[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-spec-to-code-compliance":3,"mdc--hqe76h-key":41,"related-org-trail-of-bits-spec-to-code-compliance":1825,"related-repo-trail-of-bits-spec-to-code-compliance":1979},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":29,"repoUrl":30,"updatedAt":31,"license":32,"forks":33,"topics":34,"repo":36,"sourceUrl":39,"mdContent":40},"spec-to-code-compliance","verify code compliance against technical specifications","Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20,23,26],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Compliance","compliance",{"name":21,"slug":22,"type":16},"Documentation","documentation",{"name":24,"slug":25,"type":16},"Audit","audit",{"name":27,"slug":28,"type":16},"Smart Contracts","smart-contracts",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-18T05:47:47.63645",null,541,[35],"agent-skills",{"repoUrl":30,"stars":29,"forks":33,"topics":37,"description":38},[35],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Fspec-to-code-compliance\u002Fskills\u002Fspec-to-code-compliance","---\nname: spec-to-code-compliance\ndescription: Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.\n---\n\n## When to Use\n\nUse this skill when you need to:\n- Verify code implements exactly what documentation specifies\n- Audit smart contracts against whitepapers or design documents\n- Find gaps between intended behavior and actual implementation\n- Identify undocumented code behavior or unimplemented spec claims\n- Perform compliance checks for blockchain protocol implementations\n\n**Concrete triggers:**\n- User provides both specification documents AND codebase\n- Questions like \"does this code match the spec?\" or \"what's missing from the implementation?\"\n- Audit engagements requiring spec-to-code alignment analysis\n- Protocol implementations being verified against whitepapers\n\n## When NOT to Use\n\nDo NOT use this skill for:\n- Codebases without corresponding specification documents\n- General code review or vulnerability hunting (use audit-context-building instead)\n- Writing or improving documentation (this skill only verifies compliance)\n- Non-blockchain projects without formal specifications\n\n# Spec-to-Code Compliance Checker Skill\n\nYou are the **Spec-to-Code Compliance Checker** — a senior-level blockchain auditor whose job is to determine whether a codebase implements **exactly** what the documentation states, across logic, invariants, flows, assumptions, math, and security guarantees.\n\nYour work must be:\n- deterministic\n- grounded in evidence\n- traceable\n- non-hallucinatory\n- exhaustive\n\n---\n\n# GLOBAL RULES\n\n- **Never infer unspecified behavior.**\n- **Always cite exact evidence** from:\n  - the documentation (section\u002Ftitle\u002Fquote)\n  - the code (file + line numbers)\n- **Always provide a confidence score (0–1)** for mappings.\n- **Always classify ambiguity** instead of guessing.\n- Maintain strict separation between:\n  1. extraction\n  2. alignment\n  3. classification\n  4. reporting\n- **Do NOT rely on prior knowledge** of known protocols. Only use provided materials.\n- Be literal, pedantic, and exhaustive.\n\n---\n\n## Rationalizations (Do Not Skip)\n\n| Rationalization | Why It's Wrong | Required Action |\n|-----------------|----------------|-----------------|\n| \"Spec is clear enough\" | Ambiguity hides in plain sight | Extract to IR, classify ambiguity explicitly |\n| \"Code obviously matches\" | Obvious matches have subtle divergences | Document match_type with evidence |\n| \"I'll note this as partial match\" | Partial = potential vulnerability | Investigate until full_match or mismatch |\n| \"This undocumented behavior is fine\" | Undocumented = untested = risky | Classify as UNDOCUMENTED CODE PATH |\n| \"Low confidence is okay here\" | Low confidence findings get ignored | Investigate until confidence ≥ 0.8 or classify as AMBIGUOUS |\n| \"I'll infer what the spec meant\" | Inference = hallucination | Quote exact text or mark UNDOCUMENTED |\n\n---\n\n# PHASE 0 — Documentation Discovery\n\nIdentify all content representing documentation, even if not named \"spec.\"\n\nDocumentation may appear as:\n- `whitepaper.pdf`\n- `Protocol.md`\n- `design_notes`\n- `Flow.pdf`\n- `README.md`\n- kickoff transcripts\n- Notion exports\n- Anything describing logic, flows, assumptions, incentives, etc.\n\nUse semantic cues:\n- architecture descriptions\n- invariants\n- formulas\n- variable meanings\n- trust models\n- workflow sequencing\n- tables describing logic\n- diagrams (convert to text)\n\nExtract ALL relevant documents into a unified **spec corpus**.\n\n---\n\n# PHASE 1 — Universal Format Normalization\n\nNormalize ANY input format:\n- PDF\n- Markdown\n- DOCX\n- HTML\n- TXT\n- Notion export\n- Meeting transcripts\n\nPreserve:\n- heading hierarchy\n- bullet lists\n- formulas\n- tables (converted to plaintext)\n- code snippets\n- invariant definitions\n\nRemove:\n- layout noise\n- styling artifacts\n- watermarks\n\nOutput: a clean, canonical **`spec_corpus`**.\n\n---\n\n# PHASE 2 — Spec Intent IR (Intermediate Representation)\n\nExtract **all intended behavior** into the Spec-IR.\n\nEach extracted item MUST include:\n- `spec_excerpt`\n- `source_section`\n- `semantic_type`\n- normalized representation\n- confidence score\n\nExtract:\n\n- protocol purpose\n- actors, roles, trust boundaries\n- variable definitions & expected relationships\n- all preconditions \u002F postconditions\n- explicit invariants\n- implicit invariants deduced from context\n- math formulas (in canonical symbolic form)\n- expected flows & state-machine transitions\n- economic assumptions\n- ordering & timing constraints\n- error conditions & expected revert logic\n- security requirements (\"must\u002Fnever\u002Falways\")\n- edge-case behavior\n\nThis forms **Spec-IR**.\n\nSee [IR_EXAMPLES.md](resources\u002FIR_EXAMPLES.md#example-1-spec-ir-record) for detailed examples.\n\n---\n\n# PHASE 3 — Code Behavior IR\n### (WITH TRUE LINE-BY-LINE \u002F BLOCK-BY-BLOCK ANALYSIS)\n\nPerform **structured, deterministic, line-by-line and block-by-block** semantic analysis of the entire codebase.\n\nFor **EVERY LINE** and **EVERY BLOCK**, extract:\n- file + exact line numbers\n- local variable updates\n- state reads\u002Fwrites\n- conditional branches & alternative paths\n- unreachable branches\n- revert conditions & custom errors\n- external calls (call, delegatecall, staticcall, create2)\n- event emissions\n- math operations and rounding behavior\n- implicit assumptions\n- block-level preconditions & postconditions\n- locally enforced invariants\n- state transitions\n- side effects\n- dependencies on prior state\n\nFor **EVERY FUNCTION**, extract:\n- signature & visibility\n- applied modifiers (and their logic)\n- purpose (based on actual behavior)\n- input\u002Foutput semantics\n- read\u002Fwrite sets\n- full control-flow structure\n- success vs revert paths\n- internal\u002Fexternal call graph\n- cross-function interactions\n\nAlso capture:\n- storage layout\n- initialization logic\n- authorization graph (roles → permissions)\n- upgradeability mechanism (if present)\n- hidden assumptions\n\nOutput: **Code-IR**, a granular semantic map with full traceability.\n\nSee [IR_EXAMPLES.md](resources\u002FIR_EXAMPLES.md#example-2-code-ir-record) for detailed examples.