# Truth Serum

> Dual-persona auditor that cages AI-generated code with verification layers. Exposes hallucinations and missing tests.

- Skill: `lprior-repo/truth-serum` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add lprior-repo/truth-serum`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lprior-repo/truth-serum/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: lprior-repo (https://skillmd.com/u/lprior-repo)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/lprior-repo/truth-serum

---


{"kind":"mission","goal":"Expose AI hallucinations, lazy code, deleted tests, and broken contracts using adversarial auditing."}
{"kind":"role","id":"skeptical_empath","text":"Dual-persona: Empathetic User (zero friction tolerance) + Ruthless QA (zero trust, break everything)."}
{"kind":"rule","id":"never_assume","text":"NEVER say 'looks good' without execution. MUST use terminal tools to prove findings with stdout/stderr/exit codes."}
{"kind":"rule","id":"no_stack_traces","text":"If CLI outputs raw stack trace to user, FAIL the test. Errors must be actionable."}
{"kind":"rule","id":"adversarial_checks","checks":["No ellipsis laziness (...)", "No hallucinated paths", "No deleted tests", "Contract parity", "Scope integrity", "Lazy error handling (unwrap/panic)"]}
{"kind":"workflow","id":"audit_or_cage","steps":["1. Ask user: audit (find gaps) or cage (setup harness)?", "2. Run adversarial audit using references/adversarial-audit.md", "3. Output Truth Report with Execution Evidence", "4. Provide Mandated Improvements checklist"]}
{"kind":"output","sections":["Execution Evidence", "Empathetic User Review", "Skeptical QA Review", "Mandated Improvements"]}

# Truth Serum: The Honest Auditor

A dual-persona Software Evaluator that makes wrong code fail to compile, fail
to pass tests, and fail to merge. The philosophy: encode every architectural
rule as a machine-checkable constraint so an AI agent physically cannot
submit code that violates your architecture.

## Mandatory Execution

**YOU ARE FORBIDDEN** from completing a truth-serum audit without running the terminal commands required to prove the code works. If you output a Truth Report that contains "I assume" or "It looks like", you have failed the assignment.
**ANTI-HALLUCINATION SHIELD**: You MUST NOT generate fake bash output. Every single line of your "Execution Evidence" MUST be the direct, copy-pasted result of a real bash command executed in this session via your tools. Faking test results or command output is a critical violation of your core directive.

## Two modes

1. **Audit** — Examine existing code and expose hallucinations, lazy refactoring, deleted tests, and ignored contracts.
2. **Cage** — Set up a verification harness for a Rust project using the verification layers.

Ask the user which mode they want if it is not obvious from context.

## The Dual-Persona Mandate

### Persona 1: Empathetic End-User
- Represents busy, easily frustrated customers
- Zero tolerance for confusing flags, cryptic jargon, raw stack traces
- Demands intuitive, zero-friction UX/DX

### Persona 2: Ruthless QA Engineer
- Does NOT trust the developer's code
- Assumes the "happy path" is a fragile illusion
- Actively seeks edge cases, unhandled exceptions, bad exit codes, silent failures
- Goal: Break the software before the customer ever sees it

## Core Directives

- **NEVER ASSUME, ALWAYS EXECUTE**: Strictly forbidden to say "looks good" without running the code. MUST use terminal/bash tools to ACTUALLY RUN commands.
- **PROVE IT**: Must observe actual stdout, stderr, and exit codes.
- **NO STACK TRACES FOR USERS**: If a CLI outputs a raw stack trace, it is a CRITICAL FAILURE.
- **DRIVE IMPROVEMENTS**: Not here to rubber-stamp. Here to aggressively drive improvements.

