feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction)

[kiki830621]

Problem

Source: surfaced during /idd-close #44 (2026-05-10) — retroactive Implementation Complete posted as workaround.

/idd-close 的 v2.41.0+ supersession 設計依賴 ## Implementation Complete > ### Checklist 全 - [x] 才 trigger,讓 Strategy / Implementation Plan 的 stale - [ ] 自動 superseded。

但 Spectra path 不會自動 post ## Implementation Complete comment 到 GitHub issue。spectra-apply 管 archive 內 tasks.md,結束後 issue body / comments 沒 canonical Implementation Complete anchor → supersession 永遠不 trigger → /idd-close 撞 stale Strategy - [ ] (從 spectra-discuss 階段 inherited 的 pre-design 提案,通常已被 propose / apply 階段重新設計)refuse close。

實際撞到的案例:#44 (/idd-all-chain 的 root issue) 走完 Spectra path,change archived,plugin v2.55.0 ship。但 Strategy section 的 bullets 是 pre-discuss 提案 (含 rejected --chain flag + chain_policy config) — 全 unchecked。/idd-close #44 走 Legacy fallback 把這些 stale - [ ] 視為阻擋,refuse close。Workaround:retroactive 合成 Implementation Complete comment(描述實際 ship 的東西,不 mapping 回 stale Strategy bullets)→ supersession trigger → close pass。

每個 Spectra-archived issue close 都會撞同樣 friction。

Type

feature (cross-skill — Spectra ↔ IDD bridge mechanism)

Expected

兩個方向都可以解(可同時):

Option A: spectra-apply 結束時 auto-post Implementation Complete to GitHub issue

spectra-apply Step 9 (final summary report) 結束後增加 Step 10:

1. Detect linked GitHub issue — 從 change directory 內 read proposal.md 或 design.md 找 Refs #N / Closes #N / 「GitHub-side tracker: #N」 mention,或從 commits 內 grep #N cross-link
2. Compose Implementation Complete comment:
   • Title: ## Implementation Complete (auto-posted by spectra-apply 2026-05-10)
   • Note: 「本 issue 走 Spectra path,實際 ship 的 mechanism 在 archive 內 tasks.md 同步,本 comment 是合成的 audit anchor 讓 /idd-close supersession 觸發」
   • Checklist: - [x] per spec capability ADDED / MODIFIED + per major commit
3. gh issue comment $N --body-file ... post comment
4. Audit trail entry in spectra apply summary 報告

Pros:解 root cause,讓所有 future Spectra-archived issues 的 close 都自動 work。
Cons:跨 skill (Spectra is third-party) — 需要 contract refinement,也許要 issue-driven-dev 那邊提 hook mechanism。

Option B: /idd-close 偵測 archived Spectra change → 自動觸發 supersession

/idd-close Step 0 supersession check 增加 fallback path:

1. Scan openspec/changes/archive/*/ 找 proposal.md 含 Refs #N / GitHub-side tracker pointer
2. 找到 → 視為「Implementation Complete equivalent exists」→ supersession active,跳過 stale Strategy / Plan scan
3. Fallback chain:
   • Implementation Complete > Checklist exists + 全 [x] → supersession (existing)
   • Archived Spectra change references this issue → supersession (NEW)
   • Otherwise → Legacy fallback strict scan

Pros:在 idd-close 內部解,不依賴 Spectra hook。
Cons:idd-close 邏輯變複雜,需要 file-system aware (scan archive directories)。

Option C (Hybrid)

A 為長期解,B 為 transitional fallback。先 ship B 解 immediate friction,再跟 Spectra-app upstream 協調 A。

Actual

每個 Spectra-archived issue close 都要手動合成 Implementation Complete comment(per /idd-close #44 retroactive workaround)。違反 IDD「automatic audit trail」紀律。

Impact

影響的工作流

• 任何走完整 spectra-discuss → spectra-propose → spectra-apply chain 的 issue
• 包含 (in-flight): feature: /idd-all-chain accept multiple root issues with DFS/BFS traversal (default DFS) #46 multi-root chain, idd-issue: 加入 multi-finding source 的 triage 機制（避免每筆 finding 手動分 create/update/comment/edit） #48 multi-finding triage(都是 Spectra tier)— 這 2 個 issue ship 後 close 都會撞同樣 friction

影響的檔案 (Option B)

• plugins/issue-driven-dev/skills/idd-close/SKILL.md Step 0 supersession check 加新 fallback
• plugins/issue-driven-dev/references/ 文件化新 supersession path

影響的檔案 (Option A)

• 跨 plugin — spectra-app upstream 增加 GitHub issue post hook(third-party,需 coordinate)
• 或:在 issue-driven-dev 加 idd-spectra-bridge skill 跑在 spectra-apply 後

Acceptance criteria

1. Spectra path issue 走完整 lifecycle 後,/idd-close #N 不需 retroactive 合成 Implementation Complete 即可通過
2. Audit trail 仍然完整(future reader 看 issue 仍能找到 "what shipped" 的 anchor)
3. Backward compat:既有 archived Spectra changes 不需 re-process

