feat: harden OpenSpec SDD workflow
This commit is contained in:
@@ -3,6 +3,7 @@ set -euo pipefail
|
||||
|
||||
script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
|
||||
verifier="$script_dir/verify-openspec-authority.sh"
|
||||
contract_version=$(tr -d '[:space:]' < "$script_dir/../openspec/.cli-version")
|
||||
|
||||
if [[ ! -f "$verifier" ]]; then
|
||||
echo "expected verifier at $verifier" >&2
|
||||
@@ -21,7 +22,7 @@ write_file() {
|
||||
|
||||
write_file "specs/.openspec-store/store.yaml" $'version: 1\nid: wealth-ledger-specs'
|
||||
mkdir -p "$fixture/specs/openspec"
|
||||
write_file "specs/openspec/.cli-version" '1.10.0'
|
||||
write_file "specs/openspec/.cli-version" "$contract_version"
|
||||
write_file "specs/openspec/config.yaml" 'schema: wealth-ledger-sdd'
|
||||
mkdir -p "$fixture/specs/openspec/schemas"
|
||||
cp -R "$script_dir/../openspec/schemas/wealth-ledger-sdd" "$fixture/specs/openspec/schemas/wealth-ledger-sdd"
|
||||
@@ -48,11 +49,12 @@ entrypoints=(
|
||||
.opencode/skills/openspec-sync-specs/SKILL.md
|
||||
.opencode/skills/openspec-verify-change/SKILL.md
|
||||
)
|
||||
planning_line='bash specs/scripts/verify-openspec-planning.sh "<change>"'
|
||||
|
||||
for path in "${entrypoints[@]}"; do
|
||||
content=$'bash specs/scripts/verify-openspec-version.sh\nopenspec status --store wealth-ledger-specs'
|
||||
if [[ "$path" == .opencode/skills/* ]]; then
|
||||
content=$'generatedBy: "1.10.0"\n'"$content"
|
||||
content="generatedBy: \"$contract_version\""$'\n'"$content"
|
||||
fi
|
||||
if [[ "$path" == *continue* || "$path" == *explore* || "$path" == *propose* ]]; then
|
||||
content="$content"$'\nCreate at most ONE planning artifact per invocation.\nSTOP for explicit Change Owner approval.'
|
||||
@@ -60,6 +62,9 @@ for path in "${entrypoints[@]}"; do
|
||||
if [[ "$path" == *apply* || "$path" == *archive* ]]; then
|
||||
content="$content"$'\nRequire explicit Change Owner approval and invalidate dependent approvals after upstream edits.'
|
||||
fi
|
||||
if [[ "$path" != *new* && "$path" != *sync* ]]; then
|
||||
content="$content"$'\n'"$planning_line"
|
||||
fi
|
||||
write_file "$path" "$content"
|
||||
done
|
||||
|
||||
@@ -68,18 +73,25 @@ openspec status --store wealth-ledger-specs
|
||||
Require affected delivery area gates, semantic verification and independent read-only review.
|
||||
Require explicit Change Owner approval and invalidate dependent approvals after upstream edits.
|
||||
Do not ask for or accept a confirmation override.'
|
||||
archive_gate="$archive_gate"$'\n'"$planning_line"
|
||||
write_file ".opencode/commands/opsx-archive.md" "$archive_gate"
|
||||
write_file ".opencode/skills/openspec-archive-change/SKILL.md" $'generatedBy: "1.10.0"\n'"$archive_gate"
|
||||
write_file ".opencode/skills/openspec-archive-change/SKILL.md" "generatedBy: \"$contract_version\""$'\n'"$archive_gate"
|
||||
|
||||
verification_gate='bash specs/scripts/verify-openspec-version.sh
|
||||
openspec status --store wealth-ledger-specs
|
||||
Check every affected delivery area with the workspace verifier and require independent read-only review.'
|
||||
verification_gate="$verification_gate"$'\n'"$planning_line"
|
||||
write_file ".opencode/commands/opsx-verify.md" "$verification_gate"
|
||||
write_file ".opencode/skills/openspec-verify-change/SKILL.md" $'generatedBy: "1.10.0"\n'"$verification_gate"
|
||||
write_file ".opencode/skills/openspec-verify-change/SKILL.md" "generatedBy: \"$contract_version\""$'\n'"$verification_gate"
|
||||
|
||||
apply_gate='bash specs/scripts/verify-openspec-version.sh
|
||||
openspec status --store wealth-ledger-specs
|
||||
Require explicit Change Owner approval and invalidate dependent approvals after upstream edits.'
