From b5e86ec4e761b088bddf717699a401fb1a19e0a7 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 21 Jun 2026 18:15:51 +0200 Subject: [PATCH 1/9] feat(openspec): bootstrap OpenSpec spec layer for the demo's status showcase MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds an OpenSpec layer mirroring reqstool-client#407's dogfooding pattern, scoped to this repo's actual purpose: showcasing every reqstool status outcome (pass, manual-fail, not-implemented, failing-test, skipped-test, missing-test) across six small feature capabilities. - openspec/specs/{greeting,billing,reporting,validation,notifications, audit-logging}/spec.md — one capability per status outcome, in thin ID-reference form against the existing requirements.yml/SVC IDs (REQ_PASS, REQ_MANUAL_FAIL, ...). IDs are kept as-is (no capability prefix) since they're already domain-named and intentionally demonstrate non-passing states, unlike reqstool-client's renamed/100%-passing set. - openspec/openspecui.hooks.ts — reqstool-ai's openspecui enrichment hook. - .reqstool-ai.yaml — single "demo" module, domain-specific (no) prefix. - .mcp.json — project-scoped reqstool MCP server entry. Validated: openspec validate --specs --strict (6/6 pass), reqstool validate --strict (pass), reqstool status (1/6 complete, by design), mvn clean verify (build succeeds; one intentionally failing test, by design), and CLI vs MCP get_requirements_status now agree exactly across all 6 requirements (confirmed after reqstool-client#411's fix). Signed-off-by: Jimisola Laursen --- .mcp.json | 8 ++ .reqstool-ai.yaml | 33 ++++++++ openspec/openspecui.hooks.ts | 108 +++++++++++++++++++++++++++ openspec/specs/audit-logging/spec.md | 17 +++++ openspec/specs/billing/spec.md | 20 +++++ openspec/specs/greeting/spec.md | 20 +++++ openspec/specs/notifications/spec.md | 17 +++++ openspec/specs/reporting/spec.md | 16 ++++ openspec/specs/validation/spec.md | 17 +++++ 9 files changed, 256 insertions(+) create mode 100644 .mcp.json create mode 100644 .reqstool-ai.yaml create mode 100644 openspec/openspecui.hooks.ts create mode 100644 openspec/specs/audit-logging/spec.md create mode 100644 openspec/specs/billing/spec.md create mode 100644 openspec/specs/greeting/spec.md create mode 100644 openspec/specs/notifications/spec.md create mode 100644 openspec/specs/reporting/spec.md create mode 100644 openspec/specs/validation/spec.md diff --git a/.mcp.json b/.mcp.json new file mode 100644 index 0000000..a14c1b1 --- /dev/null +++ b/.mcp.json @@ -0,0 +1,8 @@ +{ + "mcpServers": { + "reqstool": { + "command": "reqstool", + "args": ["mcp"] + } + } +} diff --git a/.reqstool-ai.yaml b/.reqstool-ai.yaml new file mode 100644 index 0000000..61780ba --- /dev/null +++ b/.reqstool-ai.yaml @@ -0,0 +1,33 @@ +# reqstool-ai configuration +# +# This file tells reqstool-ai skills where to find your reqstool files +# and how to generate IDs for new requirements and SVCs. +# +# Place this file at: .reqstool-ai.yaml (project root) + +# Project URN — matches the urn in your reqstool YAML files +urn: reqstool-demo + +# Revision string for new requirements and SVCs +revision: "0.0.1" + +# System-level reqstool directory (contains the SSOT requirements and SVCs) +system: + path: docs/reqstool + +# Subproject modules — each module imports a subset of requirements/SVCs via filters +# +# Required fields per module: +# path — path to the module's reqstool directory (contains filter files) +# req_prefix — prefix for requirement IDs belonging to this module (e.g., CORE_) +# svc_prefix — prefix for SVC IDs belonging to this module (e.g., SVC_CORE_) +# +# Add as many modules as your project has. The module name (key) is used in +# commands like `/reqstool:status core` and `/reqstool:add-req core`. +modules: + # Domain-specific prefixes: this demo's IDs are managed manually + # (REQ_PASS, REQ_MANUAL_FAIL, REQ_NOT_IMPLEMENTED, ...; SVC_010, SVC_020, ...) + demo: + path: docs/reqstool + req_prefix: "" + svc_prefix: "SVC_" diff --git a/openspec/openspecui.hooks.ts b/openspec/openspecui.hooks.ts new file mode 100644 index 0000000..49a96ee --- /dev/null +++ b/openspec/openspecui.hooks.ts @@ -0,0 +1,108 @@ +// @reqstool-openspec-hooks: 0.1.1 +import { spawn, ChildProcess } from "child_process"; +import type { OnReadDocumentHookV1 } from "openspecui/hooks"; + +// Minimal MCP client over stdio (JSON-RPC 2.0, newline-delimited). +// Uses only Node.js built-ins — no npm packages required. +class McpStdioClient { + private proc: ChildProcess; + private buf = ""; + private pending = new Map< + number, + { resolve: (v: unknown) => void; reject: (e: Error) => void } + >(); + private id = 1; + readonly ready: Promise; + + constructor(cwd: string) { + this.proc = spawn("reqstool", ["mcp"], { + cwd, + stdio: ["pipe", "pipe", "pipe"], + }); + this.proc.stdout!.on("data", (chunk: Buffer) => { + this.buf += chunk.toString(); + let nl: number; + while ((nl = this.buf.indexOf("\n")) !== -1) { + const line = this.buf.slice(0, nl).trim(); + this.buf = this.buf.slice(nl + 1); + if (line) this.handle(line); + } + }); + this.ready = this.init(); + } + + private handle(line: string) { + try { + const msg = JSON.parse(line) as { id?: number; result?: unknown; error?: { message: string } }; + if (msg.id !== undefined) { + const p = this.pending.get(msg.id); + if (p) { + this.pending.delete(msg.id); + msg.error ? p.reject(new Error(msg.error.message)) : p.resolve(msg.result); + } + } + } catch (e) { + console.warn("[reqstool-openspec] Skipping non-JSON line from reqstool mcp:", e instanceof Error ? e.message : e); + } + } + + private send(method: string, params: unknown, expectReply = true): Promise { + if (!expectReply) { + this.proc.stdin!.write(JSON.stringify({ jsonrpc: "2.0", method, params }) + "\n"); + return Promise.resolve(); + } + const id = this.id++; + return new Promise((resolve, reject) => { + this.pending.set(id, { resolve, reject }); + this.proc.stdin!.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n"); + }); + } + + private async init(): Promise { + await this.send("initialize", { + protocolVersion: "2024-11-05", + capabilities: { tools: {} }, + clientInfo: { name: "openspecui", version: "1.0" }, + }); + this.send("notifications/initialized", {}, false); + } + + async enrich(content: string, preset: string): Promise { + await this.ready; + const result = (await this.send("tools/call", { + name: "enrich_document", + arguments: { content, preset }, + })) as { content: { text: string }[] }; + return result.content[0].text; + } + + close() { + this.proc.stdin?.end(); + this.proc.kill(); + } +} + +let client: McpStdioClient | null = null; + +export const onReadDocument: OnReadDocumentHookV1 = async (ctx, read) => { + if (!client) { + client = new McpStdioClient(ctx.projectDir); + ctx.lifecycle.onDispose(() => { + client?.close(); + client = null; + }); + } + + const result = await read(); + const preset = `openspec:${ctx.document.kind}`; + + try { + const enriched = await client.enrich(result.markdown, preset); + return { ...result, markdown: enriched, sourceLabel: `reqstool ${preset}` }; + } catch (e) { + return { + ...result, + diagnostics: [{ level: "warning", message: `reqstool enrich failed: ${e}` }], + }; + } +}; diff --git a/openspec/specs/audit-logging/spec.md b/openspec/specs/audit-logging/spec.md new file mode 100644 index 0000000..d85f6e2 --- /dev/null +++ b/openspec/specs/audit-logging/spec.md @@ -0,0 +1,17 @@ +# Audit Logging Specification + +## Purpose + +Requirement and SVC content is owned by reqstool (single source of truth). This spec references +reqstool requirement and SVC IDs only; titles and descriptions are injected at read time via +`reqstool enrich` (or the openspecui hook). See `docs/reqstool/`. This capability demonstrates a +requirement and SVC that exist but have no verifying test at all — the **missing-test** status +case. + +## Requirements + +### Requirement: REQ_MISSING_TEST +The system SHALL implement REQ_MISSING_TEST. + +#### Scenario: SVC_060 +The system SHALL pass SVC_060. diff --git a/openspec/specs/billing/spec.md b/openspec/specs/billing/spec.md new file mode 100644 index 0000000..c2d17a3 --- /dev/null +++ b/openspec/specs/billing/spec.md @@ -0,0 +1,20 @@ +# Billing Specification + +## Purpose + +Requirement and SVC content is owned by reqstool (single source of truth). This spec references +reqstool requirement and SVC IDs only; titles and descriptions are injected at read time via +`reqstool enrich` (or the openspecui hook). See `docs/reqstool/`. This capability demonstrates a +requirement that passes its