本文へ移動
cccskills
無料GitHub で公開

openspec-verify-change

Verify implementation matches OpenSpec change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving. Also use when the user says "openspec verify" or "opsx verify".

インストール方法を見る

含まれるファイル(1)

  • SKILL.md17.9 KB

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Verify that an implementation matches the change artifacts (specs, tasks, design).

Store selection: If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run openspec store list --json to discover registered store ids, then pass --store <id> on the commands that read or write specs and changes (new change, status, instructions, list, show, validate, archive, doctor, context, schemas, view). Once selected, treat --store <id> as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run openspec status --change "<name>" --json --store "<id>", not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local openspec/ root.

Project check: These steps expect a project that already uses OpenSpec. Before the first step that writes anything (new change, archive, sync specs, or authoring an artifact file), confirm the project has a root: run openspec list --json (with --store <id> when a store is selected, since the store is then the root) and read root. A root object means the project is set up. "root": null means it is not - there is no openspec/ directory here, and a write such as openspec new change would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.

One "root": null is not about setup: when a status error message starts with Declared in or Invalid store declaration in and names this project's openspec/config.yaml (or config.yml), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the store: line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's message and fix.

Otherwise, with no root, what happens next depends on how this workflow was reached:

  • Auto-selected: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
  • Explicit OpenSpec request: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (openspec init), target a store they already have (--store <id>), or continue without OpenSpec for this request. Wait for their answer.

In both branches, never create the root as a side effect: do not run openspec init until the user asks for it, do not hand-create openspec/ files, and do not let a command create it.

Input: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.

Steps

  1. Select the change

    If a name is provided, use it. Otherwise:

    • Infer from conversation context if the user mentioned a change
    • Auto-select if only one active change exists
    • If ambiguous, run openspec list --json to get available changes and ask the user to select one

    When prompting, show all active changes returned by the list, including changes with status: "no-tasks". Include the schema used for each change if available. Mark changes with incomplete tasks as "(In Progress)".

    Always announce: "Using change: <name>" and how to override (e.g., /openspec-verify-change <other>).

  2. Check status to understand the schema

    openspec status --change "<name>" --json
    

    Parse the JSON to understand:

    • schemaName: The workflow being used (e.g., "spec-driven")
    • planningHome, changeRoot, artifactPaths, and actionContext: path and scope context
    • Which artifacts exist for this change
  3. Get planning context and load artifacts

    openspec instructions apply --change "<name>" --json
    

    This returns the change directory, contextFiles (artifact ID -> array of concrete file paths), taskTrackingConfigured, and top-level tasks and progress aggregated from every concrete file matched by the schema's apply.tracks configuration that could be read. Read all available artifacts from contextFiles.

    Treat apply state and instruction as context, not a verification verdict. Do not implement tasks or archive the change during verification.

  4. Initialize verification report structure

    Create a report structure with three dimensions:

    • Completeness: Track tasks and spec coverage
    • Correctness: Track requirement implementation and scenario coverage
    • Coherence: Track design adherence and pattern consistency

    Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.

    Verification is advisory. Respect intentional omissions such as skip_specs: true, optional design documents, and schemas without task tracking. Do not require or invent optional or intentionally omitted artifacts to obtain a clean report. Not verified describes a limit of this report, not a new archive prerequisite. Archive retains its own checks and user-confirmation behavior.

    Mark checks the schema does not define, or artifacts the status reports as intentionally skipped, as Not applicable. The correctness checks of a change whose readable delta specs contain REMOVED or RENAMED requirements but no ADDED or MODIFIED requirements are also Not applicable (see step 6). Exclude them from skipped-check counts and the archive-readiness assessment. Reserve Not verified for applicable checks whose evidence is missing or unusable.

    If only task evidence is available for applicable checks, verify task completion only and mark the remaining applicable checks, including Code Pattern Consistency, as not verified with the reason "Only task evidence available".

