exonous 0.0.0-stage → 2.10.4

package/assets/techne/skills/dotnet/reference/dotnet-core.md

@@ -0,0 +1,131 @@
+# .NET / C# core
+
+## Immutability and nullability
+
+```csharp
+public sealed record Money(decimal Amount, string Currency);
+
+public sealed class CreateOrderRequest
+{
+    public required string CustomerId { get; init; }
+    public required IReadOnlyList<OrderLine> Lines { get; init; }
+}
+```
+
+Enable nullable reference types; express optional returns as `T?` or `Result<T>`.
+
+## Dependency injection
+
+```csharp
+public interface IOrderRepository
+{
+    Task<Order?> FindByIdAsync(Guid id, CancellationToken cancellationToken);
+    Task AddAsync(Order order, CancellationToken cancellationToken);
+}
+
+builder.Services.AddScoped<IOrderRepository, SqlOrderRepository>();
+builder.Services.AddScoped<IOrderService, OrderService>();
+```
+
+Primary constructors (C# 12+) are fine when all dependencies are injected interfaces.
+
+## Async
+
+```csharp
+public async Task<OrderSummary> BuildSummaryAsync(Guid id, CancellationToken cancellationToken)
+{
+    var order = await _orders.FindByIdAsync(id, cancellationToken)
+        ?? throw new NotFoundException(id);
+
+    var buyer = await _customers.GetAsync(order.CustomerId, cancellationToken);
+    return OrderSummary.From(order, buyer);
+}
+```
+
+Parallel independent IO:
+
+```csharp
+await Task.WhenAll(fetchOrders, fetchMetrics);
+```
+
+Never block on `Task` in ASP.NET request threads.
+
+## Options
+
+```csharp
+public sealed class EmailOptions
+{
+    public const string SectionName = "Email";
+    public required string Host { get; init; }
+    public int Port { get; init; } = 587;
+}
+
+builder.Services.Configure<EmailOptions>(
+    builder.Configuration.GetSection(EmailOptions.SectionName));
+```
+
+Inject `IOptions<EmailOptions>` or `IOptionsMonitor<EmailOptions>` for reload-safe settings.
+
+## Result instead of exceptions (expected failures)
+
+```csharp
+public readonly record struct Result<T>(bool Ok, T? Value, string? Error)
+{
+    public static Result<T> Success(T value) => new(true, value, null);
+    public static Result<T> Fail(string message) => new(false, default, message);
+}
+```
+
+Use for validation/business rejections; reserve exceptions for truly exceptional faults.
+
+## EF Core repository sketch
+
+```csharp
+public async Task<Order?> FindByIdAsync(Guid id, CancellationToken cancellationToken)
+{
+    return await _db.Orders
+        .Include(o => o.Lines)
+        .AsNoTracking()
+        .FirstOrDefaultAsync(o => o.Id == id, cancellationToken);
+}
+```
+
+Track entities only inside command handlers that mutate state.
+
+## Middleware
+
+Register custom middleware with `app.UseMiddleware<RequestTimingMiddleware>()`; log elapsed ms and status code; avoid swallowing exceptions.
+
+## Minimal APIs
+
+```csharp
+var orders = app.MapGroup("/api/orders").RequireAuthorization().WithTags("Orders");
+
+orders.MapGet("/{id:guid}", async (Guid id, IOrderRepository repo, CancellationToken ct) =>
+{
+    var order = await repo.FindByIdAsync(id, ct);
+    return order is null ? Results.NotFound() : Results.Ok(order);
+});
+```
+
+Use `TypedResults` for OpenAPI metadata; validate bodies with `[AsParameters]` or explicit records + `Results.ValidationProblem`.
+
+## Guard clauses
+
+Validate arguments first (`ThrowIfNull`, range checks) so happy path stays flat.
