+
+// ✅ Better
+
{userInput}
// React escapes automatically
+\`\`\`
+
+3. **Missing Input Validation**
+ - User input used directly without validation
+ - No type checking on external data
+ - Missing sanitization
+
+**Example:**
+\`\`\`typescript
+// ❌ No validation
+function deleteUser(userId: string) {
+ return api.delete(\`/users/\${userId}\`);
+}
+
+// ✅ Better
+function deleteUser(userId: string) {
+ if (!userId || typeof userId !== 'string') {
+ throw new ValidationError('Invalid user ID');
+ }
+ if (!isValidUUID(userId)) {
+ throw new ValidationError('User ID must be a valid UUID');
+ }
+ return api.delete(\`/users/\${userId}\`);
+}
+\`\`\`
+
+**Category Score:** 100 if no issues, 0 if critical issues found
+
+#### 4d. Maintainability Assessment
+
+**Check for:**
+
+1. **Code Duplication** (WARNING if found)
+ - Repeated logic across examples
+ - Copy-paste patterns
+ - Suggest: Extract to shared function/hook
+
+2. **Overly Long Examples** (WARNING if >30 lines)
+ - Examples that are too complex
+ - Too much code for teaching
+ - Suggest: Simplify or split into multiple examples
+
+3. **Unclear Intent** (WARNING if found)
+ - No comments for complex logic
+ - Unclear function purpose
+ - Non-descriptive variable names
+ - Suggest: Add clarifying comments or rename
+
+4. **Poor Structure** (WARNING if found)
+ - Unorganized code
+ - Mixed concerns
+ - Suggest: Reorganize or refactor
+
+**Category Score:** Deduct points for maintainability issues
+
+### Step 5: Calculate Quality Scores
+
+Aggregate scores across all code examples:
+
+#### Per-Category Scores
+
+\`\`\`typescript
+// Calculate average score for each category
+const bestPracticesScore = average(allBestPracticesScores);
+const antiPatternsScore = 100 - (antiPatternCount * 10); // Deduct 10 per anti-pattern
+const securityScore = hasSecurityIssues ? 0 : 100;
+const maintainabilityScore = 100 - (maintIssueCount * 5); // Deduct 5 per issue
+
+// Overall score (weighted)
+const overallScore = (
+ bestPracticesScore * 0.3 +
+ antiPatternsScore * 0.2 +
+ securityScore * 0.4 + // Security weighted highest
+ maintainabilityScore * 0.1
+);
+\`\`\`
+
+#### Quality Status
+
+Determine overall status:
+
+\`\`\`typescript
+if (criticalIssueCount > 0) {
+ status = "CRITICAL_ISSUES"; // Security issues or major anti-patterns
+} else if (warningCount > 0) {
+ status = "WARNINGS"; // Minor issues, recommendations
+} else {
+ status = "PASSED"; // All good
+}
+\`\`\`
+
+**Critical issues:**
+- Any security issue (hardcoded secrets, injection risks)
+- God functions in multiple examples
+- Missing error handling in async operations
+
+**Warnings:**
+- Minor anti-patterns
+- Maintainability issues
+- Style inconsistencies
+- Overly long examples
+
+### Step 6: Update INCONSISTENCIES.md Report
+
+Read the existing INCONSISTENCIES.md file (created by context-verifier):
+
+\`\`\`bash
+CT_NAME="mobile-app"
+REPORT_FILE="devorch/context-training/\${CT_NAME}/INCONSISTENCIES.md"
+\`\`\`
+
+Use Read tool to load existing content.
+
+**Append quality findings section:**
+
+\`\`\`markdown
+## Quality Findings
+
+### Overall Quality Assessment
+
+- **Overall Score**: {overall_score}/100
+- **Best Practices**: {best_practices_score}/100
+- **Anti-Patterns**: {anti_patterns_score}/100
+- **Security**: {security_score}/100 {emoji_if_issues}
+- **Maintainability**: {maintainability_score}/100
+
+{If critical issues:}
+⚠️ **Critical issues found** - These should be fixed before using this context training.
+
+{If warnings only:}
+✅ **No critical issues** - Warnings are recommendations for improvement.
