constraint-driven-development – skill Agent & Tự động hóa cho agent AI

Constraint-Driven Development

Overview

Other skills in this pack describe what good looks like. code-review-and-quality gives you five axes. test-driven-development gives you a cycle. security-and-hardening gives you a threat list. All of that lives in prose the agent reads and may or may not follow, and none of it survives the end of the session.

This skill produces something different: a written record of this project's bar, with numbers, that outlives the conversation and can be checked mechanically.

The reason matters. When you wrote the code, reading it told you whether it was any good. An agent writes more in an afternoon than you will read that week, so the judgement moves out of your head and into checks that run around the loop. Those checks need to exist, they need numbers you actually chose, and they need to fire close enough to the work that the agent fixes its own output.

Spec-driven development says what to build. Test-driven development proves it works. Constraint-driven development defines what "good enough to ship" means, before anyone argues about it in a pull request.

When to Use

Apply this skill when:

• Starting a project or a significant feature and no quality bar is written down
• The user asks to "set up constraints", "add quality gates", "define our standards", or "stop the agent shipping junk"
• An agent is producing volume nobody is reading line by line
• CI has checks but nobody can say which ones block a merge and which ones are decoration
• Coverage, performance, or accessibility numbers get argued about per-PR instead of decided once
• You're about to run /build auto or any autonomous loop, and the only thing standing between it and main is a test suite the agent also wrote

When NOT to use:

• The project already has a CONSTRAINTS.md and the user isn't changing it — read it and follow it instead
• One-off scripts, spikes, throwaway prototypes
• The user wants a code review right now (code-review-and-quality) or a CI pipeline built (ci-cd-and-automation)
• Pre-product-market-fit code with a two-week expected lifetime — the floor below is still worth it, the rest isn't

Loading Constraints

The interview needs a live user. Don't run it in non-interactive contexts (CI, /loop, autonomous runs). If constraints are missing and you're in one of those, apply the Floor below, note that you did, and flag the rest for a human.

The Process

Step 1: Detect before you ask

Never ask what you can read. Before the first question, gather:

| What | Where to look |

|------|---------------|

| Language and stack | package.json, pyproject.toml, go.mod, Cargo.toml |

| Test runner | dev dependencies, test script, existing test files |

| Existing linters | eslint.config.*, biome.json, .ruff.toml |

| Coverage today | coverage/ output, or run the suite once |

| CI | .github/workflows/, .gitlab-ci.yml |

| Agent harness | .claude/, .codex/, AGENTS.md |

Report what you found in two lines, then ask only what's left.

Step 2: Four questions, each with a default

Follow the one-question-at-a-time discipline from interview-me, with one change: every question here has a default, so "I don't know" is a complete answer that still produces a working config.

Q1: Beyond the floor, which of these do you want enforced?
    (a) Test coverage on new code
    (b) Security scanning
    (c) Performance budgets
    (d) Accessibility
    (e) Architecture boundaries
GUESS: (a) and (b) — you have a test runner already and you're handling user input.
DEFAULT if unsure: (a) and (b).
Say what each pick costs: (c) and (d) need a running URL, (e) needs a rules file written.

Q2: When a check fails while the agent is mid-task, should it block or warn?
GUESS: Block. You're running agents unattended and a warning nobody reads is a warning.
DEFAULT if unsure: Block on the floor, warn on everything else for the first two weeks.

Q3: Do you have target numbers in mind, or should I measure where you are today and hold that line?
GUESS: Measure. Most teams don't have a number, and an invented one gets ignored.
DEFAULT if unsure: Measure and hold. See "Ratchets" below.

Q4: What's the slowest check you'll tolerate before the agent hands work back?
GUESS: About 90 seconds. Longer and you'll stop running it.
DEFAULT if unsure: 90 seconds at task end, unlimited in CI.

Stop at four. A twelve-question intake produces a config nobody understands and a user who regrets starting.

Step 3: Write CONSTRAINTS.md

One file at the repo root. Any agent on any harness can read it, and a change to it shows up in review where it belongs.