Priority

P2 — Spectra workflow 高頻使用,每次 close 都撞 friction。但有 retroactive workaround,不阻擋 individual issue close。

Sister concerns

• feature: mechanism for sync archived Spectra spec deltas with subsequent capability extensions #54 (mechanism for sync archived Spectra spec deltas with subsequent capability extensions) — 這是 archive-side 同步問題;本 issue 是 close-side audit anchor 問題。兩者 orthogonal 但 both about Spectra archive ↔ IDD lifecycle integration。

---

Current Status

Phase: closed
Last updated: 2026-05-18 by idd-close

Key Decisions

• Re-routed Spectra → Plan tier in /spectra-discuss (addition not breaking change)
• Option A directly (spectra-archive end auto-post)
• 3-fallback detection chain (explicit marker → Refs/Closes/Fixes → commit grep)
• R3: extracted Step 7 to executable script spectra-archive-post-ic.sh (unit-testable, closes design-by-narrative)

Verify Result (final — round 6)

✅ PASS — 6/6 AI (5 reviewer Agents + Codex), zero CRITICAL/HIGH/MEDIUM, tests 11/11.

• R6 master report: feat(spectra-archive): auto-post Implementation Complete to linked GitHub issue (#56) #92 (comment)
• Severity decayed monotonically R1 architectural → R4 HIGH → R5 MEDIUM → R6 zero.

Verify Trajectory

Round	Fix	Outcome
R1→R2	8 P1	introduced CRITICAL Python3 RCE
R2→R3	extract to script	closes RCE, 4 new HIGH
R3→R4	4 HIGH	1 new P1 (cross-Bash handoff)
R4→R5	deterministic path	3 MEDIUM
R5→R6	M1/M2/M3	✅ clean PASS

Resolution

• PR feat(spectra-archive): auto-post Implementation Complete to linked GitHub issue (#56) #92 squash-merged as 982de7a; issue auto-closed COMPLETED 2026-05-18.
• Closing summary: see closing comment.
• Accepted LOW/INFO residuals + pre-existing [refactor] spectra-archive SKILL.md exists in 3 copies (.claude/, .agents/, plugins/) — divergence risk (follow-up from #56) #93 noted in closing summary.

Commits

• 982de7a feat(spectra-archive): auto-post Implementation Complete to linked GitHub issue (feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56) (feat(spectra-archive): auto-post Implementation Complete to linked GitHub issue (#56) #92) — squash of 8 PR commits a40ab7a…87f5627

[kiki830621]

Diagnosis

Type

feature (cross-skill bridge — Spectra ↔ IDD lifecycle integration)

Analysis

Issue body 已 explicit Option A/B/C trade-off + lean toward C (Hybrid)。本 diagnose 主要工作是確認 Spectra tier 判定 + 擴展 Option C 的 sequencing。

Why Spectra-tier confirmed

• Layer 2 命中:新 published convention between Spectra and IDD plugin — spectra-apply Step 10 hook(option A)是 Spectra plugin 的新 contract surface;/idd-close archive scan(option B)是 IDD plugin 的新 detection convention。兩者都對 future plugin authors / reviewers 是 published API
• Layer 3a 命中:Modifies idd-close skill normative behavior(supersession 邏輯) + spectra-app skill normative behavior(post-apply hook)
• Layer 3b 命中:Cross-spec — idd-close Step 0 + spectra-apply Step 9 + 可能 reference doc。需要 explicit consistency checking
• Layer 3c 命中:Architectural decision — Spectra-IDD integration model long-term implications(future hooks 都會跟著 Option A/B/C 的 mental model)

Option B vs A vs C 細考量

Option B (IDD-side fix) advantages:

• 完全 in-IDD 控制,不依賴 spectra-app 第三方 release
• Backward-compat:既有 archived Spectra changes 立即受惠(scan 找得到)
• Detection 邏輯 isolated to idd-close

Option B disadvantages:

• IDD-close 變 file-system aware(scan archive directories)— 邏輯複雜度↑
• 若 archive layout 改變需同步改 idd-close

Option A (Spectra-side hook) advantages:

• Solve root cause — Implementation Complete comment 真的存在於 issue
• Audit trail 對 future reader 最直觀

Option A disadvantages:

• 跨 plugin coordination(spectra-app 是 third-party)— ship 速度慢
• 既有 archived Spectra changes 沒 retroactive cover(只解 future)

Option C (Hybrid) = ship B 立即解 friction + 同時談 A 為長期解 → 本 diagnose 推這個。

Sequencing decision

Spectra path: /spectra-discuss 對齊以下 sub-decisions:

1. Confirm Option C strategy(B 立即 ship,A 跟 spectra-app 談)
2. B 的 archive scan algorithm(per-comment grep Refs #N vs scan proposal.md body)
3. 透過「new supersession trigger」設計 — Implementation Complete > Checklist (existing) OR Archived Spectra change references this issue (new)?
4. spectra-app 可能不 ship hook 的 fallback(B 永久作 sole solution)
5. Cross-link audit trail 怎麼寫(close summary mention archived change?)

