popoffvg/impl-verify
harness/plugins/work-manager/common/skills/impl-verify/SKILL.md
Adversarially verify that an implemented TODO satisfies its spec. Reads `<notes-dir>/todos/TODO-N.md` (Outcome, Changes, Autotest), inspects the real diff/commit, re-runs the Autotest, and writes a `<notes-dir>/verify-TODO-N.md` verdict (PASS | DEVIATES) with a deviation list. Independent of the implementer — the post-implementation half of spec verification. Run after impl, before the user commits (or right after the commit).
$ install --global
skillsauthnpx skillsauth add popoffvg/dotfiles impl-verifyInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 16, 2026, 5:44 AM359.6s1 file scanned
SKILL.md
- name:
- impl-verify
- description:
- >
impl-verify
Judge one implemented TODO against its spec. The implementer self-reports; this skill re-derives the verdict from the spec + the actual code + a fresh test run. The Outcome is the anchor — everything is checked against it (mirrors the spec verification chain Type → Outcome → Terms → Changes → Autotest).
Inputs
<notes-dir>/todos/TODO-N.md— the spec for this unit (Outcome, Changes, Autotest, Files, Definition of done).- The real change:
git diff/git show <sha>for the commit(s) implementing TODO-N (find via<notes-dir>/worklog.md).
Procedure
- Read the TODO fully. Pin the Outcome (the post-condition) and the Changes pseudocode.
- Inspect the real diff. For each file in Files, confirm the change exists and matches the Changes intent. Flag edits outside Files (scope creep) and Files that were not touched (incomplete).
- Re-run the Autotest yourself. Execute the TODO's
## AutotestCommand verbatim. Capture real output. If it fails or the command is missing/uncrunnable → DEVIATES. - Map Outcome → evidence. State, in one line, which test case or diff hunk proves the Outcome holds. No evidence → DEVIATES.
- Check the Definition of done boxes against reality, not against the implementer's claims.
Verdict contract — write <notes-dir>/verify-TODO-N.md
# Verify TODO-N: <title>
**Verdict:** PASS | DEVIATES
**Commit(s):** <sha(s)>
**Autotest:** `<command>` → <pass | fail> (<real summary of output>)
## Outcome check
- Outcome: <restate verbatim from TODO-N.md>
- Holds? <yes/no> — evidence: <test case / diff hunk that proves it>
## Deviations
- <each gap between spec and implementation; empty if PASS>
- <scope creep: edits outside Files> / <missing: Files not changed> / <Outcome unproven> / <test gap>
## Notes
- <anything the user should know before committing>
Rules
- Skeptical default: if the Outcome cannot be proven from the diff + a passing test, verdict is DEVIATES.
- Read-only on source. Only write
<notes-dir>/verify-TODO-N.mdand a one-line<notes-dir>/worklog.mdentry. Never fix the code — report deviations for the implementer/user to address. - One TODO per run, then stop.
- A DEVIATES verdict is not a failure of process — it is the loop working. List concrete, actionable deviations.
Related Skills
popoffvg/improve-claude-local
tools
VerifiedTrustedCommunity
Improve a whole CLAUDE.local.md — the private, per-project rules captured from user corrections. Wraps each conditional rule in a <task-relevant> block so it only surfaces for matching work, merges duplicates, generalizes one-off facts, drops stale entries, and routes raw project facts to engram. Use when the user says "improve claude.local", "clean up the local rules", "claude.local is bloated", or after the Stop hook has appended many rules.
2SKILL.mdUpdated Jun 25, 2026
popoffvg/workflow
testing
VerifiedTrustedCommunity
WM pipeline and conventions shared across all phases. Agents must read this before spec, impl, or verify work.
2SKILL.mdUpdated Jun 19, 2026
popoffvg/code
development
VerifiedTrustedCommunity
One entry point for spec writing, implementation, and bug fixing. Default is new (write spec → grill loop → produce notes → author TODO bodies). Other subcommands: verify (audit), revise (sync to shipped), prototype (settle a decision), code-map (diagram), impl (execute one TODO), fix (analyze cause, correct thoughts, fix behavior), help (this page). Invoke as /code <subcommand>.
2SKILL.mdUpdated Jun 19, 2026
popoffvg/red-green-refactor
development
VerifiedTrustedCommunity
Red-Green-Refactor cycle for bug fixes. Before fixing a bug, first write a failing test that reproduces it (Red), then make the minimal change to pass (Green), then clean up the code (Refactor). Use on any bug fix, error correction, failing test repair, or when user says "fix this bug".
2SKILL.mdUpdated Jun 18, 2026