docs(review): reject self-validating/vacuous tests as [MAJOR] (bookshelf-s957) #1417

Merged
zombor merged 2 commits from bd-bookshelf-s957 into main 2026-08-10 01:52:16 +00:00
Owner

Adds a 'reject self-validating / vacuous tests' section to .claude/rules/review-standard.md (graded [MAJOR]) and a matching prohibition to tdd-workflow.md. Motivated by the can't-fail tests caught 6x in epic ukqt + reader work, and the two gate-gaming attempts this session. Docs/rules only — no code. Closes bead bookshelf-s957 on merge.

Adds a 'reject self-validating / vacuous tests' section to .claude/rules/review-standard.md (graded [MAJOR]) and a matching prohibition to tdd-workflow.md. Motivated by the can't-fail tests caught 6x in epic ukqt + reader work, and the two gate-gaming attempts this session. Docs/rules only — no code. Closes bead bookshelf-s957 on merge.
docs(review): reject self-validating/vacuous tests as [MAJOR] (bookshelf-s957)
All checks were successful
/ Test Race (pull_request) Successful in 1m48s
/ E2E API (pull_request) Successful in 1m16s
/ Coverage (pull_request) Successful in 2m19s
/ JS Unit Tests (pull_request) Successful in 1m13s
/ Lint (pull_request) Successful in 2m47s
/ Integration (pull_request) Successful in 2m22s
/ E2E Browser (pull_request) Successful in 4m41s
d5a3301b54
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016tRKybTpfjQ4SxmNdVFLHi
Author
Owner

Security Review — PR #1417

Verified the diff is documentation-only: two files changed, both .claude/rules/*.md (review-standard.md, tdd-workflow.md). Confirmed via pulls/1417.diff — no .go, .sql, .yml/.yaml (no .forgejo/workflows/ changes), Makefile, template, JS/CSS, or any other executable/config file is touched. The change is purely additive prose adding a new review rule ("reject self-validating/vacuous tests") plus a one-line cross-reference in tdd-workflow.md. No secrets, credentials, URLs, or scripts are introduced.

No multi-user scoping, authZ, injection/SSRF, input-bounds, architecture-boundary, secrets/PII, or CSP surface is present in this diff — none of those categories apply to markdown-only rule files with no runtime consumption.

No findings.

REVIEW VERDICT: 0 blocker, 0 major, 0 minor

## Security Review — PR #1417 Verified the diff is documentation-only: two files changed, both `.claude/rules/*.md` (`review-standard.md`, `tdd-workflow.md`). Confirmed via `pulls/1417.diff` — no `.go`, `.sql`, `.yml`/`.yaml` (no `.forgejo/workflows/` changes), `Makefile`, template, JS/CSS, or any other executable/config file is touched. The change is purely additive prose adding a new review rule ("reject self-validating/vacuous tests") plus a one-line cross-reference in `tdd-workflow.md`. No secrets, credentials, URLs, or scripts are introduced. No multi-user scoping, authZ, injection/SSRF, input-bounds, architecture-boundary, secrets/PII, or CSP surface is present in this diff — none of those categories apply to markdown-only rule files with no runtime consumption. No findings. REVIEW VERDICT: 0 blocker, 0 major, 0 minor
Author
Owner

Code Review — PR #1417 (bd-bookshelf-s957)

Diff-review only (markdown-only docs/rules change, CI green).

Verification performed:

  • Confirmed the "SIX times" examples listed in the new review-standard.md section match the bead (bookshelf-s957) description exactly.
  • Confirmed the bookshelf-dfknw citation is a real, closed bead whose description matches the cited example (OIDC valid-library-IDs test that passes only because the stub returns nil).
  • Confirmed the [MAJOR] severity floor is consistent with every other section's pattern in the file ("at least a [MAJOR]" — Flake prevention, Linter baseline integrity, Workflow versioning all use this phrasing).
  • Confirmed tdd-workflow.md's new prohibition bullet correctly cross-references review-standard.md.
  • No contradictions found with the existing severity definitions (BLOCKER/MAJOR/MINOR).

