rsc-universal 0.1.1

package/skills/terms-conditions/references/notices-and-aup.md

@@ -0,0 +1,125 @@
+# Notices & AUP kit
+
+The standalone Acceptable Use Policy, the DMCA designated-agent block plus its
+registration checklist, the copyright/IP footer notice, the auto-renewal
+disclosure block, and the EU AI Act Art. 50 transparency notice. Fill every
+`[PLACEHOLDER]`. Not legal advice — have a licensed attorney review before you
+publish.
+
+## Acceptable Use Policy (standalone, referenced by the ToS)
+
+Keep this a separate document so you can update prohibited conduct without
+re-opening the master agreement. The ToS should say: "Your use of [SERVICE] is
+also governed by the Acceptable Use Policy, incorporated by reference."
+
+```text
+Acceptable Use Policy — [SERVICE]
+
+You may not use [SERVICE] to:
+
+1. Illegal content/conduct — post or transmit anything unlawful, or use
+   [SERVICE] to break the law.
+2. Infringement — upload content that infringes another's IP or privacy.
+3. Harassment & abuse — threaten, harass, defame, or target others; post
+   hateful or violent content.
+4. Spam — send unsolicited bulk messages, phishing, or deceptive content.
+5. Security circumvention — bypass authentication, probe, scan, or breach
+   security or access controls.
+6. Scraping & automated extraction — scrape, crawl, or harvest data except as
+   [SERVICE] expressly permits.
+7. Reverse engineering — decompile or reverse-engineer [SERVICE] or extract its
+   models, except where the law forbids this restriction.
+8. Resource abuse — overload, disrupt, or interfere with [SERVICE] or other
+   users (e.g., denial-of-service, excessive load).
+
+Enforcement: Violating this Policy is a breach of the Terms of Service.
+[ENTITY] may remove content and suspend or terminate your account, with or
+without notice depending on severity, and may report illegal activity to
+authorities.
+```
+
+## DMCA designated-agent notice + registration checklist
+
+A clause is not enough. You need **both** the on-site notice **and** the
+Copyright Office registration to keep §512 safe-harbor protection for
+user-generated content.
+
+On-site notice block:
+
+```text
+Copyright Complaints (DMCA)
+
+[ENTITY] responds to notices of alleged copyright infringement under the DMCA.
+To file a notice, send the following to our Designated Agent:
+
+Designated Agent: [NAME / TITLE]
+[ENTITY], [MAILING ADDRESS]
+Email: [DMCA EMAIL]
+
+Your notice must include: (1) your physical or electronic signature; (2)
+identification of the copyrighted work; (3) identification of the infringing
+material and its location (URL); (4) your contact information; (5) a statement
+of good-faith belief that the use is unauthorized; and (6) a statement, under
+penalty of perjury, that the notice is accurate and you are authorized to act.
+
+We may remove material, notify the user, and terminate repeat infringers.
+```
+
+Registration checklist (do not skip):
+
+- [ ] Register the Designated Agent in the U.S. Copyright Office DMCA Directory
+      (online; fee is ~$6).
+- [ ] Use the *same* agent contact details on the site and in the registration.
+- [ ] Implement and follow a repeat-infringer termination policy.
+- [ ] **Renew the registration every 3 years** — it expires automatically.
+      Add a calendar reminder now.
+
+## Copyright / IP footer notice
+
+```text
+© [YEAR] [ENTITY]. All rights reserved. [SERVICE] and the [SERVICE] logo are
+trademarks of [ENTITY]. All other marks are the property of their owners.
+```
+
+## Auto-renewal disclosure block (ROSCA / CARL fields)
+
+Show this *clearly and conspicuously before* collecting billing information and
+get express consent before charging. Provide cancellation at least as easy as
+sign-up, in the same medium.
