@dsalazardev/ai-hub-cli 0.0.0-stage → 0.1.0

package/skills/shared/testing-go/SKILL.md

@@ -0,0 +1,263 @@
+---
+name: testing-go
+description: "Use when writing or running Go tests — table-driven cases, named subtests, parallel isolation, fakes instead of mock frameworks, coverage profiles, benchmarks, fuzzing, golden files, and testing concurrent goroutines deterministically. NOT general Go code or modules (that is `go`), NOT pytest fixtures (that is `testing-py`), NOT browser user flows (that is `e2e-testing`)."
+tags: [go, testing, table-driven-tests, benchmarks, coverage, synctest, mocks, fuzzing]
+recommends: [go, secure-coding, testing-py, e2e-testing]
+origin: ai-hub
+---
+
+# Testing Go
+
+You test **behavior at the package boundary**, not private internals. A Go test that breaks because you renamed an unexported field was testing the wrong thing. Target Go **1.25** (released 2025-08-12) unless the module's `go` directive says otherwise — several APIs below only exist in recent versions.
+
+Default stack, in order of reach:
+1. The standard `testing` package. It is enough for ~90% of tests.
+2. `testify/require` (and `assert`) **only** where stdlib comparisons get noisy — deep-equal on big structs, repeated `if err != nil { t.Fatal }`. Not as a reflex.
+3. Hand-written fakes over any mock generator. A 12-line fake beats `gomock` for code you own.
+
+Run `go test ./...` early and often. Add `-race` for anything that touches a goroutine. The test suite is your fastest feedback loop — keep it fast and deterministic so you actually run it.
+
+## What am I testing? Pick the tool
+
+| Situation | Reach for |
+|---|---|
+| Pure logic, many input/output cases | Table-driven test + `t.Run` subtests |
+| An HTTP client or `http.Handler` | `net/http/httptest` (server or recorder) |
+| Goroutines, timers, timeouts, `context` deadlines | `testing/synctest` + `-race` |
+| "Is it fast / did my change regress?" | `testing.B.Loop` + `benchstat` |
+| "Does it crash or misbehave on weird input?" | `func FuzzXxx(f *testing.F)` |
+| A dependency you own (DB, payment client, clock) | A hand-written interface fake |
+
+If you find yourself reaching past the standard library for the first row, stop — table-driven tests need nothing else.
+
+## Table-driven tests
+
+The canonical shape: a slice of anonymous structs with a `name`, run as named subtests.
+
+```go
+func TestReverse(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{name: "empty", in: "", want: ""},
+		{name: "ascii", in: "abc", want: "cba"},
+		{name: "unicode", in: "héllo", want: "olléh"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := Reverse(tc.in)
+			if got != tc.want {
+				t.Errorf("Reverse(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+```
+
+- **Name every case.** `t.Run(tc.name, ...)` gives you `go test -run TestReverse/unicode` to target one case, and a readable failure path instead of "index 2".
+- **Use `t.Errorf`, not `t.Fatalf`, inside the loop** unless the rest of the case is meaningless after the failure. `Fatalf` stops the whole subtest; `Errorf` lets the other cases still run.
+- **One table per behavior, not per function.** If two functions share inputs and expectations, one table. If a case needs three extra fields only it uses, that case wants its own test.
+
+Bad — copy-pasted near-identical functions:
+
+```go
+func TestAddOne(t *testing.T)  { if Add(1) != 2 { t.Fail() } }
+func TestAddTwo(t *testing.T)  { if Add(2) != 3 { t.Fail() } }
+func TestAddZero(t *testing.T) { if Add(0) != 1 { t.Fail() } }
+```
+
+Good — one table, each case named, failures localized (see the `TestReverse` shape above).
+
+## Parallel & isolation
+
+```go
+for _, tc := range tests {
+	t.Run(tc.name, func(t *testing.T) {
+		t.Parallel() // this subtest runs concurrently with its siblings
+		got := Process(tc.in)
+		if got != tc.want {
+			t.Errorf("Process(%q) = %v, want %v", tc.in, got, tc.want)
+		}
+	})
+}
+```
+
+- **Do not write `tc := tc` before `t.Run`.** Go 1.22+ gives each loop iteration its own variable scope, so the historical copy is dead ceremony. Only modules whose `go.mod` declares `go 1.21` or older still need it — and you should bump the directive instead.