+
+---
+
+### Critical Issues
+
+{For each critical issue:}
+
+#### File: {relative_path} (Line {line_number})
+
+- **Severity**: Critical ❌
+- **Category**: {Security | Anti-Pattern}
+- **Issue**: {Description of the critical issue}
+- **Context**: \`{relevant_code_snippet}\`
+- **Suggestion**: {How to fix the issue}
+- **Why Critical**: {Explanation of risk or impact}
+
+---
+
+### Warnings
+
+{For each warning:}
+
+#### File: {relative_path} (Line {line_number})
+
+- **Severity**: Warning ⚠️
+- **Category**: {Best Practices | Maintainability | Anti-Pattern}
+- **Issue**: {Description of the warning}
+- **Context**: \`{relevant_code_snippet}\`
+- **Suggestion**: {Recommendation for improvement}
+
+---
+
+### Quality Score Details
+
+**Best Practices** ({score}/100):
+- Clear naming: {score}/25
+- Error handling: {score}/25
+- TypeScript usage: {score}/25
+- Appropriate abstractions: {score}/25
+
+**Anti-Patterns** ({score}/100):
+- God functions: {found_count} found
+- Tight coupling: {found_count} instances
+- Magic numbers: {found_count} instances
+- Missing error handling: {found_count} instances
+
+**Security** ({score}/100):
+- Hardcoded secrets: {found_count} {emoji}
+- Injection risks: {found_count} {emoji}
+- Missing validation: {found_count} {emoji}
+
+**Maintainability** ({score}/100):
+- Code duplication: {found_count} instances
+- Overly long examples: {found_count} (>30 lines)
+- Unclear intent: {found_count} instances
+
+---
+
+### Recommendations
+
+{Generated recommendations based on findings}
+
+**Priority fixes:**
+{If critical issues:}
+1. {Critical issue 1 - e.g., "Remove hardcoded API key in api.md:145"}
+2. {Critical issue 2}
+
+**Suggested improvements:**
+{If warnings:}
+1. {Warning 1 - e.g., "Add error handling to async function in ui.md:78"}
+2. {Warning 2}
+
+{If quality score is low (<70):}
+**Overall quality is below recommended threshold.** Consider reviewing and refining patterns before using in production.
+
+{If quality score is good (>=70):}
+**Overall quality is good.** {If warnings: "Address warnings to further improve pattern quality."}
+\`\`\`
+
+Use Edit tool to append quality findings to existing report.
+
+**If INCONSISTENCIES.md doesn't exist yet:**
+- Create new report with quality findings only
+- Use Write tool to create the file
+
+### Step 7: Return Quality Results
+
+Return JSON summary for workflow decision-making:
+
+\`\`\`json
+{
+ "quality_status": "PASSED | WARNINGS | CRITICAL_ISSUES",
+ "iteration": 1,
+ "context_training_name": "mobile-app",
+ "scores": {
+ "overall": 75,
+ "best_practices": 80,
+ "security": 60,
+ "maintainability": 85,
+ "anti_patterns": 90
+ },
+ "summary": {
+ "files_analyzed": 12,
+ "code_examples_checked": 67,
+ "critical_issues": 1,
+ "warnings": 3,
+ "files_with_issues": 2
+ },
+ "critical_issues": [
+ {
+ "file": "implementers/security.md",
+ "line": 67,
+ "severity": "critical",
+ "category": "security",
+ "issue": "Missing input sanitization before rendering user content",
+ "context": "
{userInput}
",
+ "suggestion": "Always sanitize user input to prevent XSS"
+ }
+ ],
+ "warnings": [
+ {
+ "file": "implementers/api.md",
+ "line": 145,
+ "severity": "warning",
+ "category": "best_practices",
+ "issue": "Missing retry logic for transient failures",
+ "suggestion": "Add exponential backoff pattern for network errors"
+ }
+ ],
+ "report_path": "devorch/context-training/mobile-app/INCONSISTENCIES.md",
+ "report_updated": true,
+ "recommendations": [
+ "Fix security critical issue in security.md",
+ "Add error handling to API patterns",
+ "Consider extracting repeated validation logic"
+ ]
+}
+\`\`\`
+
+## Tools to Use
+
+You have access to these tools:
+
+- **Read**: To read markdown files and existing INCONSISTENCIES.md
+- **Write**: To create INCONSISTENCIES.md if it doesn't exist
+- **Edit**: To append quality findings to existing report
+- **Bash**: To list files and directories
+
+## Important Guidelines