+
+```text
+Subscription & Auto-Renewal
+
+Your [PLAN] subscription is [PRICE] per [BILLING PERIOD]. It automatically
+renews each [BILLING PERIOD] at the then-current price until you cancel. By
+subscribing you authorize [ENTITY] to charge [PAYMENT METHOD] at the start of
+each renewal term.
+
+Cancel anytime in [Account → Billing] or by emailing [CANCEL EMAIL] — no phone
+call required. If you cancel, you keep access until the end of the current
+billing period. [For California users: we will send a renewal reminder before
+each renewal.]
+```
+
+Compliance notes: ROSCA requires (a) clear/conspicuous disclosure of all
+material terms before billing info is collected, (b) express informed consent
+before charging, and (c) a simple cancellation mechanism at least as easy as
+sign-up and in the same medium. California's CARL adds express affirmative
+consent and annual renewal reminders. The FTC "Click-to-Cancel" Rule was
+vacated July 2025; the FTC issued an ANPRM 2026-03-11 restarting rulemaking,
+but ROSCA still binds and the FTC still enforces — comply now.
+
+## EU AI Act Art. 50 transparency notice
+
+Applies to AI features reaching EU users; transparency obligations apply from
+2026-08-02.
+
+```text
+AI Transparency
+
+[SERVICE] uses artificial-intelligence systems. When you interact with our AI
+features, you are interacting with an AI system, not a human. Content generated
+or substantially modified by our AI is identifiable as AI-generated [and is
+labeled where required]. AI output may be inaccurate — see the AI terms in our
+Terms of Service.
+```

package/skills/terms-conditions/scripts/verify.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# verify.sh — lint a drafted Terms / AUP / notice document.
+#
+# Read-only. Checks a generated legal document for two things:
+#   1. archaic legalese the skill is told never to use (always FAIL),
+#   2. if the doc self-identifies as a full Terms of Service, the required
+#      structural sections (governing law, limitation of liability, attorney-
+#      review disclaimer); a missing DMCA notice is a WARN, not a FAIL.
+#
+# Usage:
+#   scripts/verify.sh [path]
+#   - path to a .md file, OR
+#   - a directory (globs for *.md), OR
+#   - nothing (globs the current working directory for *.md).
+#
+# Exits 0 on a clean target AND on an empty target (no docs found => nothing to
+# fail). Exits 1 only when a real FAIL is found. No dependencies beyond a POSIX
+# shell + grep.
+
+set -u
+
+FAILS=0
+WARNS=0
+CHECKED=0
+
+BANLIST='heretofore|hereinafter|witnesseth|party of the first part|aforementioned|whereas the parties'
+
+is_full_tos() {
+  # Only treat a document as a full ToS if the phrase appears in a HEADING or a
+  # title line — not merely mentioned in prose (e.g. an AUP that says "the
+  # Terms of Service"). A heading is a Markdown '#'-line or a line that is
+  # *only* the title.
+  grep -Eiq '^[[:space:]]*#{1,6}[[:space:]].*(terms of service|terms of use|terms (and|&) conditions)' "$1" \
+    || grep -Eiq '^[[:space:]]*(terms of service|terms of use|terms (and|&) conditions)([[:space:]]*[—:-].*)?[[:space:]]*$' "$1"
+}
+
+check_file() {
+  local f="$1"
+  CHECKED=$((CHECKED + 1))
+  local file_failed=0
+
+  # 1. Archaic-legalese banlist (case-insensitive). Always a FAIL.
+  if grep -Eiq "$BANLIST" "$f"; then
+    echo "FAIL  $f: archaic legalese found ->"
+    grep -Eino "$BANLIST" "$f" | sed 's/^/        line /'
+    file_failed=1
+  fi
+
+  # 2. Structural checks, only for a full ToS.
