runtime-verification-a2e85e — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited runtime-verification-a2e85e (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Iron law: no completion until the code builds, runs, and behaves correctly; if you cannot verify it, build the infrastructure to verify it. Invoked after quality checks pass by /flow:start Phase 4 step 2, /flow:pr Phase 4 via Agent(integration-verifier), and the address-pr, debug, and start-issue workflows. Returns the Runtime Verification Results and Acceptance Criteria Verification tables, with failures as P1 findings (category=runtime). Permitted skips: only markdown-only, config-only, or dependency-bump-only, each with its listed evidence; any other skip needs an approved six-field escalation via AskUserQuestion.
| Category | Definition | Required evidence |
|---|---|---|
markdown-only | Only .md, .markdown, .txt, .rst files | git diff --name-only origin/$DEFAULT_BRANCH..HEAD showing only doc extensions |
config-only | Only config files (.json, .yaml, .yml, .toml, .ini, .env.example, dotfiles) with no code-path change; syntax still validated (lint/schema, dry-run) | Full file list plus validation output |
dependency-bump-only | Only lockfiles and manifest version strings (package.json version, package-lock.json, poetry.lock, Gemfile.lock, go.sum, Cargo.lock); no source, config semantics, or new dependencies; build still succeeds | Full file list plus build output |
Mixed diffs (a whitelisted category plus one .py file, a new dependency, or a behavior-changing config value) get full verification. "Small change", "CI-only", "tests cover this", "just a refactor" are not categories.
Out-of-whitelist skips (anything uncovered): raise a Proactive-Autonomy escalation per references/escalation-format.md via AskUserQuestion and wait for approval; Situation cites why the whitelist misses the change, Tried lists the fast-path, build, and smoke attempts. Blanket repo-wide authorization is never valid.
verify.sh or scripts/verify.sh is run and its results returned.runtime-verification-probes.md). Build failure IS the finding: read errors, fix, rebuild up to closedLoop.maxBuildIterations (default 5).lsp.enabled and lsp.diagnosticsAsQuality (both default true): Error=P1, Warning=P2, Info/Hint=P3, deduplicated against CLI output, bounded by lsp.timeout (default 5000 ms); timeout or no server is N/A, never a block.capability-discovery output. Won't start: read the error, fix, retry up to closedLoop.maxServerRetries (default 3); port busy: another port; startup wait timeouts.devServerStartup seconds (default 30).curl /health and /; non-200 is a P1 finding (references/finding-schema.md).timeouts.e2eTest (default 120); otherwise ad-hoc verification by project type (reference); "no test framework" is a problem to solve, not a skip.On any failure: read the full error, root-cause it (debugging-patterns), fix, re-verify, up to closedLoop.maxDebugIterations (default 5), then escalate; the user never supplies logs.
UI-relevant diffs (rules in skills/visual-verification/SKILL.md) also run Skill(visual-verification) in parallel; if the dev server cannot start, that skill returns SKIP ("dev server unavailable") and the server failure is the primary finding; tables render side by side. visualVerification.* settings belong there.
Complete only when every testable criterion has Pass/Fail/N/A with a reason and every failure, including a dev server that won't start, is a P1 finding.
### Runtime Verification Results
| Check | Status | Details |
|-------|--------|---------|
| Dev server | {Running/Not found} | Port {N} |
| Health check | {Pass/Fail/N/A} | HTTP {status} |
| E2E tests | {Pass/Fail/N/A} | {framework} |
| Smoke tests | {Pass/Fail/N/A} | {details} |
| LSP diagnostics | {Pass/Fail/Skip/N/A} | {errors: N, warnings: N, files checked: N} |
### Acceptance Criteria Verification
| # | Criterion | Verified | Method |
|---|-----------|----------|--------|
| {n} | {ui criterion} | Pass/Fail | visual-verification `Observed:` blocks → bundle `### Visual analysis` |~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.