feat: harden OpenSpec SDD workflow

scripts/verify-openspec-authority.sh

@@ -6,6 +6,7 @@ workspace=${WEALTH_LEDGER_WORKSPACE:-$(cd "$script_dir/../.." && pwd -P)}
 failures=0
 
 bash "$script_dir/verify-openspec-version.sh" "$workspace/specs/openspec/.cli-version"
+expected_version=$(tr -d '[:space:]' < "$workspace/specs/openspec/.cli-version")
 
 fail() {
   printf 'FAIL: %s\n' "$1" >&2
@@ -57,11 +58,16 @@ require_file_contains "$config_file" 'schema: wealth-ledger-sdd'
 
 schema_file="$canonical_root/schemas/wealth-ledger-sdd/schema.yaml"
 require_file_contains "$schema_file" 'name: wealth-ledger-sdd'
+require_file_contains "$schema_file" 'version: 2'
 require_schema_edge "$schema_file" 'specs' 'proposal'
 require_schema_edge "$schema_file" 'design' 'specs'
 require_schema_edge "$schema_file" 'tasks' 'design'
 require_file_contains "$schema_file" 'requires: [ tasks ]'
 
+if ! projection_validation=$(WEALTH_LEDGER_WORKSPACE="$workspace" bash "$script_dir/verify-agent-projection.sh" 2>&1); then
+  fail "agent projection verification failed: $projection_validation"
+fi
+
 if [[ -d "$workspace/specs" ]]; then
   if ! schema_validation=$(cd "$workspace/specs" && openspec schema validate wealth-ledger-sdd 2>&1); then
     fail "wealth-ledger-sdd schema validation failed: $schema_validation"
@@ -140,7 +146,7 @@ skill_entrypoints=(
   .opencode/skills/openspec-verify-change/SKILL.md
 )
 for relative_path in "${skill_entrypoints[@]}"; do
-  require_file_contains "$workspace/$relative_path" 'generatedBy: "1.10.0"'
+  require_file_contains "$workspace/$relative_path" "generatedBy: \"$expected_version\""
 done
 
 one_artifact_entrypoints=(
@@ -160,6 +166,24 @@ for relative_path in "${one_artifact_entrypoints[@]}"; do
   fi
 done
 
+planning_entrypoints=(
+  .opencode/commands/opsx-apply.md
+  .opencode/commands/opsx-archive.md
+  .opencode/commands/opsx-continue.md
+  .opencode/commands/opsx-explore.md
+  .opencode/commands/opsx-propose.md
+  .opencode/commands/opsx-verify.md
+  .opencode/skills/openspec-apply-change/SKILL.md
+  .opencode/skills/openspec-archive-change/SKILL.md
+  .opencode/skills/openspec-continue-change/SKILL.md
+  .opencode/skills/openspec-explore/SKILL.md
+  .opencode/skills/openspec-propose/SKILL.md
+  .opencode/skills/openspec-verify-change/SKILL.md
+)
+for relative_path in "${planning_entrypoints[@]}"; do
+  require_file_contains "$workspace/$relative_path" 'bash specs/scripts/verify-openspec-planning.sh'
+done
+
 approval_blocker_entrypoints=(
   .opencode/commands/opsx-apply.md
   .opencode/commands/opsx-archive.md