Testability Canary (Decoupling & Mockability Audit)

Audit code to ensure it is decoupled, modular, and easy to cover with automated tests.

Auditing Categories

1. Hardcoded Constructors — instantiating deps inside classes (new DatabaseClient()) instead of injecting via constructor/factory (prevents mocking).
2. SRP Violations — a class or method doing too many distinct duties (e.g. a service that also parses JSON and formats UI).
3. Static Dependencies — reliance on global static methods or Singletons that make test isolation impossible.
4. Time & Environment Coupling — direct DateTime.Now, fs, or process.env calls without an abstraction layer (fragile time/path-sensitive tests).
5. Private Logic Gaps — complex business logic hidden in private methods that can't be tested directly (extract to testable helpers).

Per-stack patterns and the mock-strategy vocabulary: read references/checks.md before scanning.

Fix mode (choice-gated)

In Agent Context, after the report, present via ask_question:

• Apply safe refactoring: extract hardcoded initializations into constructor params (DI) + add interface definitions. Each fix: checkpoint (copy the touched file(s) aside, or use an isolated worktree — never git stash/git commit, which can hide or include unrelated staged/unstaged user work) → record a build+test BASELINE → apply → build + tests → auto-revert only if a NEW failure appeared versus the baseline.
• Let me pick: user selects specific refactoring moves.
• Report only: exit unchanged.

Grants & denials (CLASSIFY-BLOCK)

Output

| file:line | coupling point | severity | finding | mock strategy |

Severity: CRITICAL (un-mockable external write/network call) · HIGH (SRP violation blocking unit testing) · MEDIUM (time/env coupling) · LOW (minor static dependency)