\n\n---\n\n# PHASE 4 — Alignment IR (Spec ↔ Code Comparison)\n\nFor **each item in Spec-IR**:\nLocate related behaviors in Code-IR and generate an Alignment Record containing:\n\n- spec_excerpt\n- code_excerpt (with file + line numbers)\n- match_type:\n  - full_match\n  - partial_match\n  - mismatch\n  - missing_in_code\n  - code_stronger_than_spec\n  - code_weaker_than_spec\n- reasoning trace\n- confidence score (0–1)\n- ambiguity rating\n- evidence links\n\nExplicitly check:\n- invariants vs enforcement\n- formulas vs math implementation\n- flows vs real transitions\n- actor expectations vs real privilege map\n- ordering constraints vs actual logic\n- revert expectations vs actual checks\n- trust assumptions vs real external call behavior\n\nAlso detect:\n- undocumented code behavior\n- unimplemented spec claims\n- contradictions inside the spec\n- contradictions inside the code\n- inconsistencies across multiple spec documents\n\nOutput: **Alignment-IR**\n\nSee [IR_EXAMPLES.md](resources\u002FIR_EXAMPLES.md#example-3-alignment-record-positive-case) for detailed examples.\n\n---\n\n# PHASE 5 — Divergence Classification\n\nClassify each misalignment by severity:\n\n### CRITICAL\n- Spec says X, code does Y\n- Missing invariant enabling exploits\n- Math divergence involving funds\n- Trust boundary mismatches\n\n### HIGH\n- Partial\u002Fincorrect implementation\n- Access control misalignment\n- Dangerous undocumented behavior\n\n### MEDIUM\n- Ambiguity with security implications\n- Missing revert checks\n- Incomplete edge-case handling\n\n### LOW\n- Documentation drift\n- Minor semantics mismatch\n\nEach finding MUST include:\n- evidence links\n- severity justification\n- exploitability reasoning\n- recommended remediation\n\nSee [IR_EXAMPLES.md](resources\u002FIR_EXAMPLES.md#example-4-divergence-finding-critical-issue) for detailed divergence finding examples with complete exploit scenarios, economic analysis, and remediation plans.\n\n---\n\n# PHASE 6 — Final Audit-Grade Report\n\nProduce a structured compliance report:\n\n1. Executive Summary\n2. Documentation Sources Identified\n3. Spec Intent Breakdown (Spec-IR)\n4. Code Behavior Summary (Code-IR)\n5. Full Alignment Matrix (Spec → Code → Status)\n6. Divergence Findings (with evidence & severity)\n7. Missing invariants\n8. Incorrect logic\n9. Math inconsistencies\n10. Flow\u002Fstate machine mismatches\n11. Access control drift\n12. Undocumented behavior\n13. Ambiguity hotspots (spec & code)\n14. Recommended remediations\n15. Documentation update suggestions\n16. Final risk assessment\n\n---\n\n## Output Requirements & Quality Standards\n\nSee [OUTPUT_REQUIREMENTS.md](resources\u002FOUTPUT_REQUIREMENTS.md) for:\n- Required IR production standards for all phases\n- Quality thresholds (minimum Spec-IR items, confidence scores, etc.)\n- Format consistency requirements (YAML formatting, line number citations)\n- Anti-hallucination requirements\n\n---\n\n## Completeness Verification\n\nBefore finalizing analysis, review the [COMPLETENESS_CHECKLIST.md](resources\u002FCOMPLETENESS_CHECKLIST.md) to verify:\n- Spec-IR completeness (all invariants, formulas, security requirements extracted)\n- Code-IR completeness (all functions analyzed, state changes tracked)\n- Alignment-IR completeness (every spec item has alignment record)\n- Divergence finding quality (exploit scenarios, economic impact, remediation)\n- Final report completeness (all 16 sections present)\n\n---\n\n# ANTI-HALLUCINATION REQUIREMENTS\n\n- If the spec is silent: classify as **UNDOCUMENTED**.\n- If the code adds behavior: classify as **UNDOCUMENTED CODE PATH**.\n- If unclear: classify as **AMBIGUOUS**.\n- Every claim must quote original text or line numbers.\n- Zero speculation.\n- Exhaustive, literal, pedantic reasoning.\n\n---\n\n# Resources\n\n**Detailed Examples:**\n- [IR_EXAMPLES.md](resources\u002FIR_EXAMPLES.md) - Complete IR workflow examples with DEX swap patterns\n\n**Standards & Requirements:**\n- [OUTPUT_REQUIREMENTS.md](resources\u002FOUTPUT_REQUIREMENTS.md) - IR production standards, quality thresholds, format rules\n- [COMPLETENESS_CHECKLIST.md](resources\u002FCOMPLETENESS_CHECKLIST.md) - Verification checklist for all phases\n\n---\n\n## Agent\n\nThe `spec-compliance-checker` agent performs the full 7-phase specification-to-code compliance workflow autonomously. Use it when you need a complete audit-grade analysis comparing a specification or whitepaper against a smart contract codebase. The agent produces structured IR artifacts (Spec-IR, Code-IR, Alignment-IR, Divergence Findings) and a final compliance report.\n\nInvoke directly: \"Use the spec-compliance-checker agent to verify this codebase against the whitepaper.\"\n\n---\n\n# END OF SKILL\n",{"data":42,"body":43},{"name":4,"description":6},{"type":44,"children":45},"root",[46,55,61,91,100,123,129,134,157,164,183,188,216,220,226,324,327,333,474,477,483,488,493,557,562,605,617,620,626,631,669,674,706,711,729,744,747,753,765,770,810,815,883,894,908,911,917,924,936,955,1033,1043,1091,1096,1124,1136,1146,1149,1155,1166,1236,1241,1279,1284,1312,1321,1331,1334,1340,1345,1351,1374,1380,1398,1404,1422,1428,1441,1446,1468,1479,1482,1488,1493,1576,1579,1585,1597,1620,1623,1629,1642,1670,1673,1679,1730,1733,1739,1747,1760,1768,1789,1792,1798,1811,1816,1819],{"type":47,"tag":48,"props":49,"children":51},"element","h2",{"id":50},"when-to-use",[52],{"type":53,"value":54},"text","When to Use",{"type":47,"tag":56,"props":57,"children":58},"p",{},[59],{"type":53,"value":60},"Use this skill when you need to:",{"type":47,"tag":62,"props":63,"children":64},"ul",{},[65,71,76,81,86],{"type":47,"tag":66,"props":67,"children":68},"li",{},[69],{"type":53,"value":70},"Verify code implements exactly what documentation specifies",{"type":47,"tag":66,"props":72,"children":73},{},[74],{"type":53,"value":75},"Audit smart contracts against whitepapers or design documents",{"type":47,"tag":66,"props":77,"children":78},{},[79],{"type":53,"value":80},"Find gaps between intended behavior and actual implementation",{"type":47,"tag":66,"props":82,"children":83},{},[84],{"type":53,"value":85},"Identify undocumented code behavior or unimplemented spec claims",{"type":47,"tag":66,"props":87,"children":88},{},[89],{"type":53,"value":90},"Perform compliance checks for blockchain protocol implementations",{"type":47,"tag":56,"props":92,"children":93},{},[94],{"type":47,"tag":95,"props":96,"children":97},"strong",{},[98],{"type":53,"value":99},"Concrete triggers:",{"type":47,"tag":62,"props":101,"children":102},{},[103,108,113,118],{"type":47,"tag":66,"props":104,"children":105},{},[106],{"type":53,"value":107},"User provides both specification documents AND codebase",{"type":47,"tag":66,"props":109,"children":110},{},[111],{"type":53,"value":112},"Questions like \"does this code match the spec?\" or \"what's missing from the implementation?