verification-before-completion
Defense-in-depth verification before declaring any task complete.
它会碰到什么
逐条看命中(9 条严重或高危)
- 高
scripts/validate.py:68exec-spawnif "eval(" in content: - 高
scripts/validate.py:69exec-spawnissues.append("Found eval() usage (security risk)") - 高
scripts/validate.py:97exec-spawnresult = subprocess.run(
- 高
scripts/validate.py:140exec-spawnresult = subprocess.run(
- 高
scripts/validate.py:230exec-spawnresult = subprocess.run(["pytest", "--version"], capture_output=True, timeout=5)
- 高
scripts/validate.py:238exec-spawnresult = subprocess.run(
- 高
scripts/validate.py:260exec-spawnresult = subprocess.run(
- 高
scripts/validate.py:285exec-spawnresult = subprocess.run(["npm", "--version"], capture_output=True, timeout=5)
- 高
scripts/validate.py:306exec-spawnresult = subprocess.run(
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
Verification before completion
Verify the requested result using observed commands and actual artifacts. Match checks to the affected behavior and repository requirements.
Instructions
- Inspect
git status --shortandgit diffto include modified, staged, and untracked files. Read the changed code; check imports, error handling, compatibility, and unintended edits. - Run the repository's required tests, build, lint, and format checks. Start with relevant tests; run the full affected suite when required or when shared behavior changed. Do not substitute syntax checks for behavior tests.
- Check generated artifacts at their expected paths. For integrations, verify all four levels: EXISTS on disk, SUBSTANTIVE implementation, WIRED into callers, and real DATA FLOWS through it. Trace inputs and results; an unused file or hardcoded empty result is not a working feature.
- Inspect the diff for accidental debug code, secrets, placeholders, and unfinished work. Review matches in context: an intentional
passor empty result is not automatically a stub. Resolve missing implementations and wiring before claiming completion. - Fix failures within the authorized task and rerun affected checks. A failed required build or test blocks a success claim. Do not repeat unchanged passing checks without a reason.
- Report commands, observed status, relevant counts, and remaining limitations. Retain full logs; include actionable failure excerpts and log paths instead of every passing test name. Distinguish automated checks, manual checks, and checks not run.
Use project commands first. Defaults when no project command exists:
| Language | Tests | Build or syntax | Lint |
|---|---|---|---|
| Python | pytest -v | python -m py_compile {files} | ruff check {files} |
| Go | go test ./... -v -race | go build ./... | golangci-lint run ./... |
| JavaScript | npm test | npm run build | npm run lint |
| TypeScript | npm test | npx tsc --noEmit | npm run lint |
| Rust | cargo test | cargo build | cargo clippy |
Reuse check evidence
Reuse a passing result when it covers the current task and checked files, dependencies, configuration, and relevant environment. Keep its command, scope, revision or file state, result, and log path when available. A phase change or new worker alone does not require a rerun.
After edits, rerun affected checks. Rerun when evidence is missing, the checked state cannot be established, shared dependencies or environment changed, or failures leave uncertainty. Refresh mutable external state such as CI and deployment status before acting on it. Required CI and release checks still apply to the commit or artifact being delivered; an earlier local pass does not replace them.
For inherited results, cite their source and check their applicability. Do not claim you ran them. Review roster and review reuse belong to skills/process/pr-workflow/references/pr-risk-policy.md; this skill owns check evidence and completion claims.
Recovery
- No tests: perform suitable manual checks and state the coverage gap. Add a regression test when the task warrants one; do not imply manual inspection proves behavior.
- Missing dependencies: use the repository environment; report the missing tool and any narrower checks performed. Unrun checks are not passes.
- Build or test failure: retain the failing command and diagnostic, identify the cause, fix it, and rerun. Separate unrelated failures with evidence.
- Missing wiring or data flow: name the caller or call site where integration stops and repair it.
Reference loading table
Load only when the signal applies; files are under references/.
| Signal | Reference | Purpose |
|---|---|---|
| Stub detection or integration evidence | adversarial-methodology.md | Four-level checks and goal-backward verification |
| Domain checklist or database/schema change | checklist.md | Before/after schema, duplicate tables/columns, existing-query compatibility |
| Verification walkthrough needed | verification-examples.md | Bug fix, refactor, migration, config examples |
| Pressure to skip consequential checks | anti-rationalization-enforcement.md | Failure patterns and pressure checks |
For code-review artifacts, use python3 scripts/validate-review-output.py --type {systematic|parallel|sapcc-review|sapcc-audit} <file.md>. Exit codes: 0 valid, 1 schema errors, 2 unparseable, 3 missing jsonschema (pip install jsonschema). Systematic and parallel review validate on return and retry once before stopping. A valid schema verifies structure, not the truth of review findings.
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。
它属于哪个仓库
skills/process/verification-before-completion/SKILL.md