blushneybusiness-glitch/roblox-omniskills/rbx-qa-gauntlet

rbx-qa-gauntlet

Laws

1. Sweep, then fix. Finish a phase's entire sweep and log every finding

(CRITICAL/HIGH/MEDIUM, with repro steps) before touching code. When you do fix, script_grep for sibling instances of the same pattern first — a bug found once usually lives in three places.

1. Verified means played. Every fix re-runs the exact rbx-qa-playtest scenario that

exposed it. Re-reading the patched source is not verification; a clean console after a live repro attempt is.

1. Bounded. Max 5 fix attempts per finding (quality-bars.md

bounded-loops law), then park it as OPEN with the smallest repro case. Each phase runs once; survivors go in the report, not into an endless loop.

1. Server authority is the lens. Any gameplay value a client can set — currency, damage,

position claims, purchase results — is a CRITICAL finding even without a demonstrated exploit. Clients are hostile; that is the axiom, not the conclusion.

Passes

1. Data — script_grep for GetAsync|SetAsync|UpdateAsync without pcall + retry;

confirm BindToClose exists and saves; hunt the default-then-overwrite wipe pattern. Live check: play, earn something, stop, replay — the value must come back.

1. Security — enumerate every remote via search_game_tree, read each OnServerEvent/

OnServerInvoke handler for type, range, and ownership validation plus a rate limit. More than 10 remotes or anything suspicious → chain rbx-security-audit for the deep pass.

1. Monetization — ProcessReceipt order is grant → save → PurchaseGranted; ownership via

UserOwnsGamePassAsync in pcall, cached per session; prompt-test each product once in Studio. A 0 -- TODO placeholder id is a logged finding, never a silent pass.

1. UI — open every screen over every other screen; spam-click buy/close buttons 10 times

in 2 seconds; screen_capture a 375-wide emulated spot check for overlap and clipped text.

1. Gameplay — 10-minute core-loop run through rbx-qa-playtest, then edge probes: die

mid-cutscene, buy at 0 currency, leave mid-trade, rejoin mid-round, spam the main action.

1. Scale — load rbx-qa-scale; multi-client test at 4+ players, one deliberately

throttled client, join/leave churn, and a 30-minute soak watching for climbing memory.

1. Device — load rbx-qa-devices; emulation sweep across phone/tablet/console presets

plus the quality-level-1 fairness check (can you still see the killbrick?).

Performance budget

Each phase caps at 15 execute/console cycles before it must produce its findings list. Playtest scenarios ≤ 5 minutes each except the soak. Frame verdicts cite numbers against real budgets — 16.7 ms/frame for the 60 FPS desktop target, 33.3 ms floor on low-end mobile — never "feels fine". The full report ships even if fixes are still open.

Load with

rbx-qa-playtest, rbx-qa-scale, rbx-qa-devices — don't ask, include them; the gauntlet is hollow without all three. Phase-2 depth: rbx-security-audit. Fix loops: rbx-script-debug. Exit gate after the gauntlet: rbx-publish-checklist, with dashboard steps flowing to rbx-publish-settings.

AI-tells

• ☐ A PASS verdict with no playtest run behind it
• ☐ A phase skipped because the game "looks simple"
• ☐ A fix applied mid-sweep without grepping for sibling instances
• ☐ A race "closed" with task.wait(3) instead of fixing the dependency
• ☐ The scale phase run single-client
• ☐ Monetization marked PASS while CONFIG still holds 0 placeholder ids
• ☐ Findings without severity ratings or repro steps
• ☐ execute_luau fired while play mode was running

Memory

Read: the game's projects.md block (known fragile systems, prior gauntlet results, product ids). Write: the per-phase verdict table and every OPEN finding into the game's projects.md block; publish blockers into its manual steps pending: queue; a bug pattern seen in 2+ games gets promoted to a law in preferences.md.