DDD + TDD verification

Audit, never modify. Covers a batch implemented by /implement-tdd, never a feature without plan. Validations run the repo's configured commands (commands.build, commands.test), resolved as in skills/implement-tdd/references/test-scope.md § Runner.

$ARGUMENTS

Modes

• Fast, default: global plan + batch sheet, DDD/APP/PERF coverage, applied ids, diff, modified files, targeted tests.
• Full, with full in argument: widens to touched boundaries, adds whole fast suites (§3.4). Never the whole IntegrationTests suite.
• Resume, with resume: re-audit after correction. Scope = previous verdict's deviation table + the correction's change set, both supplied by the caller — the change set read off the tree (cctoolkit audit-round), never the files the correction declared. Read only those files and their diff; re-judge only the axes and suites the deviations reach; nothing already verdicted is re-established. A changed file that is neither cited as a deviation's evidence nor the test of one is a Scope Major, unless the correction declared it as an extension whose reason a deviation's closure required. A gap the correction contested gets its answer (§ Contested findings).

Coverage: read the compact indexes ddd-rules.md + architecture-rules.md (under 6 kB), then the lines of the ids the sheet applies. ddd-examples.md only if an id stays ambiguous.

Workflow

1. Establish the scope

1. Require batch FX. The caller supplies the sheet's FX section and the capture of cctoolkit audit-capture: status, diff --check, modified files, diff, cctoolkit rules-coverage --untested and --ids <sheet>, cctoolkit access-cost --diff, build / ArchitectureTests exit codes. Use it as is; read the plan or sheet yourself only if missing or contradicting the repo. No capture → produce status, check and diff yourself, one command. Read the capture's ## Mechanical audit — FX section first (Axis | Check | Result | Evidence): an ok row is never re-established — no rerun, no re-derivation from the diff; a gap row is a finding of the verdict, severity of its axis (§ Severities), its Evidence cell the evidence; a not checked row is yours to judge, the layer-rule axes of §2 always are. No section (older capture): everything above is yours.
2. No full coverage, or no Design section: still audit the code (§2), report the plan gap as Major, fix = update sheet. Every id is applied on a sheet kit:applied-rules row, or N/A — reason once on the global plan's kit:na-rules line. The capture's not cited line settles the mechanical half — an id listed there = Blocking unclassified id. Yours: whether a stated N/A reason holds. Never infer design from the implementation.
3. Walk the diff hunk by hunk, tie each to an RM/CU or sheet step; untied = Scope deviation. Read beyond a hunk only when the axis being judged needs it. Expected diff already committed → require an explicit base in argument.

2. Audit the delivered code

One table, one pass, over the batch diff. A green test proves nothing here. Ids cited = those of ddd-rules.md + architecture-rules.md: read the id line before invoking it.

Locating the existing element behind a Reuse or Placement deviation: graphify explain|affected "X" first, grep -rn scoped to the layer folder otherwise.

Bug class — a Correctness, Cost or Placement deviation is a pattern, not a line. Before reporting it, git grep -n that pattern over the files the batch changed: every instance goes in the same gap, Evidence listing each path:line, Closure covering them all. Fixed one instance at a time, the class comes back each round.

Worsened — pre-existing defect the batch makes measurably worse, judged as if batch introduced it: severity of its axis, Gap cell prefixed (worsened). Worse means one more of the same thing: one more repository call in an already looping path, one more branch in an already defensive chain, one more copy of an already duplicated block, one more caller of a pre-existing unbounded read. Evidence: pre-existing state (context line of hunk, or path:line at base) and batch line adding to it. Untouched pre-existing defect, or one batch merely sits next to, stays Minor. Fix expected: only what batch added, never pre-existing part — outside scope.

Missing evidence never a favourable assumption: cite file and line where deviation observed, or say point could not be verified.

Don't propose adding a comment, XML doc, anticipatory abstraction or isolated aggregate test: they are deviations, not fixes.

Classify every code/plan divergence before reporting it, one explicit line:

• Faulty code — plan still right, implementation departs. Fix: code.
• Stale plan — implementation better, or decision settled mid-batch. Fix: sheet, plus source spec if RM/CU moves. Severity Minor — the code is the reference, the sheet a plan; Major only when an RM/CU moves and the spec must follow.
• Unsettleable divergence — both readings hold. Report both, arbitration to user. Never decide in plan's place.

RM/CU with no code owner stays blocking in all three cases: hole, not divergence.

3. Run the minimal validations

Runner, filters, suite scope, integration filter → skills/implement-tdd/references/test-scope.md. Test volume is an audit decision: never re-run what /implement-tdd or the capture already ran — read its exit code, run only what is missing or was scoped too narrowly.

