--- name: spec-to-code-compliance description: "Spec-to-Code Compliance Checker Skill workflow skill. Use this skill when the user needs Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off." version: "0.0.1" category: testing-security tags: ["spec-to-code-compliance", "verifies", "implements", "exactly", "what", "documentation", "specifies", "for"] complexity: advanced risk: caution tools: ["codex-cli", "claude-code", "cursor", "gemini-cli", "opencode"] source: community author: "sickn33" date_added: "2026-04-15" date_updated: "2026-04-25" --- # Spec-to-Code Compliance Checker Skill ## Overview This public intake copy packages `plugins/antigravity-awesome-skills-claude/skills/spec-to-code-compliance` from `https://github.com/sickn33/antigravity-awesome-skills` into the native Omni Skills editorial shape without hiding its origin. Use it when the operator needs the upstream workflow, support files, and repository context to stay intact while the public validator and private enhancer continue their normal downstream flow. This intake keeps the copied upstream files intact and uses the `external_source` block in `metadata.json` plus `ORIGIN.md` as the provenance anchor for review. Imported source sections that did not map cleanly to the public headings are still preserved below or in the support files. Notable imported sections: Rationalizations (Do Not Skip), Output Requirements & Quality Standards, Completeness Verification, Agent, Limitations. ## When to Use This Skill Use this section as the trigger filter. It should make the activation boundary explicit before the operator loads files, runs commands, or opens a pull request. - Verify code implements exactly what documentation specifies - Audit smart contracts against whitepapers or design documents - Find gaps between intended behavior and actual implementation - Identify undocumented code behavior or unimplemented spec claims - Perform compliance checks for blockchain protocol implementations - User provides both specification documents AND codebase ## Operating Table | Situation | Start here | Why it matters | | --- | --- | --- | | First-time use | `metadata.json` | Confirms repository, branch, commit, and imported path through the `external_source` block before touching the copied workflow | | Provenance review | `ORIGIN.md` | Gives reviewers a plain-language audit trail for the imported source | | Workflow execution | `SKILL.md` | Starts with the smallest copied file that materially changes execution | | Supporting context | `SKILL.md` | Adds the next most relevant copied source file without loading the entire package | | Handoff decision | `## Related Skills` | Helps the operator switch to a stronger native skill when the task drifts | ## Workflow This workflow is intentionally editorial and operational at the same time. It keeps the imported source useful to the operator while still satisfying the public intake standards that feed the downstream enhancer flow. 1. Confirm the user goal, the scope of the imported workflow, and whether this skill is still the right router for the task. 2. Read the overview and provenance files before loading any copied upstream support files. 3. Load only the references, examples, prompts, or scripts that materially change the outcome for the current request. 4. Execute the upstream workflow while keeping provenance and source boundaries explicit in the working notes. 5. Validate the result against the upstream expectations and the evidence you can point to in the copied files. 6. Escalate or hand off to a related skill when the work moves out of this imported workflow's center of gravity. 7. Before merge or closure, record what was used, what changed, and what the reviewer still needs to verify. ### Imported Workflow Notes #### Imported: Rationalizations (Do Not Skip) | Rationalization | Why It's Wrong | Required Action | |-----------------|----------------|-----------------| | "Spec is clear enough" | Ambiguity hides in plain sight | Extract to IR, classify ambiguity explicitly | | "Code obviously matches" | Obvious matches have subtle divergences | Document match_type with evidence | | "I'll note this as partial match" | Partial = potential vulnerability | Investigate until full_match or mismatch | | "This undocumented behavior is fine" | Undocumented = untested = risky | Classify as UNDOCUMENTED CODE PATH | | "Low confidence is okay here" | Low confidence findings get ignored | Investigate until confidence ≥ 0.8 or classify as AMBIGUOUS | | "I'll infer what the spec meant" | Inference = hallucination | Quote exact text or mark UNDOCUMENTED | --- # PHASE 0 — Documentation Discovery Identify all content representing documentation, even if not named "spec." Documentation may appear as: - `whitepaper.pdf` - `Protocol.md` - `design_notes` - `Flow.pdf` - `README.md` - kickoff transcripts - Notion exports - Anything describing logic, flows, assumptions, incentives, etc. Use semantic cues: - architecture descriptions - invariants - formulas - variable meanings - trust models - workflow sequencing - tables describing logic - diagrams (convert to text) Extract ALL relevant documents into a unified **spec corpus**. --- # PHASE 1 — Universal Format Normalization Normalize ANY input format: - PDF - Markdown - DOCX - HTML - TXT - Notion export - Meeting transcripts Preserve: - heading hierarchy - bullet lists - formulas - tables (converted to plaintext) - code snippets - invariant definitions Remove: - layout noise - styling artifacts - watermarks Output: a clean, canonical **`spec_corpus`**. --- # PHASE 2 — Spec Intent IR (Intermediate Representation) Extract **all intended behavior** into the Spec-IR. Each