The bugs that only appear under load — races, shared mutable state, and ordering assumptions that hold on a quiet laptop and break in production.
Free & open · no signup · read-only — it ends by asking · nothing leaves your machine
You are working inside this repo. Mission: find the defects that hide until two things happen at once — races, unguarded shared state, and ordering assumptions that pass every test on a quiet machine and corrupt data under real traffic.
Read-only pass. Read concurrent paths, shared state, and transaction boundaries; change nothing but the report file.
Phase 2 sweeps the codebase through every one of these, citing file and line for each finding.
globals, singletons, and caches mutated from concurrent requests or threads
read, decide, write sequences with no atomicity (TOCTOU)
retries, double-submits, and webhook redelivery that duplicate effects
missing locks, over-broad locks, lock ordering that can deadlock
assumptions that async work completes in order; unawaited work
multi-statement logic with no transaction; wrong isolation level
concurrent writes to one row; a job runner processing a task twice
One structured report at the repo root — or in reports/, if you keep one — the same shape every time, ready for a teammate — or the optional Studio — to act on.
Every Goal Prompt follows the same four steps, so results are consistent and repeatable — no matter which one you run.
Identify what runs concurrently.
Give the interleaving that triggers each finding.
Rank by blast radius × likelihood.
Create CONCURRENCY.md at repo root.
Copy it and paste it into your agent inside the repo you want checked.
Install the goal plugin once — two commands — then just type /goal:concurrency-audit.
/plugin marketplace add GhostlyGawd/goal-prompts/plugin install goal@goal-promptsOr install only this Goal Prompt as /goal-concurrency-audit:
curl -fsSL https://goal-prompts.vercel.app/install | BRIEF=98 shLet an agent fetch it mid-conversation, or pull the raw Goal Prompt by URL.
https://goal-prompts.vercel.app/raw/98.mdNothing hidden — this is the whole Goal Prompt, verbatim. Read it in a minute, edit it, or copy it as-is.
# Goal: Concurrency & Race-Condition Audit You are working inside this repo. Mission: find the defects that hide until two things happen at once — races, unguarded shared state, and ordering assumptions that pass every test on a quiet machine and corrupt data under real traffic. Read-only pass. Read concurrent paths, shared state, and transaction boundaries; change nothing but the report file. ## Phase 1 — Find the concurrent surfaces - Identify what runs concurrently: request handlers, background jobs, workers, async tasks, webhooks. - Locate shared mutable state each touches: globals, singletons, caches, the same database rows. - Note the operations that must be atomic but span several steps. ## Phase 2 — Audit through 7 lenses Give the interleaving that triggers each finding. 1. **Shared mutable state** — globals, singletons, and caches mutated from concurrent requests or threads 2. **Check-then-act races** — read, decide, write sequences with no atomicity (TOCTOU) 3. **Idempotency** — retries, double-submits, and webhook redelivery that duplicate effects 4. **Locking discipline** — missing locks, over-broad locks, lock ordering that can deadlock 5. **Async ordering** — assumptions that async work completes in order; unawaited work 6. **Transaction boundaries** — multi-statement logic with no transaction; wrong isolation level 7. **External concurrency** — concurrent writes to one row; a job runner processing a task twice ## Phase 3 — Curate - Rank by blast radius × likelihood: data corruption on a hot path outranks a rare double-log. - For each, describe the interleaving that triggers it and the fix — atomic op, lock, idempotency key, transaction. - Flag the ones that are silent: races that corrupt without ever throwing. ## Phase 4 — Report Create `CONCURRENCY.md` at repo root: 1. **Findings** — each: severity S1–S3 · location · the interleaving that triggers it · the fix 2. **Silent corruptors** — the races that leave no error behind, called out 3. **Systemic fixes** — the idempotency keys, locks, or transaction patterns that close whole classes 4. **How to reproduce** — the concurrency the tests should now exercise Start the report with today's date. If `CONCURRENCY.md` already exists from a previous run, read it first and lead with what changed since. ## Rules - Describe the interleaving; a race with no scenario is a guess - The dangerous races are the silent ones that corrupt without throwing - No concurrent code in this repo? Say so in a one-paragraph null report and stop — a null result is a valid finding. - If a `reports/` directory exists at the repo root, write the report there instead of the root. - Before asking, present the top findings as a ranked list in plain words - Report only — end by asking which races to fix first
reports/ directory exists at the repo root, write the report there instead of the root.Trace latent bugs, unhandled edge cases, and race conditions; rank by user pain with repro paths and fix sketches.
Map what is tested against what is riskiest, and produce a test-writing plan that buys the most safety per hour.
Find swallowed errors, missing logs, and monitoring blind spots — everywhere the system can break without anyone knowing.
Where the type system has been defeated or never engaged — the casts, anys, and untyped boundaries where the compiler stops protecting you.