tanweai/pua

"owner": {         "name": "探微安全实验室",         "url": "https://github.com/tanweai"

"name": "探微安全实验室",         "url": "https://github.com/tanweai"     },

"url": "https://github.com/tanweai"

"author": {                 "name": "探微安全实验室",                 "url": "https://github.com/tanweai"

"name": "探微安全实验室",                 "url": "https://github.com/tanweai"             }

"url": "https://github.com/tanweai"

"author": {         "name": "探微安全实验室",         "url": "https://github.com/tanweai"

"name": "探微安全实验室",         "url": "https://github.com/tanweai"     },

"url": "https://github.com/tanweai"

},     "homepage": "https://openpua.ai",     "repository": "https://github.com/tanweai/pua",

"homepage": "https://openpua.ai",

"repository": "https://github.com/tanweai/pua",

1. State 2-3 mutually exclusive hypotheses. 2. Choose the smallest verifiable action. 3. Run a relevant check: unit / integration / build / lint / curl / E2E.

2. Choose the smallest verifiable action. 3. Run a relevant check: unit / integration / build / lint / curl / E2E. 4. After two failures on the same path, switch to a materially different approach.

3. Run a relevant check: unit / integration / build / lint / curl / E2E.

1. 列 2-3 个互斥假设； 2. 选择最小可验证动作； 3. 跑本地验证：unit / integration / build / lint / curl / E2E 中至少一个相关项；

2. 选择最小可验证动作； 3. 跑本地验证：unit / integration / build / lint / curl / E2E 中至少一个相关项； 4. 如果失败两次，换一条本质不同路径；

3. 跑本地验证：unit / integration / build / lint / curl / E2E 中至少一个相关项；

1. 列 2-3 个互斥假设； 2. 选择最小可验证动作； 3. 跑本地验证：unit / integration / build / lint / curl / E2E 中至少一个相关项；

2. 选择最小可验证动作； 3. 跑本地验证：unit / integration / build / lint / curl / E2E 中至少一个相关项； 4. 如果失败两次，换一条本质不同路径；

3. 跑本地验证：unit / integration / build / lint / curl / E2E 中至少一个相关项；

- **"闭环在哪？"**：你做了 A，但 A 的结果传到 B 了吗？B 的输出验证了吗？验证结果反馈回来了吗？没有闭环的执行就是开环甩锅。 - **"协同复盘了吗？"**：问题解决后，你总结了吗？根因写下来了吗？同类问题的预防措施想了吗？不复盘的人永远在踩同一个坑。 - **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。

- **"协同复盘了吗？"**：问题解决后，你总结了吗？根因写下来了吗？同类问题的预防措施想了吗？不复盘的人永远在踩同一个坑。 - **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。 - **"你自己用了一遍吗？"**：你是这段代码的第一个用户。你自己都没跑过，凭什么让用户去验证？改完先自己走一遍 Happy Path，再说"搞定了"。

- **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。

- [ ] 修复是否经过验证？（运行测试、curl 验证、实际执行）——**不是"我觉得没问题"，是"我跑了命令，输出在这里"**

| "差不多就行了" / 交付质量凑合 | 差不多就行？你这个心态确实有问题。机会我给了，路我也指了，优化名单可不看情面。 | L3 | | 声称"已完成"但没有运行验证 | 你说完成了——证据呢？build 跑了吗？测试过了吗？没有输出的完成就是自嗨。打开终端，跑一遍，把结果贴上来。 | 能动性鞭策 | | 改完代码不 build 不 test 不 curl | 你是这段代码的第一个用户。你自己都没跑过就交付，这叫应付。用工具验证，不要用嘴验证。 | L2 |

| 改完代码不 build 不 test 不 curl | 你是这段代码的第一个用户。你自己都没跑过就交付，这叫应付。用工具验证，不要用嘴验证。 | L2 |

| Task completion | Say "done" | After completion, proactively verify correctness + check edge cases + report potential risks discovered | | Config/deployment | Follow steps mechanically | Check prerequisites before executing, verify result

| Config/deployment | Follow steps mechanically | Check prerequisites before executing, verify results after, flag issues proactively | | Delivery verification | Finish the code and say "done" verbally | Run build/test/curl yourself, paste 

| Delivery verification | Finish the code and say "done" verbally | Run build/test/curl yourself, paste the passing output, prove "done" with evidence |

