feat(implement-task): add query-scope verification for subset-targeted batch operations

[mrizzi]

Summary

• Adds a ### Query-scope verification subsection to Step 9 (Self-Verification) in implement-task/SKILL.md that checks whether batch operations use appropriately filtered queries when the task description targets a subset of records
• Adds constraint 5.14 to docs/constraints.md reflecting the new verification rule
• Adds eval scenario (id 11) with task-query-scope.md fixture testing detection of query-scope mismatch in a data migration targeting SPDX SBOMs
• Condenses Query-scope verification subsection and Data-flow trace example to pass Skillsaw 16,000-token context budget

Implements TC-5395
Implements TC-5437

Test plan

• Run /run-evals implement-task to verify eval 11 passes
• Verify existing evals 1–10 are unaffected
• Verify claude plugin validate plugins/sdlc-workflow passes

🤖 Generated with Claude Code

[sourcery-ai]

Reviewer's Guide

Adds query-scope verification guidance to the implement-task skill, codifies it as a new constraint, and introduces an eval scenario/fixture to test detection of query-scope mismatches in subset-targeted batch operations.

Flow diagram for query-scope verification in implement-task self-verification

flowchart TD
  TaskDescription[Extract target scope from task description] --> ExtractTargetScope
  ImplementationBatchCode[Inspect batch operation query or iteration scope] --> InspectQueryScope

  ExtractTargetScope --> CheckScopeMismatch[Check for scope mismatch between target subset and query scope]
  InspectQueryScope --> CheckScopeMismatch

  CheckScopeMismatch -->|narrower query possible at data source| FlagBroaderQueries[Flag broader queries and document mismatch]
  CheckScopeMismatch -->|filter not expressible or intentional broad query| AcceptIntentionalBroadQueries[Accept broad query with documented rationale]

Loading

File-Level Changes

Change	Details	Files
Add a new Step 9 subsection that instructs implement-task to verify query/iteration scope for batch operations against the subset described in the task and to flag overly broad queries when narrower data-source filters exist.	Introduce "Query-scope verification" subsection under Self-Verification describing how to extract the target scope from the task description. Specify how to inspect query/iteration scope for batch operations and detect when all records are fetched instead of the targeted subset. Define criteria for identifying scope mismatches and checking for available query-level filters (columns, labels, ORM scopes, API filters). Describe how to flag broader queries, including required details about task target, query behavior, available filters, and performance impact. Clarify when intentionally broad queries are acceptable and require documenting rationale in code comments. Provide a concrete example contrasting a task that targets SPDX SBOMs with an unfiltered Document::all() query and recommending a filtered alternative.	plugins/sdlc-workflow/skills/implement-task/SKILL.md
Add a formal constraint requiring implement-task to perform query-scope verification for subset-targeted batch operations and to flag broader queries when narrowing at the data-source level is possible.	Append constraint 5.14 to the constraints table describing the query-scope verification requirement. Reference Step 9 of implement-task/SKILL.md as the location of the enforcement rule.	docs/constraints.md
Introduce a new eval scenario and task fixture that exercise query-scope verification for a data migration targeting only SPDX SBOMs.	Register eval scenario 11 in the implement-task evals JSON (diff omits details but implies a new entry). Create task-query-scope.md fixture describing a synthetic Jira task for a data migration that must re-process only SPDX SBOM documents, not CycloneDX. Encode repository, target branch, implementation notes, acceptance criteria, and test requirements that emphasize subset targeting and available query-level filters via labels->>'type'. Document production-scale performance considerations to motivate query filtering on SPDX SBOMs only.	evals/implement-task/evals.json evals/implement-task/files/task-query-scope.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider tightening the wording of constraint 5.14 to explicitly reference the new "Query-scope verification" subsection and the concrete reviewer action expected (e.g., adding a note in the implementation review output), so it's clear how the constraint is satisfied.
• The Query-scope verification step focuses on database queries; if batch operations over other data sources (e.g., in-memory collections or external APIs) should also be covered, consider expanding the guidance to mention those explicitly to avoid ambiguity.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider tightening the wording of constraint 5.14 to explicitly reference the new "Query-scope verification" subsection and the concrete reviewer action expected (e.g., adding a note in the implementation review output), so it's clear how the constraint is satisfied.
- The Query-scope verification step focuses on database queries; if batch operations over other data sources (e.g., in-memory collections or external APIs) should also be covered, consider expanding the guidance to mention those explicitly to avoid ambiguity.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[github-actions]

Eval Results

Eval Results: implement-task

Eval	Passed	Failed	Pass Rate
eval-1	9/10	1	90%
eval-2	5/5	0	100%
eval-3	6/6	0	100%
eval-4	6/6	0	100%
eval-5	7/7	0	100%
eval-6	4/4	0	100%
eval-7	5/5	0	100%
eval-8	5/5	0	100%
eval-9	5/5	0	100%
eval-10	5/5	0	100%
eval-11	5/5	0	100%

