chore(verify): rebuild the verify skill around the sim harness as an agent-agnostic tree at tools/verify, with a capture helper and a feature map

[mforce]

Summary

The verify skill predated the Playwright suite in tools/simulation/ui/ that every revamp PR now verifies with, and it had no doctor step, no evidence standard, no cleanup discipline and no feature map. This rebuilds it around the sim harness:

• Launch and doctor the cluckwork-sim stack (bootstrap, sg docker reset, the Farms: ready marker, the four doctor checks including "was the image built from this checkout's head").
• Drive through the harness's own fixtures and catalog labels (signIn, the cast personas, tEn, commitNamedPicker, the two viewport projects), with the two-farm rule: captures on readme-farm, write flows on default-farm.
• Evidence standards and where proofs go; capture.sh takes four 1:1 frames of a route (1280 and 390, light and dark) on the demo farm, prints console errors, and removes its throwaway spec.
• Cleanup that removes what the run created and never the evidence; the shared-stack rule (one compose project, never reset under another driver).
• Feature map (features/): Dashboard, Daily entry, Sales, Stock, Flocks, each with sub-features, the user's path, real handles from the existing specs, and the end state that proves it. The unmapped routes are listed for later.
• The dev-server path stays as the debugging section.

.gitignore's carve-out !.claude/skills/verify/ never applied, because git cannot re-include a file under an excluded directory; the parent rule is now .claude/skills/*, so the helper and the map are tracked as the comment intended.

Proven once, per the skill's own steps

Doctor against the live stack (all healthy, /health/ready 200), then capture.sh verify-skill-proof / readme: four frames in /tmp/verify-skill-proof/ in 8 s, the throwaway spec gone afterwards, git status clean, evidence still on disk after cleanup. The one console line it reports (a single 401 on the sign-in page's session probe) is documented as expected noise.

Both image-pin guards green on the tracked markdown.

Docs-only PR: web and image skip by the #782 gate.

[mforce]

@coderabbitai review

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f646d7a2-0979-4615-b04f-75c9da3d443e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[mforce]

Security review (commit hook) flagged capture.sh: the slug and route were interpolated into the generated spec and the /tmp path unvalidated (code injection, path traversal). Fixed in 2e4f7d6: each argument is held to a fixed alphabet before anything is written; ../x, a quoted slug and a javascript:${x} route now exit 2.

[mforce]

Correction: 2e4f7d6's route pattern was a bash parse error (an unquoted & inside [[ =~ ]]), so every call exited 2, the rejection "proofs" included. d390f11 moves the patterns into variables; re-proven: ../x, a"b, x${y} and a javascript: route exit 2, and a real capture.sh verify-skill-proof2 / readme produced its four frames in 7 s with the throwaway spec removed.

[mforce]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[mforce]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[mforce]

Review round (CodeRabbit rate limited; local Codex CLI review of git diff origin/main...HEAD at 428eeca stood in) found two real defects in tools/verify/capture.sh, both fixed in 77e054d:

1. The trailing || true swallowed every Playwright failure and the following ls returned 0, so the helper could report success with no evidence. The exit status now propagates and all four frames must exist on disk.
2. The slug alphabet admitted . and .., so /tmp/.. resolved to /. A slug must now start alphanumeric.

Re-proven: ., .. and -x exit 2; a forced Playwright failure (BASE_URL pointed at a dead port) exits non-zero with no frames and the throwaway spec still removed; a real capture still produces its four frames.