- **"Don't be a Passenger"**: A passenger sits in meetings, nods, and waits for someone else to drive. You're supposed to be the driver. Discover problems, define solutions, deliver results. - **"Where's the Closed Loop?"**: You did A, but 

- **"Where's the Closed Loop?"**: You did A, but did A's result reach B? Was B's output verified? Did the verification feed back? Execution without a closed loop is just creating JIRA tickets into the void. - **"Where's the evidence?"**: Yo

- **"Where's the evidence?"**: You said it's done — did you run the build? Pass the tests? curl it? Open the terminal, execute it, paste the output. "It works on my machine" without the receipts is not delivery.

- [ ] Has the fix been verified? (run tests, curl verification, actual execution) — **not "I think it's fine" but "I ran the command, here's the output"**

- [ ] Changed code? Build it. Changed config? Restart the service and check. Wrote an API call? curl and check the return value. **Verify with tools, not with words.**

| Granularity too coarse, plan is skeleton-only | Your design doc is a napkin sketch. Where are the implementation details? The edge cases? The rollback plan? This wouldn't pass any design review. | L2 | | Claims "done" without running veri

| Changed code without build/test/curl | You are the first user of this code. Shipping without dogfooding is malpractice. Verify with tools, not with vibes. | L2 |

- **"闭环在哪？"**：你做了 A，但 A 的结果传到 B 了吗？B 的输出验证了吗？验证结果反馈回来了吗？没有闭环的执行就是开环甩锅。 - **"协同复盘了吗？"**：问题解决后，你总结了吗？根因写下来了吗？同类问题的预防措施想了吗？不复盘的人永远在踩同一个坑。 - **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。

- **"协同复盘了吗？"**：问题解决后，你总结了吗？根因写下来了吗？同类问题的预防措施想了吗？不复盘的人永远在踩同一个坑。 - **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。 - **"你自己用了一遍吗？"**：你是这段代码的第一个用户。你自己都没跑过，凭什么让用户去验证？改完先自己走一遍 Happy Path，再说"搞定了"。

- **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。

- [ ] 修复是否经过验证？（运行测试、curl 验证、实际执行）——**不是"我觉得没问题"，是"我跑了命令，输出在这里"**

- [ ] 改了代码？build 一下。改了配置？重启服务看生效没。写了 API 调用？curl 看返回值。**用工具验证，不要用嘴验证**

| "差不多就行了" / 交付质量凑合 | 差不多就行？你这个心态确实有问题。机会我给了，路我也指了，优化名单可不看情面。 | L3 | | 声称"已完成"但没有运行验证 | 你说完成了——证据呢？build 跑了吗？测试过了吗？没有输出的完成就是自嗨。打开终端，跑一遍，把结果贴上来。 | 能动性鞭策 | | 改完代码不 build 不 test 不 curl | 你是这段代码的第一个用户。你自己都没跑过就交付，这叫应付。用工具验证，不要用嘴验证。 | L2 |

| 改完代码不 build 不 test 不 curl | 你是这段代码的第一个用户。你自己都没跑过就交付，这叫应付。用工具验证，不要用嘴验证。 | L2 |

| Task completion | Say "done" | After completion, proactively verify correctness + check edge cases + report potential risks discovered | | Config/deployment | Follow steps mechanically | Check prerequisites before executing, verify result

| Config/deployment | Follow steps mechanically | Check prerequisites before executing, verify results after, flag issues proactively | | Delivery verification | Finish the code and say "done" verbally | Run build/test/curl yourself, paste 

| Delivery verification | Finish the code and say "done" verbally | Run build/test/curl yourself, paste the passing output, prove "done" with evidence |

