Paths: File paths (shared/, references/, ../ln-*) are relative to skills repo root. If not found at CWD, locate this SKILL.md directory and go up one level for repo root.
Coverage Gaps Auditor (L3 Worker)
Specialized worker identifying missing tests for critical business logic.
Purpose & Scope
- Worker in ln-630 coordinator pipeline
- Audit Coverage Gaps (Category 4: High Priority)
- Identify untested critical paths
- Classify by category (Money, Security, Data, Core Flows)
- Calculate compliance score (X/10)
Inputs (from Coordinator)
MANDATORY READ: Load shared/references/task_delegation_pattern.md#audit-coordinator--worker-contract for contextStore structure.
Receives contextStore with: tech_stack, testFilesMetadata, codebase_root, output_dir.
Domain-aware: Supports domain_mode + current_domain (see audit_output_schema.md#domain-aware-worker-output).
Workflow
Parse context — extract fields, determine scan_path (domain-aware if specified)
ELSE:
scan_path = codebase_root
domain_name = null
Identify critical paths in scan_path (not entire codebase)
- Scan production code in
scan_path for money/security/data keywords
- All Grep/Glob patterns use
scan_path (not codebase_root)
- Example:
Grep(pattern="payment|refund|discount", path=scan_path)
Check test coverage for each critical path
- Search ALL test files for coverage (tests may be in different location than production code)
- Match by function name, module name, or test description
Collect missing tests
- Tag each finding with
domain: domain_name (if domain-aware)
Calculate Score: Count violations by severity, calculate compliance score (X/10)
Write Report: Build full markdown report in memory per shared/templates/audit_worker_report_template.md, write to {output_dir}/634-coverage-gaps.md (or {output_dir}/634-coverage-gaps-{domain}.md if domain-aware) in single Write call
Return Summary: Return minimal summary to coordinator (see Output Format)
Critical Paths Classification
1. Money Flows (Priority 20+)
What: Any code handling financial transactions
Examples:
- Payment processing (
/payment, processPayment())
- Discounts/promotions (
calculateDiscount(), applyPromoCode())
- Tax calculations (
calculateTax(), getTaxRate())
- Refunds (
processRefund(), /refund)
- Invoices/billing (
generateInvoice(), createBill())
- Currency conversion (
convertCurrency())
Min Priority: 20
Why Critical: Money loss, fraud, legal compliance
2. Security Flows (Priority 20+)
What: Authentication, authorization, encryption
Examples:
- Login/logout (
/login, authenticate())
- Token refresh (
/refresh-token, refreshAccessToken())
- Password reset (
/forgot-password, resetPassword())
- Permissions/RBAC (
checkPermission(), hasRole())
- Encryption/hashing (custom crypto logic, NOT bcrypt/argon2)
- API key validation (
validateApiKey())
Min Priority: 20
Why Critical: Security breach, data leak, unauthorized access
3. Data Integrity (Priority 15+)
What: CRUD operations, transactions, validation
Examples:
- Critical CRUD (
createUser(), deleteOrder(), updateProduct())
- Database transactions (
withTransaction())
- Data validation (custom validators, NOT framework defaults)
- Data migrations (
runMigration())
- Unique constraints (
checkDuplicateEmail())
Min Priority: 15
Why Critical: Data corruption, lost data, inconsistent state
4. Core User Journeys (Priority 15+)
What: Multi-step flows critical to business
Examples:
- Registration → Email verification → Onboarding
- Search → Product details → Add to cart → Checkout
- Upload file → Process → Download result
- Submit form → Approval workflow → Notification
Min Priority: 15
Why Critical: Broken user flow = lost customers
Audit Rules
1. Identify Critical Paths
Process:
- Scan codebase for money-related keywords:
payment, refund, discount, tax, price, currency
- Scan for security keywords:
auth, login, password, token, permission, encrypt
- Scan for data keywords:
transaction, validation, migration, constraint
- Scan for user journeys: multi-step flows in routes/controllers
2. Check Test Coverage
For each critical path:
- Search test files for matching test name/description
- If NO test found → add to missing tests list
- If test found but inadequate (only positive, no edge cases) → add to gaps list
3. Categorize Gaps
Severity by Priority:
- CRITICAL: Priority 20+ (Money, Security)
- HIGH: Priority 15-19 (Data, Core Flows)
- MEDIUM: Priority 10-14 (Important but not critical)
4. Provide Justification
For each missing test:
- Explain WHY it's critical (money loss, security breach, etc.)
- Suggest test type (E2E, Integration, Unit)
- Estimate effort (S/M/L)
Scoring Algorithm
MANDATORY READ: Load shared/references/audit_scoring.md for unified scoring formula.
Severity mapping by Priority:
- Priority 20+ (Money, Security) missing test → CRITICAL
- Priority 15-19 (Data Integrity, Core Flows) missing test → HIGH
- Priority 10-14 (Important) missing test → MEDIUM
- Priority <10 (Nice-to-have) → LOW
Output Format
MANDATORY READ: Load shared/templates/audit_worker_report_template.md for file format.
