Run lightweight micro-QC after each work-item phase, not just at the end

[attilaszasz]

Problem

The Implement phase runs all delivery phases then validates once (.github/skills/implement-tasks/SKILL.md:194-205). The implement-qc-loop then runs full QC. Bugs in the Nth work item's implementation are not discovered until all work items are complete, causing wasted iteration cycles.

Proposed Solution

Add a lightweight "smoke QC" after each work-item phase (US1/OBJ1 completed, then US2/OBJ2, etc.):

1. Run tests filtered to the completed work item's test files
2. Lint only files changed in this phase
3. Grep for common security anti-patterns in changed files (secrets, unsanitized input)
4. Verify the work item's exports match declared contracts

Failures at this level are cheaper to fix than at full QC — the agent is still contextually close to the code it just wrote. This is not a replacement for full QC, but a fast-feedback complement.

Suggested by DeepSeek

[attilaszasz]

Resolved by #37 (merged).

What changed

Added a lightweight Micro-QC pass to the Implement workflow that runs after the Phase Review on each delivery work-item phase ([US#]/[OBJ#]). Setup/Foundational/Polish keep the structural Phase Review only — exactly the phases you called out in the issue.

The four checks, scoped to the phase's changed files

1. Filtered tests — test commands filtered to the work item's test files (from the plan's ## Testing Strategy rows tagged to the phase's requirements, else co-located test files), run with --changed/--lf differential filters.
2. Lint changed files only — eslint [files] / ruff check [files] / stack equivalent, scoped to PHASE_CHANGED_FILES.
3. Security anti-pattern grep — hardcoded secrets, unsanitized input in changed files (via the QC Auditor's security scan).
4. Export/contract conformance — grep each → exports: symbol in its declared file; verify signature against contracts/ when present.

Key design decisions

• Scope (PHASE_CHANGED_FILES): git diff --name-only HEAD at phase end minus a snapshot captured at phase sync. Fallback to the union of task filePath/exports paths when git is unavailable. Empty changed set → skip with a SKIPPED report line.
• Execution: reuses the existing QC Auditor (.github/agents/_qc-auditor.md) in differential mode — no new sub-agent, no duplicated logic. The Auditor already supports changedFiles for differential test/lint/security. The export/contract check runs inline since the Auditor doesn't cover contract conformance.
• Failure behavior — fix-now, then continue: each failure routes into the existing per-task On FAILURE — Error Recovery loop (auto-fix by error type → one retry via Delegate: Developer), so the agent fixes while still contextually close to the code it just wrote. The implement run never halts on a micro-QC failure; a second failure on the same task follows the existing sequential-task double-failure rule (mark skipped) and re-surfaces at full /sddp-qc.

Not a replacement for full QC

Micro-QC is a fast-feedback complement, as you specified. Full /sddp-qc (Story Verifier, PI compliance, NFR checks, browser runtime validation, coverage enforcement, full traceability) still runs unchanged at the end of implement and via the implement-qc-loop. Micro-QC intentionally does not cover requirement-level behavioural/scenario verification — that stays the Story Verifier's job.

Files

• .github/skills/implement-tasks/SKILL.md — new rule in <rules>, new step 5 in the per-phase loop, new Micro-QC (Work-Item Phases Only) block after the Phase Review, microqc: field in .implement-state.
• .github/skills/implement-tasks/references/dry-run-review-checklist.md — new Micro-QC review section for future changes to this area.

CI (Validate Wrapper Drift Report) passes. Closing as resolved.