+- **`t.Cleanup(fn)` over `defer`** for teardown that must run even when a helper calls `t.Fatal`. Cleanups run LIFO after the test, and they nest correctly through helpers where a `defer` in `main` would not.
+- **`t.Helper()`** as the first line of any assertion helper, so failures point at the caller's line, not inside the helper.
+- **`t.TempDir()`** for filesystem tests — auto-removed, unique per test, parallel-safe. Never hardcode `/tmp/mytest`.
+- **`t.Context()`** (Go 1.24+) gives a context cancelled when the test and its cleanups finish — pass it to anything taking a `context.Context` instead of `context.Background()`.
+- **`t.Setenv` and `T.Chdir` forbid `t.Parallel()`.** They mutate process-global state; the test panics if you call them in a parallel test. Keep env/cwd-mutating tests serial.
+
+## Fakes over mocks
+
+Define the interface where you **consume** it (the test's package), keep it tiny, and hand-roll a fake with func fields you set per test.
+
+```go
+// Charger is what the service needs — declared at the consumer, not the vendor.
+type Charger interface {
+	Charge(ctx context.Context, cents int64) (string, error)
+}
+
+type fakeCharger struct {
+	charge func(ctx context.Context, cents int64) (string, error)
+}
+
+func (f fakeCharger) Charge(ctx context.Context, cents int64) (string, error) {
+	return f.charge(ctx, cents)
+}
+
+func TestCheckout_chargesOnce(t *testing.T) {
+	var calls int
+	f := fakeCharger{charge: func(_ context.Context, c int64) (string, error) {
+		calls++
+		return "txn_123", nil
+	}}
+	if err := Checkout(t.Context(), f, 999); err != nil {
+		t.Fatalf("Checkout: %v", err)
+	}
+	if calls != 1 {
+		t.Errorf("Charge called %d times, want 1", calls)
+	}
+}
+```
+
+This is faster to read than a generated mock and never couples your test to call order. Reach for `go.uber.org/mock` (gomock) or `testify/mock` only when a team already mandates them or the interface is large and call-sequence assertions are the point — templates and the decision in `references/mocks-and-fakes.md`. For HTTP dependencies use `net/http/httptest` (server, recorder, or a fake `RoundTripper`) instead of a fake — same reference.
+
+## Concurrency & time (synctest)
+
+`testing/synctest` graduated to GA in **Go 1.25**. It runs your code in an isolated "bubble" with a fake clock that jumps forward instantly the moment every goroutine in the bubble is durably blocked — so a test of a 30-second timeout finishes in microseconds, deterministically.
+
+```go
+func TestTimeout(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+		defer cancel()
+
+		done := make(chan error, 1)
+		go func() { done <- slowOperation(ctx) }()
+
+		synctest.Wait() // wait until the goroutine is durably blocked
+		select {
+		case err := <-done:
+			if !errors.Is(err, context.DeadlineExceeded) {
+				t.Errorf("got %v, want DeadlineExceeded", err)
+			}
+		case <-time.After(time.Minute): // fake time — never really waits
+			t.Fatal("operation did not time out")
+		}
+	})
+}
+```
+
+- **Always run concurrent code with `-race`** (`go test -race ./...`). The race detector finds data races that pass silently otherwise.
+- **`synctest.Wait()`** blocks the bubble until all other bubble goroutines are durably blocked, letting you assert at a known point.
+- Use `synctest.Test(t, ...)`, not the old `synctest.Run` — `Run` is deprecated as of Go 1.26.
+- Never use `time.Sleep` to "let the goroutine finish." That is the flaky-test factory. Full bubble semantics, durable-block definition, and goroutine-leak detection live in `references/synctest-and-concurrency.md`.
