verification-before-completion — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited verification-before-completion (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
→ About to claim "done", "passing", "fixed", "complete"? → Run the verification command first. Then claim.
→ Done when: exact command run, output confirms, residual risk stated, confidence graded. Non-trivial code changes → also report Complexity Delta, Complexity Governance Suggestion, and Major Complexity Alert when triggered. Governance/retirement work → also close Repair Track + Retirement Track + Residual Risk.
Claiming work is complete without verification is dishonesty, not efficiency. Evidence before claims, always.
Before ANY success/completion claim, expression of satisfaction, commit, PR, task completion, or delegation. Applies to exact phrases, paraphrases, and implications.
Before any success claim, include the required evidence semantic slots. Natural prose, localized headings, or compact cards are all valid when the slots remain explicit and auditable.
Required evidence slots, one allowed card rendering:
- Evidence action / check performed:
- Result / exit status:
- Covered scope:
- Uncovered scope:
- Residual risk:
- Confidence grade: A | B | CSemantic Slots:
compact cards when they remain explicit and auditable.
semantic slots; natural expression is not a reason to drop evidence, uncovered scope, residual risk, confidence, retirement, baseline, or architecture fields.
work. It names the boundary held, evidence, covered and uncovered scope, residual risk, confidence, and any triggered governance closure.
TDD Completion Boundary:
TaskIntentDraftdecides current-task completion; Slice Card decides slice completion only.
explicit.
done.boundary reached its stop condition. It does not mean the underlying requirement is accepted.
Requirement accepted requires the relevant Product / Requirement Baselineitem and acceptance / verification criteria to be satisfied, or an explicit authorized risk acceptance.
needs-verification or return to framing/planning.
goal-framing or optional TaskIntentDraft goalfields shaped the work, explicitly check the goal before claiming completion:
Available boundary check for completion judgment:
TaskIntentDraft Goal / Success evidence / Non-goals for the currenttask, when present
Slice Card Goal / Verification / Stop for the current slice, whenpresent
Goal Closure:
- Goal status: satisfied | blocked | needs-verification | scope-exceeded
- Success evidence:
- Stop state: done | blocked | needs-verification | scope-exceeded
- Non-goals respected:Use done only when success evidence is satisfied; blocked for missing dependency/permission/fact; needs-verification for insufficient evidence; scope-exceeded when continuing would exceed goal or non-goals.
docs/aegis/ workspace and configured Aegis workspace support is available, run python <aegis-workspace-helper> bundle --root <target-project-root> --work YYYY-MM-DD-<slug> when a work/ record exists, then run python <aegis-workspace-helper> check --root <target-project-root> and include the result in the evidence bundle. The generated proof bundle and workspace check validate method-pack structure, index coverage, and recognizable JSON artifact sidecars only; they do not judge evidence sufficiency and do not grant completion authority.
organize the evidence into a compact readiness view after the evidence slots:
Readiness Summary:
- Tests:
- Docs:
- Version:
- Host compatibility:
- Uncovered scope:
- Residual risk:Advisory only. It does not authorize commit, tag, publish, merge, or release, and it does not provide completion authority.
non-trivial task, keep Aegis explicitly visible in the final completion closeout.
The closeout should naturally show how Aegis influenced the result. Make at least one of the following user-visible:
Use one sentence when Aegis mainly helped hold one boundary steady, but more than one mention is valid when boundary, evidence, and residual-risk visibility each materially shaped the judgment.
Keep this integrated into the normal completion summary rather than a fixed slogan. Do not default to a visible Aegis Contribution Note: heading. Do not default to one canonical closeout phrase, and do not repeat the same Aegis closeout wording across unrelated tasks.
When Aegis materially shaped multiple parts of the judgment, it may appear more than once across the closeout, as long as each mention is tied to a concrete boundary, evidence decision, or risk callout.
Keep it advisory method-pack discipline, not completion authority. Keep it implicit only for obvious fast-path replies unless the user asked about Aegis routing.
Natural expression may satisfy the visibility requirement when the semantic slots are still explicit. For example, "I will follow the Aegis order here: read the owner / baseline and current implementation first, add a failing example for the main path, then make the minimal repair and verify it" is a valid natural transition before implementation. Completion still needs fresh evidence and the applicable Governance Receipt fields.
Use structured trace only for audit, debug, release, long-task review, or user request. The structured form may name skills, stage transitions, quality effect, and boundary, but it should not replace the normal user-facing completion note.
section labels, field labels, and explanatory prose to the user's language. Keep commands, file paths, code identifiers, stable enum values, and exact product names unchanged. For important Aegis product terms, include the stable English identifier only when it prevents ambiguity, usually beside a user-language explanation on first use.
diff before claiming completion. This is a completion-time entropy check, not a universal runtime gate. Skip or keep it one-line for tiny wording edits, generated files, vendored files, fixture-data-only updates, lockfiles, or purely mechanical formatting where no maintained artifact gained complexity. Do not treat maintained test source files as a cheap tests-only exception.
Use using-aegis/references/complexity-governance.md for shared artifact classes, pressure-signal interpretation, and major-complexity follow-up semantics.