Failed Assertions

eval-1: 1 failing assertion

• Assertion: "All files listed in the plan are within the scope defined by the task's Files to Modify and Files to Create sections — no unrelated files are modified (constraint 1.4, 5.1)"
  Evidence: "The plan explicitly mentions modifying an out-of-scope file. In Step 6 'Documentation Impact': 'Check docs/api.md for API endpoint listings and add the new GET /api/v2/sbom/{id}/advisory-summary endpoint'. In Step 9 'Documentation currency': 'Update docs/api.md if it lists API endpoints and does not yet include the new endpoint.' The file docs/api.md is not listed in either the Files to Modify or Files to Create sections of the task description. This constitutes planning to modify an unrelated file outside the defined scope."

Pass rate: 99% · Tokens: 47,538 · Duration: 121s

Baseline (5848f115): 100% · 44,165 tokens · 100s

---

Generated by sdlc-workflow/run-evals v0.13.7

[mrizzi]

[sdlc-workflow/verify-pr] Re: @sourcery-ai[bot] review —

1. "Consider tightening the wording of constraint 5.14..." — Classified as suggestion — this proposes an optional wording refinement; no matching CONVENTIONS.md rule or established codebase pattern requires a specific constraint wording format. No sub-task created.

2. "if batch operations over other data sources should also be covered..." — Classified as suggestion — this proposes expanding the scope of the guidance beyond database queries; the task description specifically targets database-level query filtering and no convention requires covering non-database data sources. No sub-task created.

[mrizzi]

Verification Report for TC-5395 (commit c84ea76)

Check	Result	Details
Review Feedback	PASS	2 suggestions from sourcery-ai (editorial); no code change requests
Root-Cause Investigation	DONE	Convention gap: Skillsaw token budget not documented in CONVENTIONS.md → TC-5439
Scope Containment	WARN	3 justified out-of-scope files (constraints doc, eval config, eval fixture)
Diff Size	PASS	121 additions across 4 files; core change is 42 lines in SKILL.md
Commit Traceability	PASS	Single commit references "Implements TC-5395"
Sensitive Patterns	PASS	No secrets detected
CI Status	FAIL	Skillsaw lint fails: SKILL.md at 16,287 tokens exceeds 16,000-token limit → TC-5437
Acceptance Criteria	PASS	3/3 criteria met
Test Quality	WARN	Eval Quality: 98% (62/63); eval-4 scope containment assertion regressed from baseline → TC-5438
Test Change Classification	N/A	No test files in PR
Verification Commands	N/A	No verification commands specified

Overall: FAIL

Blocking issue: Skillsaw CI check fails — implement-task/SKILL.md estimated at 16,287 tokens exceeds the 16,000-token context budget by 287 tokens. The new Query-scope verification subsection (42 lines) must be condensed or existing content trimmed.

Sub-tasks created:

• TC-5437 — Fix Skillsaw context budget overflow
• TC-5438 — Fix eval-4 assertion regression (likely resolves with TC-5437)

Root-cause task:

• TC-5439 — Document Skillsaw token budget limit in CONVENTIONS.md (convention gap)

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.13.7.

[mrizzi]

Verification Report for TC-5395 (commit a4c02c8)

Check	Result	Details
Review Feedback	PASS	2 suggestions from sourcery-ai (editorial); no code change requests
Root-Cause Investigation	DONE	Convention gap: Skillsaw token budget not documented in CONVENTIONS.md → TC-5439
Scope Containment	PASS	3 out-of-scope files justified (constraints doc, eval config, eval fixture)
Diff Size	PASS	101 additions across 4 files; core change is 28 net lines in SKILL.md
Commit Traceability	PASS	Both commits traceable: c84ea76→TC-5395, a4c02c8→TC-5437
Sensitive Patterns	PASS	No secrets detected
CI Status	PASS	All checks pass on a4c02c8 (Skill Lint, Plugin Validation, Eval PR Run)
Acceptance Criteria	PASS	3/3 criteria met
Test Quality	WARN	Eval Quality: 99% (62/63); eval-1 scope containment assertion — stochastic recurrence of same assertion type as TC-5438 (moved from eval-4 to eval-1 between runs)
Test Change Classification	N/A	No test files in PR
Verification Commands	N/A	None specified

Overall: PASS

All blocking issues from the previous verification are resolved:

• CI Status: FAIL → PASS (Skillsaw budget fixed in TC-5437)
• eval-4 regression: fixed (100%)
• eval-1 stochastic failure (99% overall) is informational — same scope containment assertion type shifts between evals across runs; not caused by PR changes

Previously created tasks (from first verification run):

• TC-5437 — Fix Skillsaw context budget overflow ✅ resolved
• TC-5438 — Fix eval-4 assertion regression ✅ resolved
• TC-5439 — Document Skillsaw token budget in CONVENTIONS.md (root-cause)

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.13.7.