bug-reproduce-test

A workflow step for turning a reported PHP source-code bug into a minimal failing .phpt test. A .phpt file is PHP's test format, and TDD means using tests to capture expected behavior before fixing code.

In plain words
What is it for?
Use it when a bug specification is ready and you need a standalone reproduction script plus a test that currently fails against a built PHP command-line binary.
Why use it?
It proves that the reported problem can be reproduced and preserves that reproduction as a regression test.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/pronskiy/php-src-developer/bug-reproduce-test
Any agent
npx skills add pronskiy/php-src-developer --skill bug-reproduce-test
Clone the repo
git clone --depth 1 https://github.com/pronskiy/php-src-developer

Made for: Claude Code, Codex.

Per session 111 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,476 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00111 $0.02476
Opus 5 $0.00056 $0.01238
Sonnet 5 $0.00022 $0.00495
Haiku 4.5 $0.00011 $0.00248

Measured 2d ago against content hash 819e62d53aa8, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

bug-reproduce-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/php-core-developer/skills/bug-reproduce-test/SKILL.md · 190 lines

How it starts

The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.

bug-reproduce-test

Second step of the bug-fix flow. Reads the Context already in SPEC.md, builds a minimal PHP reproduction, converts it into a .phpt test under $PHP_SRC_DIR, runs it, and asserts it FAILS (TDD).

Inputs

  1. SPEC.md in the task directory resolved per _shared/task-dir.md (env var → .current → cwd) with type: bug and Context phase done. Refuse otherwise.
  2. $PHP_SRC_DIR with a built sapi/cli/php.

What it produces

  • repro.php — minimal standalone reproduction script in the task directory, for the user's eyeballing
  • $PHP_SRC_DIR/<tests-path>/ghNNNNN.phpt — the new test, following the conventions of the surrounding directory
  • Updated SPEC.md: Reproduction phase populated, status → done once post-guardrail is green

Phase owned

Reproduction.

Steps this skill adds:

  • repro-script — minimal repro.php reproduces the issue against $PHP_SRC_DIR/sapi/cli/php. Notes observed vs expected.
  • phpt-failing.phpt test created at the appropriate path; run-tests.php returns failure.

Workflow

1. Pre-guardrails

  • SPEC.md exists and has type: bug. If type: idea, refuse with: idea SPECs don't use bug-reproduce-test.
  • Context phase is done. If not, refuse with: Run /bug-context first.
  • Research phase soft-check: if a Research phase exists with status todo, print one warning line and proceed:
    ⚠ Research phase still todo. Run /research first for prior-art (or mark it `skipped` in SPEC.md to silence this warning).
    
    done, skipped, or blocked → no warning. Status done → read Research findings; they may already pin a subsystem or hint at a prior test that captures the bug.
  • Reproduction phase is todo or in-progress. If done, refuse with: Reproduction phase is already done. Run /bug-fix next. If blocked, refuse with: Reproduction is blocked: <reason>. Resolve before retrying.
  • $PHP_SRC_DIR/sapi/cli/php exists. If missing, do not auto-build — output the build commands and stop:
    $PHP_SRC_DIR/sapi/cli/php missing. Build it first:
      cd "$PHP_SRC_DIR"
      ./buildconf
      ./configure --enable-debug
      make -j$(nproc)
    
  • target_branch matches the checked-out branch. Read target_branch from SPEC.md frontmatter. If set (not null) and not equal to git -C "$PHP_SRC_DIR" rev-parse --abbrev-ref HEAD, refuse with:
    SPEC.md target_branch is <X>; $PHP_SRC_DIR is on <Y>.
    Switch with:
      git -C "$PHP_SRC_DIR" checkout <X>
      cd "$PHP_SRC_DIR" && make -j$(nproc)
    …or update target_branch in SPEC.md if the resolution was wrong.
    
    Do not auto-switch branches (CLAUDE.md: "Executing actions with care" — branch swaps trigger rebuilds the user may not want unprompted).
  • If target_branch: null (resolver couldn't decide), refuse with: target_branch is null in SPEC.md. Resolve the Open Question raised by /bug-context before reproducing.

Read the full file on GitHub · 190 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 190 lines · 111 tokens per session scan A 819e62d53aa8

Subscribe to this mod's changes

bug-reproduce-test is a skill published in the GitHub repository pronskiy/php-src-developer (8 stars, last pushed 3mo ago), licensed MIT. It adds 111 tokens to every session and 2,476 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

agent-integration

Run all three agent integration phases sequentially: research, write-tests, and implement using E2E-first TDD (unit tests written last). For individual phases, use /agent-integration:research, /agent-integration:write-tests, or /agent-integration:implement. Use when the user says "integrate agent", "add agent…

entireio/cli · 89 tokens

engram-testing-coverage

TDD and coverage standards for Engram. Trigger: When implementing behavior changes in any package.

Gentleman-Programming/engram · 25 tokens

code-assist

Guides implementation of code tasks using test-driven development in an Explore, Plan, Code, Commit workflow. Acts as a Technical Implementation Partner and TDD Coach — following existing patterns, avoiding over-engineering, and producing idiomatic, modern code.

mikeyobrien/ralph-orchestrator · 53 tokens

tdd

Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.

GreyDGL/PentestGPT · 33 tokens

css-design-tdd

Test-driven CSS design system modifications. Run checks before/after CSS changes to verify token usage, variable definitions, fallbacks, and consistency. Use when modifying CSS tokens, fixing design inconsistencies, or auditing CSS architecture.

xiaolai/vmark · 49 tokens

mobiai-mobile-tdd

You MUST use this before writing any implementation code for a mobile feature, bug fix, refactor, or behavior change. Tests come before implementation — no exceptions.

ArisGuimera/MobiAI-Core · 38 tokens