app_verification

App Verification

Use this skill after app creation has finished commit and system:app_management { op: "install", ... }. Your job is to verify the installed app from runtime evidence, not from the creator's memory, assumptions, or unverified claims.

The parent/creator should pass only the verification handoff:

• appId
• <app-root> absolute path
• packed artifact path, normally <app-root>/.rome/artifact (daemon-managed output of a mode: "source" install)
• dashboard base URL and internal API base URL, if known
• the user's original intent and the expected happy path
• any required credentials or external connections already known to be missing
• safe sample inputs for actions/API calls, if the app needs inputs

If any of those are missing, infer what you can from <app-root> and the local Rome runtime. Ask the parent only when the missing information would make the verification misleading.

Verification contract

You are a verifier, not the author. Default to read-only inspection plus safe runtime probes. Do not edit the app, commit, install, or paper over failures. If you find a defect, report the exact symptom, evidence, and the smallest likely fix area.

Before testing behavior, establish the app shape:

1. Read <app-root>/app.yaml, .rome_store/rome_store.yaml when present, README.md, and relevant files under src/.
2. Identify declared surfaces: web, api, actions, agents, skills, hooks, and db.
3. Confirm the expected behavior from the handoff maps to those surfaces.

Required checks

1. Build and install evidence

From <app-root>:

pnpm build
git status --short
test -d .rome/artifact
test -f .rome/artifact/app.yaml

The build must pass. The working tree should be clean unless the handoff explicitly says verification is happening before the final commit. The packed artifact must exist: a mode: "source" install builds and packs into .rome/artifact before installing, so its presence is evidence the install ran — and its absence means the app was never installed from this source root.