Test commands: what the gates actually run

What they are

Every connected repo can hold a list of checks: a build, lint, unit, integration or end-to-end command. They are the single source of truth for verification. If a line is not on the list, no gate runs it.

How they are stored

Each row holds the bare in-container command, for example corepack pnpm test. The Docker wrapper is composed only at gate time, from the agent image chosen for that code. Lines must not assume root: no sudo, no global npm installs, and package managers run through corepack.

A few rows cannot be bare, such as multi-repository orchestration or a hand-written compose call. Those keep the full string, run verbatim, and are marked in the UI as pipeline-only.

Discovery

In container mode, an owner can ask DevFlow to find them. A discovery role works on a temporary checkout of the default branch, installs dependencies and runs candidates until some work. Build and test are separate passes, and each pass can only store its own categories.

The model cannot claim that something is verified. The harness reads the exit code of every shell call it made, then replays each reported line in a fresh container. The stored verdict is replay, trace only or unverified.

Why it matters

A repository with an empty list merges on the AI review alone. The readiness check warns about that case, and about any discovered entry not proven by a replay.

The deep readiness check goes further. It runs each repository's build command on a clean checkout of the default branch and reports whether it passes.