Introduction¶

In the DSH ecosystem, “code finished” and “release-ready” are two different concepts. Most projects face three core problems upon delivery: not knowing what to test (blind spots), lacking validation records (conclusions easily lost), and the inability to negotiate fix scope in a structured way (unclear fix order). QualityForge aims to transform the QA process into a reproducible pipeline: from scanning and checklist generation to executing checks, generating checkable reports, and finally returning to the project for fixes and retesting.

What Is QualityForge?¶

QualityForge is an enterprise-grade DeepSeek Harness QA plugin. It provides actionable reports based on P0–P3 severity levels through systematic end-to-end testing. Its maintainer, lpeixin, provides an enterprise-grade testing methodology library containing 45 domains, 290 methods, and 1363 test cases.

Core Capabilities¶

The core value of QualityForge is to standardize and structure the validation process.

• Enterprise-grade testing methodology library: covers 45 domains (such as build dependencies, static quality, unit tests, integration contracts, API layer, UI/accessibility, E2E acceptance, data, performance, security compliance, reliability, observability, etc.).
• Four testing depths: supports smoke, standard, deep, and exhaustive, corresponding to 331, 984, 1295, and 1363 check items.
• Project-type awareness: automatically recognizes project types (library, CLI, service, Web, desktop, mobile, plugin, data, ML, monorepo) and skips inapplicable check items. Skipped items are recorded with reasons and are never counted as passing.
• Evidence-first: reconnaissance conclusions are drawn only from on-disk evidence; every defect requires evidence, reproduction steps, files, and remediation suggestions.
• Automated execution and write-back: includes 11 preset commands (build, typecheck, lint, format, test, coverage, e2e, dependency audit, secrets scanning, install, outdated). Results are written back precisely to specific check items. If a tool is missing, it is skipped and not treated as a failure.
• Checkable reports and read-back: generates Markdown + JSON reports, with every item in the report having a checkbox. qf_update sync=true writes the checked state (WONTFIX / DEFER / NA) back into structured data.
• Fix-scope negotiation: qf_fixplan can build Fix Waves and handoff records, specifying which items are being fixed in the current round.
• Security boundaries: the reconnaissance phase is read-only and write-free; the execution phase only runs whitelisted preset commands; no runtime dependencies.

Installation and Activation¶

Add the plugin in DSH:

dsh plugin --profile <profile> add dsh-qualityforge

After installation, restart the DSH session to activate the module. If installing directly within a session, danger-full-access permission is required. After installation, verify the configuration with the following command:

dsh --profile <profile> --dump-config | grep -A3 qualityforge

Typical Usage¶

QualityForge provides a standard set of workflow commands to take the process from scanning through reporting.

1. qf_scan: perform reconnaissance. Analyze the stack, project type, and runnable commands, and identify engineering gaps.
2. qf_plan: generate the checklist. By default, it is generated at standard depth and filtered by applicability.
3. qf_exec: execute checks. Run build, type checking, lint, tests, coverage, dependency audit, and secrets scanning commands.
4. qf_report: render the report. Generate Markdown and JSON reports, including verdicts and fix waves.
5. qf_update sync=true: write back status. After developers check items in the report, sync the status back to structured data.
6. qf_fixplan: generate the fix plan. Based on the current status, generate fix waves and handoff records.

Output and Evidence¶

All intermediate artifacts and reports are stored in the .qualityforge/ directory inside the audited project, not inside the plugin:

<project>/.qualityforge/
├── audit.json                  structured data (single source of truth)
├── QUALITYFORGE-REPORT.md      checkable report
└── report.json                 machine-readable snapshot

Permissions and Limitations¶

• Locale: The current reports and directories are in Chinese.
• Evidence source: Evidence comes only from disk.
• Missing tool handling: If a tool is not detected, the command is skipped and never causes the process to fail.
• Security: The reconnaissance phase is read-only, the execution phase is limited to whitelisted preset commands, and the attack surface is minimal.

Summary¶

QualityForge bridges the evidence gap between “writing code” and “being release-ready.” It provides teams with a negotiable and verifiable QA process through structured checklists, write-back status mechanisms, and evidence-based fix waves.