Quality Review Stack

Kevin's agent quality review skills: staff-engineer code review, QA with real browsers, 6-phase design audit. Skills as markdown, thin harness, fat skills, no one-off work. Built on the same philosophy as The Brain-Agent Loop.

Architecture

The quality review stack is Kevin's family of agent review skills: gstack-review for staff-engineer code review, gstack-qa for browser-based QA, and gstack-design-review for UX/design audit. The current executable skills are narrower than the older "full sprint" map below; this page now treats that map as historical context and the three installed skills as the maintained surface. Source: skills/engineering/gstack-review/SKILL.md; skills/engineering/gstack-qa/SKILL.md; skills/engineering/gstack-design-review/SKILL.md

Current Source Snapshot

Plan Review as Preflight

Garry's text-only planning row is useful because it names the orchestration shape behind the slash-command list: before approving a plan, route it through role-specific reviewers such as a virtual CEO, DevEx manager, designer, and engineering manager. The upside is not ceremony; it is forcing product, developer-experience, design, and architecture objections to appear before the build loop starts, so the implementation can often land with less rework. For Kevin's stack, this is the planning-side companion to gstack-review and gstack-qa: use specialist review before expensive execution when a task has real product or architectural ambiguity. Source: X/@garrytan, 2026-04-20

Key Skills

UX Behavioral Foundations

Every design skill thinks about how users behave, not just how the interface looks.

UX Principles Resolver

A shared {{UX_PRINCIPLES}} resolver distills Steve Krug's "Don't Make Me Think" into actionable agent guidance: scanning behavior, satisficing, the goodwill reservoir, navigation wayfinding, and the trunk test. Injected into /design-html, /design-shotgun, /design-review, and /plan-design-review. Design reviews now catch "this navigation is confusing" problems, not just "the contrast ratio is 4.3:1."

6 Usability Tests in design-review

First-Person Narration Mode

Design review reports read like a usability consultant watching someone use the site: "I'm looking at this page... my eye goes to the logo, then a wall of text I skip entirely. Wait, is that a button?" Anti-slop guardrail: if the agent can't name the specific element, it's generating platitudes.

$B ux-audit Command

Standalone UX structural extraction. One command extracts site ID, navigation, headings, interactive elements, text blocks, and search presence as structured JSON. The agent applies the 6 usability tests to the data. Element caps: 50 headings, 100 links, 200 interactive, 50 text blocks.

snapshot -H / --heatmap Flag

Color-coded overlay screenshots. Pass a JSON map of ref IDs to colors (green/yellow/red/blue/orange/gray) and get an annotated screenshot with per-element colored boxes. Composable: any skill can use it.

Token Ceiling Enforcement

Skill docs exceeding 100KB (~25K tokens) get flagged. Catches prompt bloat before it degrades agent performance.

Confusion Protocol

The 2026-04-16 reviewed screenshot announced "gstack v0.18.0" and named Confusion Protocol as the first item: every workflow skill stops and asks when it hits an ambiguous decision instead of guessing. The same image also listed Hermes host support, GBrain integration, slop:diff advisory review, skill-router triggers, CEO-review reinforcement, and investigation history. The durable rule for Kevin's stack is the ambiguity gate: when a task reaches a real fork, ask for a decision or record a bounded assumption before running a long agent loop. Source: X/@garrytan and local image review, 2026-07-03

Security Fix Wave

The 2026-04-13 GStack/GBrain screenshot is a historical security-release artifact for agent browser and skill runtimes. It names cookie-origin pinning, persistent browse command audit logs, cookie-domain tracking, symlink-safe output validation, cookie-import path hardening, setup-script shell-injection fixes, credential-field redaction beyond type="password", prompt-injection pattern detection, IPv6 metadata blocking, private session-file permissions, frozen lockfile installs, and safer temp paths for cookie import. Source: X/@garrytan and local image review, 2026-07-04

The durable rule is not "copy GStack wholesale." It is that agent harnesses need defense-in-depth around browser state, filesystem writes, setup/install paths, logs, and prompt-derived learnings. Kevin's local route stays the installed review skills plus Agent Security Model and Security and Review Skills when importing third-party skills or browser automation.

Reviewed UX Capability Artifact

The reviewed 2026-04-14 GStack screenshot is the clearest source for the UX foundations: it names a shared {{UX_PRINCIPLES}} resolver, Steve Krug-derived scanning/satisficing/goodwill/trunk-test rules, the six usability tests above, first-person narration with an anti-slop guardrail, $B ux-audit JSON extraction, snapshot -H heatmap overlays, and token ceiling checks for generated skills. Kevin's local gstack-design-review already carries the comprehensive design-audit route, so this bookmark is evidence for the existing route rather than a new import. Source: X/@garrytan and local artifact review, 2026-07-02

Core Patterns

The quality review stack and Kevin's LLM Wiki share foundational philosophy:

• Brain-first lookup (search wiki before external sources)
• Compiled truth + timeline page structure
• "Boil the Lake" completeness ethos
• Three Layers of Knowledge
• Deterministic collectors

The UX foundations codify Steve Krug's "Don't Make Me Think" into agent-executable usability tests.

---

Timeline

• 2026-07-04 | Deep-reviewed Garry Tan's GStack/GBrain security-fix screenshot. Preserved the concrete security families: cookie-origin pinning, browse audit logs, symlink/path hardening, setup-script injection fixes, credential redaction, prompt-injection checks, metadata blocking, session-file permissions, frozen lockfile install, and temp-path cleanup. Current source authority remains garrytan/gstack main HEAD 11de390...; the screenshot is historical release evidence. Source: X/@garrytan, 2026-04-13; Source: GitHub garrytan/gstack, 2026-07-04
• 2026-07-04 | Source-reviewed the text-only GStack planning row and added plan review as preflight: run CEO/DevEx/design/engineering review before approving ambiguous plans, so implementation starts after objections are surfaced. Source: X/@garrytan, 2026-04-20
• 2026-07-03 | Deep-reviewed Garry Tan's Confusion Protocol screenshot. Preserved it as historical v0.18.0 release evidence and refreshed current source authority: MIT repo, main HEAD 11de390..., 119.2K stars, no Git tags/releases, and public changelog head 1.58.5.0. Source: X/@garrytan, 2026-04-16; Source: GitHub garrytan/gstack, 2026-07-03
• 2026-07-02 | Deep-reviewed Garry Tan's GStack UX-capability screenshot and refreshed the source snapshot: MIT repo, main HEAD 11de390..., 118.8K stars, no tags found, and no local skill import needed because gstack-design-review already covers the route. Source: X/@garrytan, 2026-04-14; Source: GitHub garrytan/gstack, 2026-07-02
• 2026-06-17 | Added explicit provenance and narrowed the maintained surface to the installed gstack-review, gstack-qa, and gstack-design-review skills. Source: skills/engineering/gstack-review/SKILL.md; skills/engineering/gstack-qa/SKILL.md; skills/engineering/gstack-design-review/SKILL.md
• 2026-05-17 | Recontextualized as Kevin's own quality review stack. Source: wiki maintenance
• 2026-04-14 | UX behavioral foundations: {{UX_PRINCIPLES}} resolver (Steve Krug), 6 usability tests in design-review, first-person narration mode, $B ux-audit command, heatmap screenshots, token ceiling enforcement. Source: agent skill notes
• 2026-04-10 | Key review patterns adopted into Kevin's wiki. Source: agent skill notes