feat: harden OpenSpec SDD workflow

2026-08-26 00:42:35 +03:00
parent 039b72eed3
commit a8b2c4eed9
42 changed files with 4024 additions and 181 deletions
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
+workspace=${WEALTH_LEDGER_WORKSPACE:-$(cd "$script_dir/../.." && pwd -P)}
+source_root="$workspace/specs/agent-projection/opencode"
+projection_root="$workspace/.opencode"
+version_file="$workspace/specs/openspec/.cli-version"
+failures=0
+
+fail() {
+  printf 'FAIL: %s\n' "$1" >&2
+  failures=$((failures + 1))
+}
+
+if [[ ! -f "$version_file" ]]; then
+  fail 'missing OpenSpec version contract: specs/openspec/.cli-version'
+  expected_version=''
+else
+  expected_version=$(tr -d '[:space:]' < "$version_file")
+  [[ -n "$expected_version" ]] || fail 'OpenSpec version contract is empty'
+fi
+
+for tree in commands skills; do
+  source_tree="$source_root/$tree"
+  projection_tree="$projection_root/$tree"
+  if [[ ! -d "$source_tree" ]]; then
+    fail "missing canonical projection tree: specs/agent-projection/opencode/$tree"
+    continue
+  fi
+  if [[ ! -d "$projection_tree" ]]; then
+    fail "missing projection directory: .opencode/$tree"
+    continue
+  fi
+
+  while IFS= read -r source_file; do
+    relative_path=${source_file#"$source_root/"}
+    projection_file="$projection_root/$relative_path"
+    if [[ ! -f "$projection_file" ]]; then
+      fail "missing projection file: $relative_path"
+    elif ! cmp -s "$source_file" "$projection_file"; then
+      fail "projection content drift: $relative_path"
+    fi
+
+    if [[ "$relative_path" == skills/*/SKILL.md ]]; then
+      marker_count=$(awk -v expected="generatedBy: \"$expected_version\"" '
+        {
+          line = $0
+          sub(/^[[:space:]]*/, "", line)
+          if (line == expected) count++
+        }
+        END { print count + 0 }
+      ' "$source_file")
+      if [[ "$marker_count" -ne 1 ]]; then
+        fail "generated version marker mismatch in $relative_path: expected $expected_version"
+      fi
+    fi
+  done < <(find "$source_tree" -type f | sort)
+
+  while IFS= read -r projection_file; do
+    relative_path=${projection_file#"$projection_root/"}
+    if [[ ! -f "$source_root/$relative_path" ]]; then
+      fail "unexpected projection file: $relative_path"
+    fi
+  done < <(find "$projection_tree" -type f | sort)
+done
+
+if [[ $failures -gt 0 ]]; then
+  exit 1
+fi
+
+printf 'Agent projection verified against versioned authority: OpenSpec %s\n' "$expected_version"