+
+## Coverage
+
+```bash
+go test -cover ./...                                   # quick per-package %
+go test -coverprofile=cover.out ./...                  # write a profile
+go tool cover -html=cover.out                          # open annotated source
+go test -coverpkg=./... -coverprofile=cover.out ./...  # cross-package coverage
+go build -cover -o ./bin/app .                         # coverage for integration binaries (1.20+)
+```
+
+A coverage **percentage is a smoke alarm, not a goal.** 100% line coverage with no assertions on the values is worthless; 70% on the branches that actually carry logic is fine. Use `-coverpkg=./...` when your tests live in a separate package and exercise code across the module, or the number undercounts. Profiles, integration-binary coverage, and reading the HTML report are in `references/coverage-and-benchmarks.md`.
+
+## Mutation: does the suite actually notice?
+
+Coverage tells you which code ran; it cannot tell you whether any test would have **noticed** if that code were wrong. A table-driven test whose cases all assert `err == nil` and nothing else raises coverage without detecting anything. Mutation testing plants bugs on purpose — flip a `<` to `<=`, drop an early return, replace a returned value with the zero value — and a mutant the suite still passes is a test that asserts nothing.
+
+This is **not** fuzzing. Fuzzing hunts inputs your code mishandles; mutation hunts tests that would not catch a bug you already know about. They find different things and neither substitutes for the other.
+
+Go has **no mature mutation tool** — `go-mutesting` and `gremlins` exist but neither is a dependable default — so this is the manual procedure, and that makes the discipline stricter here, not looser:
+
+1. Pick the changed logic. Script the run and **commit the script** (e.g. `tools/mutants.go` or a shell driver); do not hand-edit N times, because you will need to rerun it and a restore mistake is silent.
+2. One mutant at a time: flip a comparison, off-by-one a bound or slice index, delete one branch, swap `&&`/`||`, return the zero value. `go test ./...` must fail for every one.
+3. Restore, confirm with `git diff` that nothing else moved, and rerun the suite green.
+4. Report as `N/N killed`, naming the mutants.
+
+**The runner must prove it executed each mutant.** A hand-rolled driver that can report a kill it never ran only ever *inflates* the score — so that defect can never surface as a red run, and no failing test will ever tell you about it. Assert the mutated file changed on disk (compare hashes before and after) and that the test command actually exited non-zero for the reason you expect, rather than trusting the loop.
+
+**A survivor is not automatically a failure.** Some mutants are semantically equivalent and cannot be killed; classify those with the reason instead of writing a test that asserts non-behaviour. Scale the whole layer to risk (P7): reach for it where a bug is expensive — money, auth, data loss, concurrency, a public API — not on every change.
+
+## Benchmarks
+
+Use `for b.Loop()` (Go 1.24+), not the legacy `for i := 0; i < b.N; i++`. `b.Loop` manages the timer itself (setup before the loop and teardown after are excluded automatically), runs the body the right number of times, and the compiler is taught **not** to dead-code-eliminate calls inside it.
+
+```go
+func BenchmarkHash(b *testing.B) {
+	data := bytes.Repeat([]byte("x"), 1024) // setup excluded from timing
+	b.ReportAllocs()
+	for b.Loop() {
+		_ = Hash(data)
+	}
+}
+```
+
+Bad — legacy loop with manual timer juggling and a sink to fool the optimizer:
+
+```go
+func BenchmarkHash(b *testing.B) {
+	data := bytes.Repeat([]byte("x"), 1024)
+	b.ResetTimer()
+	var sink uint64
+	for i := 0; i < b.N; i++ {
+		sink = Hash(data)
+	}
+	_ = sink
+}
+```
+
+- **`b.ReportAllocs()`** always — allocation count regresses long before wall-clock does, and it is the first thing to optimize.
+- **Compare runs with `benchstat`**, never eyeball two numbers — a single run's noise is larger than most real changes. Install and workflow in `references/coverage-and-benchmarks.md`.
+- The `sink`/`runtime.KeepAlive` dance is only needed in pre-1.24 modules; inside `b.Loop()` it is redundant.
+
+## Fuzzing
+
+Built in since Go 1.18. Worth it for **parsers, decoders, and anything that ingests untrusted input** — places where a malformed byte sequence can panic or corrupt state.