+
+## Anti-patterns
+
+| Issue | Remedy |
+|-------|--------|
+| `async void` (non-events) | return `Task` |
+| `.Result` / `.Wait()` | `await` |
+| empty `catch` | log + throw or map to problem detail |
+| `new SqlConnection` in controller | injected factory/repository |
+| `dynamic` in domain | strong types/generics |
+| mutable static fields | scoped/singleton services |
+
+## Tooling
+
+- `dotnet format` in CI; analyzers (nullable, CA rules) as errors where team agrees.
+- Integration tests: `WebApplicationFactory` with test containers or SQLite provider per **techne:databases** guidance.

package/assets/techne/skills/flutter/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: flutter
+description: Flutter and Dart application engineering — null-safe idioms, immutable state (sealed/freezed), widget architecture, BLoC/Riverpod/Provider patterns, GoRouter guards, Dio networking, errors, testing, and review checklists. Use when implementing or reviewing Flutter features, navigation, async UI, or Dart architecture.
+---
+
+Dart and Flutter patterns for production apps: data flow, widgets, routing, HTTP, and quality gates. Platform chrome, adaptive UI, and native feel → **native-ui**; deep accessibility audits → **ui-design** (`audit`, `harden`).
+
+## Non-negotiable rules
+
+1. **Null-safe idioms** — Avoid `!`; use `?.`, `??`, early returns, and Dart 3 patterns; reserve `late` for guaranteed init (e.g. `AnimationController` in `initState`).
+2. **Explicit async state** — Sealed hierarchies or `freezed` unions for loading/success/failure; no overlapping `isLoading` + `hasError` booleans.
+3. **Widget classes, not builders** — Extract `_buildX()` helpers into `StatelessWidget`/`ConsumerWidget` subclasses; push `const` through the tree.
+4. **Narrow rebuilds** — Watch providers/blocs only in the smallest subtree; keep static chrome `const`.
+5. **Context safety** — After every `await` in widgets, guard with `mounted` / `context.mounted` before navigation, snackbars, or `setState`.
+6. **Layer separation** — Widgets render; state containers (Cubit, Notifier, etc.) orchestrate; repositories talk to APIs/DB — inject dependencies, no god objects.
+7. **Routing** — One declarative router (typically GoRouter); auth redirects and deep links centralized; typed route args, not raw maps.
+8. **HTTP** — Timeouts on the client; auth header interceptor; at most **one** token-refresh retry per request (flag in `extra`).
+9. **Lists** — `ListView.builder` / `GridView.builder` (or pagination) for large datasets; no unbounded `children:` lists.
+10. **Theming** — Colors and text from `Theme.of(context)`; no scattered magic hex in widgets.
+11. **Analysis** — Root `analysis_options.yaml` with strict casts/inference/raw-types; `flutter analyze` clean in CI.
+12. **Secrets** — Tokens in platform secure storage; config via `--dart-define` or env excluded from VCS; never log credentials.
+13. **Review routing** — Systematic review → **exo-qa** / code-review skill; security pass → **exo-security**; library APIs → **biblos** MCP.
+
+## References
+
+| File | Load when |
+|------|-----------|
+| [reference/patterns.md](reference/patterns.md) | Writing features — state, widgets, GoRouter, Dio, errors, tests |
+| [reference/code-review.md](reference/code-review.md) | Reviewing a PR or auditing project health across Dart/Flutter layers |

package/assets/techne/skills/flutter/reference/code-review.md

@@ -0,0 +1,76 @@
+# Flutter / Dart review checklist
+
+Library-agnostic gates for PR review. Adapt rows to the project’s state library (BLoC, Riverpod, Provider, signals, etc.).
+
+## Project and Dart hygiene
+
+- Feature-first or layer-first layout; UI free of business rules.
+- `analysis_options.yaml`: strict casts/inference/raw-types; shared in monorepos.
+- No `print` in production — structured logging.
+- Generated `*.g.dart` / `*.freezed.dart` committed or gitignored consistently.
