제약 주도 개발 Constraint-Driven Development

I wrote CONSTRAINTS.md in the current folder. There is no AGENTS.md here, so I didn't add the pointer line to it. In your real repo, add this line to AGENTS.md: Read CONSTRAINTS.md before writing code. Do not weaken it to make a change pass.

What's in it

• Floor (blocks now): no new suppressions, no stubs or empty catch, no skipped or deleted tests, no stripped assertions, no secrets, and no weakening the file itself.
• Warn until 2026-10-24, then block: types, lint, changed-line coverage ≥ 80%, Semgrep, osv-scanner and axe.
• Held, not enforced: project coverage stays at 58.2% (0.5% tolerance) and the bundle stays at 212 kB.
• Budget: checks at task end must finish in 90 seconds. Semgrep, osv-scanner and axe run in CI or on the preview deploy.
• Performance budget: you didn't pick one, so bundle size is only tracked. I picked 80% for changed-line coverage myself, because you asked to hold the current level and 80% is the skill's default for new code. Say so if you'd rather not have it.

What to install and wire up

You already have tsc, Vitest and Biome.

Add these scripts to package.json:

"check:fast": "tsc --noEmit && biome check . && gitleaks detect --redact --no-banner",
"check:task": "npm run check:fast && vitest run --coverage",
"check:full": "npm run check:task && semgrep scan --config p/default --config p/owasp-top-ten && osv-scanner scan source -r ."

• After each edit: run check:fast, for example from an agent post-edit hook.
• At task end: run check:task. Compare the lcov it writes against git diff for the 80% changed-line check, without running the tests a second time.
• In GitHub Actions: run check:full on every PR. After the preview deploy, run axe $PREVIEW_URL --tags wcag2a,wcag2aa,wcag21aa.
• Floor guard: it needs no installs and only reads the diff. Adapt the reference implementation in the skill's references/floor-guard.md, which I haven't opened.
• gitleaks: always use --redact, so a leaked key never lands in a transcript.

The diff against the floor

It violates the floor in four places, and one of them also edits the constraints file.

1. cart.test.ts: it.skip adds a skipped test, and the assertion expect(...).toThrow() is stripped. Nothing in the diff gives a reason in a commit message. The negative-quantity rule is no longer tested.
2. pay.ts, // @ts-ignore: this is a new suppression. It hides a type problem on order.total that should be fixed.
3. pay.ts, catch {}: this is an empty catch around charge(total). A failed payment now passes silently and the code carries on as if it worked. This is the most dangerous change in the diff.
4. CONSTRAINTS.md: the changed-line coverage threshold drops from 80% to 60% in the same change as the code it would excuse. That breaks the rule against weakening the file.

The four edits fit one pattern: the agent hit red checks and took the cheapest route to green. Reject the diff. The agent should restore the test, fix the type of order.total, handle or rethrow the charge error, and put the threshold back at 80%.