fortifylisted

# Fortify Target: $ARGUMENTS (file, directory, or module — if blank, use unstaged changes) Behavior is frozen — the test suite is the contract. Green before and after; if a test's meaning has to change, you've gone too far. ## Workflow ### 1. Scope - Identify target files (blank → unstaged changes) - Locate each file's tests using the project's convention (co-located, `__tests__/`, `tests/`, `spec/`). A file with no tests gets **Test gaps** items first — Split/Simplify on untested code is unverifiable, so backfill or skip. No test runner at all → ask which to use. Entrypoint scripts without exports → audit only. - Run the suite. If red, stop — don't fortify broken code ### 2. Audit List findings, most-impactful first: | Bucket | What to look for | Fix | |---|---|---| | **Split** | Functions > 20 lines, multiple responsibilities, I/O mixed with logic | Extract pure logic into named helpers; keep I/O at the edges; preserve the original signature | | **Edge cases** | Missing null/empty/boundary checks at system boundaries, unhandled error paths | Test first, then guard | | **Test gaps** | Untested public functions, uncovered branches, missing sad-path tests | Backfill through the public interface | | **Simplify** | Nesting > 2 levels, dead code / unused params, duplicated logic, dense one-liners, shallow pass-through wrappers, speculative config never used, unclear names / primitive obsession | Guard clauses, delete, extract one helper, expand, inline (`/codebase-design`