Cursor rule

1---
2description: "Prove a fix works before declaring done — re-run the failing test, run the full suite, typecheck, lint, and harden against recurrence. Use after implementing a bug fix, when user says \"is this fixed?\", or before closing an investigation."
3alwaysApply: false
4---
5 
6# Validate Fix
7> **HARD GATE** — Fix must not regress. Run full test suite and manual UAT before declaring success.
8 
9 
10Prove the fix works. "I think it works" is not evidence. Run the suite, show the output, then harden against recurrence.
11 
12> **Two-commit red/green policy (e45s08)** — Bug fixes follow the same two-commit discipline as `develop-tdd`: first commit adds/adjusts the failing test (`test(<scope>): …`), second commit applies the fix (`fix(<scope>): …`). Do not squash RED and GREEN before review.
13 
14## Checklist
15 
16### 1. Re-run the originally failing test
17 
18```bash
19# Run the specific test that captured the bug
20&lt;test command for the failing test&gt;
21```
22 
23- [ ] Previously failing test now passes
24 
25### 2. Run the full test suite
26 
27```bash
28# Run all tests — no filtering
29&lt;full test command from CLAUDE.md&gt;
30```
31 
32- [ ] All tests pass (zero regressions)
33 
34### 3. Type check
35 
36```bash
37&lt;typecheck command&gt;
38```
39 
40- [ ] No type errors introduced
41 
42### 4. Lint
43 
44```bash
45&lt;lint command&gt;
46```
47 
48- [ ] No lint violations introduced
49 
50### 5. Harden against recurrence
51 
52For every bug fixed, add at least one prevention layer:
53 
54| Mechanism | When to use |
55|-----------|-------------|
56| Type guard | Input could be the wrong shape |
57| Schema validation (Zod, Pydantic, etc.) | External data crossing a boundary |
58| Invariant assertion | Internal state that must always hold |
59| Lint rule | Pattern that's easy to repeat by mistake |
60| Environment check at startup | Missing config causes silent failure |
61 
62- [ ] At least one hardening mechanism added
63- [ ] Hardening mechanism is tested
64 
65### 5b. Generalize-fix (HARD GATE — e80s04 / GH #98)
66 
67Sweep the **defect class** across the codebase after local hardening — see [REFERENCE-generalize-fix.md](REFERENCE-generalize-fix.md).
68 
69- [ ] Defect class documented (not just the one-line root cause)
70- [ ] Grep sweep run and `match_count` recorded
71- [ ] `verify-generalize-sweep.sh` passes on the artifact
72 
73### 6. Update the bug file and registry.yaml
74 
75Find the most recent `specs/bugs/BUG-*.md` file and append the resolution:
76 
77```markdown
78## Resolution
79 
80**Fixed:** [date]
81**Root cause confirmed:** [one sentence]
82**Fix applied:** [what was changed]
83**Hardening added:** [type guard / schema / assertion / lint rule]
84**Evidence:** all tests pass (`<verify command>`)
85**Commit:** `fix(<scope>): <description>`
86```
87 
88Also update the corresponding row in `specs/bugs/registry.yaml`: set `status` to `fixed`, fill in `files_changed`, `approach`, `risk_level`, `commit_message`, and any other resolution fields.
89 
90- [ ] specs/bugs/BUG-*.md updated with resolution
91- [ ] specs/bugs/registry.yaml row updated with resolution fields
92 
93### 7. Behavioral Proof (HARD GATE)
94 
95Mechanical verification (tests passing) is only half the fix. You must prove **behavioral correctness**.
96 
97- [ ] Manually demonstrate the fixed behavior (e.g., via `run_shell_command` or `web_fetch`)
98- [ ] Compare the output/state against the "Expected Behavior" in the bug file
99- [ ] Show the user evidence of the behavior, not just the test logs
100 
101## Rules
102 
103- **Loop until behavioral correctness is verified**: if any checklist item fails, or if the behavior is still incorrect despite passing tests, return to step 1 and run all checks again from the top — do not declare done until every item is green and the behavior is proven correct in a single run.
104- **Never use `@ts-ignore`, `as any`, or `// eslint-disable`** to "fix" a bug — these suppress the symptom without fixing the root cause
105- **Never mark the task done if any test is still failing**
106- **The verify command from specs/bugs/BUG-*.md or the active epic task `verify` field must pass**
107 
108Suggest next skill: `audit-code` → `commit-message`.
109 
110## Verify
111 
112→ verify: `grep -q 'generalize-fix' skills/validate-fix/SKILL.md && test -x scripts/verify-generalize-sweep.sh && bash scripts/verify-generalize-sweep.sh --self-test && echo OK`
113 
114---
115 
116# Generalize-fix (e80s04 / GH #98)
117 
118After local hardening in `validate-fix`, sweep the **defect class** across the codebase.
119 
120## Steps
121 
1221. **Classify** — name the pattern (e.g. `unscoped org query`, `fail-open verify`, `hardcoded package manager`).
1232. **Sweep** — grep for sibling instances; record `match_count` and `grep_pattern`.
1243. **Resolve** — patch all matches in this PR **or** file one tracking issue listing every remaining instance.
1254. **Artifact** — write sweep evidence before declaring done:
126 
127```bash
128cat &gt; specs/verifications/generalize-sweep-BUG-YYYY-MM-DD-slug.json &lt;&lt;EOF
129{
130  &quot;defect_class&quot;: &quot;fail-open-verify&quot;,
131  &quot;grep_pattern&quot;: &quot;\\\\|\\\\| echo&quot;,
132  &quot;match_count&quot;: 0,
133  &quot;sweep_scope&quot;: &quot;skills/*/SKILL.md&quot;,
134  &quot;patched_in_pr&quot;: [],
135  &quot;tracked_issues&quot;: []
136}
137EOF
138bash scripts/verify-generalize-sweep.sh specs/verifications/generalize-sweep-*.json
139```
140 
141## Security classes
142 
143When the defect class is security- or gate-relevant:
144 
145- Add a row to `security-review` CWE fixture table (see `skills/security-review/SKILL.md` § CWE mapping mandate).
146- If security-impact was MEDIUM+: add regression test, false-positive exclusion rule, and threat-model update (HIGH+).
147