+  if is_full_tos "$f"; then
+    grep -Eiq 'governing law|governed by the laws' "$f" || {
+      echo "FAIL  $f: full ToS missing a governing-law clause"; file_failed=1; }
+    grep -Eiq 'limitation of liability|aggregate liability|total .*liability' "$f" || {
+      echo "FAIL  $f: full ToS missing a limitation-of-liability clause"; file_failed=1; }
+    grep -Eiq 'attorney|legal advice|not a lawyer|licensed (counsel|attorney)' "$f" || {
+      echo "FAIL  $f: full ToS missing an attorney-review / not-legal-advice disclaimer"; file_failed=1; }
+    grep -Eiq 'dmca|designated agent|copyright complaints' "$f" || {
+      echo "WARN  $f: full ToS has no DMCA notice (fine only if there is no user-generated content)"
+      WARNS=$((WARNS + 1)); }
+  fi
+
+  if [ "$file_failed" -eq 0 ]; then
+    echo "ok    $f"
+  else
+    FAILS=$((FAILS + 1))
+  fi
+}
+
+# Resolve the target into a list of .md files.
+TARGET="${1:-.}"
+FILES=()
+if [ -f "$TARGET" ]; then
+  FILES=("$TARGET")
+elif [ -d "$TARGET" ]; then
+  while IFS= read -r line; do FILES+=("$line"); done < <(find "$TARGET" -type f -name '*.md' 2>/dev/null)
+else
+  echo "verify.sh: target not found: $TARGET" >&2
+  exit 0
+fi
+
+if [ "${#FILES[@]}" -eq 0 ]; then
+  echo "verify.sh: no .md documents to check under '$TARGET' — nothing to verify."
+  exit 0
+fi
+
+for f in "${FILES[@]}"; do
+  check_file "$f"
+done
+
+echo "---"
+echo "checked: $CHECKED  fails: $FAILS  warns: $WARNS"
+[ "$FAILS" -eq 0 ] && exit 0 || exit 1

package/skills/testing-go/SKILL.md

@@ -0,0 +1,246 @@
+---
+name: testing-go
+description: "Use when writing or running Go tests — table-driven cases, named subtests, parallel isolation, fakes instead of mock frameworks, coverage profiles, benchmarks, and fuzzing. Triggers: 'write Go tests', 'table-driven test', 'go test -cover', 'benchmark this function', 'testing.B.Loop', 'test concurrent goroutines deterministically', flaky parallel subtest uses wrong case data, golden files, 'mockear una interfaz en Go', 'cobertura de tests en Go', 'testar goroutines sense esperar 5 segons'. NOT general Go code or modules (that is go), NOT pytest fixtures (that is testing-py), NOT browser user flows (that is e2e-testing)."
+tags: [go, testing, table-driven-tests, benchmarks, coverage, synctest, mocks, fuzzing]
+recommends: [go, secure-coding, testing-py, e2e-testing]
+origin: risco
+---
+
+# Testing Go
+
+You test **behavior at the package boundary**, not private internals. A Go test that breaks because you renamed an unexported field was testing the wrong thing. Target Go **1.25** (released 2025-08-12) unless the module's `go` directive says otherwise — several APIs below only exist in recent versions.
+
+Default stack, in order of reach:
+1. The standard `testing` package. It is enough for ~90% of tests.
+2. `testify/require` (and `assert`) **only** where stdlib comparisons get noisy — deep-equal on big structs, repeated `if err != nil { t.Fatal }`. Not as a reflex.
+3. Hand-written fakes over any mock generator. A 12-line fake beats `gomock` for code you own.
+
+Run `go test ./...` early and often. Add `-race` for anything that touches a goroutine. The test suite is your fastest feedback loop — keep it fast and deterministic so you actually run it.
