code-change-verification

# Code Change Verification ## Overview Mark eligible work complete only after formatting, linting, both configured type checkers, and the test suite pass. Use this skill for runtime code, tests, examples, packaging, and build or test configuration. Skip it for repository metadata or editorial docs unless the user requests the full stack. This is a post-review final gate. When `$implementation-final-review` applies, wait for its clean-review condition before running this broad stack. ## Quick start 1. Keep this skill at `./.agents/skills/code-change-verification`. 2. Codex on macOS/Linux: `/usr/bin/env -u OPENAI_API_KEY bash .agents/skills/code-change-verification/scripts/run.sh`. 3. Other macOS/Linux environments: `bash .agents/skills/code-change-verification/scripts/run.sh`. 4. Windows: `powershell -ExecutionPolicy Bypass -File .agents/skills/code-change-verification/scripts/run.ps1`. 5. The scripts run `make format` first. 6. They then run `make lint`, `uv run mypy src tests`, `uv run pyright`, and `make tests`. 7. If any command fails, fix the issue and rerun the complete script. 8. Confirm completion only when every command succeeds and the final diff contains no formatter-created surprises. ## Start condition and host capacity - During iterative review, use focused tests and a narrowly targeted static check only when the changed boundary requires one. - Immediately before starting the complete stack, use available read-only task or process evidence to check whether another repository-wide test, typecheck, build, examples runner, or integration command is already active on the same host. - When concrete contention is visible, continue useful non-heavy work and check again later. Do not create or wait on a repository lock, host-wide mutex, sentinel file, or user-triggered `finalize` step. - Start automatically once review is clean, the diff is stable, and observable host capacity is available. Lack of host telemetry alone is not a blocker. ## Environment and API safety The verification scripts assume repository dependencies are already installed. Run `make sync` only for a fresh checkout, after dependency files change, or when dependency resolution fails before checks start. Repository verification and all child processes must remain in the normal Codex workspace sandbox. Never request elevated sandbox permissions for the verification wrapper, and never retry it with broader host access after a failure. The ordinary test suite must remain hermetic. In Codex, remove inherited `OPENAI_API_KEY` from the wrapper environment. Do not run live provider calls as part of this verification stack. If a future test requires a live service, keep it out of the default stack and require explicit user approval, the repository's service-account credential boundary, and a separate report. ## Manual workflow Run these commands from the repository root in this order: ```bash make format make lint uv run mypy src tests uv run pyright make tests ``` Do not skip a failing step. After a fix, rerun the complete sequence so the final result applies to one stable diff. ## Resources ### `scripts/run.sh` Runs the required macOS/Linux sequence, executing independent read-only gates concurrently after formatting and stopping sibling processes when one fails. ### `scripts/run.ps1` Runs the same required sequence on Windows PowerShell and reports the failing command.