tdd — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tdd (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
NO PRODUCTION CODE WITHOUT A FAILING TEST FIRSTWrite code before the test? Delete it. Start over.
No exceptions:
Implement fresh from tests. Period.
The agent optimizes for green. These rules make green mean true. Every one of them closes a loophole that was actually exploited in real projects using this skill (a July 2026 audit found 18 of 25 E2E tests in one repo permanently test.skip-guarded — they had never run once — and Anthropic, METR, and Kent Beck all document agents disabling or deleting tests to pass).
1. EVIDENCE THE RED Run the new test and SHOW its failing output before
writing any implementation. It must fail for the
right reason — the missing behavior, not an import
error or typo. No observed red = the cycle never
happened.
2. FIX CODE, NOT TESTS Never delete, weaken, .skip, or loosen a test to
reach green. If you believe the test itself is
wrong, STOP, say so explicitly, and get the user's
agreement before changing it.
3. SKIPPED = FAILING "7 passed, 18 skipped" is a red suite. Always
report full counts (passed / failed / skipped).
A test that has never executed proves nothing.
4. CAN'T MAKE IT REAL? Missing test user, credentials, test DB, seed
STOP AND ASK. data — that one-time setup is the user's call.
Ask for it. Do not mock around it. Do not skip.Core principle: Tests should verify behavior through public interfaces, not implementation details. Code can change entirely; tests shouldn't.
Good tests are integration-style: they exercise real code paths through public APIs. They describe _what_ the system does, not _how_ it does it. A good test reads like a specification - "user can checkout with valid cart" tells you exactly what capability exists. These tests survive refactors because they don't care about internal structure.
Bad tests are coupled to implementation. They mock internal collaborators, test private methods, or verify through external means (like querying a database directly instead of using the interface). The warning sign: your test breaks when you refactor, but behavior hasn't changed. If you rename an internal function and tests fail, those tests were testing implementation, not behavior.
See tests.md for examples, mocking.md for mocking guidelines, and deep-modules.md / interface-design.md for designing testable interfaces.
DO NOT write all tests first, then all implementation. This is "horizontal slicing" - treating RED as "write all tests" and GREEN as "write all code."
This produces crap tests:
Correct approach: Vertical slices via tracer bullets. One test → one implementation → repeat. Each test responds to what you learned from the previous cycle.
WRONG (horizontal):
RED: test1, test2, test3, test4, test5
GREEN: impl1, impl2, impl3, impl4, impl5
RIGHT (vertical):
RED→GREEN: test1→impl1
RED→GREEN: test2→impl2
RED→GREEN: test3→impl3
...Write ONE minimal test showing what should happen.
Requirements:
<Good>
test('retries failed operations 3 times', async () => {
let attempts = 0;
const operation = () => {
attempts++;
if (attempts < 3) throw new Error('fail');
return 'success';
};
const result = await retryOperation(operation);
expect(result).toBe('success');
expect(attempts).toBe(3);
});Clear name, tests real behavior, one thing </Good>
<Bad>
test('retry works', async () => {
const mock = jest.fn()
.mockRejectedValueOnce(new Error())
.mockResolvedValueOnce('success');
await retryOperation(mock);
expect(mock).toHaveBeenCalledTimes(2);
});Vague name, tests mock not code </Bad>
npm test path/to/test.test.tsShow the failing output in your message. Then confirm:
Test passes? You're testing existing behavior. Fix the test. Test errors? Fix the error, re-run until it fails correctly.
Best practice: commit the failing test on its own (test: ...) before implementing. The red phase becomes provable in git history.
Write the SIMPLEST code to pass the test. Nothing more.
Don't add features, refactor other code, or "improve" beyond what the test requires.
npm test path/to/test.test.tsConfirm: Test passes, other tests still pass, output pristine, zero skipped.
Test fails? Fix code, not test. Other tests fail? Fix now.
After green only: Remove duplication, improve names, extract helpers. Keep tests green. Don't add behavior.
| Excuse | Reality |
|---|---|
| "Too simple to test" | Simple code breaks. Test takes 30 seconds. |
| "I'll test after" | Tests passing immediately prove nothing. |
| "Already manually tested" | Ad-hoc ≠ systematic. No record, can't re-run. |
| "Deleting X hours is wasteful" | Sunk cost fallacy. |
| "Keep as reference" | You'll adapt it. That's testing after. Delete means delete. |
| "Need to explore first" | Fine. Throw away exploration, start with TDD. |
| "TDD will slow me down" | TDD is faster than debugging. |
| "Just this once" | No. |
| "Test expectation was wrong" | Was it? Or is the code wrong? Investigate before weakening. |
| "Skip it for now, unblock the suite" | A skipped test is a failing test. Fix it or ask the user. |
| "Auth/DB isn't set up, I'll mock it" | Stop and ask for the one-time setup. Mocks here test fiction. |
A test that fails is telling you something. Investigate the code, not the assertion.
Test expected 32px, got 20px.
❌ Lower assertion to 16px → test passes → ship it
✅ Investigate: Why is it 20px? Is the CSS wrong? Did the fix not work?Only three valid reasons to change a test assertion:
If none of these apply, the test caught a real problem. Fix the code.
The anti-pattern in action:
Weakening an assertion is deleting the test with extra steps. So is test.skip. So is an .or() assertion that accepts a failure state.
If you extract validateRuleBody() and write 5 tests for it, the API route that calls validateRuleBody() is still untested. Helper tests verify transformation logic. They do NOT verify:
Behavior Coverage Checklist — two levels, both required:
Write NOW (unit/integration — during TDD in `/start` Step 4):
| Code you wrote | Test to write now |
|---|---|
| API route handler | Integration test that calls the handler, checks status + response body |
| Bug fix | Regression test that reproduces the original symptom |
| State management logic | Test through the API or function that triggers the flow |
| Extracted helper/utility | Unit test — but this DOES NOT replace tests for the code that calls it |
Owe for E2E (browser tests — written in `/start` Step 5):
| Code you wrote | E2E test owed |
|---|---|
| UI component with interactions | E2E that clicks/types/drags and verifies outcomes |
| Navigation change | E2E that clicks nav item, verifies URL + destination content |
| Bug fix with UI symptoms | E2E that reproduces the original user-visible bug |
| New page or route | E2E that navigates to it and tests the primary workflow |
Before leaving TDD, list your E2E debts. Write them down — they carry forward to Step 5. Example:
E2E debts from Step 4:
- Canvas page: drag entry→project creates rule, future entries auto-link
- Navigation: sidebar + mobile nav show Canvas, clicking navigates correctly
- Bug fix: calendar cells are ≥32px on mobile viewportThe rule: A helper test is a bonus. The behavior test is the requirement.
Gate function before adding mocks:
If unsure: Run test with real implementation FIRST, observe, THEN add minimal mocking. Mock at system boundaries only (see mocking.md) — and prefer a real test DB over a mocked one.
Before marking work complete:
Can't check all boxes? You skipped TDD. Start over.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.