+
+## What am I testing? Pick the tool
+
+| Situation | Reach for |
+|---|---|
+| Pure logic, many input/output cases | Table-driven test + `t.Run` subtests |
+| An HTTP client or `http.Handler` | `net/http/httptest` (server or recorder) |
+| Goroutines, timers, timeouts, `context` deadlines | `testing/synctest` + `-race` |
+| "Is it fast / did my change regress?" | `testing.B.Loop` + `benchstat` |
+| "Does it crash or misbehave on weird input?" | `func FuzzXxx(f *testing.F)` |
+| A dependency you own (DB, payment client, clock) | A hand-written interface fake |
+
+If you find yourself reaching past the standard library for the first row, stop — table-driven tests need nothing else.
+
+## Table-driven tests
+
+The canonical shape: a slice of anonymous structs with a `name`, run as named subtests.
+
+```go
+func TestReverse(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{name: "empty", in: "", want: ""},
+		{name: "ascii", in: "abc", want: "cba"},
+		{name: "unicode", in: "héllo", want: "olléh"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := Reverse(tc.in)
+			if got != tc.want {
+				t.Errorf("Reverse(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+```
+
+- **Name every case.** `t.Run(tc.name, ...)` gives you `go test -run TestReverse/unicode` to target one case, and a readable failure path instead of "index 2".
+- **Use `t.Errorf`, not `t.Fatalf`, inside the loop** unless the rest of the case is meaningless after the failure. `Fatalf` stops the whole subtest; `Errorf` lets the other cases still run.
+- **One table per behavior, not per function.** If two functions share inputs and expectations, one table. If a case needs three extra fields only it uses, that case wants its own test.
+
+Bad — copy-pasted near-identical functions:
+
+```go
+func TestAddOne(t *testing.T)  { if Add(1) != 2 { t.Fail() } }
+func TestAddTwo(t *testing.T)  { if Add(2) != 3 { t.Fail() } }
+func TestAddZero(t *testing.T) { if Add(0) != 1 { t.Fail() } }
+```
+
+Good — one table, each case named, failures localized (see the `TestReverse` shape above).
+
+## Parallel & isolation
+
+```go
+for _, tc := range tests {
+	t.Run(tc.name, func(t *testing.T) {
+		t.Parallel() // this subtest runs concurrently with its siblings
+		got := Process(tc.in)
+		if got != tc.want {
+			t.Errorf("Process(%q) = %v, want %v", tc.in, got, tc.want)
+		}
+	})
+}
+```
+
+- **Do not write `tc := tc` before `t.Run`.** Go 1.22+ gives each loop iteration its own variable scope, so the historical copy is dead ceremony. Only modules whose `go.mod` declares `go 1.21` or older still need it — and you should bump the directive instead.
+- **`t.Cleanup(fn)` over `defer`** for teardown that must run even when a helper calls `t.Fatal`. Cleanups run LIFO after the test, and they nest correctly through helpers where a `defer` in `main` would not.
+- **`t.Helper()`** as the first line of any assertion helper, so failures point at the caller's line, not inside the helper.
+- **`t.TempDir()`** for filesystem tests — auto-removed, unique per test, parallel-safe. Never hardcode `/tmp/mytest`.
+- **`t.Context()`** (Go 1.24+) gives a context cancelled when the test and its cleanups finish — pass it to anything taking a `context.Context` instead of `context.Background()`.
+- **`t.Setenv` and `T.Chdir` forbid `t.Parallel()`.** They mutate process-global state; the test panics if you call them in a parallel test. Keep env/cwd-mutating tests serial.
+
+## Fakes over mocks
+
+Define the interface where you **consume** it (the test's package), keep it tiny, and hand-roll a fake with func fields you set per test.
+
+```go
+// Charger is what the service needs — declared at the consumer, not the vendor.
