@nerdev/skillset 0.2.1

package/skills/engineering/tdd-workflow/SKILL.md

@@ -0,0 +1,178 @@
+---
+name: tdd-workflow
+category: engineering
+source: ECC (adapted)
+description: "Test-driven development with RED/GREEN/REFACTOR cycle, evidence capture, and mutation testing. Load when writing tests or implementing features test-first."
+
+# TDD Workflow
+
+When to use: implementing new features, fixing bugs with regression tests, refactoring code with safety nets.
+
+## The Cycle
+
+```
+RED    -> Write a failing test that defines desired behavior
+GREEN  -> Write minimal code to make the test pass
+REFACTOR -> Improve code while keeping tests green
+```
+
+Repeat. Each cycle should be 5-15 minutes.
+
+## Rules
+
+1. Write the test first. Before any implementation code, write a test that describes what the code should do.
+2. Watch it fail. Run the test and confirm it fails for the right reason.
+3. Make it pass. Write the simplest code that makes the test pass. No extra features.
+4. Refactor. Clean up the code while keeping all tests green.
+5. Commit. One commit per green-refactor cycle.
+
+## RED Phase
+
+What to test: expected output for given input, edge cases (empty, null, boundary values), error conditions, side effects (database writes, API calls, file operations).
+
+Test structure:
+
+```typescript
+// Use AAA pattern: Arrange, Act, Assert
+describe('calculateDiscount', () => {
+  it('applies percentage discount to subtotal', () => {
+    // Arrange
+    const subtotal = 100
+    const discount = 0.15
+
+    // Act
+    const result = calculateDiscount(subtotal, discount)
+
+    // Assert
+    expect(result).toBe(85)
+  })
+
+  it('throws when discount is negative', () => {
+    expect(() => calculateDiscount(100, -0.1)).toThrow('Discount cannot be negative')
+  })
+})
+```
+
+Test naming convention:
+
+```
+it('should [expected behavior] when [condition]')
+```
+
+Examples:
+- `it('should return empty array when no items match filter')`
+- `it('should throw NotFoundError when user does not exist')`
+- `it('should retry 3 times when database connection fails')`
+
+## GREEN Phase
+
+Rules:
+- Write only enough code to make the test pass.
+- No premature optimization.
+- No extra features (even if you know you'll need them).
+- Hardcoded values are fine if they pass the test.
+
+When stuck, if the test is too complex to implement in one step: skip with `it.skip` or `xit`, write a simpler test first, come back to the complex test after simpler ones pass.
+
+## REFACTOR Phase
+
+Check before refactoring:
+- [ ] All tests pass
+- [ ] No new tests needed for this cycle
+- [ ] Code duplication exists to eliminate
+- [ ] Function/method too long (> 30 lines)
+- [ ] Magic numbers or strings to extract
+- [ ] Naming unclear
+
+Refactoring patterns:
+
+| Pattern | When to Use |
+|---------|-------------|
+| Extract Function | Function does too many things |
+| Extract Variable | Complex expression repeated |
+| Rename | Name doesn't reveal intent |
+| Move Function | Function belongs elsewhere |
+| Replace Temp with Query | Local variable can be a function |
+
+Refactoring rules: one refactoring at a time, run tests after each change, if tests fail revert immediately.
+
+## Evidence Capture
+
+After each TDD cycle, capture evidence:
+
+```markdown
+## TDD Evidence: calculateDiscount
+
+### RED
+- Test: `should apply percentage discount to subtotal`
+- File: `lib/pricing.test.ts:15`
+- Status: FAIL (function not implemented)
+
+### GREEN
+- Implementation: `lib/pricing.ts:8`
+- Code: `return subtotal * (1 - discount)`
+- Status: PASS
+
+### REFACTOR
+- Extract: `validateDiscountRange(discount)` function
+- File: `lib/pricing.ts:12`
+- Status: PASS (all 14 tests)
+```
+
+## Git Checkpoints
+
+Commit at each phase transition:
+
+```bash
+# After RED (test written, failing)
+git add -A && git commit -m "test(pricing): add test for calculateDiscount"
+
+# After GREEN (test passing)
+git add -A && git commit -m "feat(pricing): implement calculateDiscount"
+
+# After REFACTOR (code cleaned)
+git add -A && git commit -m "refactor(pricing): extract validateDiscountRange"
+```
+
+## Mutation Testing
+
+Verify your tests catch real bugs:
+
+```bash
+# Install Stryker
+bun add -d @stryker-mutator/core @stryker-mutator/vitest-runner
+
+# Run mutation testing
+npx stryker run
+
+# Good mutation score: > 80%
+# Each surviving mutant = a test gap
+```
+
+What mutation testing does: introduces small changes (mutations) to your code, runs your tests against each mutation, if tests still pass = surviving mutant = test gap, if tests fail = killed mutant = good test coverage.
+
+## Anti-Patterns
+
+| Anti-Pattern | Problem | Fix |
+|--------------|---------|-----|
+| Writing tests after code | Tests confirm existing behavior, not desired behavior | Write tests first |
+| Testing implementation details | Tests break when refactoring | Test behavior, not implementation |
+| Giant test functions | Hard to identify what failed | One assertion per concept |
+| Skipping RED phase | No verification that test works | Always watch it fail first |
+| Testing everything at once | Hard to isolate failures | One behavior per test |
+| No git commits between phases | Can't revert to known-good state | Commit at each transition |
+
+## Quick Commands
+
+```bash
+bun test --watch
+bun test calculateDiscount.test.ts
+bun test --coverage
+npx stryker run
+```
+
+## Related Skills
+
+- `devops/testing` for test patterns and infrastructure
+- `engineering/verification-loop` for pre-PR quality gates
+- `engineering/code-review` for review test quality

