@rune-kit/rune 2.20.0 → 2.21.0

package/skills/test/SKILL.md

@@ -3,7 +3,7 @@ name: test
 description: "TDD test writer. Writes failing tests FIRST (red), then verifies they pass after implementation (green). Covers unit, integration, and e2e tests."
 metadata:
   author: runedev
-  version: "1.3.0"
+  version: "1.4.0"
   layer: L2
   model: sonnet
   group: development
@@ -414,23 +414,29 @@ assert(result.output.includes(oracle), "Oracle not found — pipeline lost data"
 
 ## Spec→Test Traceability
 
-When a plan with acceptance criteria exists (`.rune/features/<name>/plan.md` or phase file), every criterion MUST map to at least one test case.
+When a spec or plan with acceptance criteria exists (`.rune/features/<name>/requirements.md`, `plan.md`, or phase file), every criterion MUST map to at least one test case.
 
 ```
-Plan Acceptance Criteria → Test Case → Implementation
+Spec Acceptance Criteria → Test Case → Implementation
 
-AC-1: "User can reset password via email" → test_password_reset_sends_email()
-AC-2: "Rate limit: max 3 reset attempts/hour" → test_password_reset_rate_limit()
-AC-3: "Expired tokens rejected" → test_expired_reset_token_rejected()
+US-1/AC-1.1: "User can reset password via email" → test_password_reset_sends_email()
+US-1/AC-1.2: "Rate limit: max 3 reset attempts/hour" → test_password_reset_rate_limit()
+FR-3: "Expired tokens rejected" → test_expired_reset_token_rejected()
 ```
 
-**Validation step** (after writing tests): Cross-check plan's acceptance criteria against test names. For each criterion:
+**Validation step** (after writing tests): Cross-check acceptance criteria against test names. For each criterion:
 - Has test → OK
 - No test → flag as UNTESTED REQUIREMENT (more serious than uncovered lines)
 
+**Cross-boundary minimum**: every user story whose path crosses the UI↔data boundary (story has both a UI task and an endpoint/data task) needs **≥1 L2 integration test** exercising handler → service/endpoint with the REAL route wired (contract-level is fine; mocking the ENTIRE chain does not count). A story covered only by unit tests with the handler mocked = the story is NOT covered — that's how dead buttons reach 80% coverage.
+
+**Contract tests first**: when plan emitted `.rune/features/<name>/contracts/`, each contract gets a failing contract test (request/response shape, error cases) BEFORE the endpoint is implemented — the RED phase for the API surface.
+
 **Why this is stronger than coverage**: Coverage checks that lines were EXECUTED. Traceability checks that INTENT was VERIFIED. You can have 100% coverage but miss a requirement if the test doesn't assert the right behavior.
 
-**Skip if**: No plan exists (ad-hoc fix), or plan has no acceptance criteria section.
+**Skip if**: No spec AND no plan exists (ad-hoc fix), or neither has an acceptance criteria section. A requirements.md with US/AC IDs makes this section MANDATORY — "no plan file" alone is not a skip reason.
+
+**Browser click-through (advisory)**: when a UI story completes, SUGGEST a `browser-pilot` run of the story's Independent Test (from requirements.md) — one real click-path beats ten mocked renders. Advisory, not a gate: skip freely in headless/CI-only environments.
 
 ## Eval-Driven Development
 
@@ -571,6 +577,7 @@ Examples of test slop:
 - "route responds with 200" without checking response body (tests Express, not your handler)
 - Asserting a mock was called N times without checking the RESULT of those calls
 - Type existence tests (`typeof result === 'object'`) when you should test the actual value
+- Component renders + handler fully mocked, presented as story coverage — the click path was never exercised; the story's dead button ships with "green" tests
 
 **Red flags — any of these means STOP and rethink:**
 - Mock setup longer than test logic

package/skills/verification/SKILL.md

@@ -3,13 +3,13 @@ name: verification
 description: "Universal verification runner. Runs lint, type-check, tests, and build. Use after any code change to verify nothing is broken."
 metadata:
   author: runedev
-  version: "0.5.0"
+  version: "0.6.0"
   layer: L3
   model: haiku
   group: validation
   tools: "Read, Bash, Glob, Grep"
   listen: code.changed
-  emit: verification.complete
+  emit: verification.complete, integration.verified
 ---
 
 # verification
@@ -120,6 +120,9 @@ Glob("path/to/expected/file") → found
 | `useEffect` with empty body / `async function` with no `await` | React/JS | Hollow implementation |
 | File has only type/interface exports but no implementation | TypeScript | Stub types-only file |
 | `// TODO` or `# TODO` as the only content in a function | Any | Placeholder |
+| `onClick={() => {}}` / handler bound to an empty or `console.log`-only function | React/Vue/Svelte | Dead handler — wired to nothing |
+| `href="#"` on an action link (not navigation) | HTML/JSX | Dead action link |
+| Submit handler whose body is only `event.preventDefault()` | Any UI | Form that swallows input |
 
 If ANY stub pattern detected → mark file as STUB, Level 2 FAIL.
 
