Skip to content

chore(agents): add test-audit skill for contributor test-quality gating - #3697

Open
politerealism wants to merge 3 commits into
NVIDIA:mainfrom
politerealism:test-audit-skill
Open

politerealism wants to merge 3 commits into
NVIDIA:mainfrom
politerealism:test-audit-skill

Conversation

@politerealism

@politerealism politerealism commented Sep 25, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Adds .agents/skills/test-audit, an internal contributor skill for gating new tests and auditing existing ones for junk patterns, mock-only coverage of real dependencies, and low-value duplication across OpenShell's test surfaces (Rust unit tests, e2e/rust, the conformance suite, the tmachine/Ansible harness, and the Python/TypeScript/Go SDKs). Modeled on openclaw's test-audit skill, adapted to this repo's tooling.

Related Issue

N/A: internal contributor tooling, no product behavior change. (Precedent: PR #293, which introduced .agents/skills/ and sync-agent-infra itself, used the same "N/A, internal initiative" framing.)

Changes

  • .agents/skills/test-audit/SKILL.md (new): three modes (authoring gate, audit, campaign) built around one value bar: does a test protect an independent contract, not just mirror the implementation. It includes sections on verifying contracts independently of the implementation, on testing what crosses real boundaries (process, privilege or identity, declaration to enforcement, our code to an external tool), and on checking for overlapping issues and PRs before filing.
  • CONTRIBUTING.md: adds the skill to the "Agent Skills for Contributors" table.
  • Routing: build-from-issue applies the authoring gate when adding or changing tests, review-github-pr applies the junk-pattern checks to test diffs, and sync-agent-infra lists the skill in its maintenance map and consistency checks.

Review feedback addressed (the branch is also rebased onto current main):

  • Conformance placement is no longer restated here. The skill points to tests/suites/conformance/README.md and notes that sharing a contract across drivers is not enough on its own.
  • The test-surface inventory lists both conformance components (crates/openshell-conformance/ and tests/suites/conformance/) and defers placement and focused verification to that README. It no longer refers to mise run e2e:*.
  • The skill is wired into sync-agent-infra and routed from build-from-issue and review-github-pr.
  • The commit and push authorization rule is removed; that authority stays with the invoking workflow and AGENTS.md.

RFC 0016 alignment (latest commit): the skill uses the RFC's test families and e2e types as vocabulary and no longer tells agents to consolidate internal ComputeDriver contracts into conformance (only portable, publicly observable contracts qualify under the conformance README). It adds junk patterns for tests that skip and still pass, conformance tests that change deployment configuration or reach public services, text matching where structured output exists, and retry loops that hide races. Audits also check the tmachine exclusion list and wrapper test lists, record a rationale and tracking issue for excluded tests, and coordinate with queued migrations.

Merge order: the skill refers to tests/suites/conformance/README.md, which is added by #3945. This PR should land after #3945, or the reference will not resolve on main until it does.

Testing

  • The skill's internal anchors resolve and the sync-agent-infra consistency items for a new internal skill are satisfied (name matches directory, metadata.internal: true, listed in CONTRIBUTING.md and the maintenance map).
  • mise run pre-commit passes after the rebase onto current main (format, all linters, Markdown lint).
  • Unit and e2e tests: N/A, documentation and skill files only.

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (if applicable): not applicable; internal skill documentation, not architecture

@copy-pr-bot

copy-pr-bot Bot commented Sep 25, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@politerealism

Copy link
Copy Markdown
Contributor Author

Different layers and classes of tests would allow agents to use this and give humans a reference.

@elezar
elezar self-requested a review September 29, 2026 13:36

@elezar elezar left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewing this alongside #3945, which establishes the canonical conformance test-placement guide and the agent-routing pattern for it.

Comment thread .agents/skills/test-audit/SKILL.md Outdated
2. What credible regression makes it fail?
3. Why does existing coverage not already catch that failure? Each contract
has one primary test owner at the strongest boundary — usually the
`crates/openshell-conformance` scenario if the contract applies to more

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR #3945 makes tests/suites/conformance/README.md the canonical source for test placement. This rule is broader than that guide: applying to more than one driver is not sufficient for conformance; the contract must also be portable, publicly observable through the CLI/gateway, and runnable as an installed-product black-box test. Please replace this local ownership rule with a concise route to the canonical README so internal ComputeDriver contracts are not moved into conformance merely because multiple drivers share them.

Comment thread .agents/skills/test-audit/SKILL.md Outdated
Kubernetes, VM), feature-gated per driver (`e2e-docker`, `e2e-podman`,
`e2e-kubernetes*`), driven by shell scripts (`e2e-*.sh`) that stand up the
actual stack.
- **`crates/openshell-conformance/src/scenarios/`** — driver-agnostic

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR #3945 distinguishes the reusable scenario library from the separately compiled installed-artifact workspace. This inventory omits tests/suites/conformance/, so an audit following it can miss the actual archive tests, and it describes execution through the mise run e2e:* path that is being removed separately. Please list both conformance components and defer their placement and direct Cargo verification commands to tests/suites/conformance/README.md.