Impact

• 影響的工作流:所有走完整 spectra-discuss → spectra-propose → spectra-apply chain 的 issue close(Spectra workflow 高頻)
• 影響的檔案(per Option C):
  • Phase 1 (B 立即):
    • plugins/issue-driven-dev/skills/idd-close/SKILL.md Step 0 supersession 加 archive-scan fallback
    • plugins/issue-driven-dev/references/ 文件化新 supersession path
  • Phase 2 (A 長期):
    • 跨 plugin — spectra-app upstream PR 加 GitHub issue post hook(third-party,需 coordinate)
• 既有 archived Spectra changes:Phase 1 (B) 立即 cover(scan 找 cross-link)
• In-flight Spectra issues feature: /idd-all-chain accept multiple root issues with DFS/BFS traversal (default DFS) #46 idd-issue: 加入 multi-finding source 的 triage 機制（避免每筆 finding 手動分 create/update/comment/edit） #48 ship 後 close 自動 work

Strategy

(Spectra path — 預期 task list:)

• /spectra-discuss 對齊 Option C strategy + 5 個 sub-decisions
• /spectra-propose 起草 proposal:Phase 1 B 機制 spec + Phase 2 A coordination plan
• design.md 含:archive scan algorithm + supersession trigger fallback chain + cross-link audit trail format
• spec deltas:idd-close-supersession (MODIFIED — add archive-scan fallback path)
• (Phase 2 deferred to follow-up issue)spectra-app coordination

Complexity

Spectra (Layer 2 + Layer 3 都命中)

理由 above。Spectra path 走 /spectra-discuss (default) 對齊,不 opt-out。

Layer V — vagueness check:

• V1: 2 — issue body 已 explicit 寫 Option A/B/C + lean C
• V4: 3 — Acceptance 隱含 (next Spectra-archived close pass without retroactive workaround) + has explicit acceptance criteria 3 條
• Triggered: no

Risks

• Spectra-app 第三方 plugin:Option A 需 coordinate,若 upstream 不接受 hook design,Phase 2 會卡住。Mitigation:Option C 把 Phase 1 B 設計成 standalone solution(不需 A 也 work);A 是 nice-to-have not blocker
• Archive scan performance:repo 的 openspec/changes/archive/ 累積到 N 個 archived changes 後,每次 close 都 scan N 個 directory。Mitigation:本 issue 是 Spectra-archived close path(本來就少),且可加 cache layer if needed
• Multi-issue archived change cross-link:1 archived change ref'd N issues,close any one issue 都該 trigger supersession?Mitigation:scan algorithm 設計為「any archived change ref this issue → supersession active」即可
• False positive:future archived change 可能 incidentally mention #N(quoted text / cross-link to other repo)— 太 lax 觸發 supersession 會 silent skip stale Strategy。Mitigation:Phase 1 設計時 explicit anchor pattern (e.g. only Refs #N / Closes #N lines, not body text)

Recommended Path

Spectra (default — discuss first) → /spectra-discuss。

理由:design 還有 5 個 sub-decisions 沒收斂;cross-plugin coordination 有 dependency risk;不該 skip discuss 直接 propose。

[kiki830621]

Discuss Convergence (2026-05-18)

Run via /spectra-discuss #56 — assumptions mode, 4 assumptions confirmed by user.

Re-route: Spectra tier → Plan tier

Original diagnosis marked #56 as Spectra (Layer 2 + Layer 3a/b/c). Re-evaluated:

• Layer 2 not actually hit: change is addition to existing skill (spectra-archive Step N+1), NOT modification of published contract (idd-close behavior unchanged — existing supersession picks up new auto-posted comment naturally)
• Layer 3a/b not hit: no breaking schema change, no cross-archive ripple
• Single file change: ~30 lines in .claude/skills/spectra-archive (Step 10 / post-archive: post Implementation Complete comment to linked GitHub issue)
• Acceptance criteria all mechanically verifiable: (1) Spectra issue close passes gate without retroactive synthesis (smoke test) (2) audit trail anchor present (3) backward compat — existing archives unaffected

Plan tier sufficient.

Decision: Option A directly (not Option C Hybrid)

Issue body originally proposed Option C (Hybrid: ship B as transitional, then A long-term). Re-evaluated:

• spectra-apply and spectra-archive are local skills in this repo (.claude/skills/) — issue body's "cross-plugin coordination" concern for Option A is moot
• Option B (idd-close detects archived Spectra change → supersession) puts file-system scanning of openspec/changes/archive/*/proposal.md inside a close-time gate — wrong location for that logic
• Direct Option A: spectra-archive final step detects **GitHub-side tracker**: #N pattern in archived proposal.md → composes ## Implementation Complete (auto-posted by spectra-archive YYYY-MM-DD) comment → posts via gh issue comment
• No transitional B needed — YAGNI

Backward compat note

Existing archived Spectra changes do NOT have retroactive ## Implementation Complete synthesis. For those (already-archived issues not yet closed), user retains manual retroactive workaround (one-time per issue). New archives going forward auto-post.

Next step

/idd-plan #56 to draft Implementation Plan with explicit task checklist for spectra-archive modification.

[kiki830621]

Implementation Plan (Plan tier)

Per /spectra-discuss #56 convergence (2026-05-18): re-routed from Spectra → Plan tier; Option A directly (no Option B transitional).