@@ -138,10 +141,29 @@ If file has 0 consumers → mark as UNWIRED, Level 3 FAIL.
 
 **Exception**: Entry-point files (main.ts, index.ts, App.tsx, routes config) are exempt from Level 3 — they ARE the top-level consumers.
 
+**Level 3.5 — INTERACTION WIRED** (UI files in this task's diff only — `.tsx/.jsx/.vue/.svelte/.html`):
+
+Level 3 proves the component is *rendered*; Level 3.5 proves its interactive elements *do something*. For each UI file created or modified in this task:
+
+1. `Grep` interactive elements in the file — framework-aware patterns: `<button`, `<form`, `type="submit"`, `action=`, plus binding syntax per framework: React `onClick=`/`onSubmit=`, Svelte `on:click=`/`on:submit=`, Vue `@click`/`@submit`/`v-on:`, plain HTML `addEventListener`
+2. For each element, trace INWARD:
+   - **Handler bound?** Interactive element with NO binding in any framework syntax above and no enclosing form handler → `UNWIRED-INTERACTIVE`. **Prop-origin handlers PASS**: `onClick={props.onSave}`, `on:click={dispatch('save')}`, or a callback-library pattern (`onSubmit={handleSubmit(onSubmit)}` — react-hook-form et al.) count as bound; wiring the prop is the parent's/caller's responsibility, checked at the parent's own 3.5 pass
+   - **Handler resolves?** The bound symbol is locally defined OR imported (imported = resolves; do not demand the import's body) and its body is non-trivial (not caught by the Level 2 dead-handler patterns)
+   - **Target exists?** If the handler calls `fetch`/`axios`/a service function → the route path or service symbol EXISTS somewhere in the codebase (`Grep` the path/symbol). Handler → nonexistent target = `UNWIRED-INTERACTIVE`. Pure-navigation handlers (`router.push`, `navigate(...)`, framework `<Link>`) PASS — navigation is their target
+3. **Reverse check**: every API route file created in this task has ≥1 caller (`Grep` the route path across UI/service files). Route with 0 callers → `UNCALLED-ROUTE`
+4. Pure-display elements (no user expectation of action: decorative buttons in mockups explicitly listed in `.rune/ui-spec.md` `## Unwired Elements`) are reported as INFO, not failures — they are design's declared debt, tracked by `converge`
+5. **De-dup**: if preflight already flagged the same element as dead-interactive in this session, cite the cross-reference ("preflight Step 4.5 already flagged") instead of emitting a duplicate finding
+
+**Scope guard**: Level 3.5 runs ONLY on files in this task's diff. Pre-existing files with dead interactive elements → WARN (legacy debt, don't punish), never FAIL.
+
+**Signal**: when the diff touches both UI and api/service/data files AND every Level 3.5 check passes, emit `integration.verified` with `{files_checked, interactions_traced}`. Downstream `deploy` uses this as its cross-layer wiring evidence.
+
 <HARD-GATE name="3-level-verification">
 ALL new files must pass Level 1 + Level 2 + Level 3.
+UI files in this task's diff must ALSO pass Level 3.5.
 EXISTS but STUB = "Existence Theater" — agent created files but didn't implement them.
 EXISTS and SUBSTANTIVE but UNWIRED = dead code — created but never connected.
+SUBSTANTIVE and WIRED but UNWIRED-INTERACTIVE = dead button — renders, does nothing. Same failure tier as UNWIRED.
 Report which level failed for each file in the Verification Report.
 </HARD-GATE>
 
@@ -224,11 +246,12 @@ Tests:     [PASS/FAIL/SKIP] ([passed]/[total], [coverage]%)
 Build:     [PASS/FAIL/SKIP]
 
