Multi-Agent Quality Gates.

Manual code review at a one-person platform team is inconsistent by definition: the same person who wrote the code is reviewing it after a long session. In systems where the failure cost is high (fiscal documents with multi-tenant isolation requirements, or a shared SSO platform where a broken shared package propagates to all services simultaneously), inconsistency is the risk. So I designed a quality gate methodology to remove it: specialized Claude agents, each owning exactly one risk area, running on every relevant change without exception.

The key design decision was surgical scope. Each agent receives a specific type of change (a new route, a BullMQ worker, a Prisma migration, a shared library update) and a checklist tailored to the exact failure modes of that type, in that system. Not 'review this code' but 'for this worker: does it validate orgId internally or trust the job payload? Can it run twice and produce the same result? Is OCR output always saved as DRAFT, never auto-approved?' A focused agent with a concrete checklist catches more than a general-purpose audit prompt every time.

For FiscalHub, a multi-tenant NFS-e processing platform, the stack covers seven risk domains: principal-security-auditor (Opus) for milestone audits, security-unit-tester (Sonnet) for every new route, worker-integrity-checker (Sonnet) for BullMQ workers, prisma-migration-reviewer (Sonnet) before any schema change, qa-regression-tester (Sonnet) for release gates, api-contract-validator (Haiku) for type drift between route and TypeScript types, and env-secret-auditor (Haiku) before every commit. Each agent knows the domain: the migration reviewer checks for missing orgId NOT NULL and RLS policies on every new table; the worker checker verifies idempotence and that OCR results are never auto-approved.

For OneHub, a shared SSO platform where all services share the same PostgreSQL database, the risks are different, so the agents are different. The db-architect (Opus) runs before any schema change because a renamed column in one service silently breaks three others. The shared-libs agent (Opus) audits changes to @onehub/* packages because a bug in the shared auth middleware propagates instantly to all backends. The security-reviewer checks that every new route has authenticate + requirePermission applied and that user IDs always come from req.user, never the request body. Across both stacks the verdict system is the same: PASS, WARN, or BLOCK. BLOCK means nothing moves until it is resolved.