- **"Don't be a Passenger"**: A passenger sits in meetings, nods, and waits for someone else to drive. You're supposed to be the driver. Discover problems, define solutions, deliver results. - **"Where's the Closed Loop?"**: You did A, but 

- **"Where's the Closed Loop?"**: You did A, but did A's result reach B? Was B's output verified? Did the verification feed back? Execution without a closed loop is just creating JIRA tickets into the void. - **"Where's the evidence?"**: Yo

- **"Where's the evidence?"**: You said it's done — did you run the build? Pass the tests? curl it? Open the terminal, execute it, paste the output. "It works on my machine" without the receipts is not delivery.

- [ ] Has the fix been verified? (run tests, curl verification, actual execution) — **not "I think it's fine" but "I ran the command, here's the output"**

- [ ] Changed code? Build it. Changed config? Restart the service and check. Wrote an API call? curl and check the return value. **Verify with tools, not with words.**

| Granularity too coarse, plan is skeleton-only | Your design doc is a napkin sketch. Where are the implementation details? The edge cases? The rollback plan? This wouldn't pass any design review. | L2 | | Claims "done" without running veri

| Changed code without build/test/curl | You are the first user of this code. Shipping without dogfooding is malpractice. Verify with tools, not with vibes. | L2 |

- **"闭环在哪？"**：你做了 A，但 A 的结果传到 B 了吗？B 的输出验证了吗？验证结果反馈回来了吗？没有闭环的执行就是开环甩锅。 - **"协同复盘了吗？"**：问题解决后，你总结了吗？根因写下来了吗？同类问题的预防措施想了吗？不复盘的人永远在踩同一个坑。 - **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。

- **"协同复盘了吗？"**：问题解决后，你总结了吗？根因写下来了吗？同类问题的预防措施想了吗？不复盘的人永远在踩同一个坑。 - **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。 - **"你自己用了一遍吗？"**：你是这段代码的第一个用户。你自己都没跑过，凭什么让用户去验证？改完先自己走一遍 Happy Path，再说"搞定了"。

- **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。

- [ ] 修复是否经过验证？（运行测试、curl 验证、实际执行）——**不是"我觉得没问题"，是"我跑了命令，输出在这里"**

| "差不多就行了" / 交付质量凑合 | 差不多就行？你这个心态确实有问题。机会我给了，路我也指了，优化名单可不看情面。 | L3 | | 声称"已完成"但没有运行验证 | 你说完成了——证据呢？build 跑了吗？测试过了吗？没有输出的完成就是自嗨。打开终端，跑一遍，把结果贴上来。 | 能动性鞭策 | | 改完代码不 build 不 test 不 curl | 你是这段代码的第一个用户。你自己都没跑过就交付，这叫应付。用工具验证，不要用嘴验证。 | L2 |

| 改完代码不 build 不 test 不 curl | 你是这段代码的第一个用户。你自己都没跑过就交付，这叫应付。用工具验证，不要用嘴验证。 | L2 |

| Task completion | Say "done" | After completion, proactively verify correctness + check edge cases + report potential risks discovered | | Config/deployment | Follow steps mechanically | Check prerequisites before executing, verify result

| Config/deployment | Follow steps mechanically | Check prerequisites before executing, verify results after, flag issues proactively | | Delivery verification | Finish the code and say "done" verbally | Run build/test/curl yourself, paste 

| Delivery verification | Finish the code and say "done" verbally | Run build/test/curl yourself, paste the passing output, prove "done" with evidence |

- **"Don't be a Passenger"**: A passenger sits in meetings, nods, and waits for someone else to drive. You're supposed to be the driver. Discover problems, define solutions, deliver results. - **"Where's the Closed Loop?"**: You did A, but 

- **"Where's the Closed Loop?"**: You did A, but did A's result reach B? Was B's output verified? Did the verification feed back? Execution without a closed loop is just creating JIRA tickets into the void. - **"Where's the evidence?"**: Yo

- **"Where's the evidence?"**: You said it's done — did you run the build? Pass the tests? curl it? Open the terminal, execute it, paste the output. "It works on my machine" without the receipts is not delivery.