 ### 3-Level File Verification
-| File | L1 Exists | L2 Substantive | L3 Wired | Verdict |
-|------|-----------|----------------|----------|---------|
-| src/auth/login.ts | ✓ | ✓ | ✓ (imported by routes.ts) | PASS |
-| src/auth/reset.ts | ✓ | STUB (returns null) | — | FAIL L2 |
-| src/utils/format.ts | ✓ | ✓ | UNWIRED (0 importers) | FAIL L3 |
+| File | L1 Exists | L2 Substantive | L3 Wired | L3.5 Interaction | Verdict |
+|------|-----------|----------------|----------|------------------|---------|
+| src/auth/login.ts | ✓ | ✓ | ✓ (imported by routes.ts) | ✓ (submit → POST /api/login, route exists) | PASS |
+| src/auth/reset.ts | ✓ | STUB (returns null) | — | — | FAIL L2 |
+| src/utils/format.ts | ✓ | ✓ | UNWIRED (0 importers) | n/a (not UI) | FAIL L3 |
+| src/ui/OrderForm.tsx | ✓ | ✓ | ✓ (rendered by OrdersPage) | UNWIRED-INTERACTIVE (Save → fetch '/api/orders', route absent) | FAIL L3.5 |
 
 Overall:   [PASS/FAIL]
 
@@ -239,6 +262,8 @@ Overall:   [PASS/FAIL]
 - Build: [first 5 build errors]
 - Stubs: [files that failed Level 2 with stub pattern detected]
 - Unwired: [files that failed Level 3 with 0 consumers]
+- Dead interactions: [elements that failed Level 3.5 with the broken link named (no handler / dead handler / missing target)] 
+- Uncalled routes: [route files created this task with 0 callers]
 ```
 
 ## Output Completion Enforcement
@@ -303,6 +328,7 @@ When any skill calls verification and then reports results upstream:
 4. MUST NOT skip checks because "changes are small"
 5. MUST include stdout/stderr capture in every check result — empty output noted explicitly
 6. MUST mark Overall as INCOMPLETE if any check was skipped without valid reason (tool not installed = valid, "changes are small" = invalid)
+7. MUST run the 3-Level Artifact Verification on every file created/modified this task, AND Level 3.5 INTERACTION WIRED on every UI file (`.tsx/.jsx/.vue/.svelte/.html`) in the diff — skip 3.5 only when the diff contains no UI files (note "L3.5: n/a — no UI files")
 
 ## Sharp Edges
 
@@ -319,6 +345,10 @@ Known failure modes for this skill. Check these before declaring done.
 | Trusting exit code 0 without output verification | CRITICAL | Artifact Verification HARD-GATE: always confirm success indicator in stdout (pass count, "0 errors", output file exists) |
 | Existence Theater — file exists but is a stub | HIGH | 3-Level check: Level 2 scans for stub patterns (`<div>Placeholder</div>`, `return null`, `NotImplementedError`) |
 | Dead code — file created but never imported/used | MEDIUM | 3-Level check: Level 3 greps for consumers. 0 importers = UNWIRED |
+| Dead button — component rendered, interactive element wired to nothing | CRITICAL | Level 3.5: trace element → handler → target for every UI file in the diff. Rendering ≠ working |
+| Punishing legacy files for pre-existing dead interactions | MEDIUM | Level 3.5 scope guard: FAIL only for this task's diff; pre-existing = WARN |
+| Route created this task with zero callers passes silently | HIGH | Level 3.5 reverse check: new route files need ≥1 caller or FAIL |
+| `integration.verified` read as "quickstart validated" | LOW | Standalone verification runs do NOT execute quickstart.md (that's cook Phase 6's job) — the signal proves static wiring, not a live end-to-end run |
 | Truncated code — agent hit output limit mid-file | HIGH | Output Completion Enforcement: scan for `// ...`, `// rest of code`, bare ellipsis patterns. TRUNCATED = Level 2 FAIL |
 
 ## Done When
@@ -327,6 +357,8 @@ Known failure modes for this skill. Check these before declaring done.
 - lint, type-check, tests, and build all executed (or SKIP with reason if tool missing)
 - Each check shows actual command output
 - Failures include specific file:line references (not just counts)
+- 3-Level check run on all created/modified files; Level 3.5 INTERACTION WIRED run on all UI files in the diff (or "n/a — no UI files" noted)
+- `integration.verified` emitted when the diff spans UI+data and all 3.5 checks pass
 - Verification Report emitted with Overall PASS/FAIL verdict
 
 ## Cost Profile