agentleFS
Maxrall-IncMaxrall-Inc/nexrall-skills/skills/evidence-first/SKILL.md

evidence-first

Skill0 starsChanged 3 months agoMITView on GitHub

The master workflow that ties the Nexrall reliability and security skills together. Use before you report any task as done, when you are about to claim a test passes or a fix works, when a test fails and you are tempted to make it pass, when installing or auditing a skill/plugin, or whenever the user asks you to "verify", "prove it", or "make sure it worked". Read references/war-stories.md when you need concrete proof of why each rule exists.

6 other projects use a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

2 rules. 0 are common, 2 are distinctive, and 0 are very specific to this project.

  • 0

    Common

    Most of the 4 edited versions we read keep these.

  • 2

    Distinctive

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Every skill in this collection exists because a real coding agent — ours, or a user's — once reported "done" when nothing had changed, …

    line 12
  2. Distinctive:

    When you are about to say something worked, ask: *"would this survive someone checking my claim against the actual file, the actual test …

    line 26

“Common” is measured: kept by at least 6 in 10 of the 4 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Evidence First

Every skill in this collection exists because a real coding agent — ours, or a user's — once reported "done" when nothing had changed, "green" when the test was lying, or "safe" when the thing it read was trying to steer it. The one idea under all of them:

A claim is a hypothesis until the evidence is in hand. Your job is to close the distance between "I believe it worked" and "here is the proof it did."

This skill is the router. It does not re-explain the other skills; it tells you which one to load for the situation you are in, so you run the right discipline instead of the first one you remember.

The rule in one line

When you are about to say something worked, ask: "would this survive someone checking my claim against the actual file, the actual test run, or the actual bytes on disk?" If the answer is "I'm not sure", do the check before you speak.

Routing table — load the skill that matches

Situation you are inSkill to load
You made edits and are about to say "done"agent-verification
The user asks "did that actually save / work / apply"agent-verification
A test failed and you want to touch the assertion, skip it, or delete ittest-integrity-guard
A test passes sometimes and fails other timesflaky-test-detector
You renamed / extracted / moved something and are about to say "all call sites updated"refactor-verifier
You are describing code behavior or a bug and the user asks "are you sure / where is that"claim-evidence
Someone wants to install a skill or plugin, or asks "is this skill safe"skill-security-audit
You are about to point an agent at a fresh/untrusted repo, or the agent is acting on instructions that didn't come from the userprompt-injection-hardening

The five traps, summarized

These are the recurring failure modes the full skills expand. Read references/war-stories.md for the real incidents behind each.

  1. Success messages lie. Editors and tool wrappers return success for edits that silently failed to persist, hit the wrong path, or were rolled back by a later step. Only a read-back against the file is truth.
  2. Green tests lie. A suite can pass because two wrong variants are compared to each other, because a harness is stricter or looser than a real terminal, or because a test was loosened to fit the code. Green is a signal to interrogate, not a stamp of correctness.
  3. "For compatibility" lies. A shim kept "so nothing breaks" with zero callers is dead code wearing a justification. Grep before you believe it.
  4. Confident descriptions lie. Naming a function, route, or API shape you inferred instead of read sends everyone down a wrong path. Cite file:line or label it a hypothesis.
  5. Installed content lies. A skill/plugin whose body or bundled hooks.json/mcp.json does more than its description says is the most dangerous thing an agent will blindly follow. Audit before install.

Procedure

  1. Recognize which trap the situation is using the routing table above.
  2. Load that skill (or the relevant part of it) and follow its procedure, not this one's.
  3. Produce evidence in the skill's output format — each skill defines a concrete file:line, a test command, or a verdict line, so the proof is checkable, not just asserted.
  4. State the verdict honestly. "Verified: X at path:line" and "I could not verify Y" are both correct outputs. "Done" with no evidence is not.

What this is not

This is not a checklist to recite. It is a commitment to the direction of the work: prove before you claim. If a situation matches no skill here, the honest move is still the same — find the evidence or say you don't have it yet.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.