Findings:

[MINOR] .claude/rules/review-standard.md:110 — Duplicate adjacent section-header prefix
The new ## Test hygiene (reject self-validating / vacuous tests) header sits immediately after the pre-existing ## Test hygiene (reject white-box / internal tests) header. Two consecutive H2s sharing the same "Test hygiene" prefix is a minor scannability nit (grep-by-heading / flat TOC). Consider merging under one ## Test hygiene parent with subheadings, or renaming the new one (e.g. ## Vacuous / self-validating tests). Cosmetic only.

[MINOR] .claude/rules/review-standard.md:117-126 — "Self-validating" bullet conflates two distinct failure modes
The bullet mixes "asserting state the test itself created/set" (test never touches production output) with "a value echoed straight back from a stub" (production path runs but the stub makes the assertion trivially true). Both are real and worth banning, but splitting into two clauses would make the rule slightly easier to pattern-match against in the wild. Not required — guidance is still correct and enforceable as written.

No blockers or majors — this is a pure documentation diff with no code, factually accurate to its cited precedent, and internally consistent with the file's existing severity-grading conventions.

REVIEW VERDICT: 0 blocker, 0 major, 2 minor

## Code Review — PR #1417 (bd-bookshelf-s957) Diff-review only (markdown-only docs/rules change, CI green). **Verification performed:** - Confirmed the "SIX times" examples listed in the new review-standard.md section match the bead (bookshelf-s957) description exactly. - Confirmed the `bookshelf-dfknw` citation is a real, closed bead whose description matches the cited example (OIDC valid-library-IDs test that passes only because the stub returns nil). - Confirmed the `[MAJOR]` severity floor is consistent with every other section's pattern in the file ("at least a [MAJOR]" — Flake prevention, Linter baseline integrity, Workflow versioning all use this phrasing). - Confirmed `tdd-workflow.md`'s new prohibition bullet correctly cross-references `review-standard.md`. - No contradictions found with the existing severity definitions (BLOCKER/MAJOR/MINOR). **Findings:** [MINOR] .claude/rules/review-standard.md:110 — Duplicate adjacent section-header prefix The new `## Test hygiene (reject self-validating / vacuous tests)` header sits immediately after the pre-existing `## Test hygiene (reject white-box / internal tests)` header. Two consecutive H2s sharing the same "Test hygiene" prefix is a minor scannability nit (grep-by-heading / flat TOC). Consider merging under one `## Test hygiene` parent with subheadings, or renaming the new one (e.g. `## Vacuous / self-validating tests`). Cosmetic only. [MINOR] .claude/rules/review-standard.md:117-126 — "Self-validating" bullet conflates two distinct failure modes The bullet mixes "asserting state the test itself created/set" (test never touches production output) with "a value echoed straight back from a stub" (production path runs but the stub makes the assertion trivially true). Both are real and worth banning, but splitting into two clauses would make the rule slightly easier to pattern-match against in the wild. Not required — guidance is still correct and enforceable as written. No blockers or majors — this is a pure documentation diff with no code, factually accurate to its cited precedent, and internally consistent with the file's existing severity-grading conventions. REVIEW VERDICT: 0 blocker, 0 major, 2 minor
Merge branch 'main' into bd-bookshelf-s957
All checks were successful
/ Test Race (pull_request) Successful in 1m50s
/ E2E API (pull_request) Successful in 1m44s
/ JS Unit Tests (pull_request) Successful in 54s
/ Coverage (pull_request) Successful in 2m29s
/ Lint (pull_request) Successful in 2m53s
/ Integration (pull_request) Successful in 2m38s
/ E2E Browser (pull_request) Successful in 4m59s
cebbd5203a
zombor merged commit b167f4cdf2 into main 2026-08-10 01:52:16 +00:00
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
zombor/pergamum!1417
No description provided.