automated test but fails manual verification — the **manual-fail** +status case. + +## Requirements + +### Requirement: REQ_MANUAL_FAIL +The system SHALL implement REQ_MANUAL_FAIL. + +#### Scenario: SVC_020 +The system SHALL pass SVC_020. + +#### Scenario: SVC_022 +The system SHALL pass SVC_022. diff --git a/openspec/specs/greeting/spec.md b/openspec/specs/greeting/spec.md new file mode 100644 index 0000000..2c315bc --- /dev/null +++ b/openspec/specs/greeting/spec.md @@ -0,0 +1,20 @@ +# Greeting Specification + +## Purpose + +Requirement and SVC content is owned by reqstool (single source of truth). This spec references +reqstool requirement and SVC IDs only; titles and descriptions are injected at read time via +`reqstool enrich` (or the openspecui hook). See `docs/reqstool/`. This capability demonstrates a +requirement that is fully implemented, automatically tested, and manually verified — the **passing** +status case. + +## Requirements + +### Requirement: REQ_PASS +The system SHALL implement REQ_PASS. + +#### Scenario: SVC_010 +The system SHALL pass SVC_010. + +#### Scenario: SVC_021 +The system SHALL pass SVC_021. diff --git a/openspec/specs/notifications/spec.md b/openspec/specs/notifications/spec.md new file mode 100644 index 0000000..c7518d1 --- /dev/null +++ b/openspec/specs/notifications/spec.md @@ -0,0 +1,17 @@ +# Notifications Specification + +## Purpose + +Requirement and SVC content is owned by reqstool (single source of truth). This spec references +reqstool requirement and SVC IDs only; titles and descriptions are injected at read time via +`reqstool enrich` (or the openspecui hook). See `docs/reqstool/`. This capability demonstrates a +requirement whose implementation is intentionally unfinished, causing its automated test to be +skipped — the **skipped-test** status case. + +## Requirements + +### Requirement: REQ_SKIPPED_TEST +The system SHALL implement REQ_SKIPPED_TEST. + +#### Scenario: SVC_050 +The system SHALL pass SVC_050. diff --git a/openspec/specs/reporting/spec.md b/openspec/specs/reporting/spec.md new file mode 100644 index 0000000..cee2b86 --- /dev/null +++ b/openspec/specs/reporting/spec.md @@ -0,0 +1,16 @@ +# Reporting Specification + +## Purpose + +Requirement and SVC content is owned by reqstool (single source of truth). This spec references +reqstool requirement and SVC IDs only; titles and descriptions are injected at read time via +`reqstool enrich` (or the openspecui hook). See `docs/reqstool/`. This capability demonstrates a +requirement with an SVC but no implementation — the **not-implemented** status case. + +## Requirements + +### Requirement: REQ_NOT_IMPLEMENTED +The system SHALL implement REQ_NOT_IMPLEMENTED. + +#### Scenario: SVC_030 +The system SHALL pass SVC_030. diff --git a/openspec/specs/validation/spec.md b/openspec/specs/validation/spec.md new file mode 100644 index 0000000..20748cb --- /dev/null +++ b/openspec/specs/validation/spec.md @@ -0,0 +1,17 @@ +# Validation Specification + +## Purpose + +Requirement and SVC content is owned by reqstool (single source of truth). This spec references +reqstool requirement and SVC IDs only; titles and descriptions are injected at read time via +`reqstool enrich` (or the openspecui hook). See `docs/reqstool/`. This capability demonstrates a +requirement whose implementation has a bug, causing its automated test to fail — the +**failing-test** status case. + +## Requirements + +### Requirement: REQ_FAILING_TEST +The system SHALL implement REQ_FAILING_TEST. + +#### Scenario: SVC_040 +The system SHALL pass SVC_040. From 64d67d7f11433e63e99f7bacde94a06e64f7eb68 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 21 Jun 2026 18:21:09 +0200 Subject: [PATCH 2/9] ci(build): validate OpenSpec specs, clarify reqstool-ai prefix comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add an openspec validate --specs --strict step to build.yml so spec/SSOT drift fails CI instead of relying on the manual run documented in #104's PR description; build-docs.yml's docs/** path filter doesn't cover openspec/**, so nothing else was catching this. - Expand the .reqstool-ai.yaml comment explaining why req_prefix is empty while svc_prefix isn't. Found by /x:full-pr-review on #104. reqstool validate --strict was intentionally not added yet — not in the currently published PyPI release. Signed-off-by: Jimisola Laursen --- .github/workflows/build.yml | 8 ++++++++ .reqstool-ai.yaml | 4 +++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ead568c..24a5343 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -27,3 +27,11 @@ jobs: run: | pip install reqstool reqstool status local -p "$GITHUB_WORKSPACE"/docs/reqstool + - name: Set up Node.js + uses: actions/setup-node@v6 + with: + node-version: "24" + - name: Validate OpenSpec specs + run: | + npm install -g @fission-ai/openspec + openspec validate --specs --strict diff --git a/.reqstool-ai.yaml b/.reqstool-ai.yaml index 61780ba..dde56a6 100644 --- a/.reqstool-ai.yaml +++ b/.reqstool-ai.yaml @@ -25,7 +25,9 @@ system: # Add as many modules as your project has. The module name (key) is used in # commands like `/reqstool:status core` and `/reqstool:add-req core`. modules: - # Domain-specific prefixes: this demo's IDs are managed manually + # Domain-specific prefixes: this demo's requirement IDs are managed manually, so + # req_prefix is empty (no auto-prefix for new requirements). SVC IDs already use a + # literal "SVC_" + number convention (SVC_010, SVC_020, ...), so svc_prefix is set. # (REQ_PASS, REQ_MANUAL_FAIL, REQ_NOT_IMPLEMENTED, ...; SVC_010, SVC_020, ...) demo: path: docs/reqstool From 4e03ef4639ad6317d421f1bebbd1832b51df0f33 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 21 Jun 2026 18:28:06 +0200 Subject: [PATCH 3/9] ci(build): matrix reqstool CI across PyPI and reqstool-client@main Adds an openspec validate --specs --strict step to build.yml so spec/SSOT drift fails CI instead of relying on the manual run documented in #104's PR description. Runs reqstool status/validate against both the latest PyPI release and reqstool-client's main branch in a matrix, since reqstool-client is deliberately holding off its next release until the org-wide OpenSpec dogfooding rollout is complete, and main already has fixes (#411) and commands (validate) not yet published. reqstool validate --strict only runs on the main leg since that subcommand isn't on PyPI yet. CI continues to run the latest PyPI release as its baseline; see reqstool-demo#105 for tracking divergence between the two legs and collapsing back to PyPI-only once reqstool-client cuts its next release. Also expands the .reqstool-ai.yaml comment explaining why req_prefix is empty while svc_prefix isn't. Found by /x:full-pr-review on #104. Signed-off-by: Jimisola Laursen --- .github/workflows/build.yml | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 24a5343..e0cf77e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -13,6 +13,10 @@ on: jobs: build: runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + reqstool-source: [pypi, main] steps: - name: Check out source repository uses: actions/checkout@v6 @@ -23,10 +27,19 @@ jobs: distribution: "temurin" - name: Build project run: mvn clean verify - - name: Run reqstool status command + - name: Install reqstool (${{ matrix.reqstool-source }}) run: | - pip install reqstool - reqstool status local -p "$GITHUB_WORKSPACE"/docs/reqstool + if [ "${{ matrix.reqstool-source }}" = "main" ]; then + pip install "reqstool @ git+https://github.com/reqstool/reqstool-client.git@main" + else + pip install reqstool + fi + - name: Run reqstool status command + run: reqstool status local -p "$GITHUB_WORKSPACE"/docs/reqstool + - name: Run reqstool validate --strict + # not yet available in the latest PyPI release + if: matrix.reqstool-source == 'main' + run: reqstool validate --strict local -p "$GITHUB_WORKSPACE"/docs/reqstool - name: Set up Node.js uses: actions/setup-node@v6 with: From 6cbd004d1c403f93e661ad667f5cdd76255ab2f5 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 21 Jun 2026 18:31:12 +0200 Subject: [PATCH 4/9] fix(ci): pin Python 3.13 for reqstool install step build (main) failed: the runner's default Python (3.12) doesn't satisfy reqstool-client@main's reqstool-python-decorators>=0.1.0 dependency, which requires Python >=3.13. Add actions/setup-python@v6 pinned to 3.13, matching reqstool-client's own CI convention (build.yml, lint.yml). Signed-off-by: Jimisola Laursen --- .github/workflows/build.