UNPKG

paqad-ai

Version:

Spec-driven development framework — AI agents that think before they type

github.com/Eliyce/paqad-ai

Eliyce/paqad-ai

52 lines (37 loc) • 2.4 kB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
--- name: retest-verification description: Classifies each finding of an earlier pentest report as fixed, still-open or needs-manual-verification from fresh local evidence. Use when the pentest skill runs its Retest mode, or when asked which findings or PT ids in a pentest report are fixed or still open. Only for pentest reports. metadata: model_tier: reasoning cacheable: 'false' output_format: markdown paqad-meta: skill.meta.yaml --- ## What It Does Replays prior pentest findings against fresh project evidence so retest reports can classify each finding as fixed, still open, or requiring manual verification. ## Use This When Only when the `pentest` skill runs its Retest mode for the `pentest-retest` workflow and a prior pentest report has already identified findings to verify. The `pentest` skill is the entry point and calls this skill as a helper. ## Inputs - Read the source pentest sidecar first. - Read `references/retest-status-rules.md` before assigning statuses. - Read fresh evidence gathered during the current retest run. ## Procedure 1. Run `scripts/load-source-findings.sh <sidecar.json>`: validates the schema and emits one JSON row per finding to iterate over. 2. For each id, gather fresh code/docs/advisory/runtime evidence and pick a status from `assets/status-vocabulary.txt` (`fixed | still-open | needs-manual-verification`). 3. New gaps (not in the source report) belong in a separate report; never silently merge them here. 4. Format per `assets/output.template.md`; validate with `scripts/lint-output.sh <retest.md> <sidecar.json>`: fails if any id is invented. ## Output Contract - Match `assets/output.template.md`: `## Retest Decisions` with `### {{id}} → {{status}}` per finding plus Original title, Severity, Fresh evidence, Reasoning. - Status must be `fixed | still-open | needs-manual-verification`. - Output must pass `scripts/lint-output.sh` (exit 0). ## Escalate / Stop Conditions - Ask when the source report sidecar is missing fields required to replay a finding. - Warn when fresh evidence is blocked and the finding depends on runtime validation. - Do not invent a fixed status when the current evidence is merely absent. ## Resources - `references/retest-status-rules.md` - `scripts/load-source-findings.sh` - `scripts/lint-output.sh` - `assets/output.template.md` - `assets/status-vocabulary.txt` - `agents/openai.yaml`