A specification-wide verification workflow that checks a completed specification's implementation against its fixed acceptance contract. It records proof for each applicable requirement and creates a receipt for the exact final commit.

Running deterministic verification gates, repairing failures owned by the specification, proving each applicable requirement, and recording the final verification receipt.

It catches integration failures that may be missed when individual parts are checked separately. Its evidence-based gates also distinguish required checks from irrelevant ones.

How sponge-b0b/Polaris configures Claude Code and Codex

Reuse

Borrowing it

Nothing to install: this file belongs to sponge-b0b/Polaris. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/sponge-b0b/Polaris/main/.agents/skills/verify-spec/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/sponge-b0b/Polaris

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/sponge-b0b/polaris/verify-spec/github.svg)](https://agentmods.dev/skills/sponge-b0b/polaris/verify-spec)

Your own site

<a href="https://agentmods.dev/skills/sponge-b0b/polaris/verify-spec"><img src="https://agentmods.dev/badge/skills/sponge-b0b/polaris/verify-spec/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/sponge-b0b/polaris/verify-spec"><img src="https://agentmods.dev/badge/skills/sponge-b0b/polaris/verify-spec.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 37 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,879 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00037	$0.03879
Opus 5.5	$0.00015	$0.01552
Sonnet 5.5	$0.00007	$0.00776
Haiku 4.5	$0.00004	$0.00388

Measured 3d ago against content hash 20d0dffd2a5a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

verify-spec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/verify_spec_attribution.py, scripts/verify_spec_handoff.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/verify-spec/SKILL.md · 496 lines

How it starts

The opening of the file, as written. The whole thing — 496 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Verify Spec

$verify-spec owns integrated verification of one completed Spec candidate.

For a CCL-backed software Spec, verification consumes a frozen deterministic contract:

OBL-*   exact CCL material semantics
IMP-*   private/mechanical implementation obligations
TEST-*  explicit proof/test obligations
EXC-*   exclusions / decomposition guardrails

Verification is independent about whether the implementation satisfies those cells. It is not independent authority to reinterpret Spec prose, rediscover architecture, add a new contract cell, or strengthen/weaken a CCL assertion.

1. Recover exact lifecycle state

Assume no prior chat/session state.

Recover from current durable state:

parent Spec issue and exact body;
governance mode from Spec-local provenance markers;
exactly one Workspace Metadata record, fixed baseline, and spec-<n> branch when the Spec is branch-backed;
exact current candidate HEAD;
current ticket-coverage-manifest:v2 on the parent Spec;
complete current implementation-ticket set and native dependencies;
current ticket closure evidence/checkpoints;
applicable review/remediation state when this is a re-verification;
current CCL ledger.

Do not use Project fields or chat memory as verification authority.

For Wayfinder-managed Specs, invoke $project-delivery-management reconcile and the current governor guard(s) where the lifecycle requires actionability. Independent Specs remain outside Wayfinder focus.

Require all native Spec blockers to be closed before final certification. An unresolved blocker may coexist with verification-owned repairs that do not depend on the missing authority, but PASS is unreachable while the blocker remains.

2. Build the deterministic Spec contract

Take one exact current Spec-body snapshot and require:

python -m scripts.ccl_spec check <spec-body-file> contracts/ccl/transactions
python -m scripts.spec_contract build <issue-json> <contract-output>

Read the full file on GitHub · 496 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago Changed · +146 lines 20d0dffd2a5a
8d ago Changed · -793 lines f11c90567418
28d ago Changed · +35 lines e6ba5c6aa54b
1mo ago Changed · -4 lines b661af62fd0f
1mo ago Changed · +66 lines 1e7b45e84f70
1mo ago Changed · +51 lines b91d3d4a0a44
1mo ago Changed · +145 lines 5f038c60b986
1mo ago Changed · +19 lines 5b1181cbc78d
1mo ago Changed · +78 lines d42e3504c0cb
1mo ago First seen · 753 lines · 37 tokens per session scan A 3785ce786a69

Subscribe to this mod's changes

verify-spec is a skill published in the GitHub repository sponge-b0b/Polaris (4 stars, last pushed today), licensed Apache-2.0. It adds 37 tokens to every session and 3,879 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Testing

research-engineer

An uncompromising Academic Research Engineer. Operates with absolute scientific rigor, objective criticism, and zero flair. Focuses on theoretical correctness, formal verification, and optimal implementation across any required technology.

davila7/claude-code-templates · 43 tokens

tika-eval-compare

Compare extracts from two Tika builds over a corpus to detect regressions in content, encoding, exceptions, and embedded-document handling. Use for "compare before/after extracts", "eval this change against the corpus".

apache/tika · 50 tokens

cua-driver

Use Cua Driver for desktop or browser tasks that are awkward or unavailable through Bash/APIs, or when the user explicitly wants GUI interaction: app testing, visual bug reproduction, form filling, calendar entry, screenshots, and demo recording. Also covers Cua setup; not OpenAI Codex Computer Use or web research.

davidondrej/skills · 68 tokens

Polaris: Skill for Claude Code