@iceinvein/agent-skills 0.21.4 → 0.22.0

package/skills/bug-hunter/evals/rules.json

@@ -0,0 +1,177 @@
+{
+  "rules": [
+    {
+      "id": "target-named-in-one-line",
+      "states": "SKILL.md: Method",
+      "origin": "commit:f88c60a",
+      "cases": [],
+      "unpinned": "No grader reads the opening message where the target is named."
+    },
+    {
+      "id": "intent-collected-into-intent-md",
+      "states": "SKILL.md: Method",
+      "origin": "docs/specs/2026-10-12-bug-hunter.md",
+      "cases": [
+        "bug-cites-intent-from-spec"
+      ]
+    },
+    {
+      "id": "claim-never-from-a-changed-body",
+      "states": "SKILL.md: Method",
+      "origin": "commit:9a9dc31",
+      "cases": [
+        "bug-cites-intent-from-spec",
+        "silent-spec-is-an-ambiguity"
+      ]
+    },
+    {
+      "id": "scenarios-written-from-the-catalog",
+      "states": "SKILL.md: Method",
+      "origin": "docs/specs/2026-10-12-bug-hunter.md",
+      "cases": [],
+      "unpinned": "No grader reads scenarios.md or checks which catalog categories a run worked through."
+    },
+    {
+      "id": "repros-use-the-repos-own-test-runner",
+      "states": "SKILL.md: Method",
+      "origin": "docs/specs/2026-10-12-bug-hunter.md",
+      "cases": [],
+      "unpinned": "The repro judge reads what the repro asserts against the fixture's code, not which runner or framework it is written in."
+    },
+    {
+      "id": "no-test-dependency-installed",
+      "states": "SKILL.md: Method",
+      "origin": "commit:9a9dc31",
+      "cases": [],
+      "unpinned": "Every fixture runs on node --test with no dependencies, and an install in the scratch copy leaves no path in the caller's tree for tree-unchanged to see."
+    },
+    {
+      "id": "many-cheap-probes",
+      "states": "SKILL.md: Method",
+      "origin": "commit:9a9dc31",
+      "cases": [],
+      "unpinned": "No grader counts probes or reads how a run followed up a failure; each fixture has at most one defect to find."
+    },
+    {
+      "id": "failure-rechecked-alone-before-reporting",
+      "states": "SKILL.md: Method",
+      "origin": "commit:9a9dc31",
+      "cases": [],
+      "unpinned": "No grader checks a repro was re-run alone, and no fixture has a mock or setup that could make a repro fail on its own."
+    },
+    {
+      "id": "scratch-worktree-leaves-callers-tree-unchanged",
+      "states": "SKILL.md: Method",
+      "origin": "docs/specs/2026-10-12-bug-hunter.md",
+      "cases": [
+        "callers-tree-unchanged"
+      ]
+    },
+    {
+      "id": "no-repro-no-finding",
+      "states": "SKILL.md: What counts as a bug",
+      "origin": "docs/specs/2026-10-12-bug-hunter.md",
+      "cases": [
+        "proves-a-spec-boundary-bug",
+        "correct-code-has-no-bugs",
+        "bug-cites-intent-from-spec",
+        "spec-outranks-target-docstring",
+        "impossible-value-is-a-bug"