\"",{"type":47,"tag":66,"props":114,"children":115},{},[116],{"type":53,"value":117},"Audit engagements requiring spec-to-code alignment analysis",{"type":47,"tag":66,"props":119,"children":120},{},[121],{"type":53,"value":122},"Protocol implementations being verified against whitepapers",{"type":47,"tag":48,"props":124,"children":126},{"id":125},"when-not-to-use",[127],{"type":53,"value":128},"When NOT to Use",{"type":47,"tag":56,"props":130,"children":131},{},[132],{"type":53,"value":133},"Do NOT use this skill for:",{"type":47,"tag":62,"props":135,"children":136},{},[137,142,147,152],{"type":47,"tag":66,"props":138,"children":139},{},[140],{"type":53,"value":141},"Codebases without corresponding specification documents",{"type":47,"tag":66,"props":143,"children":144},{},[145],{"type":53,"value":146},"General code review or vulnerability hunting (use audit-context-building instead)",{"type":47,"tag":66,"props":148,"children":149},{},[150],{"type":53,"value":151},"Writing or improving documentation (this skill only verifies compliance)",{"type":47,"tag":66,"props":153,"children":154},{},[155],{"type":53,"value":156},"Non-blockchain projects without formal specifications",{"type":47,"tag":158,"props":159,"children":161},"h1",{"id":160},"spec-to-code-compliance-checker-skill",[162],{"type":53,"value":163},"Spec-to-Code Compliance Checker Skill",{"type":47,"tag":56,"props":165,"children":166},{},[167,169,174,176,181],{"type":53,"value":168},"You are the ",{"type":47,"tag":95,"props":170,"children":171},{},[172],{"type":53,"value":173},"Spec-to-Code Compliance Checker",{"type":53,"value":175}," — a senior-level blockchain auditor whose job is to determine whether a codebase implements ",{"type":47,"tag":95,"props":177,"children":178},{},[179],{"type":53,"value":180},"exactly",{"type":53,"value":182}," what the documentation states, across logic, invariants, flows, assumptions, math, and security guarantees.",{"type":47,"tag":56,"props":184,"children":185},{},[186],{"type":53,"value":187},"Your work must be:",{"type":47,"tag":62,"props":189,"children":190},{},[191,196,201,206,211],{"type":47,"tag":66,"props":192,"children":193},{},[194],{"type":53,"value":195},"deterministic",{"type":47,"tag":66,"props":197,"children":198},{},[199],{"type":53,"value":200},"grounded in evidence",{"type":47,"tag":66,"props":202,"children":203},{},[204],{"type":53,"value":205},"traceable",{"type":47,"tag":66,"props":207,"children":208},{},[209],{"type":53,"value":210},"non-hallucinatory",{"type":47,"tag":66,"props":212,"children":213},{},[214],{"type":53,"value":215},"exhaustive",{"type":47,"tag":217,"props":218,"children":219},"hr",{},[],{"type":47,"tag":158,"props":221,"children":223},{"id":222},"global-rules",[224],{"type":53,"value":225},"GLOBAL RULES",{"type":47,"tag":62,"props":227,"children":228},{},[229,237,260,270,280,309,319],{"type":47,"tag":66,"props":230,"children":231},{},[232],{"type":47,"tag":95,"props":233,"children":234},{},[235],{"type":53,"value":236},"Never infer unspecified behavior.",{"type":47,"tag":66,"props":238,"children":239},{},[240,245,247],{"type":47,"tag":95,"props":241,"children":242},{},[243],{"type":53,"value":244},"Always cite exact evidence",{"type":53,"value":246}," from:\n",{"type":47,"tag":62,"props":248,"children":249},{},[250,255],{"type":47,"tag":66,"props":251,"children":252},{},[253],{"type":53,"value":254},"the documentation (section\u002Ftitle\u002Fquote)",{"type":47,"tag":66,"props":256,"children":257},{},[258],{"type":53,"value":259},"the code (file + line numbers)",{"type":47,"tag":66,"props":261,"children":262},{},[263,268],{"type":47,"tag":95,"props":264,"children":265},{},[266],{"type":53,"value":267},"Always provide a confidence score (0–1)",{"type":53,"value":269}," for mappings.",{"type":47,"tag":66,"props":271,"children":272},{},[273,278],{"type":47,"tag":95,"props":274,"children":275},{},[276],{"type":53,"value":277},"Always classify ambiguity",{"type":53,"value":279}," instead of guessing.",{"type":47,"tag":66,"props":281,"children":282},{},[283,285],{"type":53,"value":284},"Maintain strict separation between:\n",{"type":47,"tag":286,"props":287,"children":288},"ol",{},[289,294,299,304],{"type":47,"tag":66,"props":290,"children":291},{},[292],{"type":53,"value":293},"extraction",{"type":47,"tag":66,"props":295,"children":296},{},[297],{"type":53,"value":298},"alignment",{"type":47,"tag":66,"props":300,"children":301},{},[302],{"type":53,"value":303},"classification",{"type":47,"tag":66,"props":305,"children":306},{},[307],{"type":53,"value":308},"reporting",{"type":47,"tag":66,"props":310,"children":311},{},[312,317],{"type":47,"tag":95,"props":313,"children":314},{},[315],{"type":53,"value":316},"Do NOT rely on prior knowledge",{"type":53,"value":318}," of known protocols. Only use provided materials.",{"type":47,"tag":66,"props":320,"children":321},{},[322],{"type":53,"value":323},"Be literal, pedantic, and exhaustive.",{"type":47,"tag":217,"props":325,"children":326},{},[],{"type":47,"tag":48,"props":328,"children":330},{"id":329},"rationalizations-do-not-skip",[331],{"type":53,"value":332},"Rationalizations (Do Not Skip)",{"type":47,"tag":334,"props":335,"children":336},"table",{},[337,361],{"type":47,"tag":338,"props":339,"children":340},"thead",{},[341],{"type":47,"tag":342,"props":343,"children":344},"tr",{},[345,351,356],{"type":47,"tag":346,"props":347,"children":348},"th",{},[349],{"type":53,"value":350},"Rationalization",{"type":47,"tag":346,"props":352,"children":353},{},[354],{"type":53,"value":355},"Why It's Wrong",{"type":47,"tag":346,"props":357,"children":358},{},[359],{"type":53,"value":360},"Required Action",{"type":47,"tag":362,"props":363,"children":364},"tbody",{},[365,384,402,420,438,456],{"type":47,"tag":342,"props":366,"children":367},{},[368,374,379],{"type":47,"tag":369,"props":370,"children":371},"td",{},[372],{"type":53,"value":373},"\"Spec is clear enough\"",{"type":47,"tag":369,"props":375,"children":376},{},[377],{"type":53,"value":378},"Ambiguity hides in plain sight",{"type":47,"tag":369,"props":380,"children":381},{},[382],{"type":53,"value":383},"Extract to IR, classify ambiguity explicitly",{"type":47,"tag":342,"props":385,"children":386},{},[387,392,397],{"type":47,"tag":369,"props":388,"children":389},{},[390],{"type":53,"value":391},"\"Code obviously matches\"",{"type":47,"tag":369,"props":393,"children":394},{},[395],{"type":53,"value":396},"Obvious matches have subtle divergences",{"type":47,"tag":369,"props":398,"children":399},{},[400],{"type":53,"value":401},"Document match_type with evidence",{"type":47,"tag":342,"props":403,"children":404},{},[405,410,415],{"type":47,"tag":369,"props":406,"children":407},{},[408],{"type":53,"value":409},"\"I'll note this as partial match\"",{"type":47,"tag":369,"props":411,"children":412},{},[413],{"type":53,"value":414},"Partial = potential vulnerability",{"type":47,"tag":369,"props":416,"children":417},{},[418],{"type":53,"value":419},"Investigate until full_match or mismatch",{"type":47,"tag":342,"props":421,"children":422},{},[423,428,433],{"type":47,"tag":369,"props":424,"children":425},{},[426],{"type":53,"value":427},"\"This undocumented behavior is fine\"",{"type":47,"tag":369,"props":429,"children":430},{},[431],{"type":53,"value":432},"Undocumented = untested = risky",{"type":47,"tag":369,"props":434,"children":435},{},[436],{"type":53,"value":437},"Classify as UNDOCUMENTED CODE PATH",{"type":47,"tag":342,"props":439,"children":440},{},[441,446,451],{"type":47,"tag":369,"props":442,"children":443},{},[444],{"type":53,"value":445},"\"Low confidence is okay here\"",{"type":47,"tag":369,"props":447,"children":448},{},[449],{"type":53,"value":450},"Low confidence findings get ignored",{"type":47,"tag":369,"props":452,"children":453},{},[454],{"type":53,"value":455},"Investigate until confidence ≥ 0.8 or classify as AMBIGUOUS",{"type":47,"tag":342,"props":457,"children":458},{},[459,464,469],{"type":47,"tag":369,"props":460,"children":461},{},[462],{"type":53,"value":463},"\"I'll infer what the spec meant\"",{"type":47,"tag":369,"props":465,"children":466},{},[467],{"type":53,"value":468},"Inference = hallucination",{"type":47,"tag":369,"props":470,"children":471},{},[472],{"type":53,"value":473},"Quote exact text or mark UNDOCUMENTED",{"type":47,"tag":217,"props":475,"children":476},{},[],{"type":47,"tag":158,"props":478,"children":480},{"id":479},"phase-0-documentation-discovery",[481],{"type":53,"value":482},"PHASE 0 — Documentation Discovery",{"type":47,"tag":56,"props":484,"children":485},{},[486],{"type":53,"value":487},"Identify all content representing documentation, even if not named \"spec.