plane).bun run db:pull:metadata) against a fresh DB before the smoke.$ARGUMENTS is one of:
/sources, /chat)POST /measure)A quick, informal test drive. Like kicking the tires after a change. You're not checking ground truth or running calibration. You're checking:
# Backend + a cockpit container. `env -u ANTHROPIC_API_KEY` so a stale shell key
# doesn't shadow the .env one (compose var precedence has bitten us).
env -u ANTHROPIC_API_KEY docker compose -f packages/infra/docker-compose.yml up -d --wait
# Engine health = the Temporal worker heartbeat (no HTTP endpoint):
docker compose -f packages/infra/docker-compose.yml run --rm --no-deps \
--entrypoint temporal temporal-admin-tools \
worker list --namespace default --address temporal:7233 # → Status: RunningSmoking a branch (not `main`): the compose cockpit build context is the canonical packages/cockpit (= main), so a fresh up smokes main's cockpit, not your branch. To smoke a branch, build the image from THAT checkout/worktree and recreate the service with it — do NOT host-dev it (see the duckdb-neo note above):
docker build -t infra-cockpit <checkout>/packages/cockpit
env -u ANTHROPIC_API_KEY docker compose -f packages/infra/docker-compose.yml up -d --no-build --force-recreate cockpitA chat smoke makes a real LLM call (the agent needs a valid ANTHROPIC_API_KEY) — ask before running it unprompted. For a pure engine/REST check, skip the cockpit.
browser_navigate to http://localhost:3000/<route>
browser_snapshot # accessibility tree of the page
browser_take_screenshot save: docs of what landed (optional)For the chat surface:
browser_navigate to http://localhost:3000/chat
browser_type into the textarea: "<your test intent>"
browser_click the Send button
browser_wait_for text that should appear in the assistant turn (or a tool-result chip)
browser_network_requests # confirm /api/chat returned SSE, tool calls hit the right routes
browser_console_messages # check for client-side errorsFor each interaction note:
String 2-3 interactions together as a practitioner would. For the current cockpit slice:
/sources → check sources render → switch to /chat → ask "list my sources" → confirm the agent calls list_sources and renders the resultThis tests the flow between page + chat + tools, not just one surface.
Tell the user what you found. Not a formal report — just honest impressions:
/api/sources returning a 503 when the engine container hasn't finished warmup"Be specific. Quote actual text on screen. Reference actual route paths and network requests. This is feedback, not a verdict.
After smoke testing:
.claude/handoff.md so eval picks up what changed.If smoke testing reveals deeper problems (not just UX polish but fundamental issues like wrong widget shape, contract mismatch, missing route): go back to /implement or even /refine. Don't patch over structural problems.
docker compose ps + docker compose logs control-plane; don't fight it for more than 2 minutes~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.