Files & Changes

• .claude/skills/spectra-archive/SKILL.md — 新增 Step 8: Post Implementation Complete to linked GitHub issue（在現有 Step 7 "Display summary" 之後、Guardrails 之前）。Step 8 包含：(a) detect linked issue via 3-fallback scan、(b) compose ## Implementation Complete (auto-posted by spectra-archive YYYY-MM-DD) comment with checklist derived from archived tasks.md、(c) gh issue comment $N --body-file post、(d) silent skip if no linked issue (legacy archives or change without GitHub tracker — not all changes have linked issues)、(e) append **Implementation Complete posted to**: #N line to summary output (or (none — no linked issue detected) if skipped).
• .claude/skills/spectra-archive/SKILL.md — 同檔 Guardrails 段補一條: If linked issue detection finds multiple candidates (e.g. proposal mentions #44 AND #46), prompt user via AskUserQuestion to pick the canonical one — never auto-pick to avoid posting to wrong issue.

Detection Logic (Step 8 inline bash)

Three-fallback scan for linked GitHub issue number:

# Fallback 1: explicit **GitHub-side tracker** marker (preferred convention)
LINKED_ISSUE=$(grep -oE '\*\*GitHub-side tracker\*\*[^#]*#([0-9]+)' \
    "openspec/changes/archive/$ARCHIVE_DIR/proposal.md" \
    "openspec/changes/archive/$ARCHIVE_DIR/design.md" 2>/dev/null \
    | grep -oE '#[0-9]+' | head -1 | tr -d '#')

# Fallback 2: Refs / Closes / Fixes pattern in any archive artifact
if [ -z "$LINKED_ISSUE" ]; then
    LINKED_ISSUE=$(grep -hoE '(Refs|Closes|Fixes) #[0-9]+' \
        "openspec/changes/archive/$ARCHIVE_DIR"/*.md 2>/dev/null \
        | grep -oE '#[0-9]+' | head -1 | tr -d '#')
fi

# Fallback 3: scan recent commits (last 50) touching the change directory
if [ -z "$LINKED_ISSUE" ]; then
    LINKED_ISSUE=$(git log --oneline -50 -- "openspec/changes/$CHANGE_NAME" 2>/dev/null \
        | grep -oE '#[0-9]+' | head -1 | tr -d '#')
fi

# Final: silent skip if no candidate found (legitimate — change without GitHub tracker)
if [ -z "$LINKED_ISSUE" ]; then
    echo "(no linked GitHub issue detected — skipping Implementation Complete auto-post)"
    exit 0
fi

# Multi-candidate disambiguation: if Fallback 1 returned multiple distinct #N, prompt
# (handled at agent level via AskUserQuestion since bash can't prompt)

Comment Body Template

## Implementation Complete (auto-posted by spectra-archive YYYY-MM-DD)

> Auto-posted by `/spectra-archive` after archiving `<change-name>`. This comment is the canonical Implementation Complete anchor for `/idd-close` supersession.

**Spectra change**: `openspec/changes/archive/YYYY-MM-DD-<change-name>/`
**Spec deltas applied**: <capabilities list from spectra-archive output>

### Checklist
<derive from archived tasks.md: each `- [x]` task → `- [x]` here; each `- [~]` skipped → `- [~]` with original reason; each `- [-]` won't-fix → `- [-]` with reason>

---

*This comment exists to satisfy `/idd-close` Step 0 supersession gate. The canonical record of what was implemented is the archived change directory + main spec at `openspec/specs/<capability>/spec.md`.*

Sequencing & Dependencies

1. SKILL.md edit only — no helper scripts, no other skill modification needed
2. Existing /idd-close Step 0 supersession logic 已能識別 ## Implementation Complete > ### Checklist 全 - [x] 觸發 supersession — 新 auto-posted comment 自然 fit existing pattern, 不需 modify idd-close
3. spectra-archive 是 idempotent — 重跑同 archive (rare) 會 post duplicate Implementation Complete comment;mitigation: Step 8 pre-check 同 issue 是否已有 auto-posted by spectra-archive comment, 命中則 skip 重 post (idempotent guard)

Decision Points

• Detect-then-prompt vs auto-pick on multi-candidate: 選 prompt — 自動猜可能 post 到錯 issue, audit trail 比 friction 重要
• Inline bash detection vs extract helper script: 選 inline — 30 lines, single caller, no reuse anticipated
• Silent skip vs warn when no linked issue: 選 silent skip (with summary line) — 非所有 change 都有 linked issue, 不該 warning spam

Risks & Mitigations

• Risk: detection false negative on archives without GitHub tracker marker → Mitigation: 3-fallback chain (explicit marker / Refs-Closes-Fixes / commit grep) cover 既有 4 種 archive 慣例
• Risk: detection false positive — proposal mentions unrelated issue numbers (sister concerns, prior work refs) → Mitigation: priority order — explicit marker (designed-for-this) wins over generic Refs # patterns. Multi-candidate → prompt user.
• Risk: idempotent guard fails, duplicate Implementation Complete comment posted → Mitigation: pre-check gh issue view $N --json comments for existing auto-posted by spectra-archive substring before posting; skip if found
• Risk: existing archived changes (pre-this-PR) have no auto-posted comment, user 仍要手動 retroactive workaround for them → Mitigation: documented in plan body — backward compat exists archives unaffected, only NEW archives auto-post. One-time user pain for transition.

