Refs #2 (audit supplement VERIFY-001 / CA-H08). Partial: OpenSpec validation in CI and AI_INDEX link checks stay open in #2.
verify ran git diff --check on a clean checkout → always no-op. Now checks the actual committed range: PR merge-base→head, push before→after, zero/absent before → last pushed commit (full tree would flag read-only archives with existing blank-line-at-EOF).
fetch-depth: 0; Node setup / npm ci removed from this job (git-only). Commits/security jobs unchanged; verify context name kept.
README describes scope: whitespace-only structural check, not semantic spec validation.
Local proof (disposable repo): clean range with pre-existing whitespace outside it → 0; committed trailing whitespace → 2; zero-SHA fallback → 2.
Pending CI proof: disposable commit with trailing whitespace on this PR must FAIL, then revert → PASS.
Refs #2 (audit supplement VERIFY-001 / CA-H08). Partial: OpenSpec validation in CI and AI_INDEX link checks stay open in #2.
- `verify` ran `git diff --check` on a clean checkout → always no-op. Now checks the actual committed range: PR merge-base→head, push before→after, zero/absent before → last pushed commit (full tree would flag read-only archives with existing blank-line-at-EOF).
- `fetch-depth: 0`; Node setup / `npm ci` removed from this job (git-only). Commits/security jobs unchanged; `verify` context name kept.
- README describes scope: whitespace-only structural check, not semantic spec validation.
Local proof (disposable repo): clean range with pre-existing whitespace outside it → 0; committed trailing whitespace → 2; zero-SHA fallback → 2.
Pending CI proof: disposable commit with trailing whitespace on this PR must FAIL, then revert → PASS.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Refs #2 (audit supplement VERIFY-001 / CA-H08). Partial: OpenSpec validation in CI and AI_INDEX link checks stay open in #2.
verifyrangit diff --checkon a clean checkout → always no-op. Now checks the actual committed range: PR merge-base→head, push before→after, zero/absent before → last pushed commit (full tree would flag read-only archives with existing blank-line-at-EOF).fetch-depth: 0; Node setup /npm ciremoved from this job (git-only). Commits/security jobs unchanged;verifycontext name kept.Local proof (disposable repo): clean range with pre-existing whitespace outside it → 0; committed trailing whitespace → 2; zero-SHA fallback → 2.
Pending CI proof: disposable commit with trailing whitespace on this PR must FAIL, then revert → PASS.