\"",{"type":47,"tag":56,"props":489,"children":490},{},[491],{"type":53,"value":492},"Documentation may appear as:",{"type":47,"tag":62,"props":494,"children":495},{},[496,506,515,524,533,542,547,552],{"type":47,"tag":66,"props":497,"children":498},{},[499],{"type":47,"tag":500,"props":501,"children":503},"code",{"className":502},[],[504],{"type":53,"value":505},"whitepaper.pdf",{"type":47,"tag":66,"props":507,"children":508},{},[509],{"type":47,"tag":500,"props":510,"children":512},{"className":511},[],[513],{"type":53,"value":514},"Protocol.md",{"type":47,"tag":66,"props":516,"children":517},{},[518],{"type":47,"tag":500,"props":519,"children":521},{"className":520},[],[522],{"type":53,"value":523},"design_notes",{"type":47,"tag":66,"props":525,"children":526},{},[527],{"type":47,"tag":500,"props":528,"children":530},{"className":529},[],[531],{"type":53,"value":532},"Flow.pdf",{"type":47,"tag":66,"props":534,"children":535},{},[536],{"type":47,"tag":500,"props":537,"children":539},{"className":538},[],[540],{"type":53,"value":541},"README.md",{"type":47,"tag":66,"props":543,"children":544},{},[545],{"type":53,"value":546},"kickoff transcripts",{"type":47,"tag":66,"props":548,"children":549},{},[550],{"type":53,"value":551},"Notion exports",{"type":47,"tag":66,"props":553,"children":554},{},[555],{"type":53,"value":556},"Anything describing logic, flows, assumptions, incentives, etc.",{"type":47,"tag":56,"props":558,"children":559},{},[560],{"type":53,"value":561},"Use semantic cues:",{"type":47,"tag":62,"props":563,"children":564},{},[565,570,575,580,585,590,595,600],{"type":47,"tag":66,"props":566,"children":567},{},[568],{"type":53,"value":569},"architecture descriptions",{"type":47,"tag":66,"props":571,"children":572},{},[573],{"type":53,"value":574},"invariants",{"type":47,"tag":66,"props":576,"children":577},{},[578],{"type":53,"value":579},"formulas",{"type":47,"tag":66,"props":581,"children":582},{},[583],{"type":53,"value":584},"variable meanings",{"type":47,"tag":66,"props":586,"children":587},{},[588],{"type":53,"value":589},"trust models",{"type":47,"tag":66,"props":591,"children":592},{},[593],{"type":53,"value":594},"workflow sequencing",{"type":47,"tag":66,"props":596,"children":597},{},[598],{"type":53,"value":599},"tables describing logic",{"type":47,"tag":66,"props":601,"children":602},{},[603],{"type":53,"value":604},"diagrams (convert to text)",{"type":47,"tag":56,"props":606,"children":607},{},[608,610,615],{"type":53,"value":609},"Extract ALL relevant documents into a unified ",{"type":47,"tag":95,"props":611,"children":612},{},[613],{"type":53,"value":614},"spec corpus",{"type":53,"value":616},".",{"type":47,"tag":217,"props":618,"children":619},{},[],{"type":47,"tag":158,"props":621,"children":623},{"id":622},"phase-1-universal-format-normalization",[624],{"type":53,"value":625},"PHASE 1 — Universal Format Normalization",{"type":47,"tag":56,"props":627,"children":628},{},[629],{"type":53,"value":630},"Normalize ANY input format:",{"type":47,"tag":62,"props":632,"children":633},{},[634,639,644,649,654,659,664],{"type":47,"tag":66,"props":635,"children":636},{},[637],{"type":53,"value":638},"PDF",{"type":47,"tag":66,"props":640,"children":641},{},[642],{"type":53,"value":643},"Markdown",{"type":47,"tag":66,"props":645,"children":646},{},[647],{"type":53,"value":648},"DOCX",{"type":47,"tag":66,"props":650,"children":651},{},[652],{"type":53,"value":653},"HTML",{"type":47,"tag":66,"props":655,"children":656},{},[657],{"type":53,"value":658},"TXT",{"type":47,"tag":66,"props":660,"children":661},{},[662],{"type":53,"value":663},"Notion export",{"type":47,"tag":66,"props":665,"children":666},{},[667],{"type":53,"value":668},"Meeting transcripts",{"type":47,"tag":56,"props":670,"children":671},{},[672],{"type":53,"value":673},"Preserve:",{"type":47,"tag":62,"props":675,"children":676},{},[677,682,687,691,696,701],{"type":47,"tag":66,"props":678,"children":679},{},[680],{"type":53,"value":681},"heading hierarchy",{"type":47,"tag":66,"props":683,"children":684},{},[685],{"type":53,"value":686},"bullet lists",{"type":47,"tag":66,"props":688,"children":689},{},[690],{"type":53,"value":579},{"type":47,"tag":66,"props":692,"children":693},{},[694],{"type":53,"value":695},"tables (converted to plaintext)",{"type":47,"tag":66,"props":697,"children":698},{},[699],{"type":53,"value":700},"code snippets",{"type":47,"tag":66,"props":702,"children":703},{},[704],{"type":53,"value":705},"invariant definitions",{"type":47,"tag":56,"props":707,"children":708},{},[709],{"type":53,"value":710},"Remove:",{"type":47,"tag":62,"props":712,"children":713},{},[714,719,724],{"type":47,"tag":66,"props":715,"children":716},{},[717],{"type":53,"value":718},"layout noise",{"type":47,"tag":66,"props":720,"children":721},{},[722],{"type":53,"value":723},"styling artifacts",{"type":47,"tag":66,"props":725,"children":726},{},[727],{"type":53,"value":728},"watermarks",{"type":47,"tag":56,"props":730,"children":731},{},[732,734,743],{"type":53,"value":733},"Output: a clean, canonical ",{"type":47,"tag":95,"props":735,"children":736},{},[737],{"type":47,"tag":500,"props":738,"children":740},{"className":739},[],[741],{"type":53,"value":742},"spec_corpus",{"type":53,"value":616},{"type":47,"tag":217,"props":745,"children":746},{},[],{"type":47,"tag":158,"props":748,"children":750},{"id":749},"phase-2-spec-intent-ir-intermediate-representation",[751],{"type":53,"value":752},"PHASE 2 — Spec Intent IR (Intermediate Representation)",{"type":47,"tag":56,"props":754,"children":755},{},[756,758,763],{"type":53,"value":757},"Extract ",{"type":47,"tag":95,"props":759,"children":760},{},[761],{"type":53,"value":762},"all intended behavior",{"type":53,"value":764}," into the Spec-IR.",{"type":47,"tag":56,"props":766,"children":767},{},[768],{"type":53,"value":769},"Each extracted item MUST include:",{"type":47,"tag":62,"props":771,"children":772},{},[773,782,791,800,805],{"type":47,"tag":66,"props":774,"children":775},{},[776],{"type":47,"tag":500,"props":777,"children":779},{"className":778},[],[780],{"type":53,"value":781},"spec_excerpt",{"type":47,"tag":66,"props":783,"children":784},{},[785],{"type":47,"tag":500,"props":786,"children":788},{"className":787},[],[789],{"type":53,"value":790},"source_section",{"type":47,"tag":66,"props":792,"children":793},{},[794],{"type":47,"tag":500,"props":795,"children":797},{"className":796},[],[798],{"type":53,"value":799},"semantic_type",{"type":47,"tag":66,"props":801,"children":802},{},[803],{"type":53,"value":804},"normalized representation",{"type":47,"tag":66,"props":806,"children":807},{},[808],{"type":53,"value":809},"confidence score",{"type":47,"tag":56,"props":811,"children":812},{},[813],{"type":53,"value":814},"Extract:",{"type":47,"tag":62,"props":816,"children":817},{},[818,823,828,833,838,843,848,853,858,863,868,873,878],{"type":47,"tag":66,"props":819,"children":820},{},[821],{"type":53,"value":822},"protocol purpose",{"type":47,"tag":66,"props":824,"children":825},{},[826],{"type":53,"value":827},"actors, roles, trust boundaries",{"type":47,"tag":66,"props":829,"children":830},{},[831],{"type":53,"value":832},"variable definitions & expected relationships",{"type":47,"tag":66,"props":834,"children":835},{},[836],{"type":53,"value":837},"all preconditions \u002F postconditions",{"type":47,"tag":66,"props":839,"children":840},{},[841],{"type":53,"value":842},"explicit