1. Build + ArchitectureTests: exit codes from the capture. What ArchitectureTests locks is not re-argued; what it breaks is blocking.
2. Tests named in the sheet: targeted filter first.
3. Suites the diff makes mandatory, whole or filtered per §2 of that file.
4. full: adds UnitTests + ContractTests in full.

No green without exit code 0. Distinguish not run, skipped, failed. The Validations line carries each command's scope: a filter without scope reads as a full suite.

Severities

• Blocking — any of the four rules of test-scope.md §5, RM/CU with no code owner, unclassified id, rule applied with no owner, red ArchitectureTests, diff touching src/{{PRODUCT}}.Infrastructure/ with no integration test and no written waiver, cycle without observed RED (or TDD evidence ticked without observation on a sheet without ## Cycles), any Correctness deviation carrying breaking scenario.
• Major — missed reuse of named existing element, unbounded cost, business rule outside its aggregate, resource limit outside its owner (APP-05: WebAPI RequestLimits, PaginationBounds, ReadLimits), comment in production, stale plan moving an RM/CU, hunk outside batch scope.
• Minor — simplification with no functional consequence, pre-existing dead code or cost reported (observation, not request to fix), stale plan with no RM/CU moving. Pre-existing defect worsened by batch is never Minor by origin: severity of its axis.

Verdict GAPS as soon as Blocking or Major exists. Minors listed under VALID verdict without calling it into question.

Verdict

Verdict block alone, no preamble, no recap of plan, files or logs; on failure ≤6 useful lines of the command output. Ceiling 1.5 kB for VALID, 3 kB for GAPS — the calling session carries it every later turn. Headings, severities and axis labels are frozen literals (learn-candidates.py parses them). End with one of these two formats, verbatim:

## Verdict — VALID

| RM/CU or rule | Code evidence | Test evidence |
|---------------|---------------|---------------|
| RM-01 / DDD-02 / APP-01 | `path:line` | `Should...` |

Code — minors (do not block the next batch):
| Axis | Finding | Evidence |
|------|---------|----------|
| Simplification | Defensive branch on a case excluded by the invariant | `path:line` |

Scope: `[n]` hunks, all traced to an RM/CU or step — otherwise list the untraced hunks
Assumptions: `Hn` — `[assumption]`, to be validated by `[who]` — or "none"
Reported without fixing: `[pre-existing dead code or adjacent bug]` — `path:line`

Validations: `[command]` — exit 0, scope `[filter or "whole suite"]`, `[n]` tests
Not run: `[suite]` — `[reason]`

## Verdict — GAPS

| Severity | Axis | Gap | Evidence | Closure | Expected fix |
|----------|------|-----|----------|---------|--------------|
| Blocking | Correctness | Unhandled absence: `inputs X → wrong behaviour Y` | `path:line` | `inputs X` → `outcome Z`, a test proving it | Handle the missing case in the aggregate |
| Blocking | Test | Spy in a handler test | `path:line` | No interaction assertion left in the test | Assert the result or SavedEvents depending on the handler type |
| Major | Reuse | Second type of the same shape as the existing one | `path:line` | One type of that shape | Rename and extend `path:line` |
| Major | Cost | (worsened) Second repository call in a pre-existing loop | `path:line` | The batch adds no call inside the loop | Remove the call the batch added |
| Major | Plan | Stale plan: an RM moves, the sheet and the spec still state the old one | `path:line` | Sheet and spec state the delivered RM | Update the sheet, and the spec if an RM moves |
| Major | Scope | Hunk with no RM/CU nor owning step | `path:line` | Every hunk traced | Revert the hunk, or tie it to a step of the sheet |

Validations: `[command]` — exit N, scope `[filter or "whole suite"]` / not run

Closure = the observable state that closes the gap, checkable by reading the code or running a test; Expected fix is one way to reach it, never an order.

Contested findings

The correction may contest a gap instead of applying it, only by naming a concrete harm its closure would do: a behaviour it breaks, an invariant it violates, a cost it adds. "Complex", "out of scope", "not needed" open no contest: the gap is applied and the objection recorded. The resume audit answers each contest once, never by repeating the gap:

• Accept — the harm holds and outweighs the gap: the finding closes, the trade-off goes to the user's review.
• Counter — another closure reaches the gap without the harm: state it; the next round applies it.
• Refute — the harm does not hold: why, with evidence path:line; the next round applies the gap.
• Escalate — both readings hold and the choice is the user's: it goes to the user's review, nothing waits on it.