菜单
Tiered semantic analysis of changed code (rg → ast-grep → OpenGrep). Detects error-path bugs structural gates miss. Findings default to WARN. Internal — invoked by verify.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | gate-semantic |
| description | Tiered semantic analysis of changed code (rg → ast-grep → OpenGrep). Detects error-path bugs structural gates miss. Findings default to WARN. Internal — invoked by verify. |
| allowed-tools | ["Read","Bash","Glob","Grep","Write"] |
Detect semantic bugs in changed code using symbolic pre-processing when available. For each candidate finding, localize it explicitly with premises, claims, and conclusion grounded in file:line evidence.
config.json gates.semantic — categories, tools, optional rulesDir{repoStateRoot}/work/{selectedWork.id}/workflow.json — selected work unitgit diff --name-only $(git merge-base HEAD <baseBranch>){workDir}/evidence/semantic-report.mdworkflow.jsonScope (MEDIUM freedom): Changed code files only. Skip markdown/JSON/YAML/config. No changed code → PASS.
Tool tiers (LOW freedom):
Resolve from gates.semantic.tools config, fall back to PATH detection.
Missing tools narrow scope — never FAIL or ERROR. Validate sg identity:
sg --version 2>&1 | grep -iq 'ast-grep' (/usr/bin/sg from shadow-utils
is a false positive).
| Tier | Tool | Adds |
|---|---|---|
| 0 | rg | Text-pattern extraction + LLM |
| 1 | ast-grep (sg) | Structural JSON, metavariable capture |
| 2 | OpenGrep | Cross-function taint (rules: config rulesDir or .opengrep/rules/) |
Extraction (HIGH freedom):
Extract structural facts using highest available tier's tool. Feed facts
(not raw files) to LLM. Tier 1: sg scan <file> --json --rule <rule> or
sg run --pattern '...' <file> --json (avoid --stdin). Tier 2:
opengrep scan --config <rules-dir> --json <file>.
Categories (LOW freedom):
| Category | Tier | Diagnostic question |
|---|---|---|
| error-path-cleanup | 0+ | Does any error path skip releasing an acquired resource? |
| unchecked-errors | 0+ | Is any error-producing call's return value discarded? |
| fail-open-handling (CWE-636) | 1+ | Does any catch block swallow, broaden, or ignore errors? |
| error-data-leakage (CWE-209) | 1+ | Does any error response expose internals to the caller? |
| resource-lifecycle | 2+ | Is any acquired resource not released on all exit paths? |
Categories requiring an unavailable tier are skipped with an INFO note. Sole owner of CWE-636 and CWE-209 analysis (transferred from gate-security to avoid duplicate findings).
Verdict (LOW freedom):
Per protocols/evidence.md#verdict-rendering. All findings WARN by default.
No findings = PASS. WARN-only = WARN. Any BLOCK = FAIL.
Tier 0 categories: permanently WARN-only. Tier 1+ may promote to BLOCK
when: (1) ≥5 shipped units, (2) FP rate <10% per evidence.md#verdict-rendering
calibration, (3) user opt-in via config {"severity": "block"}.
Evidence report: Tool availability, skipped categories with reason, each finding with category, file:line, tier/tool, severity, remediation.
protocols/evidence.md#verdict-rendering -- verdict rendering and calibrationprotocols/evidence.md -- evidence storageprotocols/state.md -- gate status updatesprotocols/context.md -- config and anchor doc loading| Condition | Action |
|---|---|
| Disabled in config | sw-verify skips silently |
| No changed code files | PASS |
| No symbolic tools | Degrade to Tier 0 |
| Tool missing at runtime | WARN, skip tier |
| No calibration data | All findings WARN |
Specwright health check. Validates shared config, anchor docs, workflow and session state, commands, gates, and hooks. May backfill shipped PR metadata when it can prove the mapping safely.
Detects project stack and existing guardrails, then interactively configures deterministic quality checks across session, commit, push, and CI/CD layers.
Initializes Specwright in a project. Detects stack, asks about practices, creates constitution and charter, configures quality gates and hooks.
Shows current Specwright state for this worktree, the attached work, repo-wide active works, gate results, and lock status. Supports --reset, --cleanup, and --repair {unitId}.
Periodic codebase health check. Analyzes architecture, complexity, consistency, and debt across the full codebase. Produces persistent findings in AUDIT.md.
TDD implementation of one work unit. Delegates test writing to the tester agent and implementation to the executor agent. Commits per task.