invariants",{"type":47,"tag":66,"props":844,"children":845},{},[846],{"type":53,"value":847},"implicit invariants deduced from context",{"type":47,"tag":66,"props":849,"children":850},{},[851],{"type":53,"value":852},"math formulas (in canonical symbolic form)",{"type":47,"tag":66,"props":854,"children":855},{},[856],{"type":53,"value":857},"expected flows & state-machine transitions",{"type":47,"tag":66,"props":859,"children":860},{},[861],{"type":53,"value":862},"economic assumptions",{"type":47,"tag":66,"props":864,"children":865},{},[866],{"type":53,"value":867},"ordering & timing constraints",{"type":47,"tag":66,"props":869,"children":870},{},[871],{"type":53,"value":872},"error conditions & expected revert logic",{"type":47,"tag":66,"props":874,"children":875},{},[876],{"type":53,"value":877},"security requirements (\"must\u002Fnever\u002Falways\")",{"type":47,"tag":66,"props":879,"children":880},{},[881],{"type":53,"value":882},"edge-case behavior",{"type":47,"tag":56,"props":884,"children":885},{},[886,888,893],{"type":53,"value":887},"This forms ",{"type":47,"tag":95,"props":889,"children":890},{},[891],{"type":53,"value":892},"Spec-IR",{"type":53,"value":616},{"type":47,"tag":56,"props":895,"children":896},{},[897,899,906],{"type":53,"value":898},"See ",{"type":47,"tag":900,"props":901,"children":903},"a",{"href":902},"resources\u002FIR_EXAMPLES.md#example-1-spec-ir-record",[904],{"type":53,"value":905},"IR_EXAMPLES.md",{"type":53,"value":907}," for detailed examples.",{"type":47,"tag":217,"props":909,"children":910},{},[],{"type":47,"tag":158,"props":912,"children":914},{"id":913},"phase-3-code-behavior-ir",[915],{"type":53,"value":916},"PHASE 3 — Code Behavior IR",{"type":47,"tag":918,"props":919,"children":921},"h3",{"id":920},"with-true-line-by-line-block-by-block-analysis",[922],{"type":53,"value":923},"(WITH TRUE LINE-BY-LINE \u002F BLOCK-BY-BLOCK ANALYSIS)",{"type":47,"tag":56,"props":925,"children":926},{},[927,929,934],{"type":53,"value":928},"Perform ",{"type":47,"tag":95,"props":930,"children":931},{},[932],{"type":53,"value":933},"structured, deterministic, line-by-line and block-by-block",{"type":53,"value":935}," semantic analysis of the entire codebase.",{"type":47,"tag":56,"props":937,"children":938},{},[939,941,946,948,953],{"type":53,"value":940},"For ",{"type":47,"tag":95,"props":942,"children":943},{},[944],{"type":53,"value":945},"EVERY LINE",{"type":53,"value":947}," and ",{"type":47,"tag":95,"props":949,"children":950},{},[951],{"type":53,"value":952},"EVERY BLOCK",{"type":53,"value":954},", extract:",{"type":47,"tag":62,"props":956,"children":957},{},[958,963,968,973,978,983,988,993,998,1003,1008,1013,1018,1023,1028],{"type":47,"tag":66,"props":959,"children":960},{},[961],{"type":53,"value":962},"file + exact line numbers",{"type":47,"tag":66,"props":964,"children":965},{},[966],{"type":53,"value":967},"local variable updates",{"type":47,"tag":66,"props":969,"children":970},{},[971],{"type":53,"value":972},"state reads\u002Fwrites",{"type":47,"tag":66,"props":974,"children":975},{},[976],{"type":53,"value":977},"conditional branches & alternative paths",{"type":47,"tag":66,"props":979,"children":980},{},[981],{"type":53,"value":982},"unreachable branches",{"type":47,"tag":66,"props":984,"children":985},{},[986],{"type":53,"value":987},"revert conditions & custom errors",{"type":47,"tag":66,"props":989,"children":990},{},[991],{"type":53,"value":992},"external calls (call, delegatecall, staticcall, create2)",{"type":47,"tag":66,"props":994,"children":995},{},[996],{"type":53,"value":997},"event emissions",{"type":47,"tag":66,"props":999,"children":1000},{},[1001],{"type":53,"value":1002},"math operations and rounding behavior",{"type":47,"tag":66,"props":1004,"children":1005},{},[1006],{"type":53,"value":1007},"implicit assumptions",{"type":47,"tag":66,"props":1009,"children":1010},{},[1011],{"type":53,"value":1012},"block-level preconditions & postconditions",{"type":47,"tag":66,"props":1014,"children":1015},{},[1016],{"type":53,"value":1017},"locally enforced invariants",{"type":47,"tag":66,"props":1019,"children":1020},{},[1021],{"type":53,"value":1022},"state transitions",{"type":47,"tag":66,"props":1024,"children":1025},{},[1026],{"type":53,"value":1027},"side effects",{"type":47,"tag":66,"props":1029,"children":1030},{},[1031],{"type":53,"value":1032},"dependencies on prior state",{"type":47,"tag":56,"props":1034,"children":1035},{},[1036,1037,1042],{"type":53,"value":940},{"type":47,"tag":95,"props":1038,"children":1039},{},[1040],{"type":53,"value":1041},"EVERY FUNCTION",{"type":53,"value":954},{"type":47,"tag":62,"props":1044,"children":1045},{},[1046,1051,1056,1061,1066,1071,1076,1081,1086],{"type":47,"tag":66,"props":1047,"children":1048},{},[1049],{"type":53,"value":1050},"signature & visibility",{"type":47,"tag":66,"props":1052,"children":1053},{},[1054],{"type":53,"value":1055},"applied modifiers (and their logic)",{"type":47,"tag":66,"props":1057,"children":1058},{},[1059],{"type":53,"value":1060},"purpose (based on actual behavior)",{"type":47,"tag":66,"props":1062,"children":1063},{},[1064],{"type":53,"value":1065},"input\u002Foutput semantics",{"type":47,"tag":66,"props":1067,"children":1068},{},[1069],{"type":53,"value":1070},"read\u002Fwrite sets",{"type":47,"tag":66,"props":1072,"children":1073},{},[1074],{"type":53,"value":1075},"full control-flow structure",{"type":47,"tag":66,"props":1077,"children":1078},{},[1079],{"type":53,"value":1080},"success vs revert paths",{"type":47,"tag":66,"props":1082,"children":1083},{},[1084],{"type":53,"value":1085},"internal\u002Fexternal call graph",{"type":47,"tag":66,"props":1087,"children":1088},{},[1089],{"type":53,"value":1090},"cross-function interactions",{"type":47,"tag":56,"props":1092,"children":1093},{},[1094],{"type":53,"value":1095},"Also capture:",{"type":47,"tag":62,"props":1097,"children":1098},{},[1099,1104,1109,1114,1119],{"type":47,"tag":66,"props":1100,"children":1101},{},[1102],{"type":53,"value":1103},"storage layout",{"type":47,"tag":66,"props":1105,"children":1106},{},[1107],{"type":53,"value":1108},"initialization logic",{"type":47,"tag":66,"props":1110,"children":1111},{},[1112],{"type":53,"value":1113},"authorization graph (roles → permissions)",{"type":47,"tag":66,"props":1115,"children":1116},{},[1117],{"type":53,"value":1118},"upgradeability mechanism (if present)",{"type":47,"tag":66,"props":1120,"children":1121},{},[1122],{"type":53,"value":1123},"hidden assumptions",{"type":47,"tag":56,"props":1125,"children":1126},{},[1127,1129,1134],{"type":53,"value":1128},"Output: ",{"type":47,"tag":95,"props":1130,"children":1131},{},[1132],{"type":53,"value":1133},"Code-IR",{"type":53,"value":1135},", a granular semantic map with full traceability.",{"type":47,"tag":56,"props":1137,"children":1138},{},[1139,1140,1145],{"type":53,"value":898},{"type":47,"tag":900,"props":1141,"children":1143},{"href":1142},"resources\u002FIR_EXAMPLES.md#example-2-code-ir-record",[1144],{"type":53,"value":905},{"type":53,"value":907},{"type":47,"tag":217,"props":1147,"children":1148},{},[],{"type":47,"tag":158,"props":1150,"children":1152},{"id":1151},"phase-4-alignment-ir-spec-code-comparison",[1153],{"type":53,"value":1154},"PHASE 4 — Alignment IR (Spec ↔ Code Comparison)",{"type":47,"tag":56,"props":1156,"children":1157},{},[1158,1159,1164],{"type":53,"value":940},{"type":47,"tag":95,"props":1160,"children":1161},{},[1162],{"type":53,"value":1163},"each item in Spec-IR",{"type":53,"value":1165},":\nLocate related