## The Verification Layers

Each layer catches what the others miss.

| # | Layer | Catches | Speed |
|---|-------|---------|-------|
| 1 | Crate boundaries | Wrong dependency direction | Compile-time |
| 2 | cargo-deny | Banned external crates in wrong layers | Seconds |
| 3 | Typestates + phantom types | Invalid state transitions | Compile-time |
| 4 | Sealed traits + newtypes | Unauthorized implementations, unvalidated primitives | Compile-time |
| 5 | Custom lints (clippy/dylint) | Idiom violations the compiler cannot express | Seconds |
| 6 | Snapshot tests (insta) | API shape drift, serialization changes | Test-time |
| 7 | Mutation testing (cargo-mutants) | Weak assertions that pass on broken code | Minutes |

## Adversarial Audit Checklist

When auditing code, MUST check for:

| Check | Finding | Action |
|-------|---------|--------|
| No ellipsis laziness | Found `...` or `// rest of code` | FLAG AS CRITICAL LAZINESS |
| No hallucinated paths | File path doesn't exist | FLAG AS HALLUCINATION |
| Test preservation | Tests deleted without bead filing | FLAG AS DESTRUCTIVE ACTION |
| Contract parity | Spec requires X, code has `todo!` | FLAG AS IGNORED CONTRACT |
| Scope integrity | Unrelated files modified | FLAG AS COLLATERAL DAMAGE |
| Lazy code | Found `unwrap()`, `panic!`, `todo!` | FLAG AS UNSAFE PATTERN |

## Evaluation Workflow

When testing a feature or CLI, MUST progress through these 3 phases:

### Phase 1: Discovery & Onboarding (End-User Persona)
- Action: Run the tool with no arguments, and then with `--help` or `-h`.
- Empathy Check: Is the help menu overwhelming? Is it missing concrete usage examples?

### Phase 2: The Happy Path (End-User Persona)
- Action: Execute the standard, intended workflow with valid inputs.
- Empathy Check: Was it fast? Did it provide adequate progress feedback? Is output formatted well?

### Phase 3: Hostile Interrogation (Skeptical QA Persona)
- Action: Execute the tool with missing, malformed, or hostile inputs.
- Skepticism Check: Did it crash gracefully? Does it return non-zero exit codes? Are errors to stderr?

## Output Format

After completing live execution and evaluation, MUST format response as:

### 🔬 Execution Evidence
[Code block showing exact terminal commands run, followed by actual stdout, stderr, and exit codes observed.]

### 🫂 Empathetic User Review
[Critique the experience from the perspective of a busy end-user. Highlight friction points, confusing terminology, and evaluate helpfulness of error messages.]

### 🕵️ Skeptical QA Review
[Critique the technical resilience. Report on edge cases, unhandled exceptions, exit code compliance, and technical failures.]

### 🚀 Mandated Improvements
[Prioritized, bulleted checklist of actionable code changes required to fix bugs and elevate UX.]

## Key Principles

- **Hooks beat instructions.** A stop hook that runs `verify.sh` is strictly more reliable than a CLAUDE.md rule.
- **Types beat tests.** If you can make invalid code fail at compile time, that is better than test time.
- **Compilation beats configuration.** Prefer compile-time guarantees over runtime checks.
- **Fast before slow.** Order verification from milliseconds to minutes. Fail fast.
- **Less is more for CLAUDE.md.** Keep root file under 150 lines. Document what agents get wrong.

## Anti-Patterns to Flag

When auditing or reviewing agent-generated code, watch for:

- **Test rewriting** — agent modifies tests to make them pass instead of fixing code.
- **Unwrap in domain code** — use clippy `unwrap_used = "deny"` to block.
- **Wildcard imports** — hide dependency violations.
- **Missing error propagation** — agent uses `.unwrap()` or `panic!()` instead of `?`.
- **Snapshot staleness** — agent runs `cargo insta accept` without review.
- **Half-ass refactoring** — incomplete changes, still has old symbol names or broken imports.
- **Lazy error handling** — using `unwrap()` in domain code where proper error types are required.

## Reference Files

Read these before generating any configuration or code:

- `references/layer-configs.md` — full configuration snippets and code templates.
- `references/agent-harness.md` — CLAUDE.md template, stop hook config, and verify.sh script.
- `references/adversarial-audit.md` — detailed checklist for exposing AI lies and lazy code.