# Constraints

Last reviewed: 2026-08-08 by @addy

## Floor (always enforced, no setup required)

- No new suppression comments: `@ts-ignore`, `eslint-disable`, `# noqa`, `# type: ignore`
- No unimplemented stubs: `throw new Error("Not implemented")`, empty `catch {}`
- No skipped or deleted tests without a reason in the commit message
- No secrets in source
- This file does not get weakened to make a change pass

## Enforced with numbers

| Dimension | Rule | Checked by | Runs at |
|-----------|------|-----------|---------|
| Types | Zero type errors | `tsc --noEmit` | every edit |
| Lint | Zero errors from our config | `biome check` | every edit |
| Secrets | No secrets in source | `gitleaks dir . --redact` | every edit |
| Coverage | Changed lines ≥ 80% covered | `vitest run --coverage` + git diff | task end, CI |
| Security: code | No high findings | `semgrep scan --config p/default` | CI |
| Security: deps | Nothing at high or above | `osv-scanner scan source -r .` | CI |
| Accessibility | Zero critical or serious | `axe $PREVIEW_URL --tags wcag2a,wcag2aa,wcag21aa` | preview deploy |
| Performance | LCP ≤ 2500ms, CLS ≤ 0.1 | `lighthouse $PREVIEW_URL --output=json` | preview deploy |

Every row names the command that produces the verdict. A dimension with a
number and no command in this column is an aspiration, not a constraint.

## Measured, not yet enforced

| Metric | Today | Direction |
|--------|-------|-----------|
| Project coverage | 62.4% | must not fall |
| Bundle size (main) | 184 kB | must not grow |

## Exceptions

| ID | Rule | Path | Reason | Owner | Expires |
|----|------|------|--------|-------|---------|
| W1 | `no-explicit-any` | `src/legacy/**` | Rewrite tracked in ENG-441 | @addy | 2026-11-01 |

Then add one line to AGENTS.md and CLAUDE.md: Read CONSTRAINTS.md before writing code. Do not weaken it to make a change pass.

Step 4: Install what each dimension needs

Picking a dimension means installing something. Don't leave the user with a number and no mechanism, and don't invent your own checker when a de facto one exists — these tools are listed because their rule formats and thresholds are what everything else in the ecosystem targets, so the team's existing config keeps working.

| Dimension | Tool | Install | Run | Gate on |

|-----------|------|---------|-----|---------|

| Types (TS) | tsc | already there | tsc --noEmit | any error |

| Types (Python) | mypy | pip install mypy | mypy . | any error |

| Lint | your existing config | already there | eslint . / biome check / ruff check | any error |

| Coverage (JS) | your test runner | Vitest: npm i -D @vitest/coverage-v8; Jest: already there | vitest run --coverage (or jest --coverage) | coverage of changed lines |

| Coverage (Python) | pytest-cov | pip install pytest-cov | pytest --cov --cov-report=lcov | same |

| Security: code | Semgrep | pipx install semgrep | semgrep scan --config p/default --config p/owasp-top-ten | any high finding |

| Security: secrets | gitleaks | brew install gitleaks | gitleaks dir . --redact --no-banner | any finding |

| Security: dependencies | osv-scanner | brew install osv-scanner | osv-scanner scan source -r . | high or above |

| Performance: page | Lighthouse | npm i -D lighthouse | lighthouse $URL --output=json --quiet | LCP, CLS, performance score |

| Performance: bundle | size-limit | npm i -D size-limit | size-limit --json | per-entry byte budget |

| Accessibility | axe-core | npm i -D @axe-core/cli | axe $URL --tags wcag2a,wcag2aa,wcag21aa | zero critical or serious |

| Architecture | dependency-cruiser | npm i -D dependency-cruiser | depcruise --validate src | any violation |

| Assertion quality | Stryker | npm i -D @stryker-mutator/core | stryker run --mutate <changed files> | mutation score |

Five things that will bite you if you skip them:

1. --redact on gitleaks is not optional. Without it the matched secret lands in the agent's transcript, which is how a leaked key ends up in a log, a summary, or a commit message. Report the rule and the location, never the value.

2. Lighthouse and axe need a URL. They only work against a running app, so they belong in the runtime stage against a preview deploy or a local ser

… (nội dung đầy đủ có trong gói tải về)