    If artifacts cannot be read or contain no usable requirements, scenarios, or design decisions, mark the affected checks as not verified with the specific reason. Continue checks supported by the remaining evidence, but a partially checked input set is not a fully verified check. Missing requirements affect Spec Coverage and Requirement Implementation Mapping; missing scenarios affect Scenario Coverage; missing design decisions affect Design Adherence.

  5. Verify Completeness

    Task Completion:

    • If taskTrackingConfigured is false, report Task Completion as not applicable. Do not treat empty tasks as missing evidence.
    • Otherwise, use the top-level tasks and progress fields. They already aggregate every readable concrete file matched by apply.tracks, regardless of the tracked artifact's ID; do not infer tracking from a contextFiles key.
    • If unavailableTrackingFiles is nonempty, mark Task Completion as not verified and include every unavailable path and reason. Continue using any readable task evidence, but do not infer completion from the partial tasks and progress fields.
    • If taskTrackingConfigured is true and tasks is empty, mark Task Completion as not verified and record the reason from apply state and instruction. Nonzero totals alone do not establish evaluable task descriptions.
    • Report complete vs total tasks from progress.
    • If progress.remaining is greater than 0:
      • Add CRITICAL issue for each listed incomplete task. If the remaining count exceeds the listed incomplete tasks, also report the incomplete checkboxes without descriptions and recommend adding descriptions and completing them. Do not infer completion from the listed tasks alone.
      • Recommendation: "Complete task: <description>" or "Mark as done if already implemented"

    Spec Coverage:

    • If status marks the spec artifact skipped by skip_specs: true, or the schema defines no spec artifact (no artifact whose artifactPaths.<id>.outputPath is under specs/), report the spec-dependent checks as not applicable.
    • Otherwise, contextFiles is keyed by artifact id, and artifact ids come from the active schema, so do not assume an id such as specs. The spec artifacts are those whose artifactPaths.<id>.outputPath is under specs/; read their files from contextFiles.<id>. If those spec files are absent or empty, mark Spec Coverage, Requirement Implementation Mapping, and Scenario Coverage as not verified; do not treat any of them as clean.
    • If delta specs exist in those spec files:
      • Extract all requirements (marked with "### Requirement:", or listed as FROM:/TO: pairs under ## RENAMED Requirements) and note the delta section each one sits under: ## ADDED, ## MODIFIED, ## REMOVED, or ## RENAMED Requirements. The section decides what the check looks for.
      • For each ADDED or MODIFIED requirement (for MODIFIED, check the text in the delta, not the old wording):
        • Search codebase for keywords related to the requirement
        • Assess if implementation likely exists
      • If ADDED or MODIFIED requirements appear unimplemented:
        • Add CRITICAL issue: "Requirement not found: <requirement name>"
        • Recommendation: "Implement requirement X: <description>"
      • For each REMOVED requirement, the change asks for the behavior to be gone, so invert the check:
        • Search codebase for the removed behavior. Matches in openspec/ artifacts or docs, or in code that serves only the Migration note or an ADDED requirement, are not evidence by themselves. Report any code path that still delivers the removed behavior, including one shared with an ADDED requirement.
        • Finding no implementation is the expected result. Never report a REMOVED requirement as "Requirement not found" or recommend implementing it.
        • If the behavior is still present:
          • Add CRITICAL issue: "Removed requirement still implemented: <requirement name>"
          • Recommendation: "Remove the remaining implementation at <file>:<lines>, following the requirement's Migration note if it has one"
      • For each RENAMED entry (FROM:/TO:), the name changes but the behavior stays, so check the TO requirement for that unchanged behavior:
        • Do not report the FROM name as missing, and do not require code symbols, identifiers, or file names to be renamed.
        • If the TO name also appears under MODIFIED, its behavior is checked there against the MODIFIED text; skip it here.
        • Otherwise, read the baseline requirement in the main spec at <planningHome.root>/openspec/specs/<capability-path>/spec.md, using the same capability path as the delta spec: the requirement under the FROM name, or under the TO name only when the FROM name is absent because the main spec is already synced. Its body and scenarios are the evidence for the behavior the TO requirement keeps.
        • Search codebase for that behavior and assess if it is still implemented.
        • If it appears unimplemented:
          • Add CRITICAL issue: "Renamed requirement not found: <TO name>"
          • Recommendation: "Restore the behavior of <TO name> (renamed from <FROM name>); a rename must not change behavior"
        • If the baseline requirement cannot be found or read, mark Spec Coverage as not verified for that entry with the reason. Never count an unchecked rename as passing.
  6. Verify Correctness

    If the delta specs are readable and contain at least one REMOVED or RENAMED requirement but no ADDED or MODIFIED requirements (the change only removes or renames requirements), report Requirement Implementation Mapping and Scenario Coverage as Not applicable. The REMOVED and RENAMED checks under Spec Coverage are the evidence for such a change (each RENAMED entry is checked there against its baseline behavior), so do not mark these two checks as not verified. A delta spec with no parseable requirements at all is unusable evidence, not a removal-only change: mark these checks as not verified.

    Requirement Implementation Mapping:

    • For each ADDED or MODIFIED requirement from delta specs (REMOVED entries, and RENAMED entries without a MODIFIED block, were settled under Spec Coverage):
      • Search codebase for implementation evidence
      • If found, note file paths and line ranges
      • Assess if implementation matches requirement intent
      • If divergence detected:
        • Add WARNING: "Implementation may diverge from spec: <details>"
        • Recommendation: "Review <file>:<lines> against requirement X"

    Scenario Coverage:

    • For each scenario under an ADDED or MODIFIED requirement in delta specs (marked with "#### Scenario:"):
      • Check if conditions are handled in code
      • Check if tests exist covering the scenario
      • If scenario appears uncovered:
        • Add WARNING: "Scenario not covered: <scenario name>"
        • Recommendation: "Add test or implementation for scenario: <description>"
    • Skip scenarios under a REMOVED requirement; that behavior is meant to be gone.
  7. Verify Coherence

    Design Adherence:

    • If the schema defines no design artifact (no artifact with id design, and none whose artifactPaths.<id>.outputPath is or ends in design.md), report Design Adherence as not applicable.
    • If the design artifact's contextFiles.<id> file exists:
      • Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
      • Verify implementation follows those decisions
      • If contradiction detected:
        • Add WARNING: "Design decision not followed: <decision>"
        • Recommendation: "Update implementation or revise design.md to match reality"
    • Otherwise, if the design artifact's contextFiles.<id> file is absent or empty: mark Design Adherence as not verified. With other supporting artifacts, Code Pattern Consistency still runs; the task-only case remains limited to task completion.

    Code Pattern Consistency:

    • If implementation changes cannot be identified, mark Code Pattern Consistency as not verified and explain the missing evidence.
    • Otherwise, review new code for consistency with project patterns
    • Check file naming, directory structure, coding style
    • If significant deviations found:
      • Add SUGGESTION: "Code pattern deviation: <details>"
      • Recommendation: "Consider following project pattern: <example>"
  8. Generate Verification Report

    Summary Scorecard:

    ## Verification Report: <change-name>
    
    ### Summary
    | Dimension    | Status           |
    |--------------|------------------|
    | Completeness | X/Y tasks, N reqs|
    | Correctness  | M/N reqs covered |
    | Coherence    | Followed/Issues  |
    

    In each Status cell, report the results of checks that ran and Not verified (<reason>) for every skipped check. If all checks in a dimension were skipped, start the cell with Not verified. Never score a skipped check as passing. Treat every not verified or partially verified check as skipped in the final assessment. Count only ADDED and MODIFIED requirements in N, and report REMOVED and RENAMED requirements separately (for example, "1 removal confirmed, 1 rename verified"). For a change that only removes or renames requirements, the Correctness cell reads Not applicable (no ADDED or MODIFIED requirements).

