tdd — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tdd (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is an invoked helper skill, not the normal first stop in the feature pipeline.
Use /tdd when backend implementation, bug-fix work, or behavior-heavy frontend logic should proceed through strict red-green-refactor cycles, usually because /execute delegated to it or a bug workflow produced a TDD-oriented fix plan.
Frontend examples that fit well here include reducers, state machines, validation flows, accessibility-critical behavior, and reproducible regressions in a user flow. Frontend work that is primarily visual, layout-driven, styling-focused, or about interaction feel should usually stay on the direct implementation path with browser-based verification.
Do not use it to replace shaping or decomposition. If the task is still unclear at the product, contract, or slice level, return to /write-a-prd, /prd-to-issues, or /execute first.
Core principle: Tests should verify behavior through public interfaces, not implementation details. Code can change entirely; tests shouldn't. Test difficulty is a design signal, not an obstacle to work around — when a test requires complex mock setup to reach domain logic, the production code has fused decisions with infrastructure. Refactor the production code, not the test scaffolding.
False positives (tests that fail on safe refactors) trigger a destructive sequence: developers investigate, find no real bug, stop trusting the suite, start ignoring failures, and a real regression slips through unnoticed. Coupling tests to implementation details is not a minor style issue — it is the primary mechanism by which test suites lose their value.
Good tests are integration-style: they exercise real code paths through public APIs. They describe _what_ the system does, not _how_ it does it. A good test reads like a specification - "user can checkout with valid cart" tells you exactly what capability exists. These tests survive refactors because they don't care about internal structure.
Bad tests are coupled to implementation. They mock internal collaborators, test private methods, or verify through external means (like querying a database directly instead of using the interface). The warning sign: your test breaks when you refactor, but behavior hasn't changed. If you rename an internal function and tests fail, those tests were testing implementation, not behavior.
See tests.md for examples and mocking.md for mocking guidelines.
DO NOT write all tests first, then all implementation. This is "horizontal slicing" - treating RED as "write all tests" and GREEN as "write all code."
This produces crap tests:
Correct approach: Vertical slices via tracer bullets. One test → one implementation → repeat. Each test responds to what you learned from the previous cycle. Because you just wrote the code, you know exactly what behavior matters and how to verify it.
WRONG (horizontal):
RED: test1, test2, test3, test4, test5
GREEN: impl1, impl2, impl3, impl4, impl5
RIGHT (vertical):
RED→GREEN: test1→impl1
RED→GREEN: test2→impl2
RED→GREEN: test3→impl3
...!mkdir -p .claude && touch .claude/.tdd-active && echo "TDD marker created — enforcement hook active"
Before writing any code:
Ask: "What should the public interface look like? Which behaviors are most important to test?"
You can't test everything. Confirm with the user exactly which behaviors matter most. Focus testing effort on critical paths and complex logic, not every possible edge case.
Write ONE test that confirms ONE thing about the system:
RED: Write test for first behavior → test fails
GREEN: Write minimal code to pass → test passesThis is your tracer bullet - proves the path works end-to-end.
Choose a first test that exercises the full vertical path. Prefer one that forces you to create the module, wire the interface, and return a result — even if the result is trivial. The purpose is to resolve _where does this belong?_ before confronting correctness.
For each remaining behavior:
RED: Write next test → fails
GREEN: Minimal code to pass → passesRules:
After all tests pass, look for refactor candidates:
AdjacentStepOverrides for a Mastra prepareStep return), anchor the return to the library's declared shape using satisfies LibraryReturnType on the object expression, or return a fresh object literal, or derive the local type via ReturnType<typeof libraryCallback> / Parameters<…>. Do not return a typed local variable. TypeScript's excess-property check does not run on returns of typed values, so any field not declared by the library's signature is silently dropped at runtime — build passes, tests pass, the library never sees the field. This is the failure mode /research Phase 1.25 and /pre-merge Dim 8 backstop, but satisfies at refactor time closes the gap at compile time. Cite: ts-essentials Rule 31, "Use satisfies for type validation without losing inference precision."Never refactor while RED. Get to GREEN first.
After refactoring, consider where production assertions would catch future infections closer to their source. Assertions shorten the distance between a defect and the failure it causes — without them, corrupted state propagates silently until it surfaces in unrelated code.
isValid() or sane() method that checks structural properties through the public interfaceNot every cycle needs this step. Apply it when the code handles complex state, crosses trust boundaries, or was the site of a bug fix.
Any test that could reach code calling sleep, delay, retry, timeout, interval, or any other scheduled/debounced/throttled primitive has a hidden coupling to real wall-clock time. This is how tests that pass in milliseconds suddenly jump to multi-second runtime — or worse, start timing out — the moment a retry or backoff is added.
Two rules:
Effect.sleep / Schedule / Effect.retry in Effect projects, setTimeout / setInterval in vanilla Node, RxJS delay / timer operators, any retry-wrapped fetch client, and any worker queue with a polling interval.testTimeout bumps mask the coupling; injection removes it. Only bump if you have an affirmative reason — e.g. the test is genuinely exercising real-time behavior and cannot use a virtual clock.Audit signal: before you decide a slow test is legitimate, grep the touched code for Effect\.sleep|Effect\.delay|Schedule\.|setTimeout|setInterval (or the equivalent in your stack). If any match is in a code path the test can reach and the primitive isn't injected, the coupling is the bug — not the timeout.
[ ] Test describes behavior, not implementation
[ ] Test uses public interface only
[ ] Test would survive internal refactor
[ ] Code is minimal for this test
[ ] No speculative features added/execute, or by bug-fix work prepared through /triage-issue/execute, for final verification and handoff to /pre-merge/execute Step 6 removes .claude/.tdd-active after commit~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.