[autoresearch] baseline: system prompt quality tests (5/5 passing)

.agents/skills/guardrails/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: guardrails
+description: Pre-flight checklist and post-implementation self-review protocol. Use before generating any code (pre-flight) and after writing code but before verification (self-review) to catch issues early.
+---
+
+# Agent Guardrails Skill
+
+## Purpose
+Structured checklists that ensure the agent considers all applicable rules before and after writing code. Catches issues that would otherwise only surface during verification.
+
+## When to Invoke
+- **Pre-Flight:** At the start of Phase 2 (Implement), before writing any code
+- **Self-Review:** At the end of Phase 2 (Implement), after writing code but before Phase 3/4
+
+---
+
+## Pre-Flight Checklist
+
+Run through this checklist **before writing any code**:
+
+- [ ] Identified all applicable rules from `.agents/rules/`
+- [ ] Searched for existing patterns in codebase (Pattern Discovery Protocol from `architectural-pattern.md`)
+- [ ] Confirmed project structure alignment (`project-structure.md`)
+- [ ] Identified I/O boundaries that need abstraction
+- [ ] Determined test strategy (unit/integration/E2E)
+- [ ] Reviewed `rule-priority.md` for any potential conflicts
+
+If any item cannot be checked, **stop and resolve** before proceeding.
+
+---
+
+## Post-Implementation Self-Review
+
+Run through this checklist **after writing code, before verification**:
+
+### Security
+- [ ] No hardcoded secrets or configuration values
+- [ ] All user input validated at system boundaries
+- [ ] Parameterized queries (no string concatenation for SQL)
+
+### Testability
+- [ ] All I/O operations behind interfaces/abstractions
+- [ ] Business logic is pure (no side effects in calculations)
+- [ ] Dependencies injected, not hardcoded
+
+### Observability
+- [ ] All public operation entry points logged (start/success/failure)
+- [ ] Structured logging with correlation IDs
+- [ ] Appropriate log levels (not everything is INFO)
+
+### Error Handling
+- [ ] Error paths handled explicitly (no empty catch blocks)
+- [ ] Errors provide context (wrapped with additional info)
+- [ ] Resources cleaned up in error paths (defer/finally)
+
+### Testing
+- [ ] Tests cover happy path
+- [ ] Tests cover at least 2 error paths
+- [ ] Tests cover edge cases relevant to the domain
+- [ ] If I/O adapters were modified: integration tests exist and pass
+- [ ] If UI was modified: E2E tests exist (or Phase 3.5 is planned)
+
+### Consistency
+- [ ] Follows existing codebase patterns (>80% consistency)
+- [ ] Naming conventions match the codebase
+- [ ] File organization matches `project-structure.md`
+
+---
+
+## Language-Specific Self-Review
+
+After completing the universal checklist above, load the relevant language-specific checklist:
+
+| Language | Checklist |
+|---|---|
+| **Go** | `languages/go.md` |
+| **TypeScript** | `languages/typescript.md` *(placeholder — create when needed)* |
+| **Flutter/Dart** | `languages/flutter.md` *(placeholder — create when needed)* |
+| **Rust** | `languages/rust.md` *(placeholder — create when needed)* |
+
+> Only load the file for languages you are actively writing. If the file doesn't exist yet, skip — but flag its absence so it can be created.
+
+---
+
+## Rule Compliance
+This skill enforces:
+- All mandates (always-on rules)
+- Architectural Patterns @architectural-pattern.md
+- Testing Strategy @testing-strategy.md
+- Rule Priority @rule-priority.md

.agents/skills/guardrails/languages/go.md

@@ -0,0 +1,71 @@
+# Go Self-Review Checklist
+
+> **Load this file** after completing the universal self-review in `SKILL.md`, when the code under review is Go.
+
+---
+
+## Resource Cleanup
+
+- [ ] **No bare `defer X.Close()`** — all deferred closers use error-checked closures with `slog`
+- [ ] **No `//nolint:errcheck`** directives anywhere in new code
+- [ ] **Transaction rollbacks** check for `sql.ErrTxDone` before logging
+- [ ] **HTTP response bodies** are drained (`io.Copy(io.Discard, ...)`) before closing
+
+### Correct Patterns
+
+```go
+// ✅ Row/statement/connection Close
+defer func() {
+    if err := rows.Close(); err != nil {
+        slog.Warn("failed to close rows", "error", err, "operation", "<operation>")
+    }
+}()
+
+// ✅ Transaction Rollback
+defer func() {
+    if err := tx.Rollback(); err != nil && !errors.Is(err, sql.ErrTxDone) {
+        slog.Error("failed to rollback transaction", "error", err, "operation", "<operation>")
+    }
+}()
+
+// ✅ HTTP Response Body
+defer func() {
+    if _, err := io.Copy(io.Discard, resp.Body); err != nil {
+        slog.Warn("failed to drain response body", "error", err)
+    }
+    if err := resp.Body.Close(); err != nil {
+        slog.Warn("failed to close response body", "error", err)
+    }
+}()
+```
+
+---
+
+## Logging
+
+- [ ] **No `fmt.Printf` / `fmt.Println` / `log.Printf`** — only `slog` in production code
+- [ ] All log calls use **structured key-value pairs** (no `fmt.Sprintf` inside log messages)
+- [ ] Error logs include `"error", err` as a key-value pair
+
+---
+
+## Error Handling
+
+- [ ] All errors are wrapped with context using `%w`: `fmt.Errorf("doing X: %w", err)`
+- [ ] No duplicate wrapping of the same error
+- [ ] Sentinel errors used for expected conditions (`ErrNotFound`, `ErrUnauthorized`)
+
+---
+
+## Static Analysis
+
+- [ ] `go vet ./...` passes with zero issues
+- [ ] No new `//nolint:` directives without a `// NOLINT:` rationale comment
+- [ ] `//nolint:errcheck` specifically is **never** used — handle the error instead
+
+---
+
+## References
+- Go Idioms and Patterns @go-idioms-and-patterns.md (§ Idiomatic Patterns, § Formatting and Static Analysis)
+- Logging and Observability Principles @logging-and-observability-principles.md (§ Go/slog)
+- Error Handling Principles @error-handling-principles.md (§ Resource Cleanup)