safeguard

Name: safeguard
Author: Rune-kit

80stars21forks

How to install safeguard?

rune-kit/rune/safeguard

$npx -y skills add Rune-kit/rune --skill safeguard

Installs into the current project.

Summary

Build safety nets before refactoring. Use when running surgeon or any risky refactor that needs a rollback point. Creates characterization tests, boundary markers, config freezes, and rollback points.

Files · 1

View on GitHub

SKILL.md

1	# safeguard
2
3	## Purpose
4
5	Build safety nets before any refactoring begins. Safeguard creates characterization tests that capture current behavior, adds boundary markers to distinguish legacy from new code, freezes config files, and creates git rollback points. Nothing gets refactored without safeguard running first.
6
7	<HARD-GATE>
8	Characterization tests MUST pass on the current (unmodified) code before any refactoring starts. If they do not pass, safeguard is not complete.
9	</HARD-GATE>
10
11	## Called By (inbound)
12
13	- `rescue` (L1): Phase 1 SAFETY NET — build protection before surgery
14	- `surgeon` (L2): untested module found during surgery
15
16	## Calls (outbound)
17
18	- `scout` (L2): find all entry points and public interfaces of the target module
19	- `test` (L2): write and run characterization tests for the target module
20	- `verification` (L3): verify characterization tests pass on current code
21
22	## Cross-Hub Connections
23
24	- `surgeon` → `safeguard` — untested module found during surgery
25
26	## Execution Steps
27
28	### Step 1 — Identify module boundaries
29
30	Call `rune:scout` targeting the specific module. Ask scout to return:
31	- All public functions, classes, and exported symbols
32	- All files that import from this module (consumers)
33	- All files this module imports from (dependencies)
34	- Existing test files for this module (if any)
35
36	Use `Read` to open the module entry file and confirm the public interface.
37
38	### Step 2 — Write characterization tests
39
40	Create a test file at `tests/char/<module-name>.test.ts` (or `.js`, `.py` matching project convention).
41
42	Use `Write` to create the characterization test file. Rules for characterization tests:
43	- Tests MUST capture what the code CURRENTLY does, not what it should do
44	- Include edge cases that currently produce surprising output — test for that actual output
45	- Do NOT fix bugs in characterization tests — if the current code returns wrong data, test for that wrong data
46	- Cover every public function in the module
47	- Include at least one integration test calling the module as an external consumer would
48
49	Example structure:
50	```typescript
51	// tests/char/<module>.test.ts
52	// CHARACTERIZATION TESTS — DO NOT MODIFY without running safeguard again
53	// These tests capture existing behavior as of: [date]
54
55	describe('<module> — characterization', () => {
56	it('existing behavior: [function] with [input] returns [actual output]', () => {
57	// ...
58	})
59	})
60	```
61
62	### Step 3 — Add boundary markers
63
64	Use `Edit` to add boundary comments at the top of the module file and at key function boundaries:
65
66	```typescript
67	// @legacy — rune-safeguard [date] — do not refactor without characterization tests passing
68	```
69
70	For functions flagged by autopsy as high-risk, add:
71	```typescript
72	// @do-not-touch — coupled to [module], change both or neither
73	```
74
75	For planned new implementations, mark insertion points:
76	```typescript
77	// @bridge — new-v2 will replace this interface
78	```
79
80	### Step 4 — Config freeze
81
82	Use `Bash` to record current config state:
83
84	```bash
85	mkdir -p .rune
86	cp tsconfig.json .rune/tsconfig.frozen.json 2>/dev/null \|\| true
87	cp .eslintrc* .rune/ 2>/dev/null \|\| true
88	cp package-lock.json .rune/package-lock.frozen.json 2>/dev/null \|\| true
89	echo "Config frozen at $(date)" > .rune/freeze.log
90	```
91
92	This preserves the baseline config so surgery can be verified against it.
93
94	### Step 5 — Create rollback point
95
96	Use `Bash` to create a git tag:
97
98	```bash
99	git add -A
100	git commit -m "chore: safeguard checkpoint before [module] surgery" --allow-empty
101	git tag rune-safeguard-<module>
102	```
103
104	Replace `<module>` with the actual module name. Confirm the tag was created.
105
106	### Step 6 — Verify
107
108	Call `rune:verification` and explicitly pass the characterization test file path.
109
110	```
111	If characterization tests fail on the CURRENT (unchanged) code → STOP.
112	Fix the tests to match actual behavior before proceeding.
113	Characterization tests MUST pass on current code. This is non-negotiable.
114	```
115
116	Only after verification passes, declare the safety net complete.
117
118	## Output Format
119
120	```
121	## Safeguard Report
122	- Module: [module name]
123	- Tests Added: [count] characterization tests
124	- Coverage: [before]% → [after]%
125	- Markers Added: [count] boundary comments
126	- Rollback Tag: rune-safeguard-[module]
127	- Config Frozen: [list of files in .rune/]
128	- Hard Gate: PASSED — all characterization tests pass on current code
129
130	### Characterization Tests
131	- `tests/char/[module].test.ts` — [count] tests capturing current behavior
132
133	### Boundary Markers
134	- `@legacy`: [count] files marked
135	- `@do-not-touch`: [count] files protected
136	- `@bridge`: [count] insertion points marked
137
138	### Config Frozen
139	- [list of locked confi