+
+```go
+func FuzzParse(f *testing.F) {
+	f.Add("key=value")        // seed corpus
+	f.Add("")
+	f.Fuzz(func(t *testing.T, s string) {
+		got, err := Parse(s)
+		if err != nil {
+			return // rejecting bad input is fine; crashing is not
+		}
+		if out := got.String(); out != s {
+			t.Errorf("round-trip: Parse(%q).String() = %q", s, out)
+		}
+	})
+}
+```
+
+Run it with `go test -fuzz=FuzzParse -fuzztime=30s`. Without `-fuzz` the seed corpus runs as ordinary cases on every `go test`, so seeds are also free regression tests.
+
+## Anti-patterns
+
+| Anti-pattern | Why it bites | Do instead |
+|---|---|---|
+| Testing unexported internals via `export_test.go` for everything | Tests rename-break on every refactor; you're testing structure, not behavior | Test through the public API; reserve `export_test.go` for genuinely untestable seams |
+| Asserting on log output to check a code path ran | Couples tests to message wording; brittle and slow | Assert on returned values or fake-recorded calls |
+| `time.Sleep` to synchronize goroutines | Flaky on loaded CI, slow always | `testing/synctest` + `synctest.Wait()`, or a channel |
+| One giant `TestEverything` func | First failure hides the rest; no targetable subtests | Table-driven with named `t.Run` subtests |
+| Chasing 100% coverage | Inflates with assertion-free tests; false confidence | Cover the branches that carry logic; read the profile |
+| `tc := tc` before `t.Run` in a `go 1.22`+ module | Dead ceremony; signals copied-from-old-blog code | Delete it; bump the `go` directive if older |
+| `gomock`/`testify/mock` to fake an interface you own | Ceremony + coupling to call order for a 12-line job | Hand-rolled func-field fake |
+| Benchmark without `b.ReportAllocs()` | Misses allocation regressions, the cheapest win | Add `b.ReportAllocs()`; compare with `benchstat` |
+| `t.Parallel()` in a test calling `t.Setenv`/`T.Chdir` | Panics — they mutate process-global state | Keep env/cwd tests serial |
+
+## Verify & references
+
+Run `scripts/verify.sh [dir]` to check emitted tests: it runs `gofmt -l`, `go vet ./...`, and `go test ./... -count=1` (with `-race` when supported) inside the first Go module it finds, and no-ops cleanly when there is none.
+
+- `references/synctest-and-concurrency.md` — bubble model, durable-block definition, fake clock, `synctest.Wait`, `-race`, goroutine-leak detection, the `GOEXPERIMENT`→GA migration.
+- `references/mocks-and-fakes.md` — fakes vs `testify/mock` vs gomock decision and minimal templates; `httptest` server/recorder/RoundTripper recipes.
+- `references/coverage-and-benchmarks.md` — coverage profiles, `-coverpkg`, integration `go build -cover`, `benchstat` install and workflow, `-cpuprofile`/`-memprofile`.

package/skills/shared/testing-go/evals/README.md

@@ -0,0 +1,3 @@
+# Evals for testing-go
+
+These cases are prompts to sanity-check routing and capability coverage, not an automated test harness. To exercise routing, feed each `should_trigger` and `should_not_trigger` prompt to the skill router and confirm that `testing-go` is selected for the former and the named sibling (`go`, `testing-py`, `testing-web`, `e2e-testing`, `review`) for the latter. For the `capability` entry, give the scenario to the agent with this skill loaded and check the generated Go test code against the `must_include` rubric by hand — every bullet should be visibly satisfied (table-driven subtests, synctest/fake clock with no real sleep, correct parallel handling, a fake or httptest double, `-race` plus a coverage command, and a `b.Loop()` benchmark). No CI integration is assumed.

package/skills/shared/testing-go/evals/cases.yaml

@@ -0,0 +1,46 @@
+skill: testing-go
+
+should_trigger:
+  - prompt: "Turn these three near-identical test functions into a table-driven test with subtests."
