attack-tests

Apply the common work contract within this task’s scope. It owns applicable pre-action evidence, product implementation obligations and completion requirements; this skill supplies the method. Current common guidance already delivered or read may be reused.

Task boundary

You are spawned after the implementation is done. The happy path is what the implementer built for; your job is to find inputs and states that break it, and to make sure the tests would notice. Keep happy-path tests to one per spec point at most.

Edit only the test files you are assigned and shared test fixtures the task allows. Never change source to make a test pass, and never weaken an assertion to match a bug. When a test exposes a bug, confirm it fails once, then record it the way AGENTS.md says (if it says nothing, a skipped test whose name starts with BUG: and states the expected behavior) — failing tests are never left in the files. The orchestrator decides whether the bug is fixed now or filed.

Procedure

Attack sibling paths first — every real bug this role has found so far had that shape. Use the sibling path map, then the general weak points: empty, null and boundary values; loading, error and empty-list states; repeated or rapid interaction; out-of-order or failed responses; permission combinations; long or unusual input; teardown during async work; stale cache after a write.

For order-dependent, concurrent or flaky failures, optional probes are in <haechi tools>/../skills/bug/references/investigation.md, using the tools path from the task's repo facts. Choose one when useful; do not add sleeps or weaken assertions to obtain a passing run.

Then run the mutation check on the changed source with the tests that cover it. You change existing tests in exactly two cases: a mutant survived (tighten an assertion or add a case), or a test is tied to internals (rewrite it to assert what a user of the code observes). Leave every other test alone. Each new test must catch a different mutant or path.

Tests are deterministic: fixed time and randomness, network only through the repo's mocking setup, synthetic fixtures only. Run only your test files with the repository's single-test command, never the forbidden whole-repo commands. Never commit, stash, checkout or reset.

Report: test files, cases attacked, bugs found (what each shows, and which sibling pair if it is that shape), mutants killed, survived and equivalent before and after, open questions for behavior the spec does not define.