+type Charger interface {
+	Charge(ctx context.Context, cents int64) (string, error)
+}
+
+type fakeCharger struct {
+	charge func(ctx context.Context, cents int64) (string, error)
+}
+
+func (f fakeCharger) Charge(ctx context.Context, cents int64) (string, error) {
+	return f.charge(ctx, cents)
+}
+
+func TestCheckout_chargesOnce(t *testing.T) {
+	var calls int
+	f := fakeCharger{charge: func(_ context.Context, c int64) (string, error) {
+		calls++
+		return "txn_123", nil
+	}}
+	if err := Checkout(t.Context(), f, 999); err != nil {
+		t.Fatalf("Checkout: %v", err)
+	}
+	if calls != 1 {
+		t.Errorf("Charge called %d times, want 1", calls)
+	}
+}
+```
+
+This is faster to read than a generated mock and never couples your test to call order. Reach for `go.uber.org/mock` (gomock) or `testify/mock` only when a team already mandates them or the interface is large and call-sequence assertions are the point — templates and the decision in `references/mocks-and-fakes.md`. For HTTP dependencies use `net/http/httptest` (server, recorder, or a fake `RoundTripper`) instead of a fake — same reference.
+
+## Concurrency & time (synctest)
+
+`testing/synctest` graduated to GA in **Go 1.25**. It runs your code in an isolated "bubble" with a fake clock that jumps forward instantly the moment every goroutine in the bubble is durably blocked — so a test of a 30-second timeout finishes in microseconds, deterministically.
+
+```go
+func TestTimeout(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+		defer cancel()
+
+		done := make(chan error, 1)
+		go func() { done <- slowOperation(ctx) }()
+
+		synctest.Wait() // wait until the goroutine is durably blocked
+		select {
+		case err := <-done:
+			if !errors.Is(err, context.DeadlineExceeded) {
+				t.Errorf("got %v, want DeadlineExceeded", err)
+			}
+		case <-time.After(time.Minute): // fake time — never really waits
+			t.Fatal("operation did not time out")
+		}
+	})
+}
+```
+
+- **Always run concurrent code with `-race`** (`go test -race ./...`). The race detector finds data races that pass silently otherwise.
+- **`synctest.Wait()`** blocks the bubble until all other bubble goroutines are durably blocked, letting you assert at a known point.
+- Use `synctest.Test(t, ...)`, not the old `synctest.Run` — `Run` is deprecated as of Go 1.26.
+- Never use `time.Sleep` to "let the goroutine finish." That is the flaky-test factory. Full bubble semantics, durable-block definition, and goroutine-leak detection live in `references/synctest-and-concurrency.md`.
+
+## Coverage
+
+```bash
+go test -cover ./...                                   # quick per-package %
+go test -coverprofile=cover.out ./...                  # write a profile
+go tool cover -html=cover.out                          # open annotated source
+go test -coverpkg=./... -coverprofile=cover.out ./...  # cross-package coverage
+go build -cover -o ./bin/app .                         # coverage for integration binaries (1.20+)
+```
+
+A coverage **percentage is a smoke alarm, not a goal.** 100% line coverage with no assertions on the values is worthless; 70% on the branches that actually carry logic is fine. Use `-coverpkg=./...` when your tests live in a separate package and exercise code across the module, or the number undercounts. Profiles, integration-binary coverage, and reading the HTML report are in `references/coverage-and-benchmarks.md`.
+
+## Benchmarks
+
+Use `for b.Loop()` (Go 1.24+), not the legacy `for i := 0; i < b.N; i++`. `b.Loop` manages the timer itself (setup before the loop and teardown after are excluded automatically), runs the body the right number of times, and the compiler is taught **not** to dead-code-eliminate calls inside it.
+
+```go
+func BenchmarkHash(b *testing.B) {
+	data := bytes.Repeat([]byte("x"), 1024) // setup excluded from timing
+	b.ReportAllocs()
+	for b.Loop() {
+		_ = Hash(data)
+	}
+}
+```
+
+Bad — legacy loop with manual timer juggling and a sink to fool the optimizer:
+
+```go
+func BenchmarkHash(b *testing.B) {
+	data := bytes.Repeat([]byte("x"), 1024)
+	b.ResetTimer()
+	var sink uint64
+	for i := 0; i < b.N; i++ {
+		sink = Hash(data)
+	}
+	_ = sink
+}
+```
+
+- **`b.ReportAllocs()`** always — allocation count regresses long before wall-clock does, and it is the first thing to optimize.