+    why: Core table-driven refactor — the canonical reason this skill exists.
+  - prompt: "Benchmark this hashing function and tell me if my change actually made it faster."
+    why: Benchmarks + benchstat comparison; non-obvious that this is testing-go and not the general go skill.
+  - prompt: "My parallel subtests are flaky and sometimes pick up the wrong test case data."
+    why: Loop-variable / parallel-isolation symptom; the fix (Go 1.22 scope, drop tt := tt) is testing-go knowledge, and the phrasing names a symptom, not the tool.
+  - prompt: "Necesito testear código con goroutines y timeouts sin que el test tarde 5 segundos."
+    why: Spanish; deterministic concurrency/time testing via testing/synctest and a fake clock.
+  - prompt: "How do I get cross-package coverage and an HTML report out of go test?"
+    why: Coverage profile workflow (-coverpkg, -coverprofile, go tool cover -html).
+  - prompt: "Mock the payment client interface so this Go service test doesn't hit the network."
+    why: Test doubles for Go — routes here (fake/httptest), not to go; non-obvious because user said "mock".
+  - prompt: "Add a fuzz test for my Go URL parser so it doesn't panic on garbage input."
+    why: Fuzzing parsers/untrusted input with FuzzXxx — squarely testing-go.
+
+should_not_trigger:
+  - prompt: "How should I structure error handling and generics in this Go package?"
+    route_to: go
+    why: Language design and idioms, not test code.
+  - prompt: "Write pytest fixtures and parametrize for my Python API."
+    route_to: testing-py
+    why: Wrong ecosystem — Python test tooling.
+  - prompt: "Add Playwright tests for the checkout flow across multiple pages."
+    route_to: e2e-testing
+    why: Browser-driven multi-page user journey, past the process boundary.
+  - prompt: "Set up Vitest and Testing Library for my React component."
+    route_to: testing-web
+    why: Frontend/component unit tests, different runtime.
+  - prompt: "Review this Go diff for bugs before I merge it."
+    route_to: review
+    why: General code review of a diff, not authoring test code.
+
+capability:
+  - scenario: "Given a Go RateLimiter that uses a time.Ticker and exposes fetch(ctx context.Context) (Resp, error) calling an HTTP backend, write a test suite for it."
+    must_include:
+      - Table-driven cases with named subtests run via t.Run(tc.name, ...)
+      - Uses testing/synctest (or an injected fake clock) for the ticker/timeout path, with no real time.Sleep to synchronize
+      - t.Parallel() where safe, and does NOT add a gratuitous tt := tt copy (notes Go 1.22 per-iteration loop scope)
+      - A hand-written interface fake or net/http/httptest server for the HTTP dependency, not a mock framework by default
+      - Runs with -race for the concurrent path and shows a go test -coverprofile / cross-package coverage command
+      - A benchmark using for b.Loop() with b.ReportAllocs() rather than a b.N loop
+      - "Does not present the coverage percentage as proof the suite detects bugs: states Go has no mature mutation tool, gives the manual procedure, and distinguishes mutation (tests that would not notice a bug) from fuzzing (inputs the code mishandles)."
+      - "Requires a hand-rolled mutant runner to prove it executed each mutant, and says why — a kill reported without running can only inflate the score, so no failing run would ever reveal it."

package/skills/shared/testing-go/references/coverage-and-benchmarks.md

@@ -0,0 +1,85 @@
+# Coverage & benchmarks
+
+Coverage profiles (including cross-package and integration binaries) and the `benchstat` benchmarking workflow. Target Go 1.25.
+
+## Coverage profiles
+
+```bash
+go test -cover ./...                                   # per-package % to stdout
+go test -coverprofile=cover.out ./...                  # write a profile file
+go tool cover -func=cover.out                          # per-function % in the terminal
+go tool cover -html=cover.out                          # annotated source in the browser
+go tool cover -html=cover.out -o cover.html            # write the HTML report to a file
+```
+
+The profile is the truth, the percentage is the headline. Open the HTML report and look at which **branches** are red, not at the number. An error path that never executes in any test is worth more attention than three more covered getters.