Test Plan

Manual smoke (no automated test framework for this skill):

1. Happy path: Create test change with **GitHub-side tracker**: #56 in proposal, run spectra archive, verify ## Implementation Complete (auto-posted ...) comment posted to feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56 with checklist matching tasks.md
2. Fallback path (Refs): Create test change with Refs #56 only, no explicit marker — verify Fallback 2 detects feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56
3. No linked issue path: Create test change with no #N anywhere — verify silent skip, no comment posted, summary line shows (none — no linked issue detected)
4. Multi-candidate path: Create test change with proposal mentioning feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56 AND cluster-PR mode 強制 PR 與 direct-commit path 衝突：override 未文件化且 --no-pr 行為未定義 #99 — verify prompt fires
5. Idempotent re-archive: re-run spectra-archive on already-archived change (edge case) — verify no duplicate Implementation Complete comment
6. Real-world dogfood: next Spectra-path issue close pass /idd-close gate without manual retroactive Implementation Complete synthesis (i.e. self-validating — this issue feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56's own close will be the first dogfood)

Out-of-scope (will NOT be touched)

• /idd-close Step 0 supersession logic — existing logic 已 cover；不修
• /spectra-apply — NOT modified, anchor moment chosen as /spectra-archive end (closer to /idd-close cascade timing)
• Retroactive auto-post for already-archived changes — backward compat, one-time user pain accepted (YAGNI: pre-this-PR archives are stable, manual retroactive workaround already proven in feature: /idd-all chain-solve mode — 自動接續解 spawned issues + 單 review PR #44 close)
• Helper script extraction — inline (~30 lines), no reuse
• openspec/LANGUAGE.md vocabulary doc — discussion convergence noted vocabulary drift but YAGNI for single occurrence

Tangential Observations (filled by Step 2.5)

Filed: #90 (linking convention docs), #91 (spectra-archive Bootstrap TaskList consistency)

[kiki830621]

Implementation Complete

Checklist (synced from TaskList)

• .claude/skills/spectra-archive/SKILL.md Step 8 — Post Implementation Complete to linked GitHub issue block inserted (8.1 detect / 8.2 idempotent guard / 8.3 compose / 8.4 post) → commit a40ab7a
• .claude/skills/spectra-archive/SKILL.md Step 7 — summary line **Implementation Complete posted to:** ... added → commit a40ab7a
• .claude/skills/spectra-archive/SKILL.md Guardrails — multi-candidate disambiguation + silent-skip-no-linked-issue entries added → commit a40ab7a

Legend: - [x] done · - [~] skipped (may revisit) · - [-] won't fix (scope)
idd-close will refuse to close if any - [ ] remains in this checklist.

Changes

• a40ab7a: feat(spectra-archive): auto-post Implementation Complete to linked GitHub issue (feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56)

Files Changed

 .claude/skills/spectra-archive/SKILL.md | 100 ++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)

Scope Compliance

All changes confined to .claude/skills/spectra-archive/SKILL.md (single-file, ~100 lines as planned). No collateral edits to other skills, no helper script extraction (per D Decision), no plugin version bump (this is .claude/skills/, not plugin distribution surface).

Self-Validation (Dogfood — first-real-use)

This issue #56's own close will be the first dogfood:

1. After merge, /idd-close #56 → cascades /spectra-archive → ... wait, this is NOT a Spectra-path issue (no openspec/changes/<name>/ directory for feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56). So actual dogfood will be the next Spectra-tier issue close that uses this auto-post. feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56 itself was re-routed to Plan tier in discuss phase, so it doesn't exercise the new code path.

Effective dogfood plan: next time any future Spectra change is archived (e.g. when next Spectra-tier issue ships), Step 8 will fire and validate the path end-to-end.

Next: verification pending

Run /idd-verify #56 to validate the edit.

Sister Bugs Filed (mid-impl, Step 5.7)

none surfaced (single-file ~100-line addition; no adjacent skills inspected this session)

Plan-phase tangentials already filed: #90 (linking convention docs), #91 (spectra-archive Bootstrap TaskList consistency)

[kiki830621]

Verify (via PR #92)

Result: FAIL — 8 P1 blocking, 11 P2, 9 P3. 6-AI multi-source consensus on structural defects in Step 8 bash control flow + missing multi-candidate disambiguation + variable scope/ordering.

Full report: #92 (comment)

This issue's findings: see PR #92 master report (this issue is the canonical Ref).

[kiki830621]

Implementation Plan (Round 2 — addressing verify findings)

Previous round (commit a40ab7a) failed verify with 8 P1 + 11 P2 + 9 P3. This R2 plan rewrites Step 8 as a single self-contained bash block addressing all P1 + in-scope P2.