+      ]
+    },
+    {
+      "id": "contradicting-a-stated-claim-is-a-bug",
+      "states": "SKILL.md: What counts as a bug",
+      "origin": "commit:bd7fc25",
+      "cases": [
+        "proves-a-spec-boundary-bug",
+        "bug-cites-intent-from-spec",
+        "spec-outranks-target-docstring"
+      ]
+    },
+    {
+      "id": "repo-stated-sources-are-intent",
+      "states": "SKILL.md: Method",
+      "origin": "commit:bd7fc25",
+      "cases": [],
+      "unpinned": "No fixture has a sibling implementation, a stated invariant or an existing test the target contradicts, so claims from those sources are never exercised."
+    },
+    {
+      "id": "claims-have-a-rank",
+      "states": "SKILL.md: What counts as a bug",
+      "origin": "commit:23d4466",
+      "cases": [
+        "spec-outranks-target-docstring"
+      ]
+    },
+    {
+      "id": "wrong-under-every-reading-is-a-bug",
+      "states": "SKILL.md: What counts as a bug",
+      "origin": "commit:23d4466",
+      "cases": [
+        "impossible-value-is-a-bug"
+      ]
+    },
+    {
+      "id": "silent-spec-is-an-ambiguity",
+      "states": "SKILL.md: What counts as a bug",
+      "origin": "docs/specs/2026-10-12-bug-hunter.md",
+      "cases": [
+        "silent-spec-is-an-ambiguity"
+      ]
+    },
+    {
+      "id": "latent-is-not-a-bug",
+      "states": "SKILL.md: What counts as a bug",
+      "origin": "commit:9a9dc31",
+      "cases": [],
+      "unpinned": "Every fixture's defect sits on the module's exported path, so no case has a defect no production caller reaches."
+    },
+    {
+      "id": "output-in-the-dated-run-directory",
+      "states": "SKILL.md: Output",
+      "origin": "docs/specs/2026-10-12-bug-hunter.md",
+      "cases": [
+        "proves-a-spec-boundary-bug",
+        "bug-cites-intent-from-spec"
+      ]
+    },
+    {
+      "id": "findings-written-with-write-tool-to-shape",
+      "states": "SKILL.md: Output",
+      "origin": "commit:bd7fc25",
+      "cases": [
+        "silent-spec-is-an-ambiguity",
+        "correct-code-has-no-bugs"
+      ]
+    },
+    {
+      "id": "bug-hunter-dir-is-the-only-path-written",
+      "states": "SKILL.md: Output",
+      "origin": "commit:f88c60a",
+      "cases": [
+        "callers-tree-unchanged"
+      ]
+    },
+    {
+      "id": "promoting-a-repro-is-the-callers-job",
+      "states": "SKILL.md: Output",
+      "origin": "docs/specs/2026-10-12-bug-hunter.md",
+      "cases": [
+        "callers-tree-unchanged"
+      ]
+    },
+    {
+      "id": "hand-back-contents",
+      "states": "SKILL.md: Hand-back",
+      "origin": "commit:f88c60a",
+      "cases": [],
+      "unpinned": "No grader reads the final message, so the run directory, bucket counts, per-bug lines and anything not done go unchecked."
+    }
+  ],
+  "sandboxSensitive": [],
+  "vacuousWithout": [
+    "callers-tree-unchanged"
+  ],
+  "unclaimed": []
+}