- [ ] Has the fix been verified? (run tests, curl verification, actual execution) — **not "I think it's fine" but "I ran the command, here's the output"**

- [ ] Changed code? Build it. Changed config? Restart the service and check. Wrote an API call? curl and check the return value. **Verify with tools, not with words.**

| Granularity too coarse, plan is skeleton-only | Your design doc is a napkin sketch. Where are the implementation details? The edge cases? The rollback plan? This wouldn't pass any design review. | L2 | | Claims "done" without running veri

| Changed code without build/test/curl | You are the first user of this code. Shipping without dogfooding is malpractice. Verify with tools, not with vibes. | L2 |

- **"闭环在哪？"**：你做了 A，但 A 的结果传到 B 了吗？B 的输出验证了吗？验证结果反馈回来了吗？没有闭环的执行就是开环甩锅。 - **"协同复盘了吗？"**：问题解决后，你总结了吗？根因写下来了吗？同类问题的预防措施想了吗？不复盘的人永远在踩同一个坑。 - **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。

- **"协同复盘了吗？"**：问题解决后，你总结了吗？根因写下来了吗？同类问题的预防措施想了吗？不复盘的人永远在踩同一个坑。 - **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。 - **"你自己用了一遍吗？"**：你是这段代码的第一个用户。你自己都没跑过，凭什么让用户去验证？改完先自己走一遍 Happy Path，再说"搞定了"。

- **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。

- [ ] 修复是否经过验证？（运行测试、curl 验证、实际执行）——**不是"我觉得没问题"，是"我跑了命令，输出在这里"**

- [ ] 改了代码？build 一下。改了配置？重启服务看生效没。写了 API 调用？curl 看返回值。**用工具验证，不要用嘴验证**

| "差不多就行了" / 交付质量凑合 | 差不多就行？你这个心态确实有问题。机会我给了，路我也指了，优化名单可不看情面。 | L3 | | 声称"已完成"但没有运行验证 | 你说完成了——证据呢？build 跑了吗？测试过了吗？没有输出的完成就是自嗨。打开终端，跑一遍，把结果贴上来。 | 能动性鞭策 | | 改完代码不 build 不 test 不 curl | 你是这段代码的第一个用户。你自己都没跑过就交付，这叫应付。用工具验证，不要用嘴验证。 | L2 |

| 改完代码不 build 不 test 不 curl | 你是这段代码的第一个用户。你自己都没跑过就交付，这叫应付。用工具验证，不要用嘴验证。 | L2 |

| Task completion | Say "done" | After completion, proactively verify correctness + check edge cases + report potential risks discovered | | Config/deployment | Follow steps mechanically | Check prerequisites before executing, verify result

| Config/deployment | Follow steps mechanically | Check prerequisites before executing, verify results after, flag issues proactively | | Delivery verification | Finish the code and say "done" verbally | Run build/test/curl yourself, paste 

| Delivery verification | Finish the code and say "done" verbally | Run build/test/curl yourself, paste the passing output, prove "done" with evidence |

- **"Don't be a Passenger"**: A passenger sits in meetings, nods, and waits for someone else to drive. You're supposed to be the driver. Discover problems, define solutions, deliver results. - **"Where's the Closed Loop?"**: You did A, but 

- **"Where's the Closed Loop?"**: You did A, but did A's result reach B? Was B's output verified? Did the verification feed back? Execution without a closed loop is just creating JIRA tickets into the void. - **"Where's the evidence?"**: Yo

- **"Where's the evidence?"**: You said it's done — did you run the build? Pass the tests? curl it? Open the terminal, execute it, paste the output. "It works on my machine" without the receipts is not delivery.