Files & Changes

• .claude/skills/spectra-archive/SKILL.md — Rewrite Step 7 + Step 8 sequence:
  • Reorder: new Step 7 = "Post Implementation Complete to linked GitHub issue" (was Step 8); new Step 8 = "Display summary" (was Step 7). Fixes P1-1 step ordering inversion.
  • Single self-contained bash block for new Step 7 with explicit if/elif/else control flow. Fixes P1-2 (comments-as-control-flow) + P1-4 (variable scope contract).
  • Multi-candidate detection via sort -u before any selection; branch on count: 0 → silent skip, 1 → use, ≥2 → agent-level AskUserQuestion. Fixes P1-3.
  • wc -l instead of grep -c \|\| echo 0. Fixes P1-5.
  • ${COMMENT_URL:-failure_msg} parameter expansion for failure path. Fixes P1-6.
  • - [x]-only filter for derived checklist with note pointing to archived tasks.md for full audit. Fixes P1-7.
  • $CHANGE_NAME allowlist guard [[ "$CHANGE_NAME" =~ ^[A-Za-z0-9_-]+$ ]] at top. Fixes P2-9.
  • Multi-candidate AskUserQuestion shows #N + issue title for confirmation (mitigates P2-10 attacker-controlled proposal redirect).
  • Idempotent sentinel includes archive directory name auto-posted by spectra-archive for <archive-dir>. Fixes P2-11.
  • Portable mktemp BODY_FILE=$(mktemp /tmp/spectra-archive-ic.XXXXXX) && mv "$BODY_FILE" "$BODY_FILE.md". Fixes P2-12.
  • Concrete body composition with single-quoted heredoc + grep -E '^- \[x\]' filter from tasks.md. Fixes P2-13.
  • git log --follow on archived path only for Fallback 3. Fixes P2-14.
  • gh repo view hard-fail if GH_REPO empty with explicit error. Fixes P2-15.

Sequencing

Single file edit. New Step 7 must replace current Step 7 + Step 8 entirely (no piecewise edits — too easy to introduce new control flow bugs). Update internal references and Guardrails section accordingly. New Step 8 (Display summary) reads variables set by new Step 7.

Decision Points (round 2)

• D1 — Reorder vs default-init: Reorder Step 7↔Step 8 (semantic: post first, then display). Default-init at skill start would be technically simpler but leaves the "summary mentions step that ran first" oddness.
• D2 — - [x] filter vs include all markers: Filter to - [x] only. Loses some audit fidelity (skipped tasks invisible in IC anchor), but the alternative is /idd-close supersession breaking. Add explicit pointer note: > Note: only completed (- [x]) tasks shown; see archived tasks.md for skipped (- [~]) / won't-fix (- [-]) items with reasons.
• D3 — gh repo view hard-fail vs silent: Hard-fail. Posting to wrong repo is silent data corruption — better noisy failure.
• D4 — Multi-candidate prompt at agent level: Per spectra-archive's existing Step 1 (change selection via AskUserQuestion) — same pattern, agent reads bash candidate list, fires AskUserQuestion.

Risks & Mitigations

• Risk: Heredoc body composition has its own escape pitfalls (backticks in tasks.md content) → Mitigation: use 'EOF' quoted heredoc + verify with wc -c body size sanity check; reject if > 60KB (GitHub limit 65536)
• Risk: mv "$BODY_FILE" "$BODY_FILE.md" race condition unlikely but possible → Mitigation: low risk for /tmp single-user use case; not worth atomic-rename overhead
• Risk: - [x] filter hides skipped/won't-fix tasks → Mitigation: explicit pointer note + Spec Drift section in feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56 update

Test Plan (validation — no automated harness for SKILL.md prose)

Self-validation NOT possible for #56 itself (Plan tier, no Spectra change). Recommended dogfood approach:

1. Manual smoke after merge: trigger /spectra-archive on next Spectra-tier issue (feature: mechanism for sync archived Spectra spec deltas with subsequent capability extensions #54 is closed; need next live archive opportunity)
2. Alternative: temporary fixture change directory for explicit test — out of scope for this PR (file as P3 follow-up)

Out-of-scope (will NOT be touched)

• P3 [refactor] idd-list Step 5: needs-fix × PR state matrix 應展開,不該摺疊成單行 (verify follow-up from #13) #16 (3-copy spectra-archive duplication) — separate follow-up issue
• P3 polish [enhancement] idd-list Step 5: planning + has PR 應勸 user 處理 stale/zombie PR (verify follow-up from #13) #17-22 — accept current state; file unified P3 polish issue if needed
• Spec drift (issue title says spectra-apply) — idd-edit issue body in follow-up
• /idd-close Step 0 supersession modification — accept - [x]-only filter solution instead
• openspec/LANGUAGE.md vocabulary doc (YAGNI, single occurrence)

Tangential Observations (filled by Step 2.5)

(pending sister-bug sweep)

[kiki830621]

Implementation Complete (Round 2 — addressing verify findings)

Round 1 commit a40ab7a failed verify with 8 P1 + 11 P2 + 9 P3. Round 2 commit c247760 rewrites Step 7+8 sequence as single self-contained bash block.