+- `package:` imports; `final`/`const` by default; typed catches (`on SpecificException`).
+- No ignored futures without `unawaited`; no broad `catch (e)` without rethrow policy.
+
+## Widgets
+
+- `build` under ~100 lines; hot paths split into widget classes.
+- `const` constructors and literals where fields are final.
+- Keys: `ValueKey`/`ObjectKey` in reorderable lists; never `UniqueKey()` inside `build`.
+- Theme-driven color/text; responsive overflow handled (`Flexible`, `FittedBox`).
+- No network/IO/list sorting inside `build`; subscriptions not created per frame.
+
+## State management
+
+- Dependencies injected into cubits/notifiers/controllers — not constructed internally.
+- Immutable snapshots (`copyWith`, freezed, records) for BLoC/Riverpod-style flows.
+- Reactive stores mutate only through their API (`@action`, signal setters, etc.).
+- Async flows expose distinct loading/success/error variants; UI handles all branches.
+- Consumers scoped narrowly; selectors/`buildWhen`/`select` to limit rebuilds.
+- Streams/`listen` canceled in `dispose`/`close`; timers cleared.
+- Ephemeral UI stays local; shared state lifted minimally.
+
+## Performance
+
+- Builder constructors for long lists; pagination when datasets grow.
+- Images: cache + decode size (`cacheWidth`/`cacheHeight`); placeholders on failure.
+- `RepaintBoundary` around independently animating subtrees.
+- Avoid `Opacity` in animations — prefer fade transitions.
+
+## Navigation
+
+- Single routing approach; typed parameters; guards not copy-pasted per screen.
+- Deep links validated before navigation; back behavior verified on Android/iOS.
+
+## Security and data
+
+- Secrets off-device or in secure storage; API keys via compile-time env, not source.
+- HTTPS only; sanitize deep links; validate forms before API calls.
+- No sensitive values in logs.
+
+## Testing and CI
+
+- Unit coverage on domain/state; widget tests for interactions; integration for critical flows.
+- State transition tests include error/retry paths.
+- `flutter analyze` and tests block merge.
+
+## Accessibility and i18n (spot-check)
+
+- Semantic labels on custom controls; 48×48 minimum taps; contrast ≥ 4.5:1 for body text.
+- User strings through l10n; locale-aware dates/numbers.
+- Full visual/a11y pass → **ui-design**; platform-native patterns → **native-ui**.
+
+## Dependencies
+
+- Prefer maintained pub packages (pub points, recent releases, verified publisher).
+- Caret constraints unless pin required; avoid production `dependency_overrides` without ticket.
+- Monorepo: no `src/` imports across packages; workspace resolution for internals.
+
+## State library cheat sheet
+
+| Concern | BLoC | Riverpod | Provider |
+|---------|------|----------|----------|
+| Container | Cubit/Bloc | Notifier | ChangeNotifier |
+| UI hook | BlocBuilder | ConsumerWidget | Consumer |
+| Narrow rebuild | BlocSelector | `.select` | Selector |
+| Side effect | BlocListener | `ref.listen` | listener callback |
+| Test | `blocTest` | `ProviderContainer` | direct instance |

package/assets/techne/skills/flutter/reference/patterns.md

@@ -0,0 +1,201 @@
+# Flutter implementation patterns
+
+## Null safety and records
+
+```dart
+String label(Account? account) => switch (account) {
+  Account(:final name, :final email) => '$name <$email>',
+  null => 'Guest',
+};
+
+Future<SummaryBundle> loadSummary(UserRepo users, OrderRepo orders) async {
+  final (people, purchases) = await (users.all(), orders.recent()).wait;
+  return SummaryBundle(users: people, orders: purchases);
+}
+```
+
+## Immutable state
+
+```dart
+sealed class LoadState<T> {}
+final class Idle<T> extends LoadState<T> {}
+final class Pending<T> extends LoadState<T> {}
+final class Ready<T> extends LoadState<T> { const Ready(this.value); final T value; }
+final class Failed<T> extends LoadState<T> { const Failed(this.reason); final Object reason; }
+
+Widget body(LoadState<User> state) => switch (state) {
+  Idle() => const SizedBox.shrink(),
+  Pending() => const CircularProgressIndicator(),
+  Ready(:final value) => ProfileCard(user: value),
+  Failed(:final reason) => ErrorBanner(reason.toString()),
+};
+```
+
+`freezed` + json_serializable when you need `copyWith`/serialization without boilerplate.