|
||||
apply_gate="$apply_gate"$'\n'"$planning_line"
|
||||
|
||||
mkdir -p "$fixture/specs/agent-projection/opencode"
|
||||
cp -R "$fixture/.opencode/commands" "$fixture/specs/agent-projection/opencode/commands"
|
||||
cp -R "$fixture/.opencode/skills" "$fixture/specs/agent-projection/opencode/skills"
|
||||
|
||||
run_verifier() {
|
||||
WEALTH_LEDGER_WORKSPACE="$fixture" bash "$verifier"
|
||||
@@ -87,12 +99,34 @@ run_verifier() {
|
||||
|
||||
run_verifier
|
||||
|
||||
rm "$fixture/specs/agent-projection/opencode/commands/opsx-apply.md"
|
||||
if run_verifier; then
|
||||
echo "expected missing canonical projection source to fail" >&2
|
||||
exit 1
|
||||
fi
|
||||
cp "$fixture/.opencode/commands/opsx-apply.md" "$fixture/specs/agent-projection/opencode/commands/opsx-apply.md"
|
||||
|
||||
for path in \
|
||||
.opencode/commands/opsx-propose.md \
|
||||
specs/agent-projection/opencode/commands/opsx-propose.md; do
|
||||
perl -0pi -e 's/^bash specs\/scripts\/verify-openspec-planning\.sh .*\n//m' "$fixture/$path"
|
||||
done
|
||||
if run_verifier; then
|
||||
echo "expected missing planning gate in an artifact entrypoint to fail" >&2
|
||||
exit 1
|
||||
fi
|
||||
for path in \
|
||||
.opencode/commands/opsx-propose.md \
|
||||
specs/agent-projection/opencode/commands/opsx-propose.md; do
|
||||
printf '%s\n' "$planning_line" >> "$fixture/$path"
|
||||
done
|
||||
|
||||
write_file "specs/openspec/.cli-version" '9.9.9'
|
||||
if run_verifier; then
|
||||
echo "expected wrong OpenSpec version contract to fail" >&2
|
||||
exit 1
|
||||
fi
|
||||
write_file "specs/openspec/.cli-version" '1.10.0'
|
||||
write_file "specs/openspec/.cli-version" "$contract_version"
|
||||
|
||||
write_file "specs/openspec/config.yaml" 'schema: spec-driven'
|
||||
if run_verifier; then
|
||||
@@ -101,6 +135,14 @@ if run_verifier; then
|
||||
fi
|
||||
write_file "specs/openspec/config.yaml" 'schema: wealth-ledger-sdd'
|
||||
|
||||
perl -0pi -e 's/^version: 2$/version: 1/m' "$fixture/specs/openspec/schemas/wealth-ledger-sdd/schema.yaml"
|
||||
if run_verifier; then
|
||||
echo "expected obsolete project schema version to fail" >&2
|
||||
exit 1
|
||||
fi
|
||||
rm -rf "$fixture/specs/openspec/schemas/wealth-ledger-sdd"
|
||||
cp -R "$script_dir/../openspec/schemas/wealth-ledger-sdd" "$fixture/specs/openspec/schemas/wealth-ledger-sdd"
|
||||
|
||||
write_file "specs/openspec/schemas/wealth-ledger-sdd/schema.yaml" $'name: wealth-ledger-sdd\nversion: 1'
|
||||
if run_verifier; then
|
||||
echo "expected incomplete project schema graph to fail" >&2
|
||||
@@ -149,7 +191,7 @@ if run_verifier; then
|
||||
echo "expected multi-artifact proposal guidance to fail" >&2
|
||||
exit 1
|
||||
fi
|
||||
write_file ".opencode/commands/opsx-propose.md" $'bash specs/scripts/verify-openspec-version.sh\nopenspec status --store wealth-ledger-specs\nCreate at most ONE planning artifact per invocation.\nSTOP for explicit Change Owner approval.'
|
||||
write_file ".opencode/commands/opsx-propose.md" $'bash specs/scripts/verify-openspec-version.sh\nopenspec status --store wealth-ledger-specs\nCreate at most ONE planning artifact per invocation.\nSTOP for explicit Change Owner approval.\n'"$planning_line"
|
||||
|
||||
write_file ".opencode/commands/opsx-archive.md" $'bash specs/scripts/verify-openspec-version.sh\nopenspec status --store wealth-ledger-specs\nDon\x27t block archive on warnings - just inform and confirm.'
|
||||
if run_verifier; then
|
||||
|
||||
Reference in New Issue
Block a user