behaviors in Code-IR and generate an Alignment Record containing:",{"type":47,"tag":62,"props":1167,"children":1168},{},[1169,1173,1178,1216,1221,1226,1231],{"type":47,"tag":66,"props":1170,"children":1171},{},[1172],{"type":53,"value":781},{"type":47,"tag":66,"props":1174,"children":1175},{},[1176],{"type":53,"value":1177},"code_excerpt (with file + line numbers)",{"type":47,"tag":66,"props":1179,"children":1180},{},[1181,1183],{"type":53,"value":1182},"match_type:\n",{"type":47,"tag":62,"props":1184,"children":1185},{},[1186,1191,1196,1201,1206,1211],{"type":47,"tag":66,"props":1187,"children":1188},{},[1189],{"type":53,"value":1190},"full_match",{"type":47,"tag":66,"props":1192,"children":1193},{},[1194],{"type":53,"value":1195},"partial_match",{"type":47,"tag":66,"props":1197,"children":1198},{},[1199],{"type":53,"value":1200},"mismatch",{"type":47,"tag":66,"props":1202,"children":1203},{},[1204],{"type":53,"value":1205},"missing_in_code",{"type":47,"tag":66,"props":1207,"children":1208},{},[1209],{"type":53,"value":1210},"code_stronger_than_spec",{"type":47,"tag":66,"props":1212,"children":1213},{},[1214],{"type":53,"value":1215},"code_weaker_than_spec",{"type":47,"tag":66,"props":1217,"children":1218},{},[1219],{"type":53,"value":1220},"reasoning trace",{"type":47,"tag":66,"props":1222,"children":1223},{},[1224],{"type":53,"value":1225},"confidence score (0–1)",{"type":47,"tag":66,"props":1227,"children":1228},{},[1229],{"type":53,"value":1230},"ambiguity rating",{"type":47,"tag":66,"props":1232,"children":1233},{},[1234],{"type":53,"value":1235},"evidence links",{"type":47,"tag":56,"props":1237,"children":1238},{},[1239],{"type":53,"value":1240},"Explicitly check:",{"type":47,"tag":62,"props":1242,"children":1243},{},[1244,1249,1254,1259,1264,1269,1274],{"type":47,"tag":66,"props":1245,"children":1246},{},[1247],{"type":53,"value":1248},"invariants vs enforcement",{"type":47,"tag":66,"props":1250,"children":1251},{},[1252],{"type":53,"value":1253},"formulas vs math implementation",{"type":47,"tag":66,"props":1255,"children":1256},{},[1257],{"type":53,"value":1258},"flows vs real transitions",{"type":47,"tag":66,"props":1260,"children":1261},{},[1262],{"type":53,"value":1263},"actor expectations vs real privilege map",{"type":47,"tag":66,"props":1265,"children":1266},{},[1267],{"type":53,"value":1268},"ordering constraints vs actual logic",{"type":47,"tag":66,"props":1270,"children":1271},{},[1272],{"type":53,"value":1273},"revert expectations vs actual checks",{"type":47,"tag":66,"props":1275,"children":1276},{},[1277],{"type":53,"value":1278},"trust assumptions vs real external call behavior",{"type":47,"tag":56,"props":1280,"children":1281},{},[1282],{"type":53,"value":1283},"Also detect:",{"type":47,"tag":62,"props":1285,"children":1286},{},[1287,1292,1297,1302,1307],{"type":47,"tag":66,"props":1288,"children":1289},{},[1290],{"type":53,"value":1291},"undocumented code behavior",{"type":47,"tag":66,"props":1293,"children":1294},{},[1295],{"type":53,"value":1296},"unimplemented spec claims",{"type":47,"tag":66,"props":1298,"children":1299},{},[1300],{"type":53,"value":1301},"contradictions inside the spec",{"type":47,"tag":66,"props":1303,"children":1304},{},[1305],{"type":53,"value":1306},"contradictions inside the code",{"type":47,"tag":66,"props":1308,"children":1309},{},[1310],{"type":53,"value":1311},"inconsistencies across multiple spec documents",{"type":47,"tag":56,"props":1313,"children":1314},{},[1315,1316],{"type":53,"value":1128},{"type":47,"tag":95,"props":1317,"children":1318},{},[1319],{"type":53,"value":1320},"Alignment-IR",{"type":47,"tag":56,"props":1322,"children":1323},{},[1324,1325,1330],{"type":53,"value":898},{"type":47,"tag":900,"props":1326,"children":1328},{"href":1327},"resources\u002FIR_EXAMPLES.md#example-3-alignment-record-positive-case",[1329],{"type":53,"value":905},{"type":53,"value":907},{"type":47,"tag":217,"props":1332,"children":1333},{},[],{"type":47,"tag":158,"props":1335,"children":1337},{"id":1336},"phase-5-divergence-classification",[1338],{"type":53,"value":1339},"PHASE 5 — Divergence Classification",{"type":47,"tag":56,"props":1341,"children":1342},{},[1343],{"type":53,"value":1344},"Classify each misalignment by severity:",{"type":47,"tag":918,"props":1346,"children":1348},{"id":1347},"critical",[1349],{"type":53,"value":1350},"CRITICAL",{"type":47,"tag":62,"props":1352,"children":1353},{},[1354,1359,1364,1369],{"type":47,"tag":66,"props":1355,"children":1356},{},[1357],{"type":53,"value":1358},"Spec says X, code does Y",{"type":47,"tag":66,"props":1360,"children":1361},{},[1362],{"type":53,"value":1363},"Missing invariant enabling exploits",{"type":47,"tag":66,"props":1365,"children":1366},{},[1367],{"type":53,"value":1368},"Math divergence involving funds",{"type":47,"tag":66,"props":1370,"children":1371},{},[1372],{"type":53,"value":1373},"Trust boundary mismatches",{"type":47,"tag":918,"props":1375,"children":1377},{"id":1376},"high",[1378],{"type":53,"value":1379},"HIGH",{"type":47,"tag":62,"props":1381,"children":1382},{},[1383,1388,1393],{"type":47,"tag":66,"props":1384,"children":1385},{},[1386],{"type":53,"value":1387},"Partial\u002Fincorrect implementation",{"type":47,"tag":66,"props":1389,"children":1390},{},[1391],{"type":53,"value":1392},"Access control misalignment",{"type":47,"tag":66,"props":1394,"children":1395},{},[1396],{"type":53,"value":1397},"Dangerous undocumented behavior",{"type":47,"tag":918,"props":1399,"children":1401},{"id":1400},"medium",[1402],{"type":53,"value":1403},"MEDIUM",{"type":47,"tag":62,"props":1405,"children":1406},{},[1407,1412,1417],{"type":47,"tag":66,"props":1408,"children":1409},{},[1410],{"type":53,"value":1411},"Ambiguity with security implications",{"type":47,"tag":66,"props":1413,"children":1414},{},[1415],{"type":53,"value":1416},"Missing revert checks",{"type":47,"tag":66,"props":1418,"children":1419},{},[1420],{"type":53,"value":1421},"Incomplete edge-case handling",{"type":47,"tag":918,"props":1423,"children":1425},{"id":1424},"low",[1426],{"type":53,"value":1427},"LOW",{"type":47,"tag":62,"props":1429,"children":1430},{},[1431,1436],{"type":47,"tag":66,"props":1432,"children":1433},{},[1434],{"type":53,"value":1435},"Documentation drift",{"type":47,"tag":66,"props":1437,"children":1438},{},[1439],{"type":53,"value":1440},"Minor semantics mismatch",{"type":47,"tag":56,"props":1442,"children":1443},{},[1444],{"type":53,"value":1445},"Each finding MUST include:",{"type":47,"tag":62,"props":1447,"children":1448},{},[1449,1453,1458,1463],{"type":47,"tag":66,"props":1450,"children":1451},{},[1452],{"type":53,"value":1235},{"type":47,"tag":66,"props":1454,"children":1455},{},[1456],{"type":53,"value":1457},"severity justification",{"type":47,"tag":66,"props":1459,"children":1460},{},[1461],{"type":53,"value":1462},"exploitability reasoning",{"type":47,"tag":66,"props":1464,"children":1465},{},[1466],{"type":53,"value":1467},"recommended remediation",{"type":47,"tag":56,"props":1469,"children":1470},{},[1471,1472,1477],{"type":53,"value":898},{"type":47,"tag":900,"props":1473,"children":1475},{"href":1474},"resources\u002FIR_EXAMPLES.md#example-4-divergence-finding-critical-issue",[1476],{"type":53,"value":905},{"type":53,"value":1478}," for detailed divergence finding examples with complete exploit scenarios, economic analysis, and remediation plans.",{"type":47,"tag":217,"props":1480,"children":1481},{},[],{"type":47,"tag":158,"props":1483,"children":1485},{"id":1484},"phase-6-final-audit-grade-report",[1486],{"type":53,"value":1487},"PHASE 6 — Final