package/skills/engineering/verification-loop/SKILL.md

@@ -0,0 +1,199 @@
+---
+name: verification-loop
+category: engineering
+source: ECC (adapted)
+description: "6-phase verification system: Build, Type Check, Lint, Test, Security, Review. Load before PRs or after major changes."
+
+# Verification Loop
+
+When to use: before creating PRs, after major changes, before releases, when setting up CI pipelines.
+
+## The 6 Phases
+
+```
+1. Build          -> Does it compile?
+2. Type Check     -> Are types correct?
+3. Lint           -> Does it follow conventions?
+4. Test Suite     -> Do tests pass with adequate coverage?
+5. Security Scan  -> Are there vulnerabilities?
+6. Diff Review    -> Is the change scoped and intentional?
+```
+
+Each phase must PASS before proceeding. Any FAIL stops the loop.
+
+## Phase 1: Build
+
+```bash
+bun run build
+```
+
+What it catches: syntax errors, missing imports, circular dependencies, configuration issues.
+
+Pass criteria: exit code 0, no errors in output, all packages build successfully.
+
+## Phase 2: Type Check
+
+```bash
+bun run check-types  # or tsc --noEmit
+```
+
+What it catches: type mismatches, missing type annotations, invalid generic usage, null/undefined errors.
+
+Pass criteria: exit code 0, no type errors, strict mode enabled.
+
+## Phase 3: Lint
+
+```bash
+bun run lint  # or eslint .
+```
+
+What it catches: code style violations, unused variables/imports, forbidden patterns (any, console.log in prod), complexity issues.
+
+Pass criteria: exit code 0, no warnings (warnings = errors), all custom rules pass.
+
+## Phase 4: Test Suite
+
+```bash
+bun test --coverage
+```
+
+What it catches: regression bugs, missing edge cases, broken contracts, performance regressions.
+
+Pass criteria: all tests pass, coverage thresholds met (lines >= 80%, functions >= 80%, branches >= 70%, statements >= 80%), no flaky tests.
+
+## Phase 5: Security Scan
+
+```bash
+# Dependency audit
+bun audit --audit-level=high
+
+# Secret detection
+grep -r "password\|secret\|token\|key\|api_key" --include="*.ts" --include="*.js" --include="*.env*"
+
+# Input validation check
+grep -r "req\.body\|req\.query\|req\.params" --include="*.ts" | grep -v "validate\|sanitize\|parse"
+```
+
+What it catches: known vulnerabilities in dependencies, hardcoded secrets, missing input validation, dangerous patterns (eval, exec, innerHTML).
+
+Pass criteria: no high/critical vulnerabilities, no hardcoded secrets, all user input validated.
+
+## Phase 6: Diff Review
+
+```bash
+# Review changes
+git diff main...HEAD --stat
+
+# Check for large files
+git diff main...HEAD | grep "^+" | wc -l
+
+# Check for sensitive files
+git diff main...HEAD --name-only | grep -E "\.env|secret|password|key"
+```
+
+What it catches: out-of-scope changes, large PRs that should be split, sensitive file modifications, missing documentation updates.
+
+Pass criteria: changes match PR description, PR size < 400 lines (ideal), no sensitive files modified, documentation updated if needed.
+
+## Verification Report
+
+After running all phases, generate a report:
+
+```markdown
+## Verification Report
+
+Date: 2026-08-13
+Branch: feat/add-user-auth
+Commit: abc1234
+
+### Results
+
+| Phase | Status | Duration |
+|-------|--------|----------|
+| Build | PASS | 12s |
+| Type Check | PASS | 8s |
+| Lint | PASS | 5s |
+| Test Suite | PASS | 45s |
+| Security Scan | PASS | 3s |
+| Diff Review | PASS | 2s |
+
+### Overall: READY TO MERGE
+
+### Coverage Summary
+- Lines: 84% (threshold: 80%)
+- Functions: 87% (threshold: 80%)
+- Branches: 72% (threshold: 70%)
+- Statements: 85% (threshold: 80%)
+
+### Notes
+- All phases passed
+- No security issues found
+- PR size: 127 lines (ideal)
+```
+
+## Automation
+
+GitHub Actions integration:
+
+```yaml
+# .github/workflows/verify.yml
+name: Verification Loop
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v1
+      - run: bun install --frozen-lockfile
+
+      - name: Phase 1 - Build
+        run: bun run build
+
+      - name: Phase 2 - Type Check
+        run: bun run check-types
+
+      - name: Phase 3 - Lint
+        run: bun run lint
+
+      - name: Phase 4 - Test Suite
+        run: bun test --coverage
+
+      - name: Phase 5 - Security Scan
+        run: bun audit --audit-level=high
+
+      - name: Phase 6 - Diff Review
+        run: |
+          LINES=$(git diff main...HEAD --numstat | awk '{added+=$1} END {print added}')
+          if [ "$LINES" -gt 800 ]; then
+            echo "PR too large: $LINES lines added"
+            exit 1
+          fi
+```
+
+## Quick Commands
+
+```bash
+# Run full verification loop
+bun run build && bun run check-types && bun run lint && bun test --coverage && bun audit --audit-level=high
+
+# Run specific phase
+bun run build
+bun run check-types
+bun run lint
+bun test --coverage
+bun audit --audit-level=high
+
+# Generate coverage report
+bun test --coverage --reporter=json
+```
+
+## Related Skills
+
+- `engineering/tdd-workflow` for test-first development
+- `engineering/code-review` for review process
+- `devops/git-ci` for CI/CD pipeline setup