skills/team/tdd/SKILL.md
The canonical RED-GREEN-REFACTOR inner loop. Enforces behavioral, structure-insensitive tests and prohibits horizontal slicing. Use when writing any new code test-first, managing TDD phase transitions, or as the inner loop for qrspi-implement, qraspi-implement, or any other implementation skill. Triggers on "tdd", "red green refactor", "write a failing test", "test-first", "tdd cycle". Do NOT use to audit existing test suites — use evaluate-tests instead.
npx skillsauth add michaelalber/ai-toolkit tddInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"Write tests that are sensitive to behavior changes, insensitive to structure changes." — Kent Beck
Every test must satisfy both before leaving RED:
| Property | A compliant test... | A violation looks like |
|----------|---------------------|------------------------|
| Behavioral | fails when the observable outcome breaks | assert repo.save.called — verifies a method was called, not what the system produced |
| Structure-insensitive | survives a rename-only or extract-method refactor | assert order._total == 100 — reads internal state; breaks on any rename |
The most common TDD failure in AI-generated code:
# WRONG — horizontal slice
def test_register(): ...
def test_login(): ...
def test_logout(): ...
# ... then all implementation
class Auth: ...
# RIGHT — vertical slice
def test_register(): ... # one test
class Auth: # minimal code to pass it
def register(): ...
# refactor → commit → next test
def test_login(): ...
Horizontal slicing produces tests that were never red, implementations that were never minimal, and refactoring that was never constrained by a safety net. Never accumulate unimplemented tests.
test-scaffold<tdd-state>
phase: RED | GREEN | REFACTOR
iteration: N
current_test: [test name]
failure_reason: [semantic description — not "syntax error"]
tests_passing: true | false
</tdd-state>
The one canonical loop (GREEN/REFACTOR depth in references/ above). Companions are modes and audits, not alternatives:
| Need | Skill |
|------|-------|
| AI drives all phases autonomously (defers here for mechanics) | tdd-agent |
| Human + AI pair — ping-pong / navigator / teaching (defers here) | tdd-pair |
| Audit test quality or TDD compliance after the fact | evaluate-tests |
| .NET test conventions — xUnit / AAA / mocks | test-scaffold |
| RED before/after examples | Behavioral Examples |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".