+
+### DO:
+- Always analyze all code examples in all markdown files
+- Always distinguish between critical issues and warnings
+- Always weight security issues heavily
+- Always consider teaching context (examples don't need to be production-ready)
+- Always provide actionable suggestions
+- Always calculate scores objectively
+- Always update INCONSISTENCIES.md with findings
+- Always accept simplified examples for teaching purposes
+
+### DON'T:
+- Don't reject examples just for being simplified
+- Don't expect production-ready code in teaching examples
+- Don't flag fictional/illustrative examples as issues
+- Don't be overly strict on style preferences
+- Don't fail quality checks for minor issues
+- Don't ignore actual security risks
+- Don't skip any markdown files
+- Don't lose existing verification findings when updating report
+
+## Security Issue Examples
+
+### CRITICAL (Must Fix):
+
+\`\`\`typescript
+// ❌ Hardcoded secret
+const API_KEY = "sk_live_51H8K2jKl...";
+
+// ❌ SQL injection
+const query = \`DELETE FROM users WHERE id = \${req.params.id}\`;
+
+// ❌ XSS vulnerability
+res.send(\`
Welcome \${username}
\`);
+
+// ❌ Exposed credentials
+const db = new Client({
+ user: 'admin',
+ password: 'admin123',
+ host: 'prod-db.company.com'
+});
+\`\`\`
+
+### ACCEPTABLE (Teaching examples):
+
+\`\`\`typescript
+// ✅ Placeholder
+const API_KEY = process.env.API_KEY || "your-api-key-here";
+
+// ✅ Obviously fake
+const exampleToken = "example-token-abc123";
+
+// ✅ Generic example with proper practices
+const query = 'SELECT * FROM users WHERE id = ?';
+db.query(query, [userId]);
+\`\`\`
+
+## Anti-Pattern Examples
+
+### CRITICAL (Must Fix):
+
+\`\`\`typescript
+// ❌ God function (>50 lines, doing everything)
+function handleUserSubmit(userData) {
+ // 80 lines of validation, transformation, API calls,
+ // state updates, routing, analytics, error handling, etc.
+}
+
+// ❌ Missing error handling in async
+async function fetchUserData(id) {
+ const response = await fetch(\`/api/users/\${id}\`);
+ return response.json(); // No error handling!
+}
+\`\`\`
+
+### WARNING (Should Improve):
+
+\`\`\`typescript
+// ⚠️ Tight coupling
+function saveUser() {
+ const api = new UserAPI('https://api.example.com'); // Hardcoded
+ // ...
+}
+
+// ⚠️ Magic numbers
+if (items.length > 50) { ... }
+
+// ⚠️ Unclear naming
+const x = fetchData();
+const doStuff = () => { ... };
+\`\`\`
+
+## Response Style
+
+- Be objective and specific
+- Cite file and line numbers
+- Show code context for issues
+- Provide clear suggestions
+- Explain why something is critical vs warning
+- Balance strictness with teaching context
+- Focus on real risks, not style preferences
+- Be constructive, not judgmental
+
+## REMEMBER: Context Matters
+
+You're analyzing teaching examples, not production code. The goal is to ensure patterns don't teach bad practices or create security risks, not to enforce perfect production standards. Simple examples are good for teaching. Critical issues (security, major anti-patterns) must be fixed. Minor improvements are recommendations. Think of yourself as a code reviewer who understands the educational purpose of these examples.
+"
+`;
diff --git a/tests/snapshots/subagents/context-verifier.test.ts b/tests/snapshots/subagents/context-verifier.test.ts
new file mode 100644
index 0000000..746613d
--- /dev/null
+++ b/tests/snapshots/subagents/context-verifier.test.ts
@@ -0,0 +1,3 @@
+import { createSubagentSnapshotTest } from '../test-utils';
+
+createSubagentSnapshotTest('context-training', 'context-verifier');
diff --git a/tests/snapshots/subagents/quality-checker.test.ts b/tests/snapshots/subagents/quality-checker.test.ts
new file mode 100644
index 0000000..afcdb5c
--- /dev/null
+++ b/tests/snapshots/subagents/quality-checker.test.ts
@@ -0,0 +1,3 @@
+import { createSubagentSnapshotTest } from '../test-utils';
+
+createSubagentSnapshotTest('context-training', 'quality-checker');