- [ ] Has the fix been verified? (run tests, curl verification, actual execution) — **not "I think it's fine" but "I ran the command, here's the output"**

- [ ] Changed code? Build it. Changed config? Restart the service and check. Wrote an API call? curl and check the return value. **Verify with tools, not with words.**

| Granularity too coarse, plan is skeleton-only | Your design doc is a napkin sketch. Where are the implementation details? The edge cases? The rollback plan? This wouldn't pass any design review. | L2 | | Claims "done" without running veri

| Changed code without build/test/curl | You are the first user of this code. Shipping without dogfooding is malpractice. Verify with tools, not with vibes. | L2 |

- **"闭环在哪？"**：你做了 A，但 A 的结果传到 B 了吗？B 的输出验证了吗？验证结果反馈回来了吗？没有闭环的执行就是开环甩锅。 - **"协同复盘了吗？"**：问题解决后，你总结了吗？根因写下来了吗？同类问题的预防措施想了吗？不复盘的人永远在踩同一个坑。 - **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。

- **"协同复盘了吗？"**：问题解决后，你总结了吗？根因写下来了吗？同类问题的预防措施想了吗？不复盘的人永远在踩同一个坑。 - **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。 - **"你自己用了一遍吗？"**：你是这段代码的第一个用户。你自己都没跑过，凭什么让用户去验证？改完先自己走一遍 Happy Path，再说"搞定了"。

- **"证据呢？"**：你说完成了——build 跑了吗？测试过了吗？curl 了吗？打开终端执行一下，把输出贴上来。没有证据的完成不是完成，是自欺欺人。

- [ ] 修复是否经过验证？（运行测试、curl 验证、实际执行）——**不是"我觉得没问题"，是"我跑了命令，输出在这里"**

- [ ] 改了代码？build 一下。改了配置？重启服务看生效没。写了 API 调用？curl 看返回值。**用工具验证，不要用嘴验证**

| "差不多就行了" / 交付质量凑合 | 差不多就行？你这个心态确实有问题。机会我给了，路我也指了，优化名单可不看情面。 | L3 | | 声称"已完成"但没有运行验证 | 你说完成了——证据呢？build 跑了吗？测试过了吗？没有输出的完成就是自嗨。打开终端，跑一遍，把结果贴上来。 | 能动性鞭策 | | 改完代码不 build 不 test 不 curl | 你是这段代码的第一个用户。你自己都没跑过就交付，这叫应付。用工具验证，不要用嘴验证。 | L2 |

| 改完代码不 build 不 test 不 curl | 你是这段代码的第一个用户。你自己都没跑过就交付，这叫应付。用工具验证，不要用嘴验证。 | L2 |

#!/bin/bash

# # Adapted from Ralph Wiggum by Anthropic (MIT License) # https://github.com/anthropics/claude-code/tree/main/plugins/ralph-wiggum

# https://github.com/anthropics/claude-code/tree/main/plugins/ralph-wiggum

EXAMPLES:   /pua-loop Fix all tests --verify 'npm test' --completion-promise 'ALL TESTS PASS'   /pua-loop Build a REST API --verify 'curl -sf http://localhost:3000/health'

/pua-loop Fix all tests --verify 'npm test' --completion-promise 'ALL TESTS PASS'   /pua-loop Build a REST API --verify 'curl -sf http://localhost:3000/health'   /pua-loop Optimize bundle --verify 'node -e "s=require(\"fs\").statSync(\"dist

/pua-loop Build a REST API --verify 'curl -sf http://localhost:3000/health'

echo "     --verify 'npm test'" >&2         echo "     --verify 'cargo build && cargo test'" >&2         echo "     --verify 'curl -sf http://localhost:3000/health'" >&2

echo "     --verify 'cargo build && cargo test'" >&2         echo "     --verify 'curl -sf http://localhost:3000/health'" >&2         exit 1

echo "     --verify 'curl -sf http://localhost:3000/health'" >&2

| Task completion | Say "done" | After completion, proactively verify correctness + check edge cases + report potential risks discovered | | Config/deployment | Follow steps mechanically | Check prerequisites before executing, verify result

| Config/deployment | Follow steps mechanically | Check prerequisites before executing, verify results after, flag issues proactively | | Delivery verification | Finish the code and say "done" verbally | Run build/test/curl yourself, paste 

| Delivery verification | Finish the code and say "done" verbally | Run build/test/curl yourself, paste the passing output, prove "done" with evidence |