+
+## Widget architecture
+
+Isolate reactive subtrees:
+
+```dart
+class DashboardPage extends StatelessWidget {
+  const DashboardPage({super.key});
+  @override
+  Widget build(BuildContext context) {
+    return const Scaffold(
+      body: Column(children: [
+        StaticHeader(),
+        _LiveCounter(),
+        StaticFooter(),
+      ]),
+    );
+  }
+}
+
+class _LiveCounter extends ConsumerWidget {
+  const _LiveCounter();
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final n = ref.watch(counterProvider);
+    return Text('$n');
+  }
+}
+```
+
+## BLoC sketch
+
+```dart
+class SignInCubit extends Cubit<SignInState> {
+  SignInCubit(this._auth) : super(const SignInState.idle());
+  final AuthGateway _auth;
+
+  Future<void> submit(String email, String password) async {
+    emit(const SignInState.busy());
+    try {
+      final profile = await _auth.signIn(email, password);
+      emit(SignInState.done(profile));
+    } on AuthFailure catch (err) {
+      emit(SignInState.problem(err.message));
+    }
+  }
+}
+```
+
+## Riverpod sketch
+
+```dart
+@riverpod
+Future<List<CatalogItem>> catalog(CatalogRef ref) async {
+  return ref.watch(catalogGatewayProvider).fetch();
+}
+
+@riverpod
+class Basket extends _$Basket {
+  @override
+  List<BasketLine> build() => [];
+
+  void increment(CatalogItem item) {
+    final hit = state.where((l) => l.sku == item.id).firstOrNull;
+    state = hit == null
+        ? [...state, BasketLine(sku: item.id, qty: 1)]
+        : [for (final l in state) if (l.sku == item.id) l.copyWith(qty: l.qty + 1) else l];
+  }
+}
+```
+
+Derive totals with a separate provider; use `firstWhereOrNull` when joining optional catalogs.
+
+## GoRouter + auth
+
+```dart
+final appRouter = GoRouter(
+  refreshListenable: GoRouterRefreshStream(signInCubit.stream),
+  redirect: (ctx, loc) {
+    final signedIn = ctx.read<SignInCubit>().state is SignInDone;
+    final onLogin = loc.matchedLocation == '/login';
+    if (!signedIn && !onLogin) return '/login';
+    if (signedIn && onLogin) return '/';
+    return null;
+  },
+  routes: [
+    GoRoute(path: '/login', builder: (_, __) => const LoginScreen()),
+    ShellRoute(
+      builder: (_, __, child) => AppScaffold(child: child),
+      routes: [
+        GoRoute(path: '/', builder: (_, __) => const HomeScreen()),
+        GoRoute(
+          path: '/item/:sku',
+          builder: (ctx, state) => ItemScreen(sku: state.pathParameters['sku']!),
+        ),
+      ],
+    ),
+  ],
+);
+```
+
+## Dio client
+
+```dart
+final client = Dio(BaseOptions(
+  baseUrl: const String.fromEnvironment('API_BASE'),
+  connectTimeout: const Duration(seconds: 10),
+  receiveTimeout: const Duration(seconds: 30),
+));
+
+client.interceptors.add(InterceptorsWrapper(
+  onRequest: (opts, next) async {
+    final token = await vault.read('access');
+    if (token != null) opts.headers['Authorization'] = 'Bearer $token';
+    next.next(opts);
+  },
+  onError: (err, next) async {
+    final retried = err.requestOptions.extra['_retried'] == true;
+    if (!retried && err.response?.statusCode == 401 && await refreshTokens()) {
+      err.requestOptions.extra['_retried'] = true;
+      return next.resolve(await client.fetch(err.requestOptions));
+    }
+    next.next(err);
+  },
+));
+```
+
+## Errors in `main`
+
+```dart
+void main() {
+  FlutterError.onError = (details) {
+    FlutterError.presentError(details);
+    reporter.recordFlutterFatalError(details);
+  };
+  PlatformDispatcher.instance.onError = (error, stack) {
+    reporter.recordError(error, stack, fatal: true);
+    return true;
+  };
+  runApp(const RootApp());
+}
+```
+
+Set `ErrorWidget.builder` in release for user-safe fallbacks.
