Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add DDDFXYqiming/Agent_Extensions --skill bob-evidence-driven-engineeringgit clone --depth 1 https://github.com/DDDFXYqiming/Agent_ExtensionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dddfxyqiming/agent_extensions/bob-evidence-driven-engineering)<a href="https://agentmods.dev/skills/dddfxyqiming/agent_extensions/bob-evidence-driven-engineering"><img src="https://agentmods.dev/badge/skills/dddfxyqiming/agent_extensions/bob-evidence-driven-engineering/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dddfxyqiming/agent_extensions/bob-evidence-driven-engineering"><img src="https://agentmods.dev/badge/skills/dddfxyqiming/agent_extensions/bob-evidence-driven-engineering.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00135 | $0.02658 |
| Opus 5.5 | $0.00054 | $0.01063 |
| Sonnet 5.5 | $0.00027 | $0.00532 |
| Haiku 4.5 | $0.00014 | $0.00266 |
Grade A, and why
bob-evidence-driven-engineering scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 21d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.
证据驱动开发流程
这套流程来自 Bob 的做法。人负责写需求，代码好不好由机器检查说了算，能不能交付由一个独立的 QA 子代理签字。整个流程由 tools/bobflow.py 一个脚本执行，脚本只用 Python 标准库，init 时复制进项目仓库。每一步的对错由命令退出码判定，文档里的要求没做到，对应命令会直接失败。
一句话记住分工。实现的负责写，机器负责判质量，独立 QA 负责放行。写代码的不能给自己发通行证。
退出码
| 退出码 | 含义 | 一般原因 |
|---|---|---|
| 0 | 通过 | 这一步完成，可以继续 |
| 2 | 缺前置 | 没有规格、没有独立 QA 签字、或者没有新的检查结果 |
| 3 | 检查未通过 | 测试失败，覆盖率或复杂度不达标 |
| 4 | 需要人工批准 | 测试变少、跳过变多、门槛被调低这类改动需要书面说明 |
执行步骤
- 首次使用运行
python tools/bobflow.py init。脚本探测项目的语言和测试工具，生成.bob/config.json，把自身复制到tools/，再装上 git 钩子。结束时打印检查清单，写明哪些检查已启用。 - 运行
python tools/bobflow.py spec，在docs/bob/生成三份文件。spec.md记录需求切片，acceptance.feature记录验收场景，qa-plan.md记录测试计划。 - 填写三份文件。每个需求切片包含编号、示例、边界、错误行为、明确不做的部分。验收场景的每一步都要能观察到结果，例如页面上出现什么、命令输出什么、退出码是多少。
- 运行
python tools/bobflow.py approve记录规格意图。用户在线就请他过目再按。用户不在在线可以由你代签，脚本会标注成agent-unsigned，流程继续往下走，不断流。这一道只确认"规格是不是要的东西"，不负责判质量。 - 写代码。随时运行
python tools/bobflow.py next查看当前进度和下一步命令。 - 写完运行
python tools/bobflow.py verify。脚本跑测试、覆盖率等检查，把原始日志存进.bob/evidence/。这一步会因为还没有独立 QA 签字而返回BLOCKED: 缺独立 QA 签字，这是对的，接着做下一步。 - 开一个独立 QA 子代理做最终验收并签字，详见下一节。QA 子代理独立核对完会用
qa-sign签发。 - 再跑一次
python tools/bobflow.py verify（或decide）。这次有独立 QA 签字，拿到PASS和.bob/decision.json。 - 运行
python tools/bobflow.py checkpoint <阶段>保存交接记录，补齐标注待补的两节。阶段名用 spec、code、clean、architect、harden、qa 里的一个。 - git commit 和 git push。钩子在提交和推送时重新运行检查，不通过就不让提交。
小改动（见下面判据）可以只做 1、2、5、6、7、8，规格只写一份填实的 spec.md（跳过 acceptance.feature 和 qa-plan.md），approve 时加 --profile commit 声明轻量，但独立 QA 签字一步不能省。
独立 QA 与子代理
放行权在独立 QA 手里，不在写代码的手里。做法是开一个干净上下文的子代理扮演 QA，让它看不到你的实现思路，只凭规格和公开入口去验。
给 QA 子代理这些，不给别的：
- 规格三件套（
docs/bob/spec.md、acceptance.feature、qa-plan.md）。 - 项目的公开入口，怎么装、怎么跑、界面或命令行长什么样。
- 一条指令，按验收场景逐条从用户入口核对，跑
python tools/bobflow.py verify，通过后用 `python tools/bobflow.py qa-sign --role qa-subagent --by <你的名字>签发。
不要给它： 你写的实现代码、你的判断、你认为哪里可能有问题。它得自己从入口走一遍才算独立。
各 harness 怎么开子代理：
- 有子代理能力就直接开。pi 用 spawn 起子代理，codex 用 subagent 或 task，claude code 用 Task 工具。给它上面那份 QA 任务就行。
- 没有子代理能力，就用 CLI 调自己开一个新进程，比如
pi -p --no-session "<QA 任务>"，或者新开一个干净会话把 QA 任务发过去。关键是要有干净上下文。 - 都做不到，才在本会话里先放下实现思路、只拿规格重走一遍验收，然后
python tools/bobflow.py qa-sign --role self降级自签。脚本会标注这是降级自验、不是独立 QA，有条件时要补一个真正的独立 QA。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 21d ago First seen · 111 lines · 135 tokens per session scan A a2a045d018e2
bob-evidence-driven-engineering is a skill published in the GitHub repository DDDFXYqiming/Agent_Extensions (6 stars, last pushed 4d ago), licensed MIT. It adds 135 tokens to every session and 2,658 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other skills, from other repositories
hypothesis-testing
Property-based testing with Hypothesis for discovering edge cases and validating invariants. Use when implementing comprehensive test coverage, testing complex logic with many inputs, or validating mathematical properties and invariants across input domains. Triggered by: hypothesis, property-based testing, @given…
migrate-to-shoehorn
A testing utility that replaces TypeScript's `as` type assertions with Shoehorn helpers for creating partial or intentionally invalid test data.
test-harness
Generates pytest test suites with happy path, edge cases, error conditions, fixture scaffolding, mocks, async patterns. Triggers on: "generate tests", "write tests for", "test this function", "create test suite", "pytest for", "unit tests for", "mock strategy for".
tdd
Guidance for test-driven development (TDD), a method where you write a failing test, make it pass with a small change, and then improve the code. It focuses on tests that check user-visible behavior through public interfaces.
pair-programming
AI-assisted pair programming with multiple modes (driver/navigator/switch), real-time verification, quality monitoring, and comprehensive testing. Supports TDD, debugging, refactoring, and learning sessions. Features automatic role switching, continuous code review, security scanning, and performance optimization with…
visual-proof
Capture before/after screenshot evidence of a web page at real breakpoints (375, 768, 1440) in both light and dark themes, using Playwright against a local dev server or a deployed URL. Use before starting any visual change to capture the current state, and again after to prove the delta. Also use when asked to "show…