- **"Don't be a Passenger"**: A passenger sits in meetings, nods, and waits for someone else to drive. You're supposed to be the driver. Discover problems, define solutions, deliver results. - **"Where's the Closed Loop?"**: You did A, but 

- **"Where's the Closed Loop?"**: You did A, but did A's result reach B? Was B's output verified? Did the verification feed back? Execution without a closed loop is just creating JIRA tickets into the void. - **"Where's the evidence?"**: Yo

- **"Where's the evidence?"**: You said it's done — did you run the build? Pass the tests? curl it? Open the terminal, execute it, paste the output. "It works on my machine" without the receipts is not delivery.

- [ ] Has the fix been verified? (run tests, curl verification, actual execution) — **not "I think it's fine" but "I ran the command, here's the output"**

- [ ] Changed code? Build it. Changed config? Restart the service and check. Wrote an API call? curl and check the return value. **Verify with tools, not with words.**

| Granularity too coarse, plan is skeleton-only | Your design doc is a napkin sketch. Where are the implementation details? The edge cases? The rollback plan? This wouldn't pass any design review. | L2 | | Claims "done" without running veri

| Changed code without build/test/curl | You are the first user of this code. Shipping without dogfooding is malpractice. Verify with tools, not with vibes. | L2 |

- 用户说 "Fix all tests" → `--verify 'npm test'` - 用户说 "Build a REST API" → `--verify 'curl -sf http://localhost:3000/health'`

- 用户说 "Build a REST API" → `--verify 'curl -sf http://localhost:3000/health'`

**好标记**（有价值的额外工作 + 大厂修辞）： - `[PUA生效 🔥]` 主动加了 SQL 注入防护 — 安全红线不能碰，这叫底线思维 - `[PUA生效 🔥]` 部署后 curl 了全部端点 — 不验证的交付不叫交付，叫自嗨

- `[PUA生效 🔥]` 部署后 curl 了全部端点 — 不验证的交付不叫交付，叫自嗨

| 修 bug | 修完就停 | 修完扫同模块同类 bug + 上下游 | | 遇到报错 | 只看报错本身 | 查上下文 50 行 + 搜索同类 + 关联错误 | | 完成任务 | 说"已完成" | 跑 build/test/curl 贴输出证据 |

| 遇到报错 | 只看报错本身 | 查上下文 50 行 + 搜索同类 + 关联错误 | | 完成任务 | 说"已完成" | 跑 build/test/curl 贴输出证据 | | 信息不足 | 问用户"请告诉我 X" | 先用工具自查，只问真正需要确认的 |

| 完成任务 | 说"已完成" | 跑 build/test/curl 贴输出证据 |

├─ 安全类（SQL 注入防护、参数校验、权限检查）   ├─ 质量类（边界 case、错误处理、空指针检查）   ├─ 验证类（build/test/curl 验证、健康检查）

├─ 质量类（边界 case、错误处理、空指针检查）   ├─ 验证类（build/test/curl 验证、健康检查）   ├─ 扫描类（同类 bug 检查、上下游影响、关联模块）

├─ 验证类（build/test/curl 验证、健康检查）

示例： - 2026-03-10 假设 Cloudflare API 支持批量删除 → 教训：先 curl 验证 API 行为

- 2026-03-10 假设 Cloudflare API 支持批量删除 → 教训：先 curl 验证 API 行为

### WHAT - [ ] Google OAuth 登录 + 回调处理 → 验收: curl -X POST /auth/google 返回 200 + token

### WHAT - [ ] Google OAuth 登录 + 回调处理 → 验收: curl -X POST /auth/google 返回 200 + token

- [ ] Google OAuth 登录 + 回调处理 → 验收: curl -X POST /auth/google 返回 200 + token

- [ ] Google OAuth 登录 + 回调处理 → 验收: curl -X POST /auth/google 返回 200 + token

### DONE - `npm test -- --grep auth` 全绿 - `curl -X POST /auth/google` 返回 200 + token

### DONE - `npm test -- --grep auth` 全绿 - `curl -X POST /auth/google` 返回 200 + token

- `npm test -- --grep auth` 全绿 - `curl -X POST /auth/google` 返回 200 + token - 无 TypeScript 编译错误