Checklist (synced from TaskList)

• Reorder Step 7 ↔ Step 8 — new Step 7 = post Implementation Complete, new Step 8 = display summary (fixes P1-1 ordering inversion) → c247760
• Collapse Step 7 into single self-contained bash block with explicit if/elif/else throughout (fixes P1-2 comments-as-control-flow + P1-4 variable scope) → c247760
• Replace head -1 with sort -u + case branch on count 0/1/N; multi-candidate writes to /tmp/spectra-archive-candidates.txt + sets pending message for agent AskUserQuestion (fixes P1-3) → c247760
• Replace grep -c \|\| echo 0 with grep -F ... \| wc -l \| tr -d ' ' (fixes P1-5) → c247760
• Use ${COMMENT_URL:-failure_msg} parameter expansion in post-comment branch (fixes P1-6) → c247760
• Filter checklist to - [x] only with pointer note to archived tasks.md (fixes P1-7 supersession compatibility) → c247760
• Concrete body composition: single-quoted heredoc + python3 multiline substitution; no placeholder comments (fixes P1-8 design-by-narrative) → c247760
• Allowlist guard [[ "$CHANGE_NAME" =~ ^[A-Za-z0-9_-]+$ ]] at top (fixes P2-9 injection) → c247760
• Multi-candidate AskUserQuestion shows #N + issue title (mitigates P2-10 cross-issue redirect) → c247760
• Idempotent sentinel includes archive directory basename (fixes P2-11 broad guard) → c247760
• Portable mktemp pattern: mktemp /tmp/...XXXXXX + mv with .md suffix (fixes P2-12 macOS BSD) → c247760
• Concrete body composition (also fixes P2-13 prose placeholder) → c247760
• git log --follow on archived path only (fixes P2-14) → c247760
• Hard-fail with error message if gh repo view returns empty (fixes P2-15) → c247760

Legend: - [x] done · - [~] skipped (may revisit) · - [-] won't fix (scope)

Changes

• c247760: fix(spectra-archive): rewrite Step 7+8 — address 8 P1 + 7 P2 from verify round 1 (feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56)

Files Changed

 .claude/skills/spectra-archive/SKILL.md | 283 ++++++++++++++++++++++----------
 1 file changed, 192 insertions(+), 91 deletions(-)

Verify-driven Improvements

Round 2 incorporates explicit safeguards surfaced by 6-AI consensus:

Layer	Defense Added
Input validation	$CHANGE_NAME allowlist regex
Detection	sort -u multi-candidate; LINKED_ISSUE_RESOLVED env var validation against original set
Idempotency	Per-archive sentinel (not per-repo)
Failure semantics	Default value at start + explicit branch per outcome; 8 documented states for IMPLEMENTATION_COMPLETE_POSTED
Resource limits	60KB body size sanity check before posting (GitHub limit 65536)
Cross-platform	macOS BSD mktemp compatibility
Audit fidelity	- [x]-only filter with pointer to archived tasks.md for skipped/won't-fix

Out-of-scope (deferred)

• P3 [refactor] idd-list Step 5: needs-fix × PR state matrix 應展開,不該摺疊成單行 (verify follow-up from #13) #16 (3-copy spectra-archive duplication) — separate follow-up issue to file via Step 5.7
• P3 polish [enhancement] idd-list Step 5: planning + has PR 應勸 user 處理 stale/zombie PR (verify follow-up from #13) #17-22 — accept current state for this round; address opportunistically
• Spec drift (issue title still says spectra-apply) — idd-edit in follow-up or at /idd-close
• Self-dogfood impossible — feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56 is Plan tier, no Spectra change of its own; next Spectra archive will be real first-real-use

Sister Bugs Filed (mid-impl, Step 5.7)

Filed: #93 (3-copy spectra-archive duplication, P3 follow-up)

Scope Compliance

All changes confined to .claude/skills/spectra-archive/SKILL.md. No collateral edits.

Next: re-verify round 2

Run /idd-verify #56 to validate fixes against round 1 findings.

[kiki830621]

Verify Round 2 (via PR #92)

Result: FAIL — STRONGLY RECOMMEND HALT ITERATION

R2 ✅ fixed all 8 R1 P1 findings, BUT introduced 3 NEW P1 regressions including a CRITICAL Python3 RCE live-exploited by Security reviewer. Devil's Advocate D1 meta-finding: 2 rounds of code review with zero actual executions — perpetuates the design-by-narrative anti-pattern that #56 was filed to fix.

Recommendation: pivot approach — extract Step 7 to a unit-testable script (scripts/spectra-archive-post-ic.sh) rather than iterate R3 on prose-with-illustrative-bash.

Full report: #92 (comment)

This issue's findings: see PR #92 master report (#56 is canonical Ref).

[kiki830621]

Implementation Complete (Round 3 — Option A: extract to executable script)

R2 verify (#92 (comment)) recommended HALTING iteration on prose-with-illustrative-bash and pivoting to script extraction. R3 implements Option A directly.

