sdd-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sdd-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Merge delta specs from a change directory into the main baseline specs. Applies each delta marker intelligently, preserving existing content not mentioned in the delta.
SPECS_ROOTis resolved by thesddrouter before this skill runs. Replace.specs/with your project's actual specs root in all paths below.
sdd-sync.sdd-verify passes with no blocking findings — implementation is confirmed correctsdd-verify reports only blockers that are explicitly overridden per references/sdd-change-formats.mdsdd-verify firstsdd-verifyIf no delta specs exist in .specs/changes/<name>/specs/, warn:
"No delta specs to sync."
Stop unless the user confirms to proceed.
Before syncing, confirm verification status and any recorded override trail:
sdd-sync consumes the latest sdd-verify outcome; it does not reconstruct verification from design.md.sdd-verify first..specs/changes/<name>/design.md for ## Verification Overrides and confirm each applicable entry has all required fields (finding, stage, reason, constraints, follow-up task, approved by, recorded).Stop if any required field is missing.
Stop and tell the user which blockers remain uncovered.
.specs/changes/<name>/specs/.specs/specs/tasks.mdFor each delta spec, read both files:
.specs/changes/<name>/specs/<capability>/spec.md.specs/specs/<capability>/spec.md (may not exist for new capabilities)Apply delta markers:
| Delta marker | Action |
|---|---|
| ADDED requirements | Insert as new ### Requirement: entries in the main spec |
| MODIFIED requirements | Find the matching requirement by name and replace it — apply the MODIFIED preservation guard first |
| REMOVED requirements | Find the matching requirement by name and delete it |
| RENAMED capabilities | Rename the capability directory and update the spec header |
Preservation rule: Content in the main spec not mentioned in the delta is never touched.
Strip delta-only annotations: When writing any requirement into a baseline spec — inserting an ADDED requirement, replacing a MODIFIED one, or creating a new capability (Phase 3) — strip its delta-only lines: the > Previously: … provenance line and any Serves: backlink. Baseline specs carry contracts, not change provenance or value backlinks; the value layer (user stories and Serves: links) is change-scoped and stays in the change directory.
MODIFIED preservation guard: The preservation rule operates at requirement granularity — a MODIFIED requirement is replaced as a whole, so scenarios its delta block omits are _not_ preserved. Before replacing, compare the baseline requirement's scenarios and sub-clauses against the MODIFIED delta block. If the delta omits any baseline scenario that the change did not deliberately remove (no rationale in design.md), stop and surface it:
"MODIFIED<name>: baseline scenario(s)<…>are absent from the delta block and will be deleted on sync. Restore the full post-change requirement, or confirm the removal is intentional."
Replace only after the omission is confirmed intentional, and strip the delta-only > Previously: … and Serves: lines — they do not belong in the baseline (see Strip delta-only annotations).
A mechanical backstop ships with the skill for the dropped-scenario half of this guard: run scripts/check_modified_completeness.py <specs-root> --change <name> (a uv script; deps are declared inline). It compares scenario names only and exits non-zero when a MODIFIED delta drops a baseline scenario — sub-clause and body-text preservation is _not_ mechanically checked, so keep verifying that by reading. Mark intentional scenario drops with a <!-- modified-removes: ScenarioName --> comment inside the delta block.
Idempotency rule: Applying the same delta twice produces the same result as applying it once. For ADDED: check whether the requirement already exists by name before inserting — skip if already present. For RENAMED: check whether the new directory name already exists before renaming — skip if already renamed.
RENAMED processing order: When a delta spec contains RENAMED alongside other markers, process the rename first (directory rename + spec header update), then apply any ADDED/MODIFIED/REMOVED markers against the already-renamed main spec. The delta spec is always identified by the _old_ capability name — look it up before renaming.
If a delta spec covers a capability with no corresponding main spec:
.specs/specs/<capability>/ directoryspec.md in baseline format (no delta markers)## ADDED, ## MODIFIED, ## REMOVED section headings and keep the ### Requirement: entries beneath them as plain requirementsSee references/sdd-spec-formats.md for the baseline spec format.
If the delta spec contains only RENAMED and the old capability does not exist in main specs, create the capability under the new name using the ADDED requirements as baseline content.
If .specs/.sdd/schema-config.yaml exists and schemas/after/ is present in the change directory:
.specs/changes/<name>/schemas/after/<schema-type> to .specs/schemas/<schema-type> (overwrite)..specs/schemas/.schema-sources.yaml with the generation date and change name.docs/openapi.yaml), surface a reminder — do not auto-update it:"Authored schema at<path>may need updating to match the implementation. Reference:.specs/changes/<name>/schemas/after/"
If no schema config exists but .specs/schemas/ contains files and no schemas/after/ directory exists in the change, emit a visible warning:
WARNING: Schema baseline exists at.specs/schemas/but this change has no after-snapshot. The schema baseline may be stale. Runsdd-deriveor create.specs/.sdd/schema-config.yamlto enable schema tracking.
If no schema config exists and .specs/schemas/ is empty or absent, skip silently.
> Previously: provenance lines, or Serves: backlinks remain in main specsList each capability synced:
Synced:
- auth/ → 2 requirements added, 1 modified
- payments/ → 1 requirement removed
- notifications/ → new capability created (3 requirements)
Schema snapshots updated:
- openapi.yaml → 2 endpoints added, 1 model modified
- Reminder: authored docs/openapi.yaml may be stale (schema sync did not update it)
Synced under overrides:
- `pip audit` failure for `litellm` → stage: `verify`; reason: upstream fix unavailable in current environment; constraints: no ignore added; follow-up remains open in `tasks.md`> Previously: … provenance line into the baseline specServes: backlink into the baseline spec — like > Previously:, it is change-scoped and must be stripped at syncdesign.md instead of consuming the latest sdd-verify result plus any recorded overridessdd-verify clears all blockers, whether by a clean pass or a recorded overridedesign.md override and an unchecked remediation task in tasks.mdreferences/sdd-spec-formats.md — baseline spec format for new capabilities created during syncreferences/sdd-change-formats.md — change directory artifact formats (proposal, design, tasks)references/sdd-schema.md — schema lifecycle policy (§ 4) and .schema-sources.yaml format (§ 3)scripts/check_modified_completeness.py — mechanical dropped-scenario check (scenario names only, not body sub-clauses); exits non-zero on dropped baseline scenarios, wireable as a pre-commit/CI gate~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.