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

safeguard

80stars21forks

View on GitHub

How to install safeguard?

rune-kit/rune/safeguard

$npx -y skills add Rune-kit/rune --skill safeguard

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# safeguard
2
3	## Purpose
4
5	Build safety nets before any refactoring begins. Safeguard creates characterization tests that capture current behavior, adds boundary markers to distinguish legacy from new code, freezes config files, and creates git rollback points. Nothing gets refactored without safeguard running first.
6
7	<HARD-GATE>
8	Characterization tests MUST pass on the current (unmodified) code before any refactoring starts. If they do not pass, safeguard is not complete.
9	</HARD-GATE>
10
11	## Called By (inbound)
12
13	- `rescue` (L1): Phase 1 SAFETY NET — build protection before surgery
14	- `surgeon` (L2): untested module found during surgery
15
16	## Calls (outbound)
17
18	- `scout` (L2): find all entry points and public interfaces of the target module
19	- `test` (L2): write and run characterization tests for the target module
20	- `verification` (L3): verify characterization tests pass on current code
21
22	## Cross-Hub Connections
23
24	- `surgeon` → `safeguard` — untested module found during surgery
25
26	## Execution Steps
27
28	### Step 1 — Identify module boundaries
29
30	Call `rune:scout` targeting the specific module. Ask scout to return:
31	- All public functions, classes, and exported symbols
32	- All files that import from this module (consumers)
33	- All files this module imports from (dependencies)
34	- Existing test files for this module (if any)
35
36	Use `Read` to open the module entry file and confirm the public interface.
37
38	### Step 2 — Write characterization tests
39
40	Create a test file at `tests/char/<module-name>.test.ts` (or `.js`, `.py` matching project convention).
41
42	Use `Write` to create the characterization test file. Rules for characterization tests:
43	- Tests MUST capture what the code CURRENTLY does, not what it should do
44	- Include edge cases that currently produce surprising output — test for that actual output
45	- Do NOT fix bugs in characterization tests — if the current code returns wrong data, test for that wrong data
46	- Cover every public function in the module
47	- Include at least one integration test calling the module as an external consumer would
48
49	Example structure:
50	```typescript
51	// tests/char/<module>.test.ts
52	// CHARACTERIZATION TESTS — DO NOT MODIFY without running safeguard again
53	// These tests capture existing behavior as of: [date]
54
55	describe('<module> — characterization', () => {
56	it('existing behavior: [function] with [input] returns [actual output]', () => {
57	// ...
58	})
59	})
60	```
61
62	### Step 3 — Add boundary markers
63
64	Use `Edit` to add boundary comments at the top of the module file and at key function boundaries:
65
66	```typescript
67	// @legacy — rune-safeguard [date] — do not refactor without characterization tests passing
68	```
69
70	For functions flagged by autopsy as high-risk, add:
71	```typescript
72	// @do-not-touch — coupled to [module], change both or neither
73	```
74
75	For planned new implementations, mark insertion points:
76	```typescript
77	// @bridge — new-v2 will replace this interface
78	```
79
80	### Step 4 — Config freeze
81
82	Use `Bash` to record current config state:
83
84	```bash
85	mkdir -p .rune
86	cp tsconfig.json .rune/tsconfig.frozen.json 2>/dev/null \|\| true
87	cp .eslintrc* .rune/ 2>/dev/null \|\| true
88	cp package-lock.json .rune/package-lock.frozen.json 2>/dev/null \|\| true
89	echo "Config frozen at $(date)" > .rune/freeze.log
90	```
91
92	This preserves the baseline config so surgery can be verified against it.
93
94	### Step 5 — Create rollback point
95
96	Use `Bash` to create a git tag:
97
98	```bash
99	git add -A
100	git commit -m "chore: safeguard checkpoint before [module] surgery" --allow-empty
101	git tag rune-safeguard-<module>
102	```
103
104	Replace `<module>` with the actual module name. Confirm the tag was created.
105
106	### Step 6 — Verify
107
108	Call `rune:verification` and explicitly pass the characterization test file path.
109
110	```
111	If characterization tests fail on the CURRENT (unchanged) code → STOP.
112	Fix the tests to match actual behavior before proceeding.
113	Characterization tests MUST pass on current code. This is non-negotiable.
114	```
115
116	Only after verification passes, declare the safety net complete.
117
118	## Output Format
119
120	```
121	## Safeguard Report
122	- Module: [module name]
123	- Tests Added: [count] characterization tests
124	- Coverage: [before]% → [after]%
125	- Markers Added: [count] boundary comments
126	- Rollback Tag: rune-safeguard-[module]
127	- Config Frozen: [list of files in .rune/]
128	- Hard Gate: PASSED — all characterization tests pass on current code
129
130	### Characterization Tests
131	- `tests/char/[module].test.ts` — [count] tests capturing current behavior
132
133	### Boundary Markers
134	- `@legacy`: [count] files marked
135	- `@do-not-touch`: [count] files protected
136	- `@bridge`: [count] insertion points marked
137
138	### Config Frozen
139	- [list of locked confi

People who liked this also viewed

6 picks

Type