@@ -0,0 +1,365 @@
---
name: test-audit
description: Invoke whenever writing, changing, reviewing, or sweeping tests anywhere in the OpenShell workspace (Rust crates, e2e/rust, the conformance suite, tests/ansible tmachine suites, Python, TypeScript SDK, Go SDK). Authoring gate for new tests plus an audit workflow for low-value, implementation-coupled, mock-only, or duplicative tests and the test-only production seams they demand. Trigger keywords - test audit, audit tests, junk tests, low-value test, prune tests, test quality, test coverage gap, mock-only coverage.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This promises a gate whenever tests are written, changed, or reviewed, but the PR only adds the skill to the human inventory in CONTRIBUTING.md. Please wire test-audit into the sync-agent-infra maintenance map and add concise routing from the applicable build/review workflows, following the discoverability pattern in PR #3945; otherwise repository-aware agents may not discover the gate during normal implementation and review.

Comment thread .agents/skills/test-audit/SKILL.md Outdated

## Landing and continuation

Commit, push, open a PR, or land only when authorized — this repo requires

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This introduces an authorization rule that is not present in AGENTS.md; CLAUDE.md only redirects to that file. Because this skill claims to trigger for every test change, the rule can incorrectly stop an already-authorized build-from-issue workflow before its normal commit/push/PR steps. Please remove this policy and defer commit and push authority to the invoking workflow and repository instructions.

OpenShell had no internal skill for auditing test quality across its
five distinct test surfaces (Rust unit tests, e2e/rust, the conformance
suite, the tmachine/Ansible harness, and the Python/TypeScript/Go SDKs).
Modeled on openclaw's test-audit skill, adapted to this repo's actual
tooling (mise tasks, cargo nextest, uv, driver feature gates) instead of
Vitest, with two OpenShell-specific additions grounded in lessons from
NVIDIA#3663/NVIDIA#3690: a section on deriving expected values from an independent
source rather than tracing the implementation itself, and a section on
testing the handoff between components (process, privilege, and
declaration-to-enforcement boundaries) rather than only what's inside
each one.

Wired into CONTRIBUTING.md's contributor skills table per sync-agent-infra's
maintenance map; no other cross-references needed updating.

Signed-off-by: politerealism <burdcat17@gmail.com>
Wire test-audit into build-from-issue and review-github-pr so repo-aware
agents discover the authoring gate and junk-pattern checks, and into
sync-agent-infra's maintenance map and consistency checklist. Defer
conformance test placement and verification commands to
tests/suites/conformance/README.md instead of a local ownership rule, and
list both conformance components in the surface inventory. Remove the
skill's hardcoded git-push authorization rule, deferring commit/push
authority to the invoking workflow and AGENTS.md.

Signed-off-by: politerealism <burdcat17@gmail.com>
Use the RFC's test families and e2e types as vocabulary, stop telling agents to consolidate internal ComputeDriver contracts into conformance (only portable, publicly observable contracts qualify under tests/suites/conformance/README.md), and add junk patterns for silent skips, conformance tests that change deployment configuration or reach public services, text matching where structured output exists, and retry loops that hide races. Audits now also check the tmachine exclusion list and wrapper test lists, record a rationale and tracking issue for excluded tests, and coordinate with queued migrations.

Signed-off-by: politerealism <burdcat17@gmail.com>
@politerealism

Copy link
Copy Markdown
Contributor Author

@elezar, thanks again for the review. I think the four points were already addressed in the follow-up commit I pushed on October 3 (after your September 30 review), and I've now rebased the branch onto current main, so it merges cleanly again. In case it saves you a pass:

  • Conformance placement: the local ownership rule is replaced with a pointer to tests/suites/conformance/README.md, with the note that sharing a contract across drivers isn't enough for conformance.
  • Inventory: it lists both crates/openshell-conformance/ and tests/suites/conformance/, defers placement and verification to the README, and no longer mentions mise run e2e:*.
  • Discoverability: the skill is in the sync-agent-infra map and consistency checks, and build-from-issue and review-github-pr route to it.
  • Authorization: the commit and push rule is gone; that stays with the invoking workflow and AGENTS.md.

I also read the skill against RFC 0016 and your conformance README (#3945) and tightened it in a new commit: it uses the RFC's test families and e2e types, only routes portable, publicly observable contracts to conformance (an internal ComputeDriver contract stays with the driver), and adds junk patterns for silent skips, conformance tests that change deployment config or reach public services, text matching where JSON output exists, and retry loops that hide races. mise run pre-commit passes on the rebased branch.

One thing I'd like your view on: the skill points at tests/suites/conformance/README.md, which comes from #3945. Would you prefer this to wait until #3945 lands, or is it fine to merge first if the reference resolves afterwards?

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants