Unify portable acceptance and completion-target evidence - #12
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2ad69aefa8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| or any( | ||
| not row.get("evidenceRefs") or not all(row["evidenceRefs"]) for row in rows | ||
| ) |
There was a problem hiding this comment.
When a verifier emits evidenceRefs as a nonempty string instead of the required list, all(row["evidenceRefs"]) iterates its characters and accepts the malformed binding. With matching subject and target content, reuse() then returns both reusable and completionEligible as true, so invalid objective evidence can authorize issue completion; validate that this field is a nonempty list of valid reference strings before accepting it.
Useful? React with 👍 / 👎.
| if not requirement_ids or len(set(requirement_ids)) != len(requirement_ids): | ||
| raise ValueError( | ||
| "supply the unique mandatory requirement IDs from the original scope" | ||
| ) |
There was a problem hiding this comment.
If source extraction supplies --requirement "", this validation treats the blank value as a unique mandatory requirement and marks the scope complete; a matching blank evidence row then passes reuse() and can become completion-eligible without identifying any real requirement. Reject empty or whitespace-only IDs here so an empty/truncated requirement inventory cannot certify the whole issue.
Useful? React with 👍 / 👎.
| Use the resolved `moonspec-verify` Skill to verify the original instructions or authoritative declarative source. Load its `SKILL.md` and `references/acceptance-policy.md`; the Skill owns scope resolution, required checks, evidence binding, verdicts, and continuation decisions. This command supplies the user input and runs the extension hooks; it does not define a separate acceptance policy. | ||
|
|
||
| 1. **Setup**: Resolve the verification baseline in this order: | ||
| - explicit user instructions or an explicitly referenced declarative document | ||
| - issue-brief verification inputs | ||
| - an explicitly provided `spec.md` or feature directory | ||
| - an active feature directory discovered from repository context (run `.specify/scripts/bash/check-prerequisites.sh --json --paths-only` to discover it without requiring `plan.md` or `tasks.md`) | ||
| Use absolute paths for file-backed sources. Do not require `spec.md`, `plan.md`, or `tasks.md` when another usable baseline exists. | ||
| Resolve the Skill from `$MOONMIND_ACTIVE_SKILLS_DIR` when exported, otherwise the host's available Skill resolver or `.agents/skills/moonspec-verify`. Pass `$ARGUMENTS` unchanged, including the original issue/source, constraints, candidate, completion target, and evidence references. Do not require `spec.md`, `plan.md`, or `tasks.md` when another usable original baseline exists. |
There was a problem hiding this comment.
When /moonspec.verify has an enabled conditionless hook, this command runs its pre/post hook sections and then delegates to moonspec-verify, whose SKILL.md independently runs the same pre/post hooks. Mandatory hooks can therefore execute twice, including hooks with external side effects; remove hook execution from either the wrapper or the delegated Skill so each hook has one owner.
Useful? React with 👍 / 👎.
| "foreach", | ||
| "--quiet", | ||
| "--recursive", | ||
| 'test -z "$(git status --porcelain --untracked-files=all)" || echo "$displaypath"', | ||
| ) |
There was a problem hiding this comment.
When an untracked directory is itself a Git repository, the isolated git add --all records it as a gitlink, but git submodule foreach only inspects registered submodules. Changes inside that embedded repository can therefore vary while capture() returns the same content digest, allowing evidence to be reused for content that was never verified; reject or explicitly inspect every staged gitlink, not only entries traversed as configured submodules.
Useful? React with 👍 / 👎.
1 participant
Description
Related to MoonLadderStudios/MoonMind#4265.
Assessment and verification now share one portable acceptance policy. Mandatory checks remain mandatory when tools are unavailable; optional diagnostics and separately authorized production operations are distinct. Initial assessment records apparent implementation without claiming objective acceptance or landing.
The verifier ships a standard-library helper that binds evidence to actual Git content, original scope, requirements, freshness, and a completion target. The command wrapper delegates to the Skill instead of maintaining conflicting rules. In plain terms, passing on a feature branch still requires publication; matching verified target content can reuse the checks.
Testing
uv run specify --help(CLI unchanged)uv sync && uv run pytest(equivalent isolated pytest run below)python tools/validate_bundle.py python -m pytest --confcutdir=. -o addopts='' -q python tools/project_bundle.py --target /tmp/moonspec-4265-projection --projection moonmind --write python tools/project_bundle.py --target /tmp/moonspec-4265-projection --projection moonmind --check25 tests passed; bundle and projection checks passed. Python/pytest ran in an isolated environment to avoid the consumer repository's
toolspackage.AI Disclosure
AI-assisted implementation, tests, and documentation; an independent Skill exercise verified candidate/target behavior while preserving local edits.