package/skills/bug-hunter/evals/silent-spec-is-an-ambiguity/case.yaml

@@ -0,0 +1,4 @@
+schema_version: "1.1"
+name: silent-spec-is-an-ambiguity
+context:
+  scaffold_script: fixture.sh

package/skills/bug-hunter/evals/silent-spec-is-an-ambiguity/fixture.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# A cart whose spec says a line's quantity is capped and never says where. The
+# code caps at 99, so a scenario at 99, 100 or 150 has no expected value any
+# claim can supply: the cap's value is a question for product, not a bug. The
+# spec names the cap rather than staying silent about large quantities
+# altogether, because a spec that only says "setting a quantity replaces the
+# line's quantity" makes any cap a violation of that claim, and the right
+# answer would no longer be clear. Everything the spec does settle, the code
+# does, so a bug here is the skill inventing an expected value.
+set -euo pipefail
+
+mkdir -p src tests
+
+cat > package.json <<'JSON'
+{
+  "name": "cart",
+  "version": "1.2.0",
+  "type": "module",
+  "scripts": {
+    "test": "node --test \"tests/*.test.js\""
+  }
+}
+JSON
+
+cat > SPEC.md <<'MD'
+# Cart
+
+`setQuantity(cart, sku, quantity)` in `src/cart.js` sets how many of one
+product a cart line holds and returns the new cart. A cart is
+`{ lines: [{ sku, quantity }] }`.
+
+- The cart passed in is not modified.
+- Setting the quantity of a SKU already in the cart replaces that line's
+  quantity, and the line keeps its place.
+- Setting the quantity of a SKU not in the cart adds a line at the end.
+- Setting a quantity of 0 removes the line. Doing so for a SKU not in the cart
+  returns a cart with the same lines.
+- A quantity that is negative or not a whole number throws a `RangeError`.
+- A line's quantity is capped so that a slip on the keyboard cannot order a
+  pallet: setting a quantity above the cap stores the cap.
+MD
+
+git init --quiet
+git add -A
+git -c user.email=fixture@example.com -c user.name=fixture commit --quiet -m "spec: cart quantities"
+
+cat > src/cart.js <<'JS'
+const MAX_QUANTITY = 99;
+
+export function setQuantity(cart, sku, quantity) {
+  if (!Number.isInteger(quantity) || quantity < 0) {
+    throw new RangeError(`quantity must be a whole number of 0 or more, got ${quantity}`);
+  }
+
+  const stored = Math.min(quantity, MAX_QUANTITY);
+  const index = cart.lines.findIndex((line) => line.sku === sku);
+
+  if (stored === 0) {
+    return { ...cart, lines: cart.lines.filter((line) => line.sku !== sku) };
+  }
+
+  if (index === -1) {
+    return { ...cart, lines: [...cart.lines, { sku, quantity: stored }] };
+  }
+
+  const lines = cart.lines.map((line, i) => (i === index ? { ...line, quantity: stored } : line));
+  return { ...cart, lines };
+}
+JS
+
+cat > tests/cart.test.js <<'JS'
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { setQuantity } from "../src/cart.js";
+
+test("a new SKU is added as a line", () => {
+  const cart = setQuantity({ lines: [] }, "mug", 2);
+  assert.deepEqual(cart, { lines: [{ sku: "mug", quantity: 2 }] });
+});
+
+test("an existing line's quantity is replaced", () => {
+  const cart = setQuantity({ lines: [{ sku: "mug", quantity: 2 }] }, "mug", 5);
+  assert.deepEqual(cart, { lines: [{ sku: "mug", quantity: 5 }] });
+});
+
+test("a quantity of 0 removes the line", () => {
+  const cart = setQuantity({ lines: [{ sku: "mug", quantity: 2 }] }, "mug", 0);
+  assert.deepEqual(cart, { lines: [] });
+});
+
+test("a negative quantity throws", () => {
+  assert.throws(() => setQuantity({ lines: [] }, "mug", -1), RangeError);
+});
+JS
+
+git add -A
+git -c user.email=fixture@example.com -c user.name=fixture commit --quiet -m "feat: set a cart line's quantity"

package/skills/bug-hunter/evals/silent-spec-is-an-ambiguity/graders/bug-hunter-fired.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Skill
+input_match: '"skill"\s*:\s*"(?:[\w-]+:)?bug-hunter"'
+---

package/skills/bug-hunter/evals/silent-spec-is-an-ambiguity/graders/bugs-empty.md

@@ -0,0 +1,18 @@
+---
+type: regex
+# findings.json sits under a slug the skill picks, so no file target can name
+# it; the trace carries its content in the Write call (or shell command) that
+# created it. That content is one JSON string in the trace line, its quotes
+# escaped as \" and its newlines as \n, and the match is held inside that one
+# string. Matches a findings.json write whose "bugs" is an empty array, and
+# only the last one: the closing lookahead fails the match if any later
+# findings.json write follows (a Write, its echoed result, an Edit, or a shell
+# redirect), so an empty first draft rewritten with bugs does not pass. A Write
+# is echoed in full by its tool result, so the last Write still matches there.
+# A later Edit fails the grader, since an Edit's result does not carry the
+# whole file. A file written by a dispatched agent counts only if the trace
+# carries that agent's tool calls.
+pattern: 'findings\.json(?:","content":")?(?:\\.|[^"\\])*?\\"bugs\\":(?:\s|\\n)*\[(?:\s|\\n)*\](?![\s\S]*?(?:findings\.json","(?:content|old_string)":"|>\s*[^"\s]*findings\.json))'
+target: trace
+weight: 2
+---

package/skills/bug-hunter/evals/silent-spec-is-an-ambiguity/graders/cap-is-an-ambiguity.md