+
+## Testing snippets
+
+```dart
+blocTest<SignInCubit, SignInState>(
+  'busy then problem on bad password',
+  build: () => SignInCubit(FakeAuth(reject: true)),
+  act: (c) => c.submit('a@b.c', 'bad'),
+  expect: () => [const SignInState.busy(), isA<SignInProblem>()],
+);
+
+testWidgets('badge count', (tester) async {
+  await tester.pumpWidget(
+    ProviderScope(
+      overrides: [basketProvider.overrideWith(() => FakeBasket(qty: 2))],
+      child: const MaterialApp(home: BasketBadge()),
+    ),
+  );
+  expect(find.text('2'), findsOneWidget);
+});
+```
+
+Use fakes over heavy mocks; test state transitions, not private fields.

package/assets/techne/skills/go/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: go
+description: Idiomatic Go structure, errors, concurrency, and testing—table-driven tests, race detector, fuzzing, benchmarks. Use when writing or reviewing Go services, CLIs, packages, or `go test` / module layout.
+---
+
+Go favors boring, obvious code: explicit errors, small interfaces at call sites, and concurrency tied to `context`. Pair with **atlas** for repo layout, **biblos** for stdlib and third-party APIs, **techne:services** for HTTP/API design, **techne:quality** for broader TDD gates, and **code-review** / **exo-qa** before merge.
+
+## Non-negotiable rules
+
+1. **Readability beats cleverness** — straight-line control flow; return early on errors so the happy path stays shallow.
+2. **Every error gets a decision** — wrap with `%w` and operation context; classify with `errors.Is` / `errors.As`; never assign to `_` unless documented (e.g. best-effort close).
+3. **Take interfaces, return structs** — define narrow interfaces where they are consumed, not in provider packages.
+4. **`context.Context` first** on RPC, DB, and HTTP paths — derive timeouts; propagate cancel; shut down with `Shutdown` and a bounded wait, not abrupt `Close` on servers.
+5. **Goroutines must finish** — tie work to context or wait groups; use buffered sends or `select` on `ctx.Done()` so cancelled callers cannot leak workers.
+6. **Zero values should work** — lazy-init maps/slices inside methods; avoid mutable package-level singletons; inject `*sql.DB`, loggers, and clients via constructors.
+7. **Preallocate when size is known** — `make([]T, 0, n)`; build strings with `strings.Builder` or `strings.Join` in hot loops.
+8. **Table-driven tests** — one `TestX` with `[]struct{ name, … }` and `t.Run`; copy loop variables before `t.Parallel()` subtests.
+9. **Helpers call `t.Helper()`** — register cleanup with `t.Cleanup`; use `t.TempDir`, `httptest`, and interface fakes instead of testing unexported symbols.
+10. **CI runs `go test -race ./...`** — cover critical paths toward 100%, public packages ≥90%, rest ≥80%; fuzz parsers and decoders where inputs are untrusted.
+11. **Gate merges with vet, staticcheck, golangci-lint** — `gofmt` / `goimports` on every change; `go mod tidy` before commit.
