`bin/check` is the definition of done for any change to a One Shot app. It's what Claude Code runs
to confirm its own work, and what CI runs on every push. If `bin/check` is green, the change is
shippable.

```bash
bin/check
```

Run it now, right after install, so you know your machine is set up correctly before you write any
code.

## What it runs, in order

1. **RSpec** (`bin/rspec`): the full test suite, including model specs, request specs, policy specs,
   and the copy-style checks. This is where a broken tenant-isolation test or a missing spec fixture
   shows up.
2. **RuboCop** (`bin/rubocop`): style and lint, using the `rails-omakase` config. This is the
   arbiter for how Ruby code in the app should look; don't fight it, run it.
3. **Brakeman** (`bin/brakeman`): static analysis for common Rails security issues, including SQL
   injection, mass assignment, and unsafe redirects. Runs against the whole app, not just changed
   files.
4. **Bundler-audit** (`bin/bundler-audit`): checks every gem in the `Gemfile.lock` against a
   database of known vulnerabilities, and updates that database first.
5. **Importmap audit** (`bin/importmap audit`): the same idea as bundler-audit, for the JavaScript
   packages pinned in `config/importmap.rb`.
6. **Secret scan** (`bin/secret-scan`, backed by gitleaks): scans the git history for anything that
   looks like a committed credential, API key, or private key.

Each step prints `✓ ok` or `✗ FAILED`, and the whole script exits non-zero if anything failed, so
it's safe to use in CI or in a pre-push hook.

## If something fails on a fresh install

A fresh clone should pass all six steps with nothing configured. If RSpec fails immediately after
`bin/setup`, the most common cause is a database that didn't prepare cleanly; rerunning `bin/setup`
resolves that. If Brakeman or bundler-audit fail, read what they report; both point at a specific
file and line, and neither one is something you should silence rather than fix.

## Running the individual pieces

While you're iterating on one change, you don't need the whole pipeline every time:

```bash
bin/rspec              # tests only
bin/rubocop             # lint only
bin/rspec spec/models/  # just one directory
```

Run the full `bin/check` before you consider anything finished. It's cheap, and it's the same bar
Claude Code holds itself to when it says a change is done.

## Next

With a clean bill of health, you're ready to make the kit yours:
[Making It Yours](/docs/getting-started/making-it-yours).