feat: harden OpenSpec SDD workflow

2026-08-26 00:42:35 +03:00
parent 039b72eed3
commit a8b2c4eed9
42 changed files with 4024 additions and 181 deletions
@@ -0,0 +1,38 @@
+---
+name: openspec-propose
+description: Start a WealthLedger OpenSpec change and draft only its first planning artifact.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.10.0"
+---
+
+Start a WealthLedger OpenSpec change and draft only its first currently ready planning artifact. This workflow authorizes planning only and never implementation.
+
+**OpenSpec store (WealthLedger):** Use only `wealth-ledger-specs`, whose physical root is `specs/openspec`. Every OpenSpec command that reads or writes specs or changes MUST include `--store wealth-ledger-specs`; keep this flag on every follow-up. Do not infer a store from cwd, the nearest root, or machine configuration.
+
+**OpenSpec version preflight:** Before the first OpenSpec command, work from the workspace root and run `bash specs/scripts/verify-openspec-version.sh`. A missing or mismatched CLI is a blocking result.
+
+**Approval boundary:** Create at most ONE planning artifact per invocation. After showing it, STOP for explicit Change Owner approval. File existence or OpenSpec `done` status is not approval. If approval of a dependency cannot be established from the current conversation, ask again before creating a downstream artifact.
+
+**Planning gate:** After writing or editing the one artifact and before requesting approval, run `bash specs/scripts/verify-openspec-planning.sh "<name>"`. Fix structural failures and rerun the available stage checks. Structural success does not grant approval; a semantic mismatch returns to the earliest affected artifact and invalidates dependent approvals.
+
+## Workflow
+
+1. Resolve the requested intent and a kebab-case name; ask about ambiguity that changes scope, behavior, compatibility or acceptance criteria.
+2. Use the configured default schema unless the user explicitly chooses another. Available schemas are read with `openspec schemas --json --store wealth-ledger-specs`.
+3. Scaffold with `openspec new change "<name>" --store wealth-ledger-specs`; add `--schema "<schema-name>"` only after an explicit choice.
+4. Run `openspec status --change "<name>" --json --store wealth-ledger-specs` and use its resolved paths.
+5. For the first `ready` artifact run `openspec instructions "<artifact-id>" --change "<name>" --json --store wealth-ledger-specs`. Apply returned context, rules, template and instruction; create only that artifact at `resolvedOutputPath`.
+6. Run `openspec status --change "<name>" --store wealth-ledger-specs`, show the draft and stop for approval before any `/opsx-continue`.
+
+## Guardrails
+
+- Never create a downstream artifact in the same invocation, even if status reports it ready.
+- Never infer approval from file existence, CLI status, silence or the agent's own judgment.
+- If an approved upstream artifact changes, report invalidated downstream approvals and stop without regenerating them.
+- Do not edit application code or start Apply.
+- If the change already exists, ask whether to continue it.