When told to move a measure that stands for a broader goal (coverage %, make the tests pass, green CI, benchmark number): name the goal separately, classify each candidate move goal-advancing or proxy-only, forbid the proxy-only ones, and report the honest number with its gap. Skip when the measure IS the spec, and…
Before shipping ANY reverse path — a migration downgrade, rollback command, undo action, failover switch back to the old system, restore-from-backup script, or dead-letter replay: actually execute forward-then-back on seeded edge-case rows (empty, single-token, max-length, unicode, already-migrated), diff against the…
Before an irreversible action (dropping a table, deleting data, force-push, sending to customers, publishing): classify the door, and for one-way doors establish and TEST the recovery path first — a backup nobody restored is not a recovery path. Two-way doors proceed immediately. Triggers: "drop", "delete", "run the…
When effort is being converted into a date or a headcount: sum the longest dependency chain to get the floor, compare it to the horizon, and shorten the chain before adding people. REQUIRES a real work breakdown from the user — never invent one. Skip single-task plans. Triggers: "do we make it", "can we add people"…
Vet a rule, principle or heuristic and decide brutally whether it can become a useful skill. Runs the Delta Test: trigger, cold-run delta, teeth, single job. The cold run must be EXECUTED, not asserted. Triggers: "is this a good skill", "vet this rule", "would this make a useful skill".
When a performance target is given as a number: split the current time into slices, mark each fixed or improvable, sum the fixed ones into a floor, and if the target is below the floor say so and change the shape instead of optimizing. Check first whether the fixed slices can overlap. Verify the floor is measured, not…
When code decides who someone is or what they may do: for each input name who else can set it, and refuse network position, a client-supplied id, an unsigned header, or a shared static token as proof. Re-derive the target from the verified identity. Skip endpoints that make no trust decision. Triggers: "internal…
When finishing work and preparing the commit, PR or handover, and the reasoning behind it contains a justified choice: for each justification ask whether the next reader could recover it from the code alone; land the ones they could not (external constraint, rejected alternative, ordering requirement) at the site, max…
When implementing something from a short open-ended request: list every abstraction, option, hook, config knob and layer introduced, and delete each one with no current caller. Keep only what correctness needs. Triggers: "implement X", "build a Y", "write a Z" with no stated extension requirement.
Run every skill in your agent setup twice — once with it, once against an agent that cannot see it — and find out which ones change nothing. Runs locally from the cold-run npm package.