@@ -0,0 +1,12 @@
+---
+type: regex
+# The same findings.json write as bugs-empty, read for its ambiguities: one
+# whose question asks about the quantity cap (the cap, a maximum or ceiling,
+# or the 99 the code uses). The question is matched inside its own \"...\"
+# string value. The same closing lookahead as bugs-empty holds the match to
+# the last findings.json write.
+pattern: 'findings\.json(?:","content":")?(?:\\.|[^"\\])*?\\"ambiguities\\":(?:\\.|[^"\\])*?\\"question\\":(?:\s|\\n)*\\"(?:(?!\\")(?:\\.|[^"\\]))*?(?:\bcap|maximum|\bmax\b|ceiling|\b99\b|\b100\b|upper limit)(?![\s\S]*?(?:findings\.json","(?:content|old_string)":"|>\s*[^"\s]*findings\.json))'
+flags: i
+target: trace
+weight: 2
+---

package/skills/bug-hunter/evals/silent-spec-is-an-ambiguity/graders/written-with-write-tool.md

@@ -0,0 +1,13 @@
+---
+type: regex
+# SKILL.md writes intent.md, findings.json and report.md with the Write tool,
+# never from a shell command. The content graders read a heredoc's literal JSON
+# as readily as a Write call's, so this is what holds the rule: it fails a Bash
+# command that redirects or tees into one of the three under .bug-hunter/. A
+# script that opens the file itself (python3, node -e) is not caught here; the
+# content graders fail that, since the trace then holds no literal JSON.
+pattern: '"command":"(?:\\.|[^"\\])*?(?:>|\btee\b(?:\\.|[^"\\|;&])*?)\s*[^"\s]*\.bug-hunter/[^"\s]*?(?:intent\.md|findings\.json|report\.md)'
+match: not_contains
+target: trace
+weight: 2
+---

package/skills/bug-hunter/evals/silent-spec-is-an-ambiguity/prompt.md

@@ -0,0 +1,11 @@
+---
+name: silent-spec-is-an-ambiguity
+description: A limit whose value the spec never states has no expected value to prove a bug against. Pins the finding landing in ambiguities, with bugs left empty.
+tags: [ambiguity, boundary, scaffold, write]
+max_turns: 80
+timeout_seconds: 2400
+allowed_tools: [Read, Glob, Grep, Skill, Write, Edit, Bash, Agent]
+expected_outcome: findings.json under .bug-hunter/ has an empty bugs array and an ambiguity asking what the quantity cap is.
+---
+
+Before this goes to QA: what will they find in `src/cart.js`? It's meant to do what `SPEC.md` says.

package/skills/bug-hunter/evals/spec-outranks-target-docstring/case.yaml

@@ -0,0 +1,4 @@
+schema_version: "1.1"
+name: spec-outranks-target-docstring
+context:
+  scaffold_script: fixture.sh

