Claude Skill

rust-invariants

Nine non-negotiable Skill Doctor product invariants. Use when changing scan defaults, scoring, features, networking, LLM/MCP paths, CLI flags, or anything that could weaken determinism or additive-only behavior.

LLM Mart · 0 points · 7 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download KalarisLabs-Skill-Doctor-skills_rust-invariants-9413620.zip · 0 KB

kalarislabs/skill-doctor 13 1 forks Apache-2.0 Updated 7d ago

Part of kalarislabs/skill-doctor — 15 skills

Install

skills CLI npx skills add https://github.com/KalarisLabs/Skill-Doctor/tree/main/skills/rust-invariants

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install kalarislabs-skill-doctor@llmmart

Git git clone https://github.com/KalarisLabs/Skill-Doctor.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole kalarislabs/skill-doctor collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

Invariants — stop and redesign if a change breaks one

Rust-only product runtime. npm is a binary installer. Node never scans.
No mandatory LLM. Default is --offline --deterministic. L1 needs zero network, zero key.
Additive-only. L2 may add findings or raise confidence. L2 may never delete or downgrade L1.
Determinism. Two --deterministic runs → identical JSON/SARIF bytes (sorted maps, pinned time, sorted walks).
Rules compiled at build time in skill-doctor-rules. Never per scan.
SD-11. Any bytes sent to any model pass through skill-doctor-neutralize first.
Secrets. Emit environment key names only, never values.
CLI-first. TUI is feature tui plus an explicit flag. Never default.
Four frozen contributions. Do not invent SD-12 or a fifth claim.

Tests that must exist

cargo tree -e features -p skill-doctor has no LLM crate on default features.
Table test: L1 CRITICAL survives an L2 verdict of "benign".
Two deterministic JSON reports, equal SHA-256.
Neutralize is not a no-op on bidi / zero-width / homoglyph fixtures.

CI grep (keep in ci.yml)

Fail the job if default-path sources match forbidden OpenAI or Anthropic SDK imports.

Files (skill-doctor)

SKILL.md 1.5 KB

---
name: rust-invariants
description: Nine non-negotiable Skill Doctor product invariants. Use when changing scan defaults, scoring, features, networking, LLM/MCP paths, CLI flags, or anything that could weaken determinism or additive-only behavior.
---

# Invariants — stop and redesign if a change breaks one

1. **Rust-only product runtime.** npm is a binary installer. Node never scans.
2. **No mandatory LLM.** Default is `--offline --deterministic`. L1 needs zero network, zero key.
3. **Additive-only.** L2 may add findings or raise confidence. L2 may never delete or downgrade L1.
4. **Determinism.** Two `--deterministic` runs → identical JSON/SARIF bytes (sorted maps, pinned time, sorted walks).
5. **Rules compiled at build time** in `skill-doctor-rules`. Never per scan.
6. **SD-11.** Any bytes sent to any model pass through `skill-doctor-neutralize` first.
7. **Secrets.** Emit environment *key names* only, never values.
8. **CLI-first.** TUI is feature `tui` plus an explicit flag. Never default.
9. **Four frozen contributions.** Do not invent SD-12 or a fifth claim.

## Tests that must exist

- `cargo tree -e features -p skill-doctor` has no LLM crate on default features.
- Table test: L1 CRITICAL survives an L2 verdict of "benign".
- Two deterministic JSON reports, equal SHA-256.
- Neutralize is not a no-op on bidi / zero-width / homoglyph fixtures.

## CI grep (keep in ci.yml)

Fail the job if default-path sources match forbidden OpenAI or Anthropic SDK imports.