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e0cf77e..bd47ac9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -27,6 +27,10 @@ jobs: distribution: "temurin" - name: Build project run: mvn clean verify + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: "3.13" - name: Install reqstool (${{ matrix.reqstool-source }}) run: | if [ "${{ matrix.reqstool-source }}" = "main" ]; then From ff3e563a54f4694a19caa40469d82b753e73b358 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 21 Jun 2026 19:20:43 +0200 Subject: [PATCH 5/9] ci(build): use shared reqstool/openspec workflows from reqstool/.github Replaces the inline reqstool install/status/validate steps and the inline openspec install/validate step with the reusable building blocks just added to reqstool/.github for this rollout: - reqstool/.github/.github/actions/validate-reqstool (reqstool-client#412 follow-up notwithstanding, runs reqstool validate --strict; only called for the main matrix leg since that subcommand isn't on PyPI yet) - reqstool/.github/.github/actions/reqstool-status (runs reqstool status, fail-if-incomplete left false since this repo intentionally has incomplete requirements) - reqstool/.github/.github/workflows/common-validate-openspec.yml (now a separate job, since it's a reusable *workflow* rather than a composite action) Pinned to reqstool/.github@cd3b5e8 (main, 2026-06-21) per reqstool/.github#40 and #41. Signed-off-by: Jimisola Laursen --- .github/workflows/build.yml | 34 ++++++++++++---------------------- 1 file changed, 12 insertions(+), 22 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index bd47ac9..1c9c12e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -27,28 +27,18 @@ jobs: distribution: "temurin" - name: Build project run: mvn clean verify - - name: Set up Python - uses: actions/setup-python@v6 - with: - python-version: "3.13" - - name: Install reqstool (${{ matrix.reqstool-source }}) - run: | - if [ "${{ matrix.reqstool-source }}" = "main" ]; then - pip install "reqstool @ git+https://github.com/reqstool/reqstool-client.git@main" - else - pip install reqstool - fi - - name: Run reqstool status command - run: reqstool status local -p "$GITHUB_WORKSPACE"/docs/reqstool - - name: Run reqstool validate --strict + - name: Validate reqstool spec completeness # not yet available in the latest PyPI release if: matrix.reqstool-source == 'main' - run: reqstool validate --strict local -p "$GITHUB_WORKSPACE"/docs/reqstool - - name: Set up Node.js - uses: actions/setup-node@v6 + uses: reqstool/.github/.github/actions/validate-reqstool@cd3b5e8a6f8629391dd06ef9982ca81a1a0bd79f # main 2026-06-21 + with: + reqstool-source: ${{ matrix.reqstool-source }} + - name: Run reqstool status + uses: reqstool/.github/.github/actions/reqstool-status@cd3b5e8a6f8629391dd06ef9982ca81a1a0bd79f # main 2026-06-21 with: - node-version: "24" - - name: Validate OpenSpec specs - run: | - npm install -g @fission-ai/openspec - openspec validate --specs --strict + reqstool-source: ${{ matrix.reqstool-source }} + # this repo intentionally has incomplete requirements (it showcases every status outcome) + fail-if-incomplete: "false" + + validate-openspec: + uses: reqstool/.github/.github/workflows/common-validate-openspec.yml@cd3b5e8a6f8629391dd06ef9982ca81a1a0bd79f # main 2026-06-21 From 19256d4ae06bcda32535ae7a89cad5c30963fda2 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 21 Jun 2026 23:01:47 +0200 Subject: [PATCH 6/9] fix(ci): call install-reqstool explicitly, per reqstool/.github#48 validate-reqstool/reqstool-status no longer install reqstool themselves (reqstool/.github#48 removed their broken nested ./.github/actions/install-reqstool reference, which only resolved when called from within reqstool/.github itself, not from a consuming repo like this one). Call install-reqstool explicitly as its own step first. Pinned to reqstool/.github@11a00fc (main, 2026-06-21). Signed-off-by: Jimisola Laursen --- .github/workflows/build.