package/skills/bug-hunter/evals/spec-outranks-target-docstring/fixture.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# A download list whose spec and whose own docstring disagree. SPEC.md says a
+# sealed export stays on offer while its guide is rewritten in, and if that
+# rewrite fails. The module's docstring, written with the code, says a sealed
+# export whose rewrite failed is never offered, and the code follows the
+# docstring. The spec is the intent; a comment inside the changed code is the
+# change describing itself, so the disagreement is a bug citing the spec, not
+# a question for product. This is the shape the pilot's workings-3a4c4b7f5
+# key took, where the skill found the defect and filed it as an ambiguity.
+# Everything else the spec says, the code does.
+set -euo pipefail
+
+mkdir -p src tests
+
+cat > package.json <<'JSON'
+{
+  "name": "exports",
+  "version": "2.4.0",
+  "type": "module",
+  "scripts": {
+    "test": "node --test \"tests/*.test.js\""
+  }
+}
+JSON
+
+cat > SPEC.md <<'MD'
+# Exports
+
+`offeredExports(exports)` in `src/exports.js` returns the exports the
+download list shows, keeping the order it was given. An export is
+`{ id, sealed, hasGuide, rewrite }`, where `rewrite` is `"none"`,
+`"running"` or `"failed"`.
+
+- An export is offered once it is sealed. An unsealed export is not offered.
+- A sealed export made before exports carried a guide (`hasGuide` false) has
+  the guide written into it in the background. It stays on offer while that
+  rewrite runs and if the rewrite fails: a sealed export is a complete proof
+  with or without the guide.
+MD
+
+git init --quiet
+git add -A
+git -c user.email=fixture@example.com -c user.name=fixture commit --quiet -m "spec: which exports the download list offers"
+
+cat > src/exports.js <<'JS'
+/**
+ * The exports the download list offers, in the order given. A sealed export
+ * is offered. A sealed export without a guide whose rewrite failed is never
+ * offered: without the guide it cannot be opened on its own.
+ */
+export function offeredExports(exports) {
+  return exports.filter((entry) => {
+    if (!entry.sealed) return false;
+    if (!entry.hasGuide && entry.rewrite === "failed") return false;
+    return true;
+  });
+}
+JS
+
+cat > tests/exports.test.js <<'JS'
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { offeredExports } from "../src/exports.js";
+
+test("a sealed export with a guide is offered", () => {
+  const sealed = { id: "a", sealed: true, hasGuide: true, rewrite: "none" };
+  assert.deepEqual(offeredExports([sealed]), [sealed]);
+});
+
+test("an unsealed export is not offered", () => {
+  assert.deepEqual(offeredExports([{ id: "a", sealed: false, hasGuide: true, rewrite: "none" }]), []);
+});
+
+test("the order given is kept", () => {
+  const a = { id: "a", sealed: true, hasGuide: true, rewrite: "none" };
+  const b = { id: "b", sealed: true, hasGuide: true, rewrite: "none" };
+  assert.deepEqual(offeredExports([b, a]), [b, a]);
+});
+JS
+
+git add -A
+git -c user.email=fixture@example.com -c user.name=fixture commit --quiet -m "feat: offer sealed exports for download"

package/skills/bug-hunter/evals/spec-outranks-target-docstring/graders/bug-cites-the-spec.md

@@ -0,0 +1,40 @@
+---
+type: llm
+# As in proves-a-spec-boundary-bug: the judge cannot run the repro, so "fails
+# in the fixture" is judged against the fixture's code, quoted below, and it
+# reads the trace because findings.json sits under a slug no file focus names.
+focus: trace
+weight: 3
+---
+
+The agent was asked what QA will find in `src/exports.js`. `SPEC.md` says a
+sealed export without a guide stays on offer while its guide is rewritten in
+and if that rewrite fails. The module's own docstring says the opposite (a
+sealed export without a guide whose rewrite failed is never offered), and the
+code follows the docstring:
+
+```js
+if (!entry.sealed) return false;
+if (!entry.hasGuide && entry.rewrite === "failed") return false;
+return true;
+```
+
+So `offeredExports([{ id: "a", sealed: true, hasGuide: false, rewrite: "failed" }])`
+returns `[]` where the spec requires that export to be offered. Nothing else
+in the code departs from the spec.
+
+Find the `findings.json` the agent wrote under `.bug-hunter/` (its content
+appears in a Write tool call or a shell command in the trace). If it was
+written more than once, judge only the last write, with any later Edit to it
+applied.
+
+PASS if its `bugs` array has an entry whose `claim` resolves, through the
+`intent` array, to the spec's statement that a sealed export stays on offer
+when its rewrite fails (or the spec's broader "offered once it is sealed"
+claim, applied to that export), and whose `repro` asserts that a sealed
+export with `hasGuide: false` and `rewrite: "failed"` is offered, so that it
+fails against the code above.
+FAIL if no findings.json content is visible in the trace, if this case
+appears only in `ambiguities`, if the bug's claim resolves to the docstring
+rather than the spec, or if the repro asserts something the code above
+already does.