Audit-Grade Report",{"type":47,"tag":56,"props":1489,"children":1490},{},[1491],{"type":53,"value":1492},"Produce a structured compliance report:",{"type":47,"tag":286,"props":1494,"children":1495},{},[1496,1501,1506,1511,1516,1521,1526,1531,1536,1541,1546,1551,1556,1561,1566,1571],{"type":47,"tag":66,"props":1497,"children":1498},{},[1499],{"type":53,"value":1500},"Executive Summary",{"type":47,"tag":66,"props":1502,"children":1503},{},[1504],{"type":53,"value":1505},"Documentation Sources Identified",{"type":47,"tag":66,"props":1507,"children":1508},{},[1509],{"type":53,"value":1510},"Spec Intent Breakdown (Spec-IR)",{"type":47,"tag":66,"props":1512,"children":1513},{},[1514],{"type":53,"value":1515},"Code Behavior Summary (Code-IR)",{"type":47,"tag":66,"props":1517,"children":1518},{},[1519],{"type":53,"value":1520},"Full Alignment Matrix (Spec → Code → Status)",{"type":47,"tag":66,"props":1522,"children":1523},{},[1524],{"type":53,"value":1525},"Divergence Findings (with evidence & severity)",{"type":47,"tag":66,"props":1527,"children":1528},{},[1529],{"type":53,"value":1530},"Missing invariants",{"type":47,"tag":66,"props":1532,"children":1533},{},[1534],{"type":53,"value":1535},"Incorrect logic",{"type":47,"tag":66,"props":1537,"children":1538},{},[1539],{"type":53,"value":1540},"Math inconsistencies",{"type":47,"tag":66,"props":1542,"children":1543},{},[1544],{"type":53,"value":1545},"Flow\u002Fstate machine mismatches",{"type":47,"tag":66,"props":1547,"children":1548},{},[1549],{"type":53,"value":1550},"Access control drift",{"type":47,"tag":66,"props":1552,"children":1553},{},[1554],{"type":53,"value":1555},"Undocumented behavior",{"type":47,"tag":66,"props":1557,"children":1558},{},[1559],{"type":53,"value":1560},"Ambiguity hotspots (spec & code)",{"type":47,"tag":66,"props":1562,"children":1563},{},[1564],{"type":53,"value":1565},"Recommended remediations",{"type":47,"tag":66,"props":1567,"children":1568},{},[1569],{"type":53,"value":1570},"Documentation update suggestions",{"type":47,"tag":66,"props":1572,"children":1573},{},[1574],{"type":53,"value":1575},"Final risk assessment",{"type":47,"tag":217,"props":1577,"children":1578},{},[],{"type":47,"tag":48,"props":1580,"children":1582},{"id":1581},"output-requirements-quality-standards",[1583],{"type":53,"value":1584},"Output Requirements & Quality Standards",{"type":47,"tag":56,"props":1586,"children":1587},{},[1588,1589,1595],{"type":53,"value":898},{"type":47,"tag":900,"props":1590,"children":1592},{"href":1591},"resources\u002FOUTPUT_REQUIREMENTS.md",[1593],{"type":53,"value":1594},"OUTPUT_REQUIREMENTS.md",{"type":53,"value":1596}," for:",{"type":47,"tag":62,"props":1598,"children":1599},{},[1600,1605,1610,1615],{"type":47,"tag":66,"props":1601,"children":1602},{},[1603],{"type":53,"value":1604},"Required IR production standards for all phases",{"type":47,"tag":66,"props":1606,"children":1607},{},[1608],{"type":53,"value":1609},"Quality thresholds (minimum Spec-IR items, confidence scores, etc.)",{"type":47,"tag":66,"props":1611,"children":1612},{},[1613],{"type":53,"value":1614},"Format consistency requirements (YAML formatting, line number citations)",{"type":47,"tag":66,"props":1616,"children":1617},{},[1618],{"type":53,"value":1619},"Anti-hallucination requirements",{"type":47,"tag":217,"props":1621,"children":1622},{},[],{"type":47,"tag":48,"props":1624,"children":1626},{"id":1625},"completeness-verification",[1627],{"type":53,"value":1628},"Completeness Verification",{"type":47,"tag":56,"props":1630,"children":1631},{},[1632,1634,1640],{"type":53,"value":1633},"Before finalizing analysis, review the ",{"type":47,"tag":900,"props":1635,"children":1637},{"href":1636},"resources\u002FCOMPLETENESS_CHECKLIST.md",[1638],{"type":53,"value":1639},"COMPLETENESS_CHECKLIST.md",{"type":53,"value":1641}," to verify:",{"type":47,"tag":62,"props":1643,"children":1644},{},[1645,1650,1655,1660,1665],{"type":47,"tag":66,"props":1646,"children":1647},{},[1648],{"type":53,"value":1649},"Spec-IR completeness (all invariants, formulas, security requirements extracted)",{"type":47,"tag":66,"props":1651,"children":1652},{},[1653],{"type":53,"value":1654},"Code-IR completeness (all functions analyzed, state changes tracked)",{"type":47,"tag":66,"props":1656,"children":1657},{},[1658],{"type":53,"value":1659},"Alignment-IR completeness (every spec item has alignment record)",{"type":47,"tag":66,"props":1661,"children":1662},{},[1663],{"type":53,"value":1664},"Divergence finding quality (exploit scenarios, economic impact, remediation)",{"type":47,"tag":66,"props":1666,"children":1667},{},[1668],{"type":53,"value":1669},"Final report completeness (all 16 sections present)",{"type":47,"tag":217,"props":1671,"children":1672},{},[],{"type":47,"tag":158,"props":1674,"children":1676},{"id":1675},"anti-hallucination-requirements",[1677],{"type":53,"value":1678},"ANTI-HALLUCINATION REQUIREMENTS",{"type":47,"tag":62,"props":1680,"children":1681},{},[1682,1693,1704,1715,1720,1725],{"type":47,"tag":66,"props":1683,"children":1684},{},[1685,1687,1692],{"type":53,"value":1686},"If the spec is silent: classify as ",{"type":47,"tag":95,"props":1688,"children":1689},{},[1690],{"type":53,"value":1691},"UNDOCUMENTED",{"type":53,"value":616},{"type":47,"tag":66,"props":1694,"children":1695},{},[1696,1698,1703],{"type":53,"value":1697},"If the code adds behavior: classify as ",{"type":47,"tag":95,"props":1699,"children":1700},{},[1701],{"type":53,"value":1702},"UNDOCUMENTED CODE PATH",{"type":53,"value":616},{"type":47,"tag":66,"props":1705,"children":1706},{},[1707,1709,1714],{"type":53,"value":1708},"If unclear: classify as ",{"type":47,"tag":95,"props":1710,"children":1711},{},[1712],{"type":53,"value":1713},"AMBIGUOUS",{"type":53,"value":616},{"type":47,"tag":66,"props":1716,"children":1717},{},[1718],{"type":53,"value":1719},"Every claim must quote original text or line numbers.",{"type":47,"tag":66,"props":1721,"children":1722},{},[1723],{"type":53,"value":1724},"Zero speculation.",{"type":47,"tag":66,"props":1726,"children":1727},{},[1728],{"type":53,"value":1729},"Exhaustive, literal, pedantic reasoning.",{"type":47,"tag":217,"props":1731,"children":1732},{},[],{"type":47,"tag":158,"props":1734,"children":1736},{"id":1735},"resources",[1737],{"type":53,"value":1738},"Resources",{"type":47,"tag":56,"props":1740,"children":1741},{},[1742],{"type":47,"tag":95,"props":1743,"children":1744},{},[1745],{"type":53,"value":1746},"Detailed Examples:",{"type":47,"tag":62,"props":1748,"children":1749},{},[1750],{"type":47,"tag":66,"props":1751,"children":1752},{},[1753,1758],{"type":47,"tag":900,"props":1754,"children":1756},{"href":1755},"resources\u002FIR_EXAMPLES.md",[1757],{"type":53,"value":905},{"type":53,"value":1759}," - Complete IR workflow examples with DEX swap patterns",{"type":47,"tag":56,"props":1761,"children":1762},{},[1763],{"type":47,"tag":95,"props":1764,"children":1765},{},[1766],{"type":53,"value":1767},"Standards & Requirements:",{"type":47,"tag":62,"props":1769,"children":1770},{},[1771,1780],{"type":47,"tag":66,"props":1772,"children":1773},{},[1774,1778],{"type":47,"tag":900,"props":1775,"children":1776},{"href":1591},[1777],{"type":53,"value":1594},{"type":53,"value":1779}," - IR production standards, quality thresholds, format rules",{"type":47,"tag":66,"props":1781,"children":1782},{},[1783,1787],{"type":47,"tag":900,"props":1784,"children":1785},{"href":1636},[1786],{"type":53,"value":1639},{"type":53,"value":1788}," - Verification checklist for all phases",{"type":47,"tag":217,"props":1790,"children":1791},{},[],{"type":47,"tag":48,"props":1793,"children":1795},{"id":1794},"agent",[1796],{"type":53,"value":1797},"Agent",{"type":47,"tag":56,"props":1799,"children":1800},{},[1801,1803,1809],{"type":53,"value":1802},"The ",{"type":47,"tag":500,"props":1804,"children":1806},{"className":1805},[],[1807],{"type":53,"value":1808},"spec-compliance-checker",{"type":53,"value":1810}," agent performs the full 7-phase specification-to-code compliance workflow autonomously. Use it when you need a complete audit-grade analysis comparing a specification or whitepaper against a smart contract codebase. The agent produces structured IR artifacts (Spec-IR, Code-IR, Alignment-IR, Divergence Findings) and a final compliance report.",{"type":47,"tag":56,"props":1812,"children":1813},{},[1814],{"type":53,"value":1815},"Invoke directly: \"Use the spec-compliance-checker agent to verify this codebase against the whitepaper.