Checklist (synced from TaskList)

• Design + write .claude/scripts/spectra-archive-post-ic.sh (~290 lines) — single executable file with all detection / idempotent guard / safe body composition / post logic → 7290b55
• Write 9 unit-test fixtures + harness in .claude/scripts/tests/spectra-archive-post-ic/ → 7290b55
  • 9/9 PASS at commit time
• Simplify SKILL.md Step 7 from ~170 lines of inline bash to ~50 lines of thin invocation + exit-code dispatch → 7290b55
• SKILL.md Step 8 reads outcome from /tmp/spectra-archive-ic-outcome.txt (cross-Bash-call persistent file) → 7290b55

Legend: - [x] done · - [~] skipped (may revisit) · - [-] won't fix (scope)

Changes

• 7290b55: refactor(spectra-archive): extract Step 7 to script + 9 unit-test fixtures (feature: spectra-apply auto-post Implementation Complete to GitHub issue (resolve /idd-close supersession friction) #56 R3 — Option A)

Files Changed

 .claude/scripts/spectra-archive-post-ic.sh         | 293 +++++++++++++++++++++
 .claude/scripts/tests/spectra-archive-post-ic/...  | (9 fixtures + test.sh + README)
 .claude/skills/spectra-archive/SKILL.md            | 239 ++++++-------------
 49 files changed, 595 insertions(+), 187 deletions(-)

SKILL.md net -134 lines (374 → 240) — Step 7 now thin orchestration, contract lives in script.

R2 P1 Resolution

#	R2 P1	R3 Fix	Verification
N1	Python3 RCE via shell-string interpolation	✅ Env-var input to single-quoted heredoc	Fixture 05 (malicious-tasks-triple-quote) with RCE payload — confirms /tmp/pwn-fixture-05 NOT created
N2	Cross-shell variable doesn't persist	✅ Script writes to outcome file, Step 8 cats from file	Outcome file pattern survives fresh subshell
N3	LINKED_ISSUE_RESOLVED env var stateless	✅ Multi-candidate via exit 75 + candidates file + explicit --linked-issue arg	Fixture 04 (multi-candidate) + Fixture 08 (resolved) + Fixture 09 (invalid)

R2 P2 Resolution

#	R2 P2	R3 Fix
N4	sed delimiter collision	✅ All substitution in Python str.format()
N5	git log --follow on directory	✅ Dropped --follow
N6	Single-candidate redirect	⏭ Deferred — accept single-candidate auto-use; future strict-confirm flag if needed
N7	$CHANGE_NAME contract	✅ Required arg flag with allowlist guard
N8	ARCHIVE_BASENAME date	✅ Basename derived from passed --archive-dir (no recomputation)
N9	python3 hidden dependency	✅ Script checks command -v python3 + exit 64 with clear message

R2 P3 Items

#	R2 P3	R3 Status
N10	Mention injection	⏭ Polish — accept current; future markdown sanitization if abuse seen
N11	LINKED_ISSUE_RESOLVED numeric validation	✅ Added ^[0-9]+$ regex check
N12	3-copy SKILL.md (#93 follow-up)	⏭ Still tracked as #93 — separate ticket

Self-validation (THE key meta-finding from R2 D1)

R2 Devil's Advocate D1: "Two rounds of code review, zero actual executions" — design-by-narrative anti-pattern.

R3 addresses this by:

• Script IS executed end-to-end in dry-run mode by all 9 test fixtures
• Test runner exits non-zero if any fixture fails
• Adding new fixtures = new unit tests, no prose-only assertions
• Fixture 05 specifically validates the critical N1 RCE fix with an actual exploit payload

This shifts the verify model from "AI reviews prose" to "tests verify behavior".

Scope Compliance

3 directories touched:

• .claude/scripts/spectra-archive-post-ic.sh (new file)
• .claude/scripts/tests/spectra-archive-post-ic/ (new directory tree)
• .claude/skills/spectra-archive/SKILL.md (modified to delegate)

All within #56 scope. No collateral changes to other skills.

Sister Bugs Filed (mid-impl, Step 5.7)

(to be filled after Step 5.7 sweep)

Next: re-verify round 3

Run /idd-verify #56 to validate R3. Expected: PASS (or at most P3 polish findings; P1/P2 should all be addressed via script + tests).

The test suite itself provides executable evidence — verify reviewers can run .claude/scripts/tests/spectra-archive-post-ic/test.sh to confirm.

[kiki830621]

Verify Round 3 (via PR #92)

Result: PASS-WITH-CONDITIONS — R3 architectural win closes all R2 P1 (live-verified, including critical Python3 RCE), but surfaces 4 new HIGH-grade issues.

Key win: R3 broke the design-by-narrative anti-pattern. Every reviewer this round actually ran the test suite (9/9 PASS) and executed the RCE exploit fixture directly — confirmed safe. This is executable verification, finally.

New HIGH issues (3 in-scope fixable, 1 deferred):

1. test.sh eval RCE via malicious args.txt (test infra)
2. Relative script path breaks from non-repo-root cwd
3. Concurrent invocation race on /tmp outcome file
4. (Inherited R2 N6, deferred) Single-candidate auto-use trusts attacker proposal.md

Full report: #92 (comment)

Recommendation: pick — R4 (~15 line fix) OR merge PR #92 as-is + file follow-ups (4-round-trip diminishing returns suggest merge).