+
+## Cross-package coverage
+
+By default `go test` only counts coverage of the package under test. When tests live in package `foo_test` or exercise code across the module, that undercounts. Use `-coverpkg`:
+
+```bash
+go test -coverpkg=./... -coverprofile=cover.out ./...
+go test -coverpkg=./internal/... -coverprofile=cover.out ./internal/api
+```
+
+`-coverpkg` names the packages whose coverage to **measure**; the final args name the tests to **run**. They are different lists, which is the whole point — run the API tests, measure the internal packages they reach.
+
+## Integration-binary coverage (Go 1.20+)
+
+To measure coverage of a compiled binary driven by black-box tests (shell scripts, end-to-end harnesses), build with `-cover` and point `GOCOVERDIR` at an output directory:
+
+```bash
+go build -cover -o ./bin/app .
+mkdir -p covdata
+GOCOVERDIR=$(pwd)/covdata ./bin/app --do-something
+go tool covdata percent -i=covdata
+go tool covdata textfmt -i=covdata -o=cover.out   # convert to a profile for -html
+```
+
+This captures coverage from the running process, not from `go test`, so it folds real integration runs into your coverage picture.
+
+## Benchmarks: the loop
+
+Use `for b.Loop()` (Go 1.24+). It excludes setup before the loop and teardown after from the timer automatically, runs the body the correct number of times, and prevents the compiler from dead-code-eliminating the calls inside it.
+
+```go
+func BenchmarkEncode(b *testing.B) {
+	in := makeFixture()  // excluded from timing
+	b.ReportAllocs()
+	for b.Loop() {
+		_ = Encode(in)
+	}
+}
+```
+
+Always call `b.ReportAllocs()` — allocations regress before wall-clock and are usually the cheapest thing to fix. In pre-1.24 modules you instead write `for i := 0; i < b.N; i++`, call `b.ResetTimer()` after setup, and assign results to a package-level sink (or `runtime.KeepAlive`) to defeat the optimizer. None of that is needed with `b.Loop`.
+
+## benchstat workflow
+
+Never compare two raw benchmark prints — run-to-run noise usually exceeds the change you are measuring. Run each variant multiple times and let `benchstat` report the delta with a confidence interval.
+
+```bash
+go install golang.org/x/perf/cmd/benchstat@latest
+
+# on the baseline:
+go test -run=^$ -bench=BenchmarkEncode -count=10 ./... > old.txt
+# after your change:
+go test -run=^$ -bench=BenchmarkEncode -count=10 ./... > new.txt
+
+benchstat old.txt new.txt
+```
+
+`-run=^$` disables ordinary tests so only benchmarks run. `-count=10` gives benchstat enough samples to judge significance; treat a result marked `~` (no statistically significant change) as no change, regardless of the sign.
+
+## Profiling hooks
+
+Capture CPU and memory profiles from a benchmark and inspect them with pprof:
+
+```bash
+go test -run=^$ -bench=BenchmarkEncode -cpuprofile=cpu.out -memprofile=mem.out ./pkg
+go tool pprof -http=:0 cpu.out      # interactive flame graph in the browser
+go tool pprof -top mem.out          # top allocation sites in the terminal
+```
+
+Profile first, optimize second. A benchmark tells you *that* it is slow; the profile tells you *where*.

package/skills/shared/testing-go/references/mocks-and-fakes.md

@@ -0,0 +1,140 @@
+# Mocks, fakes & HTTP test doubles
+
+The default is a hand-written fake. This file covers the decision, minimal templates for the three approaches, and `net/http/httptest` recipes.
+
+## Which double?
+
+| You have | Use |
+|---|---|
+| An interface you own, small surface, you care about values not call order | Hand-rolled func-field fake |
+| A large interface where the **sequence and arguments** of calls is the contract under test | `go.uber.org/mock` (gomock) |
+| An existing codebase already standardized on testify | `testify/mock` (consistency over preference) |
+| An HTTP client or handler | `net/http/httptest` (below) — not a mock |
+
+`go.uber.org/mock` is the maintained successor to the archived `github.com/golang/mock`. Use it, not the original.