package/skills/bug-hunter/evals/spec-outranks-target-docstring/graders/bug-hunter-fired.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Skill
+input_match: '"skill"\s*:\s*"(?:[\w-]+:)?bug-hunter"'
+---

package/skills/bug-hunter/evals/spec-outranks-target-docstring/prompt.md

@@ -0,0 +1,11 @@
+---
+name: spec-outranks-target-docstring
+description: The spec and a docstring inside the changed code disagree, and the code follows the docstring. Pins a confirmed bug citing the spec claim, not an ambiguity between the two.
+tags: [bug, precedence, scaffold, write]
+max_turns: 80
+timeout_seconds: 2400
+allowed_tools: [Read, Glob, Grep, Skill, Write, Edit, Bash, Agent]
+expected_outcome: findings.json under .bug-hunter/ has a bug citing the spec's claim that a sealed export stays on offer when its rewrite fails, with a repro that fails against the fixture.
+---
+
+We're shipping the download list on Thursday. What will QA find in `src/exports.js`? `SPEC.md` is what it's meant to do.

package/skills/bug-hunter/references/findings-format.md

@@ -0,0 +1,82 @@
+# Findings format
+
+Every run writes `report.md` and `findings.json` to
+`.bug-hunter/<YYYY-MM-DD>-<slug>/`, next to `intent.md` and `scenarios.md`.
+They carry the same content; `findings.json` is the one a grader or a calling
+skill parses, so it follows this shape exactly.
+
+Write both files with the Write tool, passing the full contents. Do not build
+them with a shell command, a heredoc or a script (`python3 -c` with
+`json.dump`, `node -e` with `JSON.stringify`): a grader reading the run's trace
+sees a script, not the JSON it produced.
+
+## findings.json
+
+```
+{ "target": string, "intent": { "id": string, "claim": string, "source": string }[], "bugs": { "id": string, "scenario": string, "claim": string, "expected": string, "observed": string, "repro": { "files": Record<string,string>, "cmd": string } }[], "ambiguities": { "id": string, "scenario": string, "question": string }[], "covered": { "scenario": string, "claim": string }[] }
+```
+
+Field by field:
+
+- `target`: the one-line target description the run started from (a commit,
+  range or paths).
+- `intent`: the claims from `intent.md`. `id` is the claim's number (`I1`),
+  `claim` its text, `source` where it came from (file and line, commit SHA, or
+  `request`). A claim taken from a sibling implementation or a stated
+  invariant cites the file and line that holds it. A result wrong under every
+  reading (SKILL.md) has `source` `baseline`.
+- `bugs`: confirmed findings only. `id` numbers them (`B1`). `scenario` is
+  the scenario's id from `scenarios.md` and its one-line label, as
+  `"<id>: <label>"`, for example `"S4: quantity of exactly the cap is
+  accepted"`. A reader that sees only this field must still know what was
+  tested, so never give the bare id. `claim` is the violated intent id.
+  `expected` and `observed` are the values the repro asserted and got.
+- `repro.files`: paths relative to the repo root, each mapped to the file's
+  full contents, so a grader can write them into a fresh checkout and run
+  `repro.cmd` from the root. Include every file the repro needs that is not
+  already in the tree; an edited existing file is given in full, not as a
+  patch.
+- `repro.cmd`: a command run from the repo root that runs this repro alone and
+  exits non-zero while the bug is present.
+- `ambiguities`: `id` numbers them (`A1`); `scenario` is `"<id>: <label>"`,
+  as in `bugs`; `question` is what product has to decide.
+- `covered`: scenarios that ran and passed. `scenario` is `"<id>: <label>"`,
+  as in `bugs`; `claim` the intent id it checked.
+
+Empty buckets are empty arrays, never omitted. Rejected findings and
+exploratory tests appear nowhere in the file.
+
+## report.md
+
+```markdown
+# Bug hunt: <target>
+
+<date>. Run directory: `.bug-hunter/<YYYY-MM-DD>-<slug>/`.
+<n> bugs, <n> ambiguities, <n> covered. <scenarios not executed, and why, or "All scenarios executed.">
+
+## Bugs
+
+### B1: <one-line summary>
+
+- Scenario: S4, <scenario text>
+- Violates: I2, "<claim text>" (<source>)
+- Expected: <value>
+- Observed: <value>
+- Repro: `<path>` (and any others), run with `<cmd>`
+
+## Ambiguities
+
+### A1: <question>
+
+- Scenario: S7, <scenario text>
+- Why it is open: <the claims are silent, or I3 and I5 disagree>
+
+## Covered
+
+| Scenario | Claim |
+|---|---|
+| S1, <scenario text> | I1 |
+```
+
+A bucket with no entries keeps its heading with the line `None.` under it, so
+a reader can tell "none found" from "section missing".

