Save this content to: .claude/skills/laravel-audit-testing/SKILL.md

# Laravel Testing Audit

Audit the test suite of the Laravel application. **Do not equate line coverage with test quality.**

List applicable rules first:

```bash
php artisan auditor:rules --domain=testing --applicable
```

## What to look for

- Critical business flows with little or no test coverage: purchases, authorization boundaries, data mutations, integrations.
- Tests that do not verify meaningful behavior: tests that only assert the request succeeded, tests that pin implementation details, or tests that mock everything away.
- Missing authorization/security tests around critical boundaries: no test proving an unauthorized user is rejected.
- Important edge cases left untested: boundary values, empty states, duplicates, permissions variations.
- Brittle testing patterns: tests coupled to exact query counts, implementation ordering, or unrelated details.
- Excessive implementation-detail testing: tests that break on any refactor without protecting behavior.
- Inconsistent use of Pest/PHPUnit conventions across the suite.
- In a Pest-first suite (`tests/Pest.php` or `pestphp/pest`), new PHPUnit class tests without a documented reason (`AUD-PEST-001`).

## Evidence requirements

Every testing finding needs at least:

- The critical flow or boundary (file + route/controller/service).
- The relevant test files that should cover it.
- What behavior is or is not asserted.

## False positives

- Coverage may exist under a different name or location — check before reporting.
- A missing test for an unimportant flow is not a finding.
- Do not report line-coverage numbers as proof of quality (or lack of it).

## Severity guidance

- `high`: a critical boundary (e.g. authorization) has no meaningful tests.
- `medium`: an important flow lacks meaningful coverage or tests are brittle.
- `low`: testing hygiene issues.
- `info`: observations.