skills/tdd-cycle/SKILL.md
Orchestrate RED-GREEN-REFACTOR TDD phases. Use when starting TDD, managing phase transitions, or maintaining TDD discipline across a development session. Do NOT use when TDD discipline is optional or exploratory; do NOT use when a failing test does not yet exist — create the test first.
npx skillsauth add michaelalber/ai-toolkit tdd-cycleInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"The goal is clean code that works. First we make it work, then we make it clean." — Ron Jeffries
This skill coordinates the canonical TDD cycle: RED → GREEN → REFACTOR. It maintains phase state, enforces transitions, and prevents the AI from "helping" by skipping phases.
The cycle is non-negotiable:
Use search_knowledge (grounded-code-mcp) to ground decisions in authoritative references.
| Query | When to Call |
|-------|--------------|
| search_knowledge("TDD red green refactor cycle phases") | At session start — confirms canonical phase definitions and transition rules |
| search_knowledge("Kent Beck test desiderata properties") | When evaluating test quality — authoritative source for the 12 properties |
| search_knowledge("test-first development discipline XP") | When enforcing TDD discipline — grounding in XP practices |
| search_knowledge("unit test naming conventions AAA arrange act assert") | When guiding test structure — naming and organization patterns |
Protocol: Search before advising on phase transitions or test quality criteria. Cite the source path in your response.
Use this framework to evaluate test quality at every phase:
| Property | Description | Priority | |----------|-------------|----------| | Isolated | Tests don't affect each other | Critical | | Composable | Can run any subset of tests | High | | Deterministic | Same result every time | Critical | | Specific | Failure points to cause | High | | Behavioral | Tests behavior, not implementation | High | | Structure-insensitive | Refactoring doesn't break tests | High | | Fast | Quick feedback loop | Medium | | Writable | Easy to create new tests | Medium | | Readable | Easy to understand intent | High | | Automated | No manual intervention | Critical | | Predictive | Passing tests = working code | High | | Inspiring | Confidence to make changes | Medium |
┌─────────────────────────────────────────────────────┐
│ │
│ ┌─────┐ ┌───────┐ ┌──────────┐ │
│ ──►│ RED │─────►│ GREEN │─────►│ REFACTOR │────┐ │
│ └─────┘ └───────┘ └──────────┘ │ │
│ ▲ │ │
│ └───────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────┘
Maintain state across conversation turns using this block:
<tdd-state>
phase: RED | GREEN | REFACTOR
iteration: [number]
feature: [brief description]
current_test: [test name or "none"]
tests_passing: [true | false | unknown]
last_action: [what was just done]
next_action: [what should happen next]
blockers: [any issues preventing progress]
</tdd-state>
Preconditions:
Actions:
Exit Criteria:
Preconditions:
Actions:
Exit Criteria:
Preconditions:
Actions:
Exit Criteria:
At session start, determine the mode:
Autonomous Mode (tdd-agent):
Pair Mode (tdd-pair):
## TDD Session: [Feature Name]
**Mode**: [Autonomous | Pair]
**Stack**: [Language/Framework]
<tdd-state>
phase: RED
iteration: 1
feature: [description]
current_test: none
tests_passing: unknown
last_action: Session initialized
next_action: Write first failing test
blockers: none
</tdd-state>
### RED Phase - Iteration 1
I'll write a test for: [specific behavior]
### Phase Complete: [PHASE]
**What was accomplished:**
- [bullet points]
**Verification:**
- Tests run: [yes/no]
- Result: [pass/fail with count]
<tdd-state>
phase: [NEXT_PHASE]
...
</tdd-state>
### [NEXT_PHASE] Phase - Iteration [N]
Next step: [action]
Before writing ANY implementation code, verify:
If no failing test exists, STOP and write one first.
During GREEN phase:
During REFACTOR phase:
Before any phase transition:
The AI must NOT:
See reference files for stack-specific patterns:
tdd-implementer for implementationtdd-refactor for safe improvementstdd-agenttdd-pairtdd-verify for compliance check| Anti-Pattern | Why It's Wrong | Correct Approach | |--------------|----------------|------------------| | Test after code | Tests become verification, not specification | Always RED first | | Multiple features per cycle | Loses precision, harder to debug | One behavior at a time | | Skipping refactor | Technical debt accumulates | Always evaluate for cleanup | | Gold-plating in GREEN | Violates minimal implementation | Save improvements for REFACTOR | | Tests that test implementation | Brittle, break on refactor | Test behavior only |
The test is likely:
Action: Examine the test, strengthen assertions, or find the actual gap.
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".