package/skills/bug-hunter/references/scenario-catalog.md

@@ -0,0 +1,92 @@
+# Scenario catalog
+
+Where QA finds bugs that the author's tests missed. Work through every
+category for the target; a category that gives no purchase gets one line in
+`scenarios.md` saying why, so its absence reads as a decision. Each probe is a
+prompt for a scenario, not a scenario: the expected result still has to come
+from a claim in `intent.md`.
+
+## Boundaries
+
+- The value exactly at each stated limit, one below it, and one above it.
+- Zero, one, and many: an empty collection, a single element, the maximum.
+- The first and last item of a page, a range or a batch, and a request for
+  the page after the last.
+- Inclusive against exclusive ends: does "until Friday" or "up to 10" include
+  the endpoint the claim names.
+- Negative numbers and zero where only positives were imagined.
+
+## Sequence and state
+
+- Run the same action twice in a row; the second call should be safe or
+  refused, whichever the claim says.
+- Double submit: two identical requests arriving before the first completes.
+- Retry after partial failure: the first attempt wrote half its state and
+  failed; the retry must not duplicate or skip the half already written.
+- Out of order: the steps a workflow expects in sequence, sent in a different
+  order, or a later step without the earlier one.
+- An action on something already deleted, cancelled, closed or expired.
+- Undo, then redo, then the original action again.
+
+## Combinations of flags, options and roles
+
+- Two options that each work alone, set together, especially ones that pull
+  in opposite directions (`--force` with `--dry-run`).
+- A role with less permission reaching an action through a path built for a
+  more privileged one.
+- An option that the change added, combined with each pre-existing option it
+  interacts with.
+- The default for every option left unset, against each one explicitly set to
+  its default value.
+
+## Time
+
+- A timestamp in a timezone other than the server's, and a user whose
+  timezone differs from the data's.
+- The DST transition days: an hour that does not exist, and an hour that
+  happens twice.
+- Month end: the 31st plus one month, 29 February, and a non-leap year.
+- Midnight and the date boundary: an event at 23:59:59 and at 00:00:00, and a
+  "today" computed in UTC against local time.
+- Year end, and a range that spans it.
+
+## Data shape
+
+- Null against missing against empty: a field absent, present as `null`,
+  present as `""` or `[]`; are they meant to mean the same thing.
+- Duplicates in input that the claim assumes unique.
+- Ordering: input in reverse or random order where the code may assume sorted,
+  and output order where the claim promises one.
+- Unicode: combining characters, emoji, right-to-left text, and case folding
+  outside ASCII.
+- Size: a very long string, a very large collection, a deeply nested value.
+- Whitespace and case variants of a value meant to match: leading or trailing
+  spaces, mixed case.
+
+## Arithmetic
+
+- Rounding: half-way values, and the rounding mode the claim requires against
+  the one the language defaults to.
+- Money in floating point: sums of many small amounts, and totals that must
+  equal the sum of their rounded parts.
+- Units: seconds against milliseconds, bytes against kilobytes, cents against
+  dollars, at each boundary between components.
+- Integer division and remainder with negative operands, and division by zero.
+- Overflow at the type's limit, and percentages over 100 or below 0.
+
+## Partial failure
+
+- A dependency call that fails after earlier writes succeeded: what state is
+  left, and does the caller learn about it.
+- A timeout that fires after the remote side completed the work.
+- One item failing in a batch: do the others commit, roll back, or report.
+- An error raised inside cleanup or a `finally`, hiding the original one.
+- A process killed between two writes that the claim says happen together.
+
+## Environment
+
+- A stale cache serving a value the change made obsolete.
+- Config missing, empty, or set to a value of the wrong type.
+- A feature flag off, on, and flipped while work is in flight.
+- Running against data written by the previous version of the code.
+- A different locale, working directory, or a path with spaces in it.