development-discipline — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited development-discipline (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When this skill triggers, you MUST complete steps 1–4 IN ORDER before calling any Edit, Write, or NotebookEdit tool. Skipping steps produces the kind of silent-failure bugs that shipped to PyPI as v2.0.0.
Before any change, output:
<file>:<lines> and the relevant code does X."codebase that you considered.
If you haven't read the file you're about to edit, you cannot edit it. Read tool first, Edit tool second. No exceptions.
Output, before any code:
The "does NOT mean" line is the discipline anchor. Forces explicit scope. Without it, you'll opportunistically "improve" unrelated code and ship a 47-file PR for a 3-line bug.
Output:
If the touch list has >3 files, justify each one. Refactoring opportunistically beyond the touch list is out of scope. If a new file or dependency is needed, declare it here before you write it.
Only NOW may you call Edit/Write/NotebookEdit. Constraints:
requires re-doing Step 3.
After the change:
<pytest cmd or test name>."Before writing a new function, helper, or file:
grep, Glob, or codevira'ssearch_codebase / query_graph MCP tools.
or extend it — don't create a parallel implementation.
<term>; found <file>:<line>which does Y. Either I'll reuse / extend / replace it because Z."
This rule prevents the configure-vs-index file-matcher duplication bug (Bug A) where two parallel implementations diverged and produced 0-chunks silently.
When you notice yourself writing logic that's similar to logic elsewhere — STOP. Don't duplicate. Refactor the original to be shared first, then call it from both places.
Pattern detection: if you're about to copy/paste even 5 lines, or write a "this is similar to the X function but slightly different" function, the discipline says refactor first.
Before editing any file in the codevira repo:
mcp__codevira__get_impact(file_path) to see who calls/depends on this file.
for each: "Does my change break this caller? Yes/no/unknown."
This rule catches API-shape breaks before they ship. Skip it and you'll learn about the break from a downstream user.
test that proves it.
After every fix:
after, OR
it now passes.
Declaring a fix "done" without a test is hand-waving. The release gauntlet (G2) refuses to merge a PR that doesn't keep tests/e2e/test_first_contact.py green.
When working IN the codevira repo specifically:
mcp__codevira__get_impact(file) before editing — not grep.mcp__codevira__search_codebase(q) to find similar code —not Glob alone.
mcp__codevira__query_graph to understand call relationships.full=true for complete data, fix_command on errors.
If you won't dogfood codevira on codevira, you shouldn't expect anyone else to use it.
You may NEVER:
~80% of what you need.
task.
conversation." Memory drifts. Re-read.
v2.0.0 shipped with 23 silent-failure bugs (A–O) because the pre-v2.1 workflow was: see request → write code → claim done. No CONTEXT step, no PURPOSE confirmation, no REASON justification, no test as evidence. This skill makes those four steps mandatory and verifiable.
The release-readiness, open-source-quality, and epistemic-honesty skills layer on top of this one. Without development-discipline, the others are reinforcement without a foundation.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.