Windsurf rules

1---
2name: validate-fix
3model: haiku
4description: "Prove a fix works before declaring done — re-run the failing test, run the full suite, typecheck, lint, and harden against recurrence. Use after implementing a bug fix, when user says \"is this fixed?\", or before closing an investigation."
5---
6 
7# Validate Fix
8> **HARD GATE** — Fix must not regress. Run full test suite and manual UAT before declaring success.
9 
10 
11Prove the fix works. "I think it works" is not evidence. Run the suite, show the output, then harden against recurrence.
12 
13> **Two-commit red/green policy (e45s08)** — Bug fixes follow the same two-commit discipline as `develop-tdd`: first commit adds/adjusts the failing test (`test(<scope>): …`), second commit applies the fix (`fix(<scope>): …`). Do not squash RED and GREEN before review.
14 
15## Checklist
16 
17### 1. Re-run the originally failing test
18 
19```bash
20# Run the specific test that captured the bug
21&lt;test command for the failing test&gt;
22```
23 
24- [ ] Previously failing test now passes
25 
26### 2. Run the full test suite
27 
28```bash
29# Run all tests — no filtering
30&lt;full test command from CLAUDE.md&gt;
31```
32 
33- [ ] All tests pass (zero regressions)
34 
35### 3. Type check
36 
37```bash
38&lt;typecheck command&gt;
39```
40 
41- [ ] No type errors introduced
42 
43### 4. Lint
44 
45```bash
46&lt;lint command&gt;
47```
48 
49- [ ] No lint violations introduced
50 
51### 5. Harden against recurrence
52 
53For every bug fixed, add at least one prevention layer:
54 
55| Mechanism | When to use |
56|-----------|-------------|
57| Type guard | Input could be the wrong shape |
58| Schema validation (Zod, Pydantic, etc.) | External data crossing a boundary |
59| Invariant assertion | Internal state that must always hold |
60| Lint rule | Pattern that's easy to repeat by mistake |
61| Environment check at startup | Missing config causes silent failure |
62 
63- [ ] At least one hardening mechanism added
64- [ ] Hardening mechanism is tested
65 
66### 5b. Generalize-fix (HARD GATE — e80s04 / GH #98)
67 
68Sweep the **defect class** across the codebase after local hardening — see [REFERENCE-generalize-fix.md](REFERENCE-generalize-fix.md).
69 
70- [ ] Defect class documented (not just the one-line root cause)
71- [ ] Grep sweep run and `match_count` recorded
72- [ ] `verify-generalize-sweep.sh` passes on the artifact
73 
74### 6. Update the bug file and registry.yaml
75 
76Find the most recent `specs/bugs/BUG-*.md` file and append the resolution:
77 
78```markdown
79## Resolution
80 
81**Fixed:** [date]
82**Root cause confirmed:** [one sentence]
83**Fix applied:** [what was changed]
84**Hardening added:** [type guard / schema / assertion / lint rule]
85**Evidence:** all tests pass (`<verify command>`)
86**Commit:** `fix(<scope>): <description>`
87```
88 
89Also update the corresponding row in `specs/bugs/registry.yaml`: set `status` to `fixed`, fill in `files_changed`, `approach`, `risk_level`, `commit_message`, and any other resolution fields.
90 
91- [ ] specs/bugs/BUG-*.md updated with resolution
92- [ ] specs/bugs/registry.yaml row updated with resolution fields
93 
94### 7. Behavioral Proof (HARD GATE)
95 
96Mechanical verification (tests passing) is only half the fix. You must prove **behavioral correctness**.
97 
98- [ ] Manually demonstrate the fixed behavior (e.g., via `run_shell_command` or `web_fetch`)
99- [ ] Compare the output/state against the "Expected Behavior" in the bug file
100- [ ] Show the user evidence of the behavior, not just the test logs
101 
102## Rules
103 
104- **Loop until behavioral correctness is verified**: if any checklist item fails, or if the behavior is still incorrect despite passing tests, return to step 1 and run all checks again from the top — do not declare done until every item is green and the behavior is proven correct in a single run.
105- **Never use `@ts-ignore`, `as any`, or `// eslint-disable`** to "fix" a bug — these suppress the symptom without fixing the root cause
106- **Never mark the task done if any test is still failing**
107- **The verify command from specs/bugs/BUG-*.md or the active epic task `verify` field must pass**
108 
109Suggest next skill: `audit-code` → `commit-message`.
110 
111## Verify
112 
113→ verify: `grep -q 'generalize-fix' skills/validate-fix/SKILL.md && test -x scripts/verify-generalize-sweep.sh && bash scripts/verify-generalize-sweep.sh --self-test && echo OK`
114 
115---
116 
117# Generalize-fix (e80s04 / GH #98)
118 
119After local hardening in `validate-fix`, sweep the **defect class** across the codebase.
120 
121## Steps
122 
1231. **Classify** — name the pattern (e.g. `unscoped org query`, `fail-open verify`, `hardcoded package manager`).
1242. **Sweep** — grep for sibling instances; record `match_count` and `grep_pattern`.
1253. **Resolve** — patch all matches in this PR **or** file one tracking issue listing every remaining instance.
1264. **Artifact** — write sweep evidence before declaring done:
127 
128```bash
129cat &gt; specs/verifications/generalize-sweep-BUG-YYYY-MM-DD-slug.json &lt;&lt;EOF
130{
131  &quot;defect_class&quot;: &quot;fail-open-verify&quot;,
132  &quot;grep_pattern&quot;: &quot;\\\\|\\\\| echo&quot;,
133  &quot;match_count&quot;: 0,
134  &quot;sweep_scope&quot;: &quot;skills/*/SKILL.md&quot;,
135  &quot;patched_in_pr&quot;: [],
136  &quot;tracked_issues&quot;: []
137}
138EOF
139bash scripts/verify-generalize-sweep.sh specs/verifications/generalize-sweep-*.json
140```
141 
142## Security classes
143 
144When the defect class is security- or gate-relevant:
145 
146- Add a row to `security-review` CWE fixture table (see `skills/security-review/SKILL.md` § CWE mapping mandate).
147- If security-impact was MEDIUM+: add regression test, false-positive exclusion rule, and threat-model update (HIGH+).
148