Write report to {output_dir}/634-coverage-gaps.md (global) or {output_dir}/634-coverage-gaps-{domain}.md (domain-aware) with category: "Coverage Gaps" and checks: money_flow_coverage, security_flow_coverage, data_integrity_coverage, core_journey_coverage.
Return summary to coordinator:
Report written: docs/project/.audit/ln-630/{YYYY-MM-DD}/634-coverage-gaps.md
Score: X.X/10 | Issues: N (C:N H:N M:N L:N)
Critical Rules
- Domain-aware scanning: If
domain_mode="domain-aware", scan ONLY scan_path production code (not entire codebase)
- Tag findings: Include
domain field in each finding when domain-aware
- Test search scope: Search ALL test files for coverage (tests may be in different location than production code)
- Match by name: Use function name, module name, or test description to match tests to production code
Definition of Done
- contextStore parsed successfully (including output_dir, domain_mode, current_domain)
- scan_path determined (domain path or codebase root)
- Critical paths identified in scan_path (Money, Security, Data, Core Flows)
- Test coverage checked for each critical path
- Missing tests collected with severity, priority, justification, domain
- Score calculated using penalty algorithm
- Report written to
{output_dir}/634-coverage-gaps.md or 634-coverage-gaps-{domain}.md (atomic single Write call)
- Summary returned to coordinator
Reference Files
- Worker report template:
shared/templates/audit_worker_report_template.md
- Audit scoring formula:
shared/references/audit_scoring.md
- Audit output schema:
shared/references/audit_output_schema.md
Version: 3.0.0
Last Updated: 2025-12-23
1---2name: ln-634-test-coverage-auditor3description: Coverage Gaps audit worker (L3). Identifies missing tests for critical paths (Money 20+, Security 20+, Data Integrity 15+, Core Flows 15+). Returns list of untested critical business logic with priority justification.4---5
6> **Paths:** File paths (`shared/`, `references/`, `../ln-*`) are relative to skills repo root. If not found at CWD, locate this SKILL.md directory and go up one level for repo root.
7
8# Coverage Gaps Auditor (L3 Worker)
9
10Specialized worker identifying missing tests for critical business logic.
11
12## Purpose & Scope
13
14- **Worker in ln-630 coordinator pipeline**
15- Audit **Coverage Gaps** (Category 4: High Priority)
16- Identify untested critical paths
17- Classify by category (Money, Security, Data, Core Flows)
18- Calculate compliance score (X/10)
19
20## Inputs (from Coordinator)
21
22**MANDATORY READ:** Load `shared/references/task_delegation_pattern.md#audit-coordinator--worker-contract` for contextStore structure.
23
24Receives `contextStore` with: `tech_stack`, `testFilesMetadata`, `codebase_root`, `output_dir`.
25
26**Domain-aware:** Supports `domain_mode` + `current_domain` (see `audit_output_schema.md#domain-aware-worker-output`).
27
28## Workflow
29
301) **Parse context** — extract fields, determine `scan_path` (domain-aware if specified)
31 ELSE:
32 scan_path = codebase_root
33 domain_name = null
34 ```
35
362) **Identify critical paths in scan_path** (not entire codebase)
37 - Scan production code in `scan_path` for money/security/data keywords
38 - All Grep/Glob patterns use `scan_path` (not codebase_root)
39 - Example: `Grep(pattern="payment|refund|discount", path=scan_path)`
40
413) **Check test coverage for each critical path**
42 - Search ALL test files for coverage (tests may be in different location than production code)
43 - Match by function name, module name, or test description
44
454) **Collect missing tests**
46 - Tag each finding with `domain: domain_name` (if domain-aware)
47
485) **Calculate Score:** Count violations by severity, calculate compliance score (X/10)
49
506) **Write Report:** Build full markdown report in memory per `shared/templates/audit_worker_report_template.md`, write to `{output_dir}/634-coverage-gaps.md` (or `{output_dir}/634-coverage-gaps-{domain}.md` if domain-aware) in single Write call
51
527) **Return Summary:** Return minimal summary to coordinator (see Output Format)
53
54## Critical Paths Classification
55
56### 1. Money Flows (Priority 20+)
57
58**What:** Any code handling financial transactions
59
60**Examples:**
61- Payment processing (`/payment`, `processPayment()`)
62- Discounts/promotions (`calculateDiscount()`, `applyPromoCode()`)
63- Tax calculations (`calculateTax()`, `getTaxRate()`)
64- Refunds (`processRefund()`, `/refund`)
65- Invoices/billing (`generateInvoice()`, `createBill()`)
66- Currency conversion (`convertCurrency()`)
67
68**Min Priority:** 20
69
70**Why Critical:** Money loss, fraud, legal compliance
71
72### 2. Security Flows (Priority 20+)
73
74**What:** Authentication, authorization, encryption
75
76**Examples:**
77- Login/logout (`/login`, `authenticate()`)
