growing-outside-in-systems — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited growing-outside-in-systems (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
STARTER_CHARACTER = 🔴🟢
Build features by driving design from the outside in. Every feature starts with a failing acceptance test. Design emerges through disciplined Red-Green-Refactor cycles. Infrastructure is deferred until the domain API is proven.
Unlike inside-out TDD with mocks, this approach tests behavior at the boundary — not implementation details — making the suite refactor-friendly by design. See methodology.md.
For canonical terms used throughout, see references/glossary.md.
Outer loop (Acceptance test): Write a failing test scoped at the service/system boundary. This test exercises integration across Bounded Contexts using in-memory adapters. It defines "done."
Inner loop (Red-Green-Refactor): Cycles inside a Bounded Context to make the outer test pass. Drop into this loop only to implement what the acceptance test demands.
Every feature starts from the outside in. The acceptance test drives the process.
Acceptance and component tests are the primary instruments. Unit tests are the exception.
See testing-strategy.md for full definitions, the testing matrix, and contract test patterns.
| Fast | Slow | |
|---|---|---|
| Large Scope | Acceptance & Component — daily driver | E2E — minimize |
| Small Scope | Unit — use sparingly | Contract — CI only |
Sub-second feedback is non-negotiable. If tests take seconds, the team stops refactoring and the system decays.
Follow this sequence strictly within each Bounded Context:
The sequence is non-negotiable. Each step collects evidence about what the adapter actually needs. See methodology.md for detailed rationale and the walking skeleton.
The Domain Layer is the center. All I/O lives behind adapter interfaces at the boundary.
Dependency Rule: Infrastructure(adapters) → Application(ports) → Domain (outer depends on inner, never reverse)
I/O Classification Rule: if it does not do I/O and does not run out-of-process → belongs inside the hexagon; otherwise → adapter.
Port-referenced types must live inside the hexagon. If a port signature references a type in the adapter layer, the hexagon depends outward — a violation.
Naming:
For[Something] (e.g., ForCalculatingTaxes, ForGettingTaxRates)[Something]Adapter (e.g., WebUIAdapter, SQLDatabaseAdapter)See folder-structure.md for full folder structure, private/public hexagon split, cross-hexagon dependency rule, adapter design patterns, and test seams.
Use in-memory fakes for all adapter boundaries. Never mocks or stubs for domain-level testing.
Fakes are real implementations backed by simple data structures (maps, lists). They have actual behavior. Mocks only verify call sequences — they couple tests to implementation details and break on every refactor.
Contract tests verify the real adapter matches the fake's behavior. See testing-strategy.md.
For new projects or major new components: build a minimal end-to-end implementation first to pay integration cost upfront. Once upright, pivot to the emergent design workflow. See methodology.md.
Wires all adapter interfaces at startup. Used in two contexts:
The same business logic runs in both contexts — only the adapters differ.
Difficulty writing a test is a design signal, not a skill problem:
Do not fight the tests. Reshape the code until the test is easy to write.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.