A multi-step user acceptance testing (UAT) workflow for checking whether completed software does what its story promised. It combines cold-start checks, builds, type checking, linting, automated tests, and manual step-by-step verification.

Use it after implementing a plan or feature and before a code audit. It supports full checks, a smoke mode for hotfixes, and a CLI mode for command-line tools.

It provides evidence that a feature works in the built product, not just that its source code looks correct. Risk-based modes help adjust the depth of checking for different priorities.

verify-work — Cursor rule for Cursor by danielvm-git/bigpowers

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/danielvm-git/bigpowers

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/rules/danielvm-git/bigpowers/verify-work/github.svg)](https://agentmods.dev/rules/danielvm-git/bigpowers/verify-work)

Your own site

<a href="https://agentmods.dev/rules/danielvm-git/bigpowers/verify-work"><img src="https://agentmods.dev/badge/rules/danielvm-git/bigpowers/verify-work/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/rules/danielvm-git/bigpowers/verify-work"><img src="https://agentmods.dev/badge/rules/danielvm-git/bigpowers/verify-work.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 43 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 2,405 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00043	$0.02405
Opus 5.5	$0.00017	$0.00962
Sonnet 5.5	$0.00009	$0.00481
Haiku 4.5	$0.00004	$0.00241

Measured 1mo ago against content hash 9bf63b692932, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

verify-work scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletemediumDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm -rf .next/cache node_modules/.cache 2>/dev/null || true

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

sleep 3 && curl -sf http://localhost:<port>/health || echo "BOOT FAIL"

.cursor/rules/verify-work.mdc · 191 lines

How it starts

The opening of the file, as written. The whole thing — 191 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Verify Work

HARD GATE — No story is "done" until manual UAT for the active story is confirmed with evidence.

HARD GATE — Do NOT run on main or master. Use the feature branch from kickoff-branch.

Review answers "is the code good?"; Verify answers "does the built thing do what was promised?"

Modes

Default: full UAT plus gaps loop
--smoke: Cold-start only plus one happy-path flow. Use for hotfixes.
--cli: CLI tool verification — replaces cold-start with binary smoke checklist. Use for CLI tools with no server process.

Risk-Scaled Depth

verify-work reads the risk: field from the story template (defaults to P1 if absent) to scale verification rigor:

P0: Full verify-work multi-phase + security-review (step 5) + NFR evidence gate (step 5b).
P1: Standard verify-work (build, test, lint, step-by-step manual).
P2: Smoke, typecheck, lint only. Skip tests, security scan, and step-by-step manual UAT.
P3: Typecheck and lint only. Skip smoke, tests, security scan, and step-by-step manual UAT.

Process

Timing: bash scripts/bp-timing.sh start verify-work at invocation; bash scripts/bp-timing.sh end verify-work before handoff.

Branch check — must not be main/master.

0a. Preflight / CI green (HARD GATE — e51s03) — Run Preflight from CLAUDE.md or BP_PREFLIGHT (bp-read-agents.sh). If PR open: gh pr checks (CI green). Failure blocks all phases → quick-fix or fix-bug.

Read active story tasks from specs/epics/<capsule>/eNNsYY-tasks.yaml and story spec from specs/epics/<capsule>/eNNsYY-<slug>.md (countable-story-format, Gherkin in §17). Note the risk: level (P0–P3). 1a. Pre-UAT verify validation — for each task's verify: command, run it and detect pattern mismatches before UAT begins. If a grep/awk/jq command fails, check whether the pattern is wrong vs. a genuine failure:
```
# For a failing grep -q 'PATTERN' FILE, check what is actually in FILE
grep 'PATTERN' FILE || grep -n '' FILE | head -20   # show nearest lines
```
Report: "Pattern 'X' not found. Nearest match: 'Y' at line N" and ask "Update verify command? [Y/n]". Fix before proceeding — a mismatched verify command produces false failures during UAT.
Cold-start smoke (if app; skip if P3): stop server, clear caches, boot from scratch.
AGENTS.md preflight — if 0a skipped BP_PREFLIGHT, run bash scripts/bp-read-agents.sh and use detected command.
Mechanical gates: build → typecheck → lint → tests (from CLAUDE.md or AGENTS.md). Skip tests if P2/P3.

Read the full file on GitHub · 191 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 191 lines · 43 tokens per session scan B 9bf63b692932

Subscribe to this mod's changes

verify-work is a cursor rule published in the GitHub repository danielvm-git/bigpowers (267 stars, last pushed 27d ago), licensed MIT. It adds 43 tokens to every session and 2,405 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Claude Code E2E testing Testing ai-agents automation bmad clean-code cursor-rules

verify-work

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade B, and why

Recursive force deletemediumDestructive command

Makes network callslowCapability

How it starts

Verify Work

Modes

Risk-Scaled Depth

Process

What this file has done since we first saw it

Other cursor rules, from other repositories

page-object-patterns

testing-fundamentals

cypress-excellence

framework-architecture

testing

behat-steps