78- Token refresh (`/refresh-token`, `refreshAccessToken()`)
79- Password reset (`/forgot-password`, `resetPassword()`)
80- Permissions/RBAC (`checkPermission()`, `hasRole()`)
81- Encryption/hashing (custom crypto logic, NOT bcrypt/argon2)
82- API key validation (`validateApiKey()`)
83
84**Min Priority:** 20
85
86**Why Critical:** Security breach, data leak, unauthorized access
87
88### 3. Data Integrity (Priority 15+)
89
90**What:** CRUD operations, transactions, validation
91
92**Examples:**
93- Critical CRUD (`createUser()`, `deleteOrder()`, `updateProduct()`)
94- Database transactions (`withTransaction()`)
95- Data validation (custom validators, NOT framework defaults)
96- Data migrations (`runMigration()`)
97- Unique constraints (`checkDuplicateEmail()`)
98
99**Min Priority:** 15
100
101**Why Critical:** Data corruption, lost data, inconsistent state
102
103### 4. Core User Journeys (Priority 15+)
104
105**What:** Multi-step flows critical to business
106
107**Examples:**
108- Registration → Email verification → Onboarding
109- Search → Product details → Add to cart → Checkout
110- Upload file → Process → Download result
111- Submit form → Approval workflow → Notification
112
113**Min Priority:** 15
114
115**Why Critical:** Broken user flow = lost customers
116
117## Audit Rules
118
119### 1. Identify Critical Paths
120
121**Process:**
122- Scan codebase for money-related keywords: `payment`, `refund`, `discount`, `tax`, `price`, `currency`
123- Scan for security keywords: `auth`, `login`, `password`, `token`, `permission`, `encrypt`
124- Scan for data keywords: `transaction`, `validation`, `migration`, `constraint`
125- Scan for user journeys: multi-step flows in routes/controllers
126
127### 2. Check Test Coverage
128
129**For each critical path:**
130- Search test files for matching test name/description
131- If NO test found → add to missing tests list
132- If test found but inadequate (only positive, no edge cases) → add to gaps list
133
134### 3. Categorize Gaps
135
136**Severity by Priority:**
137- **CRITICAL:** Priority 20+ (Money, Security)
138- **HIGH:** Priority 15-19 (Data, Core Flows)
139- **MEDIUM:** Priority 10-14 (Important but not critical)
140
141### 4. Provide Justification
142
143**For each missing test:**
144- Explain WHY it's critical (money loss, security breach, etc.)
145- Suggest test type (E2E, Integration, Unit)
146- Estimate effort (S/M/L)
147
148## Scoring Algorithm
149
150**MANDATORY READ:** Load `shared/references/audit_scoring.md` for unified scoring formula.
151
152**Severity mapping by Priority:**
153- Priority 20+ (Money, Security) missing test → CRITICAL
154- Priority 15-19 (Data Integrity, Core Flows) missing test → HIGH
155- Priority 10-14 (Important) missing test → MEDIUM
156- Priority <10 (Nice-to-have) → LOW
157
158## Output Format
159
160**MANDATORY READ:** Load `shared/templates/audit_worker_report_template.md` for file format.
161
162Write report to `{output_dir}/634-coverage-gaps.md` (global) or `{output_dir}/634-coverage-gaps-{domain}.md` (domain-aware) with `category: "Coverage Gaps"` and checks: money_flow_coverage, security_flow_coverage, data_integrity_coverage, core_journey_coverage.
163
164Return summary to coordinator:
165```
166Report written: docs/project/.audit/ln-630/{YYYY-MM-DD}/634-coverage-gaps.md
167Score: X.X/10 | Issues: N (C:N H:N M:N L:N)
168```
169
170## Critical Rules
171
172- **Domain-aware scanning:** If `domain_mode="domain-aware"`, scan ONLY `scan_path` production code (not entire codebase)
173- **Tag findings:** Include `domain` field in each finding when domain-aware
174- **Test search scope:** Search ALL test files for coverage (tests may be in different location than production code)
175- **Match by name:** Use function name, module name, or test description to match tests to production code
176
177## Definition of Done
178
179- contextStore parsed successfully (including output_dir, domain_mode, current_domain)
180- scan_path determined (domain path or codebase root)
181- Critical paths identified in scan_path (Money, Security, Data, Core Flows)
182- Test coverage checked for each critical path
183- Missing tests collected with severity, priority, justification, domain
184- Score calculated using penalty algorithm
185- Report written to `{output_dir}/634-coverage-gaps.md` or `634-coverage-gaps-{domain}.md` (atomic single Write call)
186- Summary returned to coordinator
187
188## Reference Files
189
190- **Worker report template:** `shared/templates/audit_worker_report_template.md`
191- **Audit scoring formula:** `shared/references/audit_scoring.md`
192- **Audit output schema:** `shared/references/audit_output_schema.md`
193
194---
195**Version:** 3.0.0
196**Last Updated:** 2025-12-23
majiayu000