+12. **Functional options for optional config** — keep constructors stable; one receiver style (pointer or value) per type.
+
+## References
+
+| File | Load when |
+|------|-----------|
+| [reference/patterns.md](reference/patterns.md) | Packages, errors, interfaces, concurrency, memory, tooling, anti-patterns |
+| [reference/testing.md](reference/testing.md) | TDD loop, tables, mocks, golden files, HTTP tests, bench/fuzz, coverage |

package/assets/techne/skills/go/reference/patterns.md

@@ -0,0 +1,87 @@
+# Go patterns
+
+## Layout and packages
+
+Typical service repo: `cmd/<app>/main.go`, `internal/` for private app code, `pkg/` only for libraries meant for external importers, `api/` for OpenAPI/proto, `testdata/` for fixtures. Package names: short, lowercase, no `util` dumping grounds.
+
+Inject dependencies through structs and constructors—do not open DB pools in `init()` from environment variables.
+
+## Errors
+
+Sentinel vars for stable domain cases (`ErrNotFound`). Typed errors when callers need fields. Wrap at each layer with a short verb phrase:
+
+```go
+if err != nil {
+    return nil, fmt.Errorf("load profile %q: %w", id, err)
+}
+```
+
+Prefer early return over nested `if err != nil`.
+
+## Interfaces
+
+Keep interfaces tiny (often one method). Consumer packages declare what they need:
+
+```go
+type Ledger interface {
+    Post(ctx context.Context, entry Entry) error
+}
+```
+
+Optional behavior: type assert to a secondary interface (e.g. `Flusher`) instead of widening the base API.
+
+## Concurrency
+
+**Worker pool:** fixed goroutines reading `jobs` until closed; `WaitGroup` for drain.
+
+**Fan-out:** `errgroup.WithContext` cancels siblings on first error; capture loop indices before `g.Go`.
+
+**HTTP client:** `NewRequestWithContext`, always `defer resp.Body.Close()`, set timeouts on the client or context.
+
+**Shutdown:** trap `SIGINT`/`SIGTERM`, `Shutdown` with ~30s context, then exit.
+
+Avoid sending on unbuffered channels without a receiver; prefer buffer size 1 plus cancel branch when exposing async helpers.
+
+## Struct patterns
+
+**Functional options:** `type Option func(*Server)` with defaults inside `New`, variadic `opts ...Option`.
+
+**Embedding:** compose behavior (logging, metrics) without deep inheritance trees.
+
+## Performance habits
+
+| Situation | Approach |
+|-----------|----------|
+| Known output count | Pre-sized slice |
+| Repeated temp buffers | `sync.Pool` with reset in defer |
+| String assembly in loop | `strings.Builder` |
+| Map/set membership hot path | `map[T]struct{}` |
+
+Profile before `sync.Pool`; misuse adds complexity.
+
+## Tooling
+
+```bash
+go build ./...
+go test -race -cover ./...
+go vet ./...
+staticcheck ./...
+golangci-lint run
+go mod tidy && go mod verify
+gofmt -w . && goimports -w .
+```
+
+Enable errcheck, staticcheck, govet (shadow), ineffassign in CI linter config.
+
+## Anti-patterns
+
+| Avoid | Prefer |
+|-------|--------|
+| `panic` for expected errors | Return `error` |
+| Context stored on structs | Context as first param |
+| Naked returns in long funcs | Named returns only when signature is tiny |
+| Mixed value/pointer receivers | One style per type |
+| Returning `interface{}` from domain APIs | Concrete structs |
+| Global `var db *sql.DB` | Struct field + constructor |
+
+Cross-stack HTTP and middleware conventions → **techne:services**.

package/assets/techne/skills/go/reference/testing.md

@@ -0,0 +1,142 @@
+# Go testing
+
+## TDD loop
+
+1. Sketch signature or interface.
+2. Write failing test (table row or subtest).
+3. Minimal implementation until green.
