verify

A read-only checker for one task outcome, comparing the result with that task’s requirements, applicable design rules, and reproducible evidence.

In plain words
What is it for?
Use it to verify one task identified by its TASK code, including the relevant acceptance evidence, interaction contracts, tier-specific artifacts, and test or execution proof.
Why use it?
It provides an independent decision about whether a task is supported by the required plans, files, tests, contracts, and execution evidence.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/nicelight/devrails-26/verify
Clone the repo
git clone --depth 1 https://github.com/nicelight/DevRails-26
Per session 19 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,650 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00019 $0.03650
Opus 5 $0.00010 $0.01825
Sonnet 5 $0.00004 $0.00730
Haiku 4.5 $0.00002 $0.00365

Measured 2d ago against content hash 8d076170daf3, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/_shared/references/commands/verify.md · 309 lines

How it starts

The opening of the file, as written. The whole thing — 309 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/verify - Verify one TASK outcome

<input_contract> Expected $ARGUMENTS: one TASK-NNN-TN-FT-NNN-WN.

Require:

  • exactly one matching indexed task record plus .memory-bank/workflows/tier-policy.md#tier-obligations and #closure-authority;
  • #task-claim-and-dependency-ownership;
  • #tier-classification-and-escalation when scope may be under-tiered, #hard-write-boundary when a boundary/alias is non-empty, #task-scoped-acceptance-evidence when its fields are populated, and #claim-linked-red--green-for-t2t3 only for T2/T3;
  • task-linked feature/REQ material needed for this outcome;
  • direct task-linked applicable canonical SDD specs;
  • current accepted graph row and exact contract heading for every task-scoped inter-module interaction;
  • tier-selected execution protocol and /exe handoff/evidence:
    • T0/T1 -> .protocols/<TASK_ID>/run.md plus .tasks/<TASK_ID>/ when present;
    • T2/T3 -> context.md, plan.md, progress.md, handoff.md, existing verification.md, and substantive .tasks/<TASK_ID>/ artifacts.

Normal scheduler input is in_progress. Manual re-verification of another state requires tier-appropriate execution evidence or an explicit request. Never verify a merely planned|ready task as executed or silently reinterpret blocked|failed|done.

Point-of-use preflight confirms index/file/ID and ID-segment consistency, valid tier, string-array reqs/depends_on, valid gate shapes, valid verify array, and tier-selected execution evidence. This is not another full schema/review gate. Missing required input returns NEEDS-CLARIFICATION; do not reconstruct it from protocol prose.

An execute receipt is optional evidence, not required /exe input. Its absence or ineligibility routes to a rerun or replacement probe, not by itself to NEEDS-CLARIFICATION. Missing tier-required protocol, /exe handoff/evidence, or normative evidence remains a required-input blocker under the rule above. </input_contract>

<hard_invariants>

  • Before the verdict, load and apply this installed skill's references/finding-adjudication.md semantic pack.
  • Before the verdict, attempt one fresh best-effort co-review on model Codex Luna with reasoning effort xhigh, using this installed skill's agents/review-code.md; give it the task target, governing evidence, scope, and actual change surface. Do not retry or block verification if it cannot launch. Treat its output only as candidate findings.
  • Route only by task.tier; lifecycle/status ownership is canonical in .memory-bank/workflows/tier-policy.md#closure-authority.
  • Verify this task's outcome and mapped AC/REQ subset, not the whole feature or acceptance assigned to other tasks.
  • Treat done and done_for_prod dependency outcomes as prerequisites, not claims to prove. Applicable regression checks support the current task outcome and do not transfer ownership.
  • Direct task-linked canonical specs outrank secondary task prose for their concerns. For T2/T3, feature links or spec-index.md alone are insufficient.
  • Apply only spec families demanded by actual scope. Missing/conflicting/wrong canonical coverage is a planning/design blocker, not an implementation FAIL.
  • Evidence requirements and verification targets state what must be proved; they are not proof. /exe local PASS is input, not automatic PASS.
  • Executor claim-path evidence linked by the current attempt is supporting, not an independent observation or replacement for this command's functional proof. Never demand fabricated RED from historical done|done_for_prod|failed tasks.
  • An execute receipt is self-attested supporting evidence. It does not prove that its declared snapshot preceded the command or that the reported result occurred, and it is never an independent observation by /verify.
  • Advisory touched_files deviation is not material expansion by itself; hard allowed/forbidden scopes and semantic task boundaries remain strict.
  • When direct task links define architecture boundaries, PASS requires both the functional outcome and the allowed architectural path. Limit this to the actual change surface; do not run a repository-wide architecture audit.
  • Do not edit implementation, specs, AC, dependencies, tier/wave, task scope, BUG records, or follow-up tasks.
  • /verify never invokes /debug. It may recommend a separate fresh /debug <TASK_ID> for an observed failure whose root cause or minimum correction is not evidence-backed; the functional verdict still follows this command's evidence-adequacy rules.
  • Scheduler mode: never close/fail/block/promote tasks or dependents. </hard_invariants>

Read the full file on GitHub · 309 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 309 lines · 19 tokens per session scan A 8d076170daf3

Subscribe to this mod's changes

verify is a command published in the GitHub repository nicelight/DevRails-26 (22 stars, last pushed 4d ago), licensed MIT. It adds 19 tokens to every session and 3,650 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.