+- **Compare runs with `benchstat`**, never eyeball two numbers — a single run's noise is larger than most real changes. Install and workflow in `references/coverage-and-benchmarks.md`.
+- The `sink`/`runtime.KeepAlive` dance is only needed in pre-1.24 modules; inside `b.Loop()` it is redundant.
+
+## Fuzzing
+
+Built in since Go 1.18. Worth it for **parsers, decoders, and anything that ingests untrusted input** — places where a malformed byte sequence can panic or corrupt state.
+
+```go
+func FuzzParse(f *testing.F) {
+	f.Add("key=value")        // seed corpus
+	f.Add("")
+	f.Fuzz(func(t *testing.T, s string) {
+		got, err := Parse(s)
+		if err != nil {
+			return // rejecting bad input is fine; crashing is not
+		}
+		if out := got.String(); out != s {
+			t.Errorf("round-trip: Parse(%q).String() = %q", s, out)
+		}
+	})
+}
+```
+
+Run it with `go test -fuzz=FuzzParse -fuzztime=30s`. Without `-fuzz` the seed corpus runs as ordinary cases on every `go test`, so seeds are also free regression tests.
+
+## Anti-patterns
+
+| Anti-pattern | Why it bites | Do instead |
+|---|---|---|
+| Testing unexported internals via `export_test.go` for everything | Tests rename-break on every refactor; you're testing structure, not behavior | Test through the public API; reserve `export_test.go` for genuinely untestable seams |
+| Asserting on log output to check a code path ran | Couples tests to message wording; brittle and slow | Assert on returned values or fake-recorded calls |
+| `time.Sleep` to synchronize goroutines | Flaky on loaded CI, slow always | `testing/synctest` + `synctest.Wait()`, or a channel |
+| One giant `TestEverything` func | First failure hides the rest; no targetable subtests | Table-driven with named `t.Run` subtests |
+| Chasing 100% coverage | Inflates with assertion-free tests; false confidence | Cover the branches that carry logic; read the profile |
+| `tc := tc` before `t.Run` in a `go 1.22`+ module | Dead ceremony; signals copied-from-old-blog code | Delete it; bump the `go` directive if older |
+| `gomock`/`testify/mock` to fake an interface you own | Ceremony + coupling to call order for a 12-line job | Hand-rolled func-field fake |
+| Benchmark without `b.ReportAllocs()` | Misses allocation regressions, the cheapest win | Add `b.ReportAllocs()`; compare with `benchstat` |
+| `t.Parallel()` in a test calling `t.Setenv`/`T.Chdir` | Panics — they mutate process-global state | Keep env/cwd tests serial |
+
+## Verify & references
+
+Run `scripts/verify.sh [dir]` to check emitted tests: it runs `gofmt -l`, `go vet ./...`, and `go test ./... -count=1` (with `-race` when supported) inside the first Go module it finds, and no-ops cleanly when there is none.
+
+- `references/synctest-and-concurrency.md` — bubble model, durable-block definition, fake clock, `synctest.Wait`, `-race`, goroutine-leak detection, the `GOEXPERIMENT`→GA migration.
+- `references/mocks-and-fakes.md` — fakes vs `testify/mock` vs gomock decision and minimal templates; `httptest` server/recorder/RoundTripper recipes.
+- `references/coverage-and-benchmarks.md` — coverage profiles, `-coverpkg`, integration `go build -cover`, `benchstat` install and workflow, `-cpuprofile`/`-memprofile`.

