goop-accept

goop-accept is a command for coding agents from hffmnnj/goopspec. It costs 15 tokens per session (948 once invoked), scanned A, original, MIT.

A command that checks completed work, runs verification, and archives a project milestone after the user accepts it.

In plain words
What is it for?
Use it after implementation to check project state, review requirements and security, run verification and tests, present the results, and prepare open changes for merging.
Why use it?
It prevents a milestone from being treated as complete when required work, tests, security checks, or user approval are still missing.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/hffmnnj/goopspec/goop-accept
Clone the repo
git clone --depth 1 https://github.com/hffmnnj/goopspec

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for goop-accept

README.md
[![agentmods](https://agentmods.dev/badge/commands/hffmnnj/goopspec/goop-accept.svg)](https://agentmods.dev/commands/hffmnnj/goopspec/goop-accept)
Your own site
<a href="https://agentmods.dev/commands/hffmnnj/goopspec/goop-accept"><img src="https://agentmods.dev/badge/commands/hffmnnj/goopspec/goop-accept.svg" alt="Measured on agentmods" height="20"></a>
Per session 15 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 948 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00015 $0.00948
Opus 5 $0.00008 $0.00474
Sonnet 5 $0.00003 $0.00190
Haiku 4.5 $0.00002 $0.00095

Measured 4d ago against content hash 020bd6504569, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

goop-accept scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/opencode-plugin/commands/goop-accept.md · 67 lines

How it starts

The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/goop-accept

Run the verification-to-archive lifecycle. The milestone is not complete until the user explicitly accepts.

Gate check

Call goop_state({ action: "get" }). If allWavesComplete is not true or blockers exist, return BLOCKED with:

Run /goop-execute first.

Load references

goop_reference({ name: "phase-gates" })
goop_reference({ name: "security-checklist" })

Steps

  1. Read goop_read_db({ doc_types: ["spec", "blueprint", "chronicle"] }) for non-wave planning context and progress log; read wave/task/verification context via goop_acceptance_audit (which wraps goop_read_wave).

  2. Spawn goop-verifier to check must-have coverage, artifacts, key links, and quality.

  3. Spawn goop-tester for full test and build verification (top-rung, full-suite context).

  4. Present a verification matrix. Require explicit user acceptance.

  5. PR summary and merge offer — enumerate all open PRs for this workflow. Run gh pr list --json number,title,url,baseRefName filtered to the workflow's wave branches. Present them as a numbered list in merge order, newest-first (highest-numbered wave first, cascading down to Wave 1): PR number, title, URL, and target base branch. Then ask in plain text (NOT the question tool):

    All verifications passed. Want me to merge these PRs in order? (Yes / No — I'll do it myself)

    This is the one place lazy autopilot stops for a literal user reply, because merging is irreversible. Wait for the user's answer before proceeding.

  6. On acceptance:

    • Copy workflow docs to .goopspec/archive/<workflowId>-<timestamp>/.
    • Verify the copy before deleting originals.
    • Generate RETROSPECTIVE.md and extract learnings to memory.
    • Optionally tag git.
    • Update AGENTS.md with verified learnings where appropriate.
  7. On rejection or issues, return to /goop-execute or /goop-amend.

Auto-merge sequence

If the user replies Yes to the merge offer:

  1. Merge newest-first cascade — merge the highest-numbered wave's PR into the next-lower wave's branch first (e.g. Wave 3 into Wave 2), then that branch's PR (now carrying the merged work) into the wave below it, and so on, until Wave 1 — whose PR already targets main — merges last, landing the entire stack on main in one final step. For each merge: run gh pr merge <number> --merge --delete-branch. --merge (merge commit) is GoopSpec's default merge method and preserves per-wave commit history; do not substitute --squash unless a human explicitly overrides.
  2. Log each merge — append a brief entry via goop_append_chronicle after each successful merge.
  3. Failure handling — if any merge fails (conflict, CI failure, protected branch): stop immediately and report which PR failed and the reason. Leave all remaining PRs open. Never force-merge. Return to the user for resolution.
  4. Post-merge sync — after all PRs are merged: run git checkout main && git pull to sync locally. Confirm the final commit is on main and report its hash. Remote branches are deleted via --delete-branch; do not delete local branches — that is the user's responsibility.

Read the full file on GitHub · 67 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 67 lines · 15 tokens per session scan A 020bd6504569

Subscribe to this mod's changes

goop-accept is a command published in the GitHub repository hffmnnj/goopspec (46 stars, last pushed 22d ago), licensed MIT. It adds 15 tokens to every session and 948 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.