+4. Refactor with `-race` still passing.
+
+Broader red-green discipline → **techne:quality**.
+
+## Table-driven template
+
+```go
+func TestNormalizeEmail(t *testing.T) {
+    cases := []struct {
+        name string
+        in   string
+        want string
+        err  bool
+    }{
+        {"trim lower", "  A@B.com ", "a@b.com", false},
+        {"empty", "", "", true},
+    }
+    for _, tc := range cases {
+        t.Run(tc.name, func(t *testing.T) {
+            got, err := NormalizeEmail(tc.in)
+            if tc.err {
+                if err == nil {
+                    t.Fatal("expected error")
+                }
+                return
+            }
+            if err != nil {
+                t.Fatalf("unexpected: %v", err)
+            }
+            if got != tc.want {
+                t.Fatalf("got %q want %q", got, tc.want)
+            }
+        })
+    }
+}
+```
+
+Use `reflect.DeepEqual` only when no clearer field asserts exist.
+
+## Organization
+
+- Group related flows under `t.Run` blocks sharing setup.
+- `t.Parallel()` only when cases do not share mutable fixtures.
+- Helpers: `t.Helper()`, fail with `t.Fatalf`, register `t.Cleanup` for closes.
+
+## Golden files
+
+Store expected bytes under `testdata/*.golden`. Gate updates behind a flag:
+
+```go
+var updateGoldens = flag.Bool("update", false, "rewrite golden files")
+
+if *updateGoldens {
+    os.WriteFile(goldenPath, got, 0o644)
+}
+```
+
+Run `go test -update` locally; never commit refreshed goldens without reviewing diff.
+
+## Mocks
+
+Define small interfaces in the consumer package; tests supply stub structs with function fields:
+
+```go
+type stubStore struct {
+    load func(id string) (*User, error)
+}
+func (s stubStore) Load(id string) (*User, error) { return s.load(id) }
+```
+
+Prefer real sqlite/postgres test containers for integration paths when feasible.
+
+## HTTP handlers
+
+```go
+req := httptest.NewRequest(http.MethodGet, "/health", nil)
+rec := httptest.NewRecorder()
+Handler(rec, req)
+if rec.Code != http.StatusOK {
+    t.Fatalf("status %d", rec.Code)
+}
+```
+
+Table-drive method, path, body, expected status and JSON snippets.
+
+## Benchmarks and fuzz
+
+```go
+func BenchmarkEncode(b *testing.B) {
+    payload := mkPayload(1024)
+    b.ReportAllocs()
+    for i := 0; i < b.N; i++ {
+        _, _ = Encode(payload)
+    }
+}
+```
+
+Run `go test -bench=. -benchmem`. Fuzz decoders with seed corpus plus `go test -fuzz=FuzzDecode -fuzztime=30s`; assert invariants (roundtrip, no panic on reject).
+
+## Coverage
+
+```bash
+go test -race -coverprofile=coverage.out ./...
+go tool cover -func=coverage.out
+go tool cover -html=coverage.out
+```
+
+| Layer | Target |
+|-------|--------|
+| Money / auth / invariants | 100% |
+| Exported API | ≥90% |
+| Everything else | ≥80% |
+
+Exclude generated mocks from coverage via build tags when needed.
+
+## Commands cheat sheet
+
+```bash
+go test ./...
+go test -run TestUser/Create ./...
+go test -short ./...
+go test -count=10 ./...   # flake hunt
+go test -timeout 30s ./...
+```
+
+## Practices
+
+| Do | Skip |
+|----|------|
+| Assert behavior through public API | Importing `_test` packages to poke privates |
+| `t.Cleanup` for files and servers | `time.Sleep` for readiness—poll or channels |
+| Descriptive subtest names | Ignoring flaky tests |
+| Error-path table rows | Mocking every leaf when one integration test suffices |
+
+Security-sensitive parsing → add fuzz + **security-review** / **exo-security** pass.