extracted item MUST include: - `spec_excerpt` - `source_section` - `semantic_type` - normalized representation - confidence score Extract: - protocol purpose - actors, roles, trust boundaries - variable definitions & expected relationships - all preconditions / postconditions - explicit invariants - implicit invariants deduced from context - math formulas (in canonical symbolic form) - expected flows & state-machine transitions - economic assumptions - ordering & timing constraints - error conditions & expected revert logic - security requirements ("must/never/always") - edge-case behavior This forms **Spec-IR**. See IR_EXAMPLES.md for detailed examples. --- # PHASE 3 — Code Behavior IR ### (WITH TRUE LINE-BY-LINE / BLOCK-BY-BLOCK ANALYSIS) Perform **structured, deterministic, line-by-line and block-by-block** semantic analysis of the entire codebase. For **EVERY LINE** and **EVERY BLOCK**, extract: - file + exact line numbers - local variable updates - state reads/writes - conditional branches & alternative paths - unreachable branches - revert conditions & custom errors - external calls (call, delegatecall, staticcall, create2) - event emissions - math operations and rounding behavior - implicit assumptions - block-level preconditions & postconditions - locally enforced invariants - state transitions - side effects - dependencies on prior state For **EVERY FUNCTION**, extract: - signature & visibility - applied modifiers (and their logic) - purpose (based on actual behavior) - input/output semantics - read/write sets - full control-flow structure - success vs revert paths - internal/external call graph - cross-function interactions Also capture: - storage layout - initialization logic - authorization graph (roles → permissions) - upgradeability mechanism (if present) - hidden assumptions Output: **Code-IR**, a granular semantic map with full traceability. See IR_EXAMPLES.md for detailed examples. --- # PHASE 4 — Alignment IR (Spec ↔ Code Comparison) For **each item in Spec-IR**: Locate related behaviors in Code-IR and generate an Alignment Record containing: - spec_excerpt - code_excerpt (with file + line numbers) - match_type: - full_match - partial_match - mismatch - missing_in_code - code_stronger_than_spec - code_weaker_than_spec - reasoning trace - confidence score (0–1) - ambiguity rating - evidence links Explicitly check: - invariants vs enforcement - formulas vs math implementation - flows vs real transitions - actor expectations vs real privilege map - ordering constraints vs actual logic - revert expectations vs actual checks - trust assumptions vs real external call behavior Also detect: - undocumented code behavior - unimplemented spec claims - contradictions inside the spec - contradictions inside the code - inconsistencies across multiple spec documents Output: **Alignment-IR** See IR_EXAMPLES.md for detailed examples. --- # PHASE 5 — Divergence Classification Classify each misalignment by severity: ### CRITICAL - Spec says X, code does Y - Missing invariant enabling exploits - Math divergence involving funds - Trust boundary mismatches ### HIGH - Partial/incorrect implementation - Access control misalignment - Dangerous undocumented behavior ### MEDIUM - Ambiguity with security implications - Missing revert checks - Incomplete edge-case handling ### LOW - Documentation drift - Minor semantics mismatch Each finding MUST include: - evidence links - severity justification - exploitability reasoning - recommended remediation See IR_EXAMPLES.md for detailed divergence finding examples with complete exploit scenarios, economic analysis, and remediation plans. --- # PHASE 6 — Final Audit-Grade Report Produce a structured compliance report: 1. Executive Summary 2. Documentation Sources Identified 3. Spec Intent Breakdown (Spec-IR) 4. Code Behavior Summary (Code-IR) 5. Full Alignment Matrix (Spec → Code → Status) 6. Divergence Findings (with evidence & severity) 7. Missing invariants 8. Incorrect logic 9. Math inconsistencies 10. Flow/state machine mismatches 11. Access control drift 12. Undocumented behavior 13. Ambiguity hotspots (spec & code) 14. Recommended remediations 15. Documentation update suggestions 16. Final risk assessment --- ## Examples ### Example 1: Ask for the upstream workflow directly ```text Use @spec-to-code-compliance to handle . Start from the copied upstream workflow, load only the files that change the outcome, and keep provenance visible in the answer. ``` **Explanation:** This is the safest starting point when the operator needs the imported workflow, but not the entire repository. ### Example 2: Ask for a provenance-grounded review ```text Review @spec-to-code-compliance against metadata.json and ORIGIN.md, then explain which copied upstream files you would load first and why. ``` **Explanation:** Use this before review or troubleshooting when you need a precise, auditable explanation of origin and file selection. ### Example 3: Narrow the copied support files before execution ```text Use @spec-to-code-compliance for . Load only the copied references, examples, or scripts that change the outcome, and name the files explicitly before proceeding. ``` **Explanation:** This keeps the skill aligned with progressive disclosure instead of loading the whole copied package by default. ### Example 4: Build a reviewer packet ```text Review @spec-to-code-compliance using the copied upstream files plus provenance, then summarize any gaps before merge. ``` **Explanation:** This is useful when the PR is waiting for human review and you want a repeatable audit packet. ## Best Practices Treat the generated public skill as a reviewable packaging layer around the upstream