Essential Agents & Skills

I built The Bulwark because AI-assisted coding produces output that looks finished and frequently is not, and the fix is enforcement rather than hope. The Bulwark is the full harness: governance protocol, quality gates, session continuity, the whole opinionated workflow.

The problem I ran into after living with it is that the harness has a floor. Adopting The Bulwark means adopting its way of working, which is the right trade when you want the whole thing and a bad trade when what you actually need is one piece. Several of the components turned out to have nothing to do with The Bulwark’s opinions at all. A skill that reads a test file and tells you which mocks are hiding a testing gap does not care what your planning loop looks like. Neither does a validator that checks a skill definition against Anthropic’s published standards. That machinery was project-agnostic, and it was locked inside something that was not.

There is a second problem underneath, and it is the one that made the test tooling worth extracting. AI coding assistants are very good at writing tests that pass and only sometimes good at writing tests that verify anything. The failure mode is consistent: mock the system under test, assert that a function was called rather than that the output is correct, fake the external dependency the test existed to exercise. A green suite full of those tests is worse than no suite, because it manufactures confidence. Catching it by eye does not scale.

Developers and technical builders working with Claude Code who want specific quality guarantees without adopting an entire workflow framework. That includes me, on projects where The Bulwark would be more scaffolding than the job needs.

The collection is deliberately shaped for extraction. Each skill is a self-contained directory that drops into .claude/skills/, agents drop into .claude/agents/, and the README publishes a dependency map so you can take one skill and know exactly which internal skills come with it. Install by copying a directory, or wire the whole thing in as a git submodule when you want updates to follow upstream.

Six skills are user-invocable and appear in the slash menu. test-audit finds tests that mock the system under test, assert on calls rather than output, or fake the dependencies they exist to exercise. code-review runs a structured pass across security, type safety, linting, and coding standards using four parallel agents. anthropic-validator checks skills, hooks, agents, and other assets against official Anthropic standards. session-handoff generates a handoff document covering progress, decisions, and next steps. ez-statusline builds a multi-line terminal status bar with a context gauge, model badge, and git information. loop-generator takes a scope document or work-package YAML and emits an executable loop with programmatic definition-of-done, evidence gates that default to fail, human gates, model routing, and hook-enforced guardrails.

Seven more are internal, loaded by the others rather than invoked directly, and they are where the actual judgment lives. test-audit alone composes five of them: test-classification to categorise test files by type and mock usage, mock-detection to decide whether each mock is justified or hiding a gap, assertion-patterns to supply before-and-after rewrites turning call assertions into real output checks, component-patterns to hold per-component-type verification strategies, and bug-magnet-data for boundary values, injection payloads, and malformed inputs. The two shared orchestration skills, subagent-prompting and subagent-output-templating, give any orchestrating skill a consistent four-part prompt contract and a structured output format.

Two agents complete it. standards-reviewer does critical analysis against standards and returns severity-rated findings, which is what makes anthropic-validator more than a checklist. statusline-setup handles the settings mutation for ez-statusline safely.

The test tooling goes past prompting into static analysis. test-audit ships TypeScript scripts that walk the abstract syntax tree: a verification counter, a skip detector, a data-flow analyzer, and an integration mock detector. They run through tsx and have their own test suite, which sits in a top-level tests/ directory kept separate from the skills so the tooling that checks tests is itself tested.

The collection is public under MIT and in use. It is maintained in sync with The Bulwark source rather than forked away from it, which is the honest description of the relationship: The Bulwark stays the opinionated whole, and this is the set of parts that travel without it. Thirteen skills and two agents, six of them a slash command away, installable a directory at a time or as a submodule that tracks upstream.

The piece I would point at first is test-audit, because it targets the failure mode that AI-assisted development reliably produces and human review reliably misses. A suite that passes while mocking the thing it claims to verify is the most expensive kind of green.