    Issues by Priority:

    1. CRITICAL (Must fix before archive):

      • Incomplete tasks
      • Missing requirement implementations
      • Removed requirements still implemented
      • Renamed requirements whose behavior is no longer implemented
      • Each with specific, actionable recommendation
    2. WARNING (Should fix):

      • Spec/design divergences
      • Missing scenario coverage
      • Each with specific recommendation
    3. SUGGESTION (Nice to fix):

      • Pattern inconsistencies
      • Minor improvements
      • Each with specific recommendation

    Final Assessment:

    • If CRITICAL issues: "X critical issue(s) found. Fix before archiving." If any check was skipped, also name every skipped check and its reason.
    • If no CRITICAL issues, one or more warnings, and no checks were skipped: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
    • If only suggestions and no checks were skipped: "No critical issues or warnings. Z suggestion(s) to consider. Ready for archive (with noted improvements)."
    • If no issues and no checks were skipped: "All checks passed. Ready for archive."
    • If any check was skipped and there are no CRITICAL issues: do not claim readiness. Say "No critical issues found in the checks that ran. <check(s)> not verified: <reason>." Include the warning count when nonzero.
    • Include the suggestion count when nonzero in every final assessment.

Verification Heuristics

  • Completeness: Focus on objective checklist items (checkboxes, requirements list)
  • Correctness: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
  • Coherence: Look for glaring inconsistencies, don't nitpick style
  • False Positives: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
  • Actionability: Every issue must have a specific recommendation with file/line references where applicable

Output Format

Use clear markdown with:

  • Table for summary scorecard
  • Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
  • Code references in format: file.ts:123
  • Specific, actionable recommendations
  • No vague suggestions like "consider reviewing"

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

Add SLSA build-provenance attestations to existing GitHub Actions workflows. Use when the user wants to add artifact attestations, build provenance, or SLSA attestations to Docker container image builds in GitHub Actions CI/CD pipelines.

日本語の概要は準備中です。原文の説明を表示しています。

jim60105/copilot-prompt212026年10月9日 更新

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction.

日本語の概要は準備中です。原文の説明を表示しています。

jim60105/copilot-prompt212026年10月9日 更新

Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.

日本語の概要は準備中です。原文の説明を表示しています。

jim60105/copilot-prompt212026年10月9日 更新

Write, review, and optionally test Bash and Zsh shell scripts following project coding standards. Use for ANY shell scripting task: (1) creating a new Bash or Zsh script, (2) editing, fixing, or reviewing an existing .sh, .bash, or .zsh file, (3) adding error handling, dependency checks, or cleanup traps to shell scripts, (4) implementing API integration or file processing in shell, (5) writing or fixing ShellSpec tests (spec/*_spec.sh), or (6) deciding whether a script should be written in Bash or Zsh. Defaults to Bash; Zsh-specific guidance lives in a reference file that is loaded only when writing Zsh.

日本語の概要は準備中です。原文の説明を表示しています。

jim60105/copilot-prompt212026年10月9日 更新

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

日本語の概要は準備中です。原文の説明を表示しています。

jim60105/copilot-prompt212026年10月9日 更新

Create, run, and maintain API test collections using Bruno (OpenCollection YAML format and legacy Bru format). Use when the user wants to: (1) create a Bruno API test collection from scratch or from OpenAPI/Swagger specs, (2) write API request files with tests and assertions, (3) run API tests using bru CLI, (4) generate test reports (HTML, JUnit, JSON), (5) set up CI/CD pipelines (GitHub Actions) for automated API testing, (6) debug or fix failing Bruno API tests, (7) add environment configurations for API testing, (8) chain API requests with data extraction, or (9) work with any .yml/.bru Bruno collection files. Triggers on mentions of 'Bruno', 'bru CLI', 'API testing collection', 'OpenCollection', or requests to automate API testing with file-based collections.

日本語の概要は準備中です。原文の説明を表示しています。

jim60105/copilot-prompt212026年10月9日 更新

jim60105 のスキルをすべて見る

このスキルの問題を報告する