repository. The goal is to keep provenance explicit and load only the copied source material that materially improves execution. - Keep the imported skill grounded in the upstream repository; do not invent steps that the source material cannot support. - Prefer the smallest useful set of support files so the workflow stays auditable and fast to review. - Keep provenance, source commit, and imported file paths visible in notes and PR descriptions. - Point directly at the copied upstream files that justify the workflow instead of relying on generic review boilerplate. - Treat generated examples as scaffolding; adapt them to the concrete task before execution. - Route to a stronger native skill when architecture, debugging, design, or security concerns become dominant. ## Troubleshooting ### Problem: The operator skipped the imported context and answered too generically **Symptoms:** The result ignores the upstream workflow in `plugins/antigravity-awesome-skills-claude/skills/spec-to-code-compliance`, fails to mention provenance, or does not use any copied source files at all. **Solution:** Re-open `metadata.json`, `ORIGIN.md`, and the most relevant copied upstream files. Check the `external_source` block first, then restate the provenance before continuing. ### Problem: The imported workflow feels incomplete during review **Symptoms:** Reviewers can see the generated `SKILL.md`, but they cannot quickly tell which references, examples, or scripts matter for the current task. **Solution:** Point at the exact copied references, examples, scripts, or assets that justify the path you took. If the gap is still real, record it in the PR instead of hiding it. ### Problem: The task drifted into a different specialization **Symptoms:** The imported skill starts in the right place, but the work turns into debugging, architecture, design, security, or release orchestration that a native skill handles better. **Solution:** Use the related skills section to hand off deliberately. Keep the imported provenance visible so the next skill inherits the right context instead of starting blind. ## Related Skills - `@00-andruia-consultant` - Use when the work is better handled by that native specialization after this imported skill establishes context. - `@00-andruia-consultant-v2` - Use when the work is better handled by that native specialization after this imported skill establishes context. - `@10-andruia-skill-smith` - Use when the work is better handled by that native specialization after this imported skill establishes context. - `@10-andruia-skill-smith-v2` - Use when the work is better handled by that native specialization after this imported skill establishes context. ## Additional Resources Use this support matrix and the linked files below as the operator packet for this imported skill. They should reflect real copied source material, not generic scaffolding. | Resource family | What it gives the reviewer | Example path | | --- | --- | --- | | `references` | copied reference notes, guides, or background material from upstream | `references/n/a` | | `examples` | worked examples or reusable prompts copied from upstream | `examples/n/a` | | `scripts` | upstream helper scripts that change execution or validation | `scripts/n/a` | | `agents` | routing or delegation notes that are genuinely part of the imported package | `agents/n/a` | | `assets` | supporting assets or schemas copied from the source package | `assets/n/a` | ### Imported Reference Notes #### Imported: Output Requirements & Quality Standards See OUTPUT_REQUIREMENTS.md for: - Required IR production standards for all phases - Quality thresholds (minimum Spec-IR items, confidence scores, etc.) - Format consistency requirements (YAML formatting, line number citations) - Anti-hallucination requirements --- #### Imported: Completeness Verification Before finalizing analysis, review the COMPLETENESS_CHECKLIST.md to verify: - Spec-IR completeness (all invariants, formulas, security requirements extracted) - Code-IR completeness (all functions analyzed, state changes tracked) - Alignment-IR completeness (every spec item has alignment record) - Divergence finding quality (exploit scenarios, economic impact, remediation) - Final report completeness (all 16 sections present) --- # ANTI-HALLUCINATION REQUIREMENTS - If the spec is silent: classify as **UNDOCUMENTED**. - If the code adds behavior: classify as **UNDOCUMENTED CODE PATH**. - If unclear: classify as **AMBIGUOUS**. - Every claim must quote original text or line numbers. - Zero speculation. - Exhaustive, literal, pedantic reasoning. --- # Resources **Detailed Examples:** - IR_EXAMPLES.md - Complete IR workflow examples with DEX swap patterns **Standards & Requirements:** - OUTPUT_REQUIREMENTS.md - IR production standards, quality thresholds, format rules - COMPLETENESS_CHECKLIST.md - Verification checklist for all phases --- #### Imported: Agent The `spec-compliance-checker` agent performs the full 7-phase specification-to-code compliance workflow autonomously. Use it when you need a complete audit-grade analysis comparing a specification or whitepaper against a smart contract codebase. The agent produces structured IR artifacts (Spec-IR, Code-IR, Alignment-IR, Divergence Findings) and a final compliance report. Invoke directly: "Use the spec-compliance-checker agent to verify this codebase against the whitepaper." --- # END OF SKILL #### Imported: Limitations - Use this skill only when the task clearly matches the scope described above. - Do not treat the output as a substitute for environment-specific validation, testing, or expert review. - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.