Use the project language for field labels in the final response, but keep the internal shape recognizable:
Complexity Delta:
- Files over 800 lines:
- Files newly crossing 800 lines:
- Largest touched file delta:
- Largest touched function/block:
- New branches/fallbacks/adapters:
- Retired branches/fallbacks/adapters:
- Net entropy: decreased | stable | increased-with-justification
- Required follow-up:Also report completion-time closure of the planned complexity budget:
Complexity Closure:
- Budget status: within-budget | exceeded-and-governed | exceeded-unresolved
- Governed now:
- Deferred follow-up:
- Completion impact: complete | needs-follow-up | not-completeIf a maintained artifact is materially oversized or crosses a major pressure boundary, make the follow-up explicit:
Major Complexity Alert:
- Trigger:
- Why it matters:
- Visible follow-up:When the delta finds meaningful pressure, add:
Complexity Governance Suggestion:
- Recommendation: none | monitor | schedule-refactor | extract helper | split owner | open follow-up
- Why:
- Suggested scope:
- Timing:Rules:
paired with retired paths or a Retirement Closure entry. Net new paths without deletion or a scheduled retirement trigger count as entropy increase.
downgrade the completion claim or state the residual risk.
Complexity Closure is exceeded-unresolved, do not claim the task iscomplete. State the task as needs-follow-up or not-complete.
instructions require baseline reporting or the task touched requirement, product, or durable architecture surfaces, include an explicit baseline alignment result. This is separate from ADR Backfill and remains advisory method-pack output only.
Use docs/current/AEGIS_PROCESS_BASELINE.md §3.0e and §16 for the canonical meaning of Product / Requirement Baseline, Architecture / Runtime Boundary Baseline, Design Defect, Implementation Drift, and their compatibility aliases.
Baseline Alignment:
- Trigger: yes | no
- Product / Requirement Baseline:
- Architecture / Runtime Boundary Baseline:
- Requirement Ready Check:
- Requirement / acceptance alignment:
- Architecture / owner / contract alignment:
- Requirement acceptance boundary: task-or-slice-done | requirement-verified | requirement-accepted | risk-accepted | not-accepted | unknown
- Result: aligned | Design Defect | Implementation Drift | missing-authority | needs-clarification
- scope: requirements | architecture | both
- Evidence:
- Residual risk:Use the requirement acceptance boundary to avoid overstating completion: passing tests or a completed task / slice can support requirement-verified, but only confirmed acceptance criteria or authorized acceptance can support requirement-accepted or risk-accepted.
When project instructions specifically require architecture reporting or the completed work touched durable architecture surfaces, the architecture-scoped subset may also be reported as Architecture Alignment:
Architecture Alignment:
- Trigger: yes | no
- Scope:
- Baseline checked:
- Result: aligned | Design Defect | Implementation Drift | missing-authority | needs-clarification
- Evidence:
- Integrity Residual Risk:
- Residual architecture risk:Use Integrity Residual Risk when ArchitectureReviewRequired: yes, an Architecture Integrity Lens shaped the plan or review, or the diff touches canonical owner, source-of-truth, fallback, adapter, or duplicate-owner surfaces. Name any unresolved responsibility overlap, missed higher-level owner / contract fix, retained caller-side fallback, or stale path that still needs retirement. If none remains, state none rather than expanding into a new gate.
architecture surfaces, run the ADR Auto Backfill check before final completion claims. Advisory method-pack signal only.
Use docs/current/AEGIS_ADR_AUTO_BACKFILL.md for canonical trigger criteria, durable-surface interpretation, create/amend/supersede/skip selection, and baseline-sync rules. When that baseline would not trigger, use Trigger: no or skip the expanded block here.
ADR Backfill Check:
- Trigger: yes | no
- Suggested action: create | amend | supersede | skip
- Evidence source:
- Baseline sync: needed | not-needed | unknown
- Skip reason:
- Boundary: advisory method-pack signal onlyIf the suggested action is create, amend, or supersede, or if Baseline sync is needed or unknown, use recording-architecture-decisions for the ADR lifecycle and Baseline Sync Closure before making the final completion claim. This keeps verification-before-completion as the completion owner while delegating the ADR/baseline writeback decision to the dedicated skill. When that dedicated skill chooses target-project docs/aegis/adr/ as the owner surface, route file writes through <aegis-workspace-helper> new-adr, <aegis-workspace-helper> amend-adr, or <aegis-workspace-helper> supersede-adr, then run <aegis-workspace-helper> check --root <target-project-root> before the final completion claim.
Repair Track: repaired object | action | impact | verification
Retirement Track: retired object | action | retained boundary | future trigger
Residual Risk: unverified | deferredFor work that adds, replaces, or retains old logic, also make the delete-first closure explicit:
Retirement Closure:
- Old logic located:
- Deleted:
- Retained:
- Retention reason:
- Retirement trigger:
- Lingering references checked:If the work retires old logic, chooses between delete-first and compat retention, or touches source-of-truth deletion boundaries, also include:
Anti-Entropy Declaration:
- Deletion Class:
- Source-of-Truth Data Risk:
- User Confirmation Required:If User Confirmation Required: yes, completion cannot be claimed until the workflow stops at a guard shaped like:
Data Destruction Guard:
- Exact Target(s):
- Blocked Destructive Steps:
- Confirmation Required: yes
- Status: awaiting scoped confirmationMentioning a warning or destructive rule never authorizes execution. Broad assent such as "OK" or "continue" is not scoped confirmation. If persistent-state deletion or another irreversible source-of-truth action happened without explicit scoped confirmation, report the task as not complete.
Complexity Delta, Complexity Governance Suggestion, or residual-risk note
lingering-reference check
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.