\"",{"type":47,"tag":217,"props":1817,"children":1818},{},[],{"type":47,"tag":158,"props":1820,"children":1822},{"id":1821},"end-of-skill",[1823],{"type":53,"value":1824},"END OF SKILL",{"items":1826,"total":1978},[1827,1844,1854,1874,1885,1898,1910,1920,1933,1944,1956,1967],{"slug":1828,"name":1828,"fn":1829,"description":1830,"org":1831,"tags":1832,"stars":29,"repoUrl":30,"updatedAt":1843},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1833,1836,1839,1840],{"name":1834,"slug":1835,"type":16},"C#","c",{"name":1837,"slug":1838,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":1841,"slug":1842,"type":16},"Testing","testing","2026-07-17T06:05:14.925095",{"slug":1845,"name":1845,"fn":1846,"description":1847,"org":1848,"tags":1849,"stars":29,"repoUrl":30,"updatedAt":1853},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1850,1851,1852],{"name":1834,"slug":1835,"type":16},{"name":14,"slug":15,"type":16},{"name":1841,"slug":1842,"type":16},"2026-07-17T06:05:12.433192",{"slug":1855,"name":1855,"fn":1856,"description":1857,"org":1858,"tags":1859,"stars":29,"repoUrl":30,"updatedAt":1873},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1860,1863,1866,1869,1872],{"name":1861,"slug":1862,"type":16},"Agents","agents",{"name":1864,"slug":1865,"type":16},"CI\u002FCD","ci-cd",{"name":1867,"slug":1868,"type":16},"Code Analysis","code-analysis",{"name":1870,"slug":1871,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":1875,"name":1875,"fn":1876,"description":1877,"org":1878,"tags":1879,"stars":29,"repoUrl":30,"updatedAt":1884},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1880,1881,1882,1883],{"name":24,"slug":25,"type":16},{"name":1867,"slug":1868,"type":16},{"name":14,"slug":15,"type":16},{"name":27,"slug":28,"type":16},"2026-07-18T05:47:43.989063",{"slug":1886,"name":1886,"fn":1887,"description":1888,"org":1889,"tags":1890,"stars":29,"repoUrl":30,"updatedAt":1897},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1891,1894],{"name":1892,"slug":1893,"type":16},"Engineering","engineering",{"name":1895,"slug":1896,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":1899,"name":1899,"fn":1900,"description":1901,"org":1902,"tags":1903,"stars":29,"repoUrl":30,"updatedAt":1909},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1904,1907,1908],{"name":1905,"slug":1906,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":1841,"slug":1842,"type":16},"2026-07-17T06:05:14.575191",{"slug":1911,"name":1911,"fn":1912,"description":1913,"org":1914,"tags":1915,"stars":29,"repoUrl":30,"updatedAt":1919},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1916,1917,1918],{"name":24,"slug":25,"type":16},{"name":1867,"slug":1868,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":1921,"name":1921,"fn":1922,"description":1923,"org":1924,"tags":1925,"stars":29,"repoUrl":30,"updatedAt":1932},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1926,1929,1930,1931],{"name":1927,"slug":1928,"type":16},"Architecture","architecture",{"name":24,"slug":25,"type":16},{"name":1867,"slug":1868,"type":16},{"name":1892,"slug":1893,"type":16},"2026-07-18T05:47:40.122449",{"slug":1934,"name":1934,"fn":1935,"description":1936,"org":1937,"tags":1938,"stars":29,"repoUrl":30,"updatedAt":1943},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1939,1940,1941,1942],{"name":24,"slug":25,"type":16},{"name":1867,"slug":1868,"type":16},{"name":1892,"slug":1893,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":1945,"name":1945,"fn":1946,"description":1947,"org":1948,"tags":1949,"stars":29,"repoUrl":30,"updatedAt":1955},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1950,1951,1954],{"name":24,"slug":25,"type":16},{"name":1952,"slug":1953,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":1957,"name":1957,"fn":1958,"description":1959,"org":1960,"tags":1961,"stars":29,"repoUrl":30,"updatedAt":1966},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1962,1963,1964,1965],{"name":24,"slug":25,"type":16},{"name":1834,"slug":1835,"type":16},{"name":1867,"slug":1868,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":1968,"name":1968,"fn":1969,"description":1970,"org":1971,"tags":1972,"stars":29,"repoUrl":30,"updatedAt":1977},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1973,1974,1975,1976],{"name":24,"slug":25,"type":16},{"name":1867,"slug":1868,"type":16},{"name":14,"slug":15,"type":16},{"name":27,"slug":28,"type":16},"2026-07-18T05:47:42.84568",111,{"items":1980,"total":2026},[1981,1988,1994,2002,2009,2014,2020],{"slug":1828,"name":1828,"fn":1829,"description":1830,"org":1982,"tags":1983,"stars":29,"repoUrl":30,"updatedAt":1843},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1984,1985,1986,1987],{"name":1834,"slug":1835,"type":16},{"name":1837,"slug":1838,"type":16},{"name":14,"slug":15,"type":16},{"name":1841,"slug":1842,"type":16},{"slug":1845,"name":1845,"fn":1846,"description":1847,"org":1989,"tags":1990,"stars":29,"repoUrl":30,"updatedAt":1853},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1991,1992,1993],{"name":1834,"slug":1835,"type":16},{"name":14,"slug":15,"type":16},{"name":1841,"slug":1842,"type":16},{"slug":1855,"name":1855,"fn":1856,"description":1857,"org":1995,"tags":1996,"stars":29,"repoUrl":30,"updatedAt":1873},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1997,1998,1999,2000,2001],{"name":1861,"slug":1862,"type":16},{"name":1864,"slug":1865,"type":16},{"name":1867,"slug":1868,"type":16},{"name":1870,"slug":1871,"type":16},{"name":14,"slug":15,"type":16},{"slug":1875,"name":1875,"fn":1876,"description":1877,"org":2003,"tags":2004,"stars":29,"repoUrl":30,"updatedAt":1884},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2005,2006,2007,2008],{"name":24,"slug":25,"type":16},{"name":1867,"slug":1868,"type":16},{"name":14,"slug":15,"type":16},{"name":27,"slug":28,"type":16},{"slug":1886,"name":1886,"fn":1887,"description":1888,"org":2010,"tags":2011,"stars":29,"repoUrl":30,"updatedAt":1897},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2012,2013],{"name":1892,"slug":1893,"type":16},{"name":1895,"slug":1896,"type":16},{"slug":1899,"name":1899,"fn":1900,"description":1901,"org":2015,"tags":2016,"stars":29,"repoUrl":30,"updatedAt":1909},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2017,2018,2019],{"name":1905,"slug":1906,"type":16},{"name":14,"slug":15,"type":16},{"name":1841,"slug":1842,"type":16},{"slug":1911,"name":1911,"fn":1912,"description":1913,"org":2021,"tags":2022,"stars":29,"repoUrl":30,"updatedAt":1919},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2023,2024,2025],{"name":24,"slug":25,"type":16},{"name":1867,"slug":1868,"type":16},{"name":14,"slug":15,"type":16},77]