+
+## Hand-rolled fake (default)
+
+Declare the interface at the consumer, keep it minimal, give the fake a func field per method so each test sets exactly the behavior it needs.
+
+```go
+type Store interface {
+	Get(ctx context.Context, id string) (Item, error)
+	Put(ctx context.Context, it Item) error
+}
+
+type fakeStore struct {
+	get func(ctx context.Context, id string) (Item, error)
+	put func(ctx context.Context, it Item) error
+}
+
+func (f fakeStore) Get(ctx context.Context, id string) (Item, error) { return f.get(ctx, id) }
+func (f fakeStore) Put(ctx context.Context, it Item) error          { return f.put(ctx, it) }
+
+func TestService_NotFound(t *testing.T) {
+	s := Service{store: fakeStore{
+		get: func(context.Context, string) (Item, error) { return Item{}, ErrNotFound },
+	}}
+	if _, err := s.Lookup(t.Context(), "x"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("err = %v, want ErrNotFound", err)
+	}
+}
+```
+
+For a stateful fake (e.g. an in-memory store), back it with a `map` and a `sync.Mutex` instead of func fields. That doubles as a usable test fixture for many tests at once.
+
+## gomock template
+
+Generate from the interface, then set expectations:
+
+```bash
+go install go.uber.org/mock/mockgen@latest
+mockgen -source=store.go -destination=mock_store_test.go -package=mypkg
+```
+
+```go
+func TestService_callsPutOnce(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	m := NewMockStore(ctrl)
+	m.EXPECT().Put(gomock.Any(), gomock.Any()).Return(nil).Times(1)
+	// ... exercise; ctrl asserts expectations at test cleanup
+}
+```
+
+The payoff is automatic call-count and argument verification; the cost is generated files, regen on every interface change, and tests coupled to call order. Worth it only when that order is the contract.
+
+## testify/mock template
+
+```go
+type MockStore struct{ mock.Mock }
+
+func (m *MockStore) Get(ctx context.Context, id string) (Item, error) {
+	args := m.Called(ctx, id)
+	return args.Get(0).(Item), args.Error(1)
+}
+
+// in the test:
+m := new(MockStore)
+m.On("Get", mock.Anything, "x").Return(Item{}, ErrNotFound)
+m.AssertExpectations(t)
+```
+
+Use only where the repo already uses testify for mocks; otherwise prefer the func-field fake.
+
+## httptest recipes
+
+**Test an HTTP client** against a fake server:
+
+```go
+func TestClient_Fetch(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/items/42" {
+			http.NotFound(w, r)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"id":"42"}`)
+	}))
+	defer srv.Close()
+
+	c := NewClient(srv.URL)
+	it, err := c.Fetch(t.Context(), "42")
+	if err != nil {
+		t.Fatalf("Fetch: %v", err)
+	}
+	if it.ID != "42" {
+		t.Errorf("ID = %q, want 42", it.ID)
+	}
+}
+```
+
+**Test an `http.Handler`** with a recorder — no server, no socket:
+
+```go
+func TestHandler_OK(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, "/health", nil)
+	rec := httptest.NewRecorder()
+	Handler().ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Errorf("status = %d, want 200", rec.Code)
+	}
+}
+```
+
+**Fake transport** when you cannot change the base URL — swap the `RoundTripper`:
+
+```go
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+	return &http.Response{
+		StatusCode: 200,
+		Body:       io.NopCloser(strings.NewReader(`{"ok":true}`)),
+		Header:     make(http.Header),
+	}, nil
+})}
+```
+
+Prefer `httptest.NewServer` when the code under test takes a URL; reach for the `RoundTripper` only when it constructs the client internally.

package/skills/shared/testing-go/references/synctest-and-concurrency.md

@@ -0,0 +1,82 @@
+# synctest & concurrency
+
+Deterministic tests for goroutines, timers, and `context` deadlines, plus the race detector and leak detection. Target Go 1.25.