package/skills/testing-go/evals/README.md

@@ -0,0 +1,3 @@
+# Evals for testing-go
+
+These cases are prompts to sanity-check routing and capability coverage, not an automated test harness. To exercise routing, feed each `should_trigger` and `should_not_trigger` prompt to the skill router and confirm that `testing-go` is selected for the former and the named sibling (`go`, `testing-py`, `testing-web`, `e2e-testing`, `review`) for the latter. For the `capability` entry, give the scenario to the agent with this skill loaded and check the generated Go test code against the `must_include` rubric by hand — every bullet should be visibly satisfied (table-driven subtests, synctest/fake clock with no real sleep, correct parallel handling, a fake or httptest double, `-race` plus a coverage command, and a `b.Loop()` benchmark). No CI integration is assumed.

package/skills/testing-go/evals/cases.yaml

@@ -0,0 +1,44 @@
+skill: testing-go
+
+should_trigger:
+  - prompt: "Turn these three near-identical test functions into a table-driven test with subtests."
+    why: Core table-driven refactor — the canonical reason this skill exists.
+  - prompt: "Benchmark this hashing function and tell me if my change actually made it faster."
+    why: Benchmarks + benchstat comparison; non-obvious that this is testing-go and not the general go skill.
+  - prompt: "My parallel subtests are flaky and sometimes pick up the wrong test case data."
+    why: Loop-variable / parallel-isolation symptom; the fix (Go 1.22 scope, drop tt := tt) is testing-go knowledge, and the phrasing names a symptom, not the tool.
+  - prompt: "Necesito testear código con goroutines y timeouts sin que el test tarde 5 segundos."
+    why: Spanish; deterministic concurrency/time testing via testing/synctest and a fake clock.
+  - prompt: "How do I get cross-package coverage and an HTML report out of go test?"
+    why: Coverage profile workflow (-coverpkg, -coverprofile, go tool cover -html).
+  - prompt: "Mock the payment client interface so this Go service test doesn't hit the network."
+    why: Test doubles for Go — routes here (fake/httptest), not to go; non-obvious because user said "mock".
+  - prompt: "Add a fuzz test for my Go URL parser so it doesn't panic on garbage input."
+    why: Fuzzing parsers/untrusted input with FuzzXxx — squarely testing-go.
+
+should_not_trigger:
+  - prompt: "How should I structure error handling and generics in this Go package?"
+    route_to: go
+    why: Language design and idioms, not test code.
+  - prompt: "Write pytest fixtures and parametrize for my Python API."
+    route_to: testing-py
+    why: Wrong ecosystem — Python test tooling.
+  - prompt: "Add Playwright tests for the checkout flow across multiple pages."
+    route_to: e2e-testing
+    why: Browser-driven multi-page user journey, past the process boundary.
+  - prompt: "Set up Vitest and Testing Library for my React component."
+    route_to: testing-web
+    why: Frontend/component unit tests, different runtime.
+  - prompt: "Review this Go diff for bugs before I merge it."
+    route_to: review
+    why: General code review of a diff, not authoring test code.
+
+capability:
+  - scenario: "Given a Go RateLimiter that uses a time.Ticker and exposes fetch(ctx context.Context) (Resp, error) calling an HTTP backend, write a test suite for it."
+    must_include:
+      - Table-driven cases with named subtests run via t.Run(tc.name, ...)
+      - Uses testing/synctest (or an injected fake clock) for the ticker/timeout path, with no real time.Sleep to synchronize
+      - t.Parallel() where safe, and does NOT add a gratuitous tt := tt copy (notes Go 1.22 per-iteration loop scope)
+      - A hand-written interface fake or net/http/httptest server for the HTTP dependency, not a mock framework by default
+      - Runs with -race for the concurrent path and shows a go test -coverprofile / cross-package coverage command
+      - A benchmark using for b.Loop() with b.ReportAllocs() rather than a b.N loop

package/skills/testing-go/references/coverage-and-benchmarks.md

@@ -0,0 +1,85 @@
+# Coverage & benchmarks
+
+Coverage profiles (including cross-package and integration binaries) and the `benchstat` benchmarking workflow. Target Go 1.25.
