I wrote CONSTRAINTS.md in the current folder. There is no AGENTS.md here, so I didn't add the pointer line to it. In your real repo, add this line to AGENTS.md: Read CONSTRAINTS.md before writing code. Do not weaken it to make a change pass.
What's in it
- Floor (blocks now): no new suppressions, no stubs or empty
catch, no skipped or deleted tests, no stripped assertions, no secrets, and no weakening the file itself. - Warn until 2026-10-24, then block: types, lint, changed-line coverage ≥ 80%, Semgrep, osv-scanner and axe.
- Held, not enforced: project coverage stays at 58.2% (0.5% tolerance) and the bundle stays at 212 kB.
- Budget: checks at task end must finish in 90 seconds. Semgrep, osv-scanner and axe run in CI or on the preview deploy.
- Performance budget: you didn't pick one, so bundle size is only tracked. I picked 80% for changed-line coverage myself, because you asked to hold the current level and 80% is the skill's default for new code. Say so if you'd rather not have it.
What to install and wire up
You already have tsc, Vitest and Biome.
| Tool | Install |
|---|---|
| Coverage | npm i -D @vitest/coverage-v8, with the lcov reporter on |
| gitleaks | brew install gitleaks |
| Semgrep | pipx install semgrep |
| osv-scanner | brew install osv-scanner |
| axe | npm i -D @axe-core/cli |
Add these scripts to package.json:
"check:fast": "tsc --noEmit && biome check . && gitleaks detect --redact --no-banner",
"check:task": "npm run check:fast && vitest run --coverage",
"check:full": "npm run check:task && semgrep scan --config p/default --config p/owasp-top-ten && osv-scanner scan source -r ."
- After each edit: run
check:fast, for example from an agent post-edit hook. - At task end: run
check:task. Compare the lcov it writes againstgit difffor the 80% changed-line check, without running the tests a second time. - In GitHub Actions: run
check:fullon every PR. After the preview deploy, runaxe $PREVIEW_URL --tags wcag2a,wcag2aa,wcag21aa. - Floor guard: it needs no installs and only reads the diff. Adapt the reference implementation in the skill's
references/floor-guard.md, which I haven't opened. - gitleaks: always use
--redact, so a leaked key never lands in a transcript.
The diff against the floor
It violates the floor in four places, and one of them also edits the constraints file.
cart.test.ts:it.skipadds a skipped test, and the assertionexpect(...).toThrow()is stripped. Nothing in the diff gives a reason in a commit message. The negative-quantity rule is no longer tested.pay.ts,// @ts-ignore: this is a new suppression. It hides a type problem onorder.totalthat should be fixed.pay.ts,catch {}: this is an emptycatcharoundcharge(total). A failed payment now passes silently and the code carries on as if it worked. This is the most dangerous change in the diff.CONSTRAINTS.md: the changed-line coverage threshold drops from 80% to 60% in the same change as the code it would excuse. That breaks the rule against weakening the file.
The four edits fit one pattern: the agent hit red checks and took the cheapest route to green. Reject the diff. The agent should restore the test, fix the type of order.total, handle or rethrow the charge error, and put the threshold back at 80%.
Test run with the interview answers given up front, because the Skill does not run its interview in non-interactive mode. The model wrote CONSTRAINTS.md in a temporary folder, listed what to install, and correctly found four floor violations in a sample diff. It chose the 80% coverage figure itself and said so, and it did not open the floor-guard reference file. Nothing was installed.
できること
短いインタビュー(技術スタック、現在のベースライン、既存のチェック、エージェントが変更してよい範囲)を行い、CONSTRAINTS.md を書きます。初日から止める最低線(新しい抑制コメントなし、スタブや空の catch なし、テストのスキップや削除なし、アサーションの削除なし、秘密情報なし、このファイル自体を弱めない)、ツール名と実行タイミングを明記した数値ルール(型、lint、秘密情報、変更行のカバレッジ、コードと依存関係のセキュリティ、アクセシビリティ)、今日の数値を引き上げずに守るラチェット、エージェント自身のチェックの時間予算、担当者と期限付きの例外表を含みます。新しいルールはまず警告から始め、ブロックに切り替える日付を書きます。インストールするものと追加するスクリプトの一覧を示し、エージェントの diff を最低線に照らしてレビューすることもできます。
出力
CONSTRAINTS.md、インストールと配線の手順、(依頼があれば)diff の判定。
こんな場面に
エージェントにコードを書かせつつ、緑にするためにチェックを書き換えられては困るチーム。
中リスク:Skill 自体は指示のみ(最低線ガード用スクリプトの参考ファイル付き)ですが、エージェントに CONSTRAINTS.md を書かせ、ツール(カバレッジ、gitleaks、Semgrep、osv-scanner、axe)のインストールやスクリプト、フックの追加を提案します。実行前にそれらのコマンドを確認してください。インタビューは非対話モードでは動かないため、試用では答えを先に与えました。一時フォルダーにファイルを書き、必要なインストールを一覧にし(実際のインストールはしていません)、サンプル diff から最低線違反を4件見つけました。80%という数値はモデルが自分で選び、そう明記しています。最低線ガードの参考ファイルは開いていません。作者 Addy Osmani、MIT。