+
+## The bubble model
+
+`synctest.Test(t, func(t *testing.T){ ... })` runs the body inside an isolated **bubble**:
+
+- The bubble has its own **fake clock**, starting at a fixed instant. `time.Now`, `time.Sleep`, `time.After`, `time.NewTimer`, `time.NewTicker`, and `context` deadlines inside the bubble all read this fake clock.
+- The fake clock **does not tick on its own**. It only advances when every goroutine in the bubble is **durably blocked** — at which point it jumps forward to the next scheduled timer instantly. A test of a one-hour timeout therefore finishes in microseconds.
+- Goroutines started inside the bubble belong to the bubble. The bubble is done when all of them exit.
+
+```go
+func TestRetryBackoff(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		start := time.Now()
+		err := retry(t.Context(), 3, time.Second, alwaysFail)
+		elapsed := time.Since(start) // fake-clock elapsed, computed instantly
+		if !errors.Is(err, errExhausted) {
+			t.Fatalf("err = %v", err)
+		}
+		if elapsed != 3*time.Second { // 1s + 2s backoff, deterministic
+			t.Errorf("elapsed = %v, want 3s", elapsed)
+		}
+	})
+}
+```
+
+## Durably blocked — the exact definition
+
+A goroutine is **durably blocked** when it is blocked and can only be unblocked by another goroutine in the same bubble. That covers: receiving/sending on a bubble channel with no ready counterpart, `select` with no ready case, `sync.WaitGroup.Wait`, `sync.Mutex.Lock` contention, and `time.Sleep`.
+
+It does **not** cover blocking on something outside the bubble: a real network read, a system call, a channel shared with a goroutine started before the bubble. If a bubble goroutine blocks on the outside world, the fake clock will not advance and the test hangs. Keep all I/O inside the bubble fake, or out of the synctest body entirely.
+
+## synctest.Wait()
+
+`synctest.Wait()` blocks the calling goroutine until every **other** goroutine in the bubble is durably blocked. Use it to reach a known quiescent point before asserting:
+
+```go
+go worker(ch)
+ch <- job
+synctest.Wait()        // worker has processed and is now blocked waiting again
+if got := metrics.Load(); got != 1 {
+	t.Errorf("processed = %d, want 1", got)
+}
+```
+
+Without `Wait()` you would race the assertion against the worker.
+
+## Race detector
+
+Run anything concurrent with `-race`:
+
+```bash
+go test -race ./...
+go test -race -run TestRetryBackoff -count=10 ./internal/retry
+```
+
+`-count=10` re-runs to flush out order-dependent flakiness. The race detector instruments memory access; it roughly doubles runtime and memory, so it lives in CI and in targeted local runs, not necessarily every `go test`. A clean `-race` run is not a proof of correctness, but a failing one is always a real bug.
+
+## Goroutine-leak detection
+
+A test that starts a goroutine and returns before it exits leaks it. Two approaches:
+
+- Inside a synctest bubble, a leak surfaces naturally: the bubble blocks waiting for the stray goroutine, and the fake clock cannot advance, so the test hangs or the leak is obvious.
+- Outside synctest, use `go.uber.org/goleak`:
+
+```go
+func TestMain(m *testing.M) {
+	goleak.VerifyTestMain(m)
+}
+```
+
+This fails the run if any unexpected goroutine survives the suite. Prefer `t.Cleanup` to cancel contexts and `synctest.Wait` to drain workers so you never leak in the first place.
+
+## Migration: GOEXPERIMENT → GA
+
+- **Go 1.24**: `testing/synctest` shipped behind `GOEXPERIMENT=synctest`, exposing only `synctest.Run(func(){...})`.
+- **Go 1.25**: GA, no build flag. The preferred entry point is `synctest.Test(t, func(t *testing.T){...})`, which takes `*testing.T` and integrates with subtests and cleanup.
+- **Go 1.26**: `synctest.Run` is deprecated. Migrate `Run(func(){...})` calls to `Test(t, func(t *testing.T){...})` and use the passed `t` for assertions instead of capturing the outer one.
+
+If you see `GOEXPERIMENT=synctest` in a Makefile or CI config and the module is on 1.25+, delete the flag.