+
+## Coverage profiles
+
+```bash
+go test -cover ./...                                   # per-package % to stdout
+go test -coverprofile=cover.out ./...                  # write a profile file
+go tool cover -func=cover.out                          # per-function % in the terminal
+go tool cover -html=cover.out                          # annotated source in the browser
+go tool cover -html=cover.out -o cover.html            # write the HTML report to a file
+```
+
+The profile is the truth, the percentage is the headline. Open the HTML report and look at which **branches** are red, not at the number. An error path that never executes in any test is worth more attention than three more covered getters.
+
+## Cross-package coverage
+
+By default `go test` only counts coverage of the package under test. When tests live in package `foo_test` or exercise code across the module, that undercounts. Use `-coverpkg`:
+
+```bash
+go test -coverpkg=./... -coverprofile=cover.out ./...
+go test -coverpkg=./internal/... -coverprofile=cover.out ./internal/api
+```
+
+`-coverpkg` names the packages whose coverage to **measure**; the final args name the tests to **run**. They are different lists, which is the whole point — run the API tests, measure the internal packages they reach.
+
+## Integration-binary coverage (Go 1.20+)
+
+To measure coverage of a compiled binary driven by black-box tests (shell scripts, end-to-end harnesses), build with `-cover` and point `GOCOVERDIR` at an output directory:
+
+```bash
+go build -cover -o ./bin/app .
+mkdir -p covdata
+GOCOVERDIR=$(pwd)/covdata ./bin/app --do-something
+go tool covdata percent -i=covdata
+go tool covdata textfmt -i=covdata -o=cover.out   # convert to a profile for -html
+```
+
+This captures coverage from the running process, not from `go test`, so it folds real integration runs into your coverage picture.
+
+## Benchmarks: the loop
+
+Use `for b.Loop()` (Go 1.24+). It excludes setup before the loop and teardown after from the timer automatically, runs the body the correct number of times, and prevents the compiler from dead-code-eliminating the calls inside it.
+
+```go
+func BenchmarkEncode(b *testing.B) {
+	in := makeFixture()  // excluded from timing
+	b.ReportAllocs()
+	for b.Loop() {
+		_ = Encode(in)
+	}
+}
+```
+
+Always call `b.ReportAllocs()` — allocations regress before wall-clock and are usually the cheapest thing to fix. In pre-1.24 modules you instead write `for i := 0; i < b.N; i++`, call `b.ResetTimer()` after setup, and assign results to a package-level sink (or `runtime.KeepAlive`) to defeat the optimizer. None of that is needed with `b.Loop`.
+
+## benchstat workflow
+
+Never compare two raw benchmark prints — run-to-run noise usually exceeds the change you are measuring. Run each variant multiple times and let `benchstat` report the delta with a confidence interval.
+
+```bash
+go install golang.org/x/perf/cmd/benchstat@latest
+
+# on the baseline:
+go test -run=^$ -bench=BenchmarkEncode -count=10 ./... > old.txt
+# after your change:
+go test -run=^$ -bench=BenchmarkEncode -count=10 ./... > new.txt
+
+benchstat old.txt new.txt
+```
+
+`-run=^$` disables ordinary tests so only benchmarks run. `-count=10` gives benchstat enough samples to judge significance; treat a result marked `~` (no statistically significant change) as no change, regardless of the sign.
+
+## Profiling hooks
+
+Capture CPU and memory profiles from a benchmark and inspect them with pprof:
+
+```bash
+go test -run=^$ -bench=BenchmarkEncode -cpuprofile=cpu.out -memprofile=mem.out ./pkg
+go tool pprof -http=:0 cpu.out      # interactive flame graph in the browser
+go tool pprof -top mem.out          # top allocation sites in the terminal
+```
+
+Profile first, optimize second. A benchmark tells you *that* it is slow; the profile tells you *where*.