Verify

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

.claude/agents

.claude/skills

.github/CLAUDE.md

CLAUDE.md

apps/backend/CLAUDE.md

import { test, expect } from "../../fixtures/test-base";

apps/web/generated/licenses.json

`Agent (full access)`, then retry verification." Explain that push and PR

`Agent (full access)`, then retry verification." On other runtimes, tell the

create one. Recommend full access only after normal escalation could not

Audit 0.4.1 · source sha 786d4817799e · 18 Oct 2026Report an issue or request a re-scan

• Publisherkdlbs GitHub organizationOwner of the repository this skill is read from
• Source folderkdlbs/kandev/.agents/skills/verifyThe exact folder we audited
• LicenceAGPL-3.0As the repository states it
• Commit pinned for this verdict786d4817799eA new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Run a broad local verification audit only when the user explicitly requests it or PR/CI remediation requires it.

---
name: verify
description: Run a broad local verification audit only when the user explicitly requests it or PR/CI remediation requires it.
---

# Verify

`/verify` is opt-in. Do not invoke it automatically before push or PR creation:
the default pre-PR evidence is TDD plus the exact task-defined tests and E2E
commands. Use this skill only when the user explicitly asks for a broad local
audit or when a PR/CI finding needs it. Supply the `/commit` hook receipt and
last successfully verified SHA when available.

## What to do

Run the selected commands once in the primary session. Avoid overlapping full
suites in the same checkout; wait for a running command to finish before
starting another. Capture targeted failure evidence instead of repeatedly
rerunning a broad suite.

If the execution relay terminates an otherwise healthy long-running check,
rerun that check **once** in one named, monitored `tmux` session with an exit
sentinel. Do not run a parallel retry. Record the log path and result, then
close the session after collecting the sentinel. If that retry fails or its
result cannot be recovered, return the evidence as a blocked or failed
verification report.

- If verify passes cleanly: report success.
- If verify fails: fix the reported cause in the same conversation, rerun the
  relevant targeted checks, commit if needed, and restart verification.
- If verify reports that required sandbox capabilities could not be authorized,
  stop before push or PR delivery and surface its required user action.
  On Codex, tell the user exactly: "Switch the mode selector to
  `Agent (full access)`, then retry verification." Explain that push and PR
  delivery are waiting on mandatory verification; do not imply that Codex or GitHub cannot
  create PRs or ask whether to proceed unverified.

## Resource-safe frontend verification

Before a broad web test or E2E run, read
[the E2E resource-safety reference](../e2e/references/resource-safety.md).
The local Vitest configuration clamps unsafe worker overrides, and the E2E
wrappers cap local shards and workers. Do not bypass those limits or overlap
full suites unless the task is a deliberate, monitored resource experiment.

## Verification Procedure

Resolve the PR base and verification scope base, then collect
`scope-base...HEAD`, staged, unstaged, and untracked paths. The supplied last
verified SHA may be the scope base only when it is an ancestor of `HEAD`;
otherwise use the PR base. Report PR base/head, scope base, paths/categories,
hook-receipt eligibility and omissions, exact commands, and coverage limits.
If base/diff is unavailable or impact is ambiguous, use `mode=full`; use full
mode for explicit requests, releases, shared build or toolchain changes, and
unusually broad work. PR CI is the authoritative full matrix. Read
[impact-matrix.md](references/impact-matrix.md) and, when a receipt is
supplied, [hook-evidence.md](references/hook-evidence.md) before commands. A
scoped pass is `changed-scope PASS`, never `full PASS`.

In `mode=full`, run the pipeline below and ignore hook omissions. In
`mode=changed`, run only uncovered matrix commands for impacted categories; do
not run unrelated suites or repeat eligible hook-covered formatting/lint.
Evaluate the narrowly scoped pure-web-helper row in the impact matrix before
the generic `apps/web/**` row; use the generic row whenever any eligibility
condition is not proven.

```bash
# Fresh worktrees share .git/ but not apps/node_modules.
if [ ! -d apps/node_modules ]; then
  (cd apps && pnpm install --frozen-lockfile)
fi

# Resolve the current PR base; stacked PRs may not target main.
PR_BASE="$(gh pr view --json baseRefName --jq .baseRefName 2>/dev/null || true)"
if [ -n "$PR_BASE" ]; then
  git fetch origin "$PR_BASE"
  git merge-base --is-ancestor "origin/$PR_BASE" HEAD || echo "branch is behind origin/$PR_BASE"
else
  echo "No PR base resolved; skipping rebase to avoid rewriting a stacked branch."
fi

# Keep verbose output out of the main agent context. The helper prints the log
# path and extracts targeted failure lines when a command fails.
scripts/run-quiet format -- make fmt
git status --short

# make typecheck uses the top-level Makefile path and can bypass package
# pretypecheck hooks, so generate web metadata before typecheck.
node apps/web/scripts/generate-release-notes.mjs
node apps/web/scripts/generate-changelog.mjs
scripts/run-quiet typecheck -- make typecheck
scripts/run-quiet test -- make test
# Full-backend Go lint belongs to CI. Select the changed Go files locally.
scripts/run-quiet backend-lint -- bash scripts/lint-go-changed <changed-go-files>
scripts/run-quiet lint -- make lint-web lint-harness lint-specs lint-architecture
```

After quiet formatting, inspect the intended diff because formatter changes
still require review. When a quiet command fails, use its returned log path for
targeted inspection instead of rerunning the command with streamed output.

Large Go package output can bury the actual failure in the execution relay,
especially when tests emit expected simulated-error logs. Keep the command's
exit status and capture its output with `scripts/run-quiet` or an explicit
temporary log, then extract targeted markers before reading the surrounding
context:

```bash
rg -n -- '--- FAIL|^FAIL[[:space:]]|panic:|DATA RACE|WARNING: DATA RACE' <log>
```

Treat truncated tool output as incomplete evidence. Use the extracted package
and test names to inspect the focused log section, and report the log path with
the verification result.

### Disk-constrained runners

If format, typecheck, tests, lint, or E2E reports `ENOSPC`, cache
initialization/lock errors, or an apparently unrelated secondary failure,
inspect free space on the temp and cache filesystems before changing code:

```bash
df -h /tmp /var/tmp "$PWD"
```

Keep reusable caches shared. In particular, preserve an existing absolute
`GOCACHE` injected by Kandev's managed Go-cache provider, and preserve an
existing `GOLANGCI_LIN

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-18
   !CAUTION B 89 / 100

   first audit · source 786d4817799e

Questions about Verify

• github.com/kdlbs/kandev/tree/main/.agents/skills/verify — the audited source at commit 786d4817799e and every finding aboveObserved · 18 Oct 2026

Spotted something wrong? Report a correction · Methodology