菜单
Property-based and metamorphic testing expert for choosing a library, finding good properties (invariants, round-trips, idempotence, oracle/differential, metamorphic relations), and wiring generative tests into the existing test runner.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/rysweet/amplihack-rs --skill property-based-testing命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Auditing software supply chain security across CI/CD pipelines, container images, and language ecosystems. Detects mutable dependency references, insecure CI patterns, credential exposure risks, and missing SBOM/SLSA controls. Use when performing a supply chain audit, checking action pinning, auditing dependencies, scanning for CI security issues, reviewing container security, or assessing dependency security. Covers GitHub Actions, containers, Python, Node, Go, Rust, .NET, and more.
Start new work as a deterministic workflow of agentic steps, prompts, and tools instead of code. Use when designing a feature, deciding how to build something, choosing code vs recipe, or asking "how should I structure this".
Gherkin/BDD expert for writing, reviewing, and refactoring Cucumber feature files and step definitions.
基于 SOC 职业分类
正在显示 SKILL.md
| name | property-based-testing |
| version | 1.0.0 |
| description | Property-based and metamorphic testing expert for choosing a library, finding good properties (invariants, round-trips, idempotence, oracle/differential, metamorphic relations), and wiring generative tests into the existing test runner. |
| auto_activates | ["property-based testing","property based test","metamorphic testing","generative testing","fuzz property","proptest","quickcheck","hypothesis testing library","fast-check","fscheck","jqwik","shrinking"] |
| explicit_triggers | ["/property-based-testing","/amplihack:property-based-testing"] |
| confirmation_required | false |
| skip_confirmation_if_explicit | true |
| token_budget | 3000 |
Expert guidance for property-based and metamorphic testing: instead of asserting one hand-picked example, you state a rule that must hold for every input, and the library generates hundreds of inputs to try to break it.
amplihack ships two other formal-methods skills. Property-based testing is the practical middle ground between them:
| Approach | Skill | What it checks | Cost |
|---|---|---|---|
| Example tests | (unit tests) | Behavior on inputs you thought of | Low |
| Property-based / metamorphic | property-based-testing | Invariants over generated inputs, at runtime, against real code | Medium |
| BDD acceptance | gherkin-expert | Human-readable behavior scenarios | Low–medium |
| Model checking / proof | tla-plus-expert | Exhaustive state-space or temporal properties of a model | High |
Reach for property-based testing when:
Prefer TLA+ instead when the property is about concurrency, ordering, or temporal/liveness behavior of a design you can model. Prefer Gherkin when the value is a shared, human-readable acceptance spec. These are complements, not substitutes — a mature component often has all three.
| Stack | Library | Runner it plugs into |
|---|---|---|
| Rust | proptest (preferred) or quickcheck | cargo test |
| Python | Hypothesis | pytest / |
unittest| .NET | FsCheck (F#-friendly) or CsCheck (C#-friendly) | xunit / nunit |
| JS/TS | fast-check | jest / vitest / mocha |
| Java | jqwik | JUnit 5 platform |
Do not build a separate harness. Every library above runs inside your existing test runner as ordinary test cases. A property test is just a test that loops over generated inputs.
A "property" is a rule that holds for all valid inputs. The reliable families:
decode(encode(x)) == x. Great for serializers, parsers,
compressors, config load/save.f(f(x)) == f(x).
Redaction, normalization, dedup, formatting.merge(a, b) == merge(b, a).When you can't state an exact expected value, a metamorphic relation is usually still available. That is the whole point of metamorphic testing.
"a"). Never disable shrinking — the minimal case is the bug report.The snippets below use amplihack's own invariants as worked examples.
use proptest::prelude::*;
proptest! {
// redact(redact(x)) == redact(x)
#[test]
fn redact_is_idempotent(s in ".*") {
let once = redact(&s);
let twice = redact(&once);
prop_assert_eq!(once, twice);
}
// output never contains the secret
#[test]
fn redacted_output_has_no_secret(secret in "[A-Za-z0-9]{8,32}", prefix in ".*", suffix in ".*") {
let input = format!("{prefix}{secret}{suffix}");
let out = redact_secret(&input, &secret);
prop_assert!(!out.contains(&secret));
}
}
from hypothesis import given, strategies as st
# shard_jobs_max <= effective <= jobs_max
@given(
jobs_max=st.integers(min_value=1, max_value=256),
shard_jobs_max=st.integers(min_value=1, max_value=256),
requested=st.integers(min_value=0, max_value=512),
)
def test_effective_jobs_respects_bounds(jobs_max, shard_jobs_max, requested):
shard_jobs_max = min(shard_jobs_max, jobs_max)
effective = compute_effective_jobs(requested, shard_jobs_max, jobs_max)
assert shard_jobs_max <= effective <= jobs_max
using FsCheck;
using FsCheck.Xunit;
public class CoverageProperties
{
// bundle >= in_scope AND scanned + excluded == in_scope
[Property]
public Property CoverageTallyHolds(PositiveInt inScope, PositiveInt extra, NonNegativeInt excluded)
{
int in_scope = inScope.Get;
int bundle = in_scope + extra.Get; // bundle is a superset
int exc = Math.Min(excluded.Get, in_scope);
int scanned = in_scope - exc;
bool bundleSuperset = bundle >= in_scope;
bool tallyBalances = scanned + exc == in_scope;
return (bundleSuperset && tallyBalances).ToProperty();
}
}
import fc from "fast-check";
import { recordTelemetry } from "../src/telemetry";
// totality: recordTelemetry never throws and always returns a well-formed event
test("telemetry is total and safe", () => {
fc.assert(
fc.property(fc.anything(), fc.string(), (payload, name) => {
const event = recordTelemetry(name, payload); // must not throw
expect(event.name).toBe(name);
expect(typeof event.timestamp).toBe("number");
expect(typeof event.dropped).toBe("boolean"); // always a boolean, never undefined
}),
);
});
import net.jqwik.api.*;
class ConfigRoundTripProperties {
// decode(encode(x)) == x (round-trip)
@Property
boolean encodeDecodeRoundTrips(@ForAll("configs") Config c) {
return Config.decode(Config.encode(c)).equals(c);
}
// oracle/differential: fast parser agrees with reference parser
@Property
boolean parsersAgree(@ForAll("configText") String text) {
return FastParser.parse(text).equals(ReferenceParser.parse(text));
}
@Provide Arbitrary<Config> configs() { return Arbitraries.of(Config.defaults()); }
@Provide Arbitrary<String> configText() { return Arbitraries.strings().ofMaxLength(64); }
}
For amplihack's multi-runtime components, run the same generated inputs through each language implementation and assert identical outputs. Generate the corpus once (with a fixed seed), feed it to every implementation, and diff the results. Any divergence is a conformance bug — shrink it to the minimal input.
Check your understanding (answers below).
normalize_path is claimed to be safe to call more than once.
Which property family proves that, and how do you write it?normalize_path(normalize_path(p)) == normalize_path(p)
over generated paths.decode(encode(x)) == x.redact(redact(x)) == redact(x)) and a no-secret-leak
invariant (the output never matches the secret). The first is an
idempotence property; the second is a safety invariant.tla-plus-expert — exhaustive model checking of designs (the high-cost leg).gherkin-expert — human-readable BDD acceptance scenarios.test-gap-analyzer — find which code lacks coverage; then add properties here.smart-test — run the resulting property tests through the existing runner.