I wrote CONSTRAINTS.md in the current folder. There is no AGENTS.md here, so I didn't add the pointer line to it. In your real repo, add this line to AGENTS.md: Read CONSTRAINTS.md before writing code. Do not weaken it to make a change pass.
What's in it
- Floor (blocks now): no new suppressions, no stubs or empty
catch, no skipped or deleted tests, no stripped assertions, no secrets, and no weakening the file itself. - Warn until 2026-10-24, then block: types, lint, changed-line coverage ≥ 80%, Semgrep, osv-scanner and axe.
- Held, not enforced: project coverage stays at 58.2% (0.5% tolerance) and the bundle stays at 212 kB.
- Budget: checks at task end must finish in 90 seconds. Semgrep, osv-scanner and axe run in CI or on the preview deploy.
- Performance budget: you didn't pick one, so bundle size is only tracked. I picked 80% for changed-line coverage myself, because you asked to hold the current level and 80% is the skill's default for new code. Say so if you'd rather not have it.
What to install and wire up
You already have tsc, Vitest and Biome.
| Tool | Install |
|---|---|
| Coverage | npm i -D @vitest/coverage-v8, with the lcov reporter on |
| gitleaks | brew install gitleaks |
| Semgrep | pipx install semgrep |
| osv-scanner | brew install osv-scanner |
| axe | npm i -D @axe-core/cli |
Add these scripts to package.json:
"check:fast": "tsc --noEmit && biome check . && gitleaks detect --redact --no-banner",
"check:task": "npm run check:fast && vitest run --coverage",
"check:full": "npm run check:task && semgrep scan --config p/default --config p/owasp-top-ten && osv-scanner scan source -r ."
- After each edit: run
check:fast, for example from an agent post-edit hook. - At task end: run
check:task. Compare the lcov it writes againstgit difffor the 80% changed-line check, without running the tests a second time. - In GitHub Actions: run
check:fullon every PR. After the preview deploy, runaxe $PREVIEW_URL --tags wcag2a,wcag2aa,wcag21aa. - Floor guard: it needs no installs and only reads the diff. Adapt the reference implementation in the skill's
references/floor-guard.md, which I haven't opened. - gitleaks: always use
--redact, so a leaked key never lands in a transcript.
The diff against the floor
It violates the floor in four places, and one of them also edits the constraints file.
cart.test.ts:it.skipadds a skipped test, and the assertionexpect(...).toThrow()is stripped. Nothing in the diff gives a reason in a commit message. The negative-quantity rule is no longer tested.pay.ts,// @ts-ignore: this is a new suppression. It hides a type problem onorder.totalthat should be fixed.pay.ts,catch {}: this is an emptycatcharoundcharge(total). A failed payment now passes silently and the code carries on as if it worked. This is the most dangerous change in the diff.CONSTRAINTS.md: the changed-line coverage threshold drops from 80% to 60% in the same change as the code it would excuse. That breaks the rule against weakening the file.
The four edits fit one pattern: the agent hit red checks and took the cheapest route to green. Reject the diff. The agent should restore the test, fix the type of order.total, handle or rethrow the charge error, and put the threshold back at 80%.
Test run with the interview answers given up front, because the Skill does not run its interview in non-interactive mode. The model wrote CONSTRAINTS.md in a temporary folder, listed what to install, and correctly found four floor violations in a sample diff. It chose the 80% coverage figure itself and said so, and it did not open the floor-guard reference file. Nothing was installed.
Qué hace
Ejecuta una entrevista breve (stack, línea base actual, comprobaciones que ya tienes y qué puede cambiar el agente), y después escribe un CONSTRAINTS.md. Incluye una base mínima que bloquea desde el primer día (sin nuevos comentarios de supresión, sin stubs ni bloques catch vacíos, sin pruebas omitidas o eliminadas, sin aserciones eliminadas, sin secretos y sin debilitar el propio archivo), reglas numéricas con una herramienta concreta y un punto de ejecución para cada una (tipos, lint, secretos, cobertura de líneas modificadas, seguridad del código y de las dependencias, accesibilidad), un mecanismo de trinquete que mantiene los números actuales en lugar de subirlos, un presupuesto de tiempo para las comprobaciones propias del agente y una tabla de excepciones con responsables y fechas de caducidad. Las reglas nuevas empiezan como advertencias con una fecha para pasar a bloqueo. Enumera qué hay que instalar y qué scripts añadir, y puede revisar el diff de un agente contra la base mínima.
Resultado
Un CONSTRAINTS.md, instrucciones de instalación y conexión, y (si se solicita) un veredicto sobre un diff.
Ideal para
Equipos que dejan que un agente escriba código y quieren que las comprobaciones sean algo que el agente no pueda reescribir para obtener un resultado en verde.
Riesgo medio: la Skill en sí solo contiene instrucciones (más un archivo de referencia para un script floor-guard), pero indica al agente que escriba CONSTRAINTS.md y que sugiera instalar herramientas (coverage, gitleaks, Semgrep, osv-scanner, axe) y añadir scripts o hooks a tu proyecto. Revisa esos comandos antes de ejecutarlos. Se hizo una ejecución de prueba con las respuestas de la entrevista proporcionadas de antemano, ya que la entrevista no se ejecuta en modo no interactivo: escribió el archivo en una carpeta temporal, enumeró las instalaciones (no se instaló nada) y encontró cuatro infracciones de la base mínima en un diff de muestra. Eligió la cifra del 80 % por su cuenta y lo indicó; no abrió la referencia de floor-guard. Por Addy Osmani, MIT.