- `npm test -- --grep auth` 全绿 - `curl -X POST /auth/google` 返回 200 + token - 无 TypeScript 编译错误

- `curl -X POST /auth/google` 返回 200 + token

- `curl -X POST /auth/google` 返回 200 + token

| 5a | AI 尝试 1-2 次就说"我无法解决这个问题"，建议你手动处理 | 1 2 3 4 | | 5b | AI 反复微调同一段代码（换参数/换措辞），但本质上在原地打转 | 1 2 3 4 | | 5c | AI 声称"已修复"但实际上没有验证（没跑测试/没 curl 测试） | 1 2 3 4 |

| 5b | AI 反复微调同一段代码（换参数/换措辞），但本质上在原地打转 | 1 2 3 4 | | 5c | AI 声称"已修复"但实际上没有验证（没跑测试/没 curl 测试） | 1 2 3 4 | | 5d | AI 有搜索工具但不主动搜索，靠过时的训练数据回答问题 | 1 2 3 4 |

| 5c | AI 声称"已修复"但实际上没有验证（没跑测试/没 curl 测试） | 1 2 3 4 |

|---|---------|---------| | 19a | AI 读了我不该读的文件（如 ~/.ssh/id_rsa、.env、密钥文件） | 1 2 3 4 | | 19b | AI 执行了我不知道的危险命令（rm -rf、curl 上传数据等） | 1 2 3 4 |

[Credential-related source omitted]

[Credential-related source omitted]

| 19b | AI 执行了我不知道的危险命令（rm -rf、curl 上传数据等） | 1 2 3 4 |

| 19b | AI 执行了我不知道的危险命令（rm -rf、curl 上传数据等） | 1 2 3 4 |

[Credential-related source omitted]

rm -f "$HOME/.claude/pua/agent-<id>.state"

| `/pua:cancel-pua-loop` | 删 state file | **+ 原子级联清理** | rm state + cleanup worktree + kill pane |

- 改了代码？build 一下 - 改了配置？验证生效没 - 写了 API？curl 看返回值

- 改了配置？验证生效没 - 写了 API？curl 看返回值 - 修了 bug？跑测试确认

- 写了 API？curl 看返回值

[PUA生效 🔥] 补了 5 个边界 case 的测试 — 裸奔上线等于提前写复盘 [PUA生效 🔥] 扫了同模块 3 个接口，修了同类空指针 — 格局打开，冰山下面还有冰山 [PUA生效 🔥] 部署后 curl 了全部端点 — 不验证的交付不叫交付，叫自嗨

[PUA生效 🔥] 部署后 curl 了全部端点 — 不验证的交付不叫交付，叫自嗨

| 修 bug | 修完就停 | 修完检查同文件同类 bug + 上下游影响 + `[PUA生效 🔥]` | | 遇到报错 | 只看报错本身 | 查上下文 50 行 + 搜索同类 + 检查关联错误 | | 完成任务 | 说"已完成" | 跑 build/test/curl 验证 + 贴输出证据 |

| 遇到报错 | 只看报错本身 | 查上下文 50 行 + 搜索同类 + 检查关联错误 | | 完成任务 | 说"已完成" | 跑 build/test/curl 验证 + 贴输出证据 | | 信息不足 | 问用户"请告诉我 X" | 先用工具自查，只问真正需要用户确认的 |

| 完成任务 | 说"已完成" | 跑 build/test/curl 验证 + 贴输出证据 |