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1c9c12e..3a27ccf 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -27,18 +27,19 @@ jobs: distribution: "temurin" - name: Build project run: mvn clean verify + - name: Install reqstool + uses: reqstool/.github/.github/actions/install-reqstool@11a00fc386214969143ed27b1a9085eca019dc92 # main 2026-06-21 + with: + reqstool-source: ${{ matrix.reqstool-source }} - name: Validate reqstool spec completeness # not yet available in the latest PyPI release if: matrix.reqstool-source == 'main' - uses: reqstool/.github/.github/actions/validate-reqstool@cd3b5e8a6f8629391dd06ef9982ca81a1a0bd79f # main 2026-06-21 - with: - reqstool-source: ${{ matrix.reqstool-source }} + uses: reqstool/.github/.github/actions/validate-reqstool@11a00fc386214969143ed27b1a9085eca019dc92 # main 2026-06-21 - name: Run reqstool status - uses: reqstool/.github/.github/actions/reqstool-status@cd3b5e8a6f8629391dd06ef9982ca81a1a0bd79f # main 2026-06-21 + uses: reqstool/.github/.github/actions/reqstool-status@11a00fc386214969143ed27b1a9085eca019dc92 # main 2026-06-21 with: - reqstool-source: ${{ matrix.reqstool-source }} # this repo intentionally has incomplete requirements (it showcases every status outcome) fail-if-incomplete: "false" validate-openspec: - uses: reqstool/.github/.github/workflows/common-validate-openspec.yml@cd3b5e8a6f8629391dd06ef9982ca81a1a0bd79f # main 2026-06-21 + uses: reqstool/.github/.github/workflows/common-validate-openspec.yml@11a00fc386214969143ed27b1a9085eca019dc92 # main 2026-06-21 From 50723f998c6414bdd6b11a946d13e9333749afbc Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Mon, 22 Jun 2026 00:11:32 +0200 Subject: [PATCH 7/9] ci(build): re-pin reqstool/.github to 5bdf4e5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Picks up reqstool/.github#59 (drop --verbosity compact from reqstool-status, also not yet on PyPI — same situation as the validate subcommand fixed in #48), found via this PR's pypi matrix leg failing with "invalid choice: 'compact'". Signed-off-by: Jimisola Laursen --- .github/workflows/build.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3a27ccf..8b52ab0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -28,18 +28,18 @@ jobs: - name: Build project run: mvn clean verify - name: Install reqstool - uses: reqstool/.github/.github/actions/install-reqstool@11a00fc386214969143ed27b1a9085eca019dc92 # main 2026-06-21 + uses: reqstool/.github/.github/actions/install-reqstool@5bdf4e5c4af98274c44c8fbaa5b54d605a6cf38a # main 2026-06-22 with: reqstool-source: ${{ matrix.reqstool-source }} - name: Validate reqstool spec completeness # not yet available in the latest PyPI release if: matrix.reqstool-source == 'main' - uses: reqstool/.github/.github/actions/validate-reqstool@11a00fc386214969143ed27b1a9085eca019dc92 # main 2026-06-21 + uses: reqstool/.github/.github/actions/validate-reqstool@5bdf4e5c4af98274c44c8fbaa5b54d605a6cf38a # main 2026-06-22 - name: Run reqstool status - uses: reqstool/.github/.github/actions/reqstool-status@11a00fc386214969143ed27b1a9085eca019dc92 # main 2026-06-21 + uses: reqstool/.github/.github/actions/reqstool-status@5bdf4e5c4af98274c44c8fbaa5b54d605a6cf38a # main 2026-06-22 with: # this repo intentionally has incomplete requirements (it showcases every status outcome) fail-if-incomplete: "false" validate-openspec: - uses: reqstool/.github/.github/workflows/common-validate-openspec.yml@11a00fc386214969143ed27b1a9085eca019dc92 # main 2026-06-21 + uses: reqstool/.github/.github/workflows/common-validate-openspec.yml@5bdf4e5c4af98274c44c8fbaa5b54d605a6cf38a # main 2026-06-22 From 5d111f42c4c1d95f90863346493c22fd89b863bd Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Mon, 22 Jun 2026 00:21:07 +0200 Subject: [PATCH 8/9] fix(reqstool): use 0.1.0 as the first revision, per semver MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit requirements.yml and software_verification_cases.yml used 0.0.1 for every requirement/SVC. Per semver, 0.0.x is reserved for pre-release/unstable work before any real first version — the first published revision of a thing should be 0.1.0, which also matches reqstool-ai's own .reqstool-ai.yaml.template default ("Revision string for new requirements and SVCs. Default: 0.1.0"). My earlier .reqstool-ai.yaml matched the existing (non-conventional) 0.0.1 instead of fixing it forward. manual_verification_results.yml has no revision field in its schema, so nothing to change there. Signed-off-by: Jimisola Laursen --- .reqstool-ai.yaml | 2 +- docs/reqstool/requirements.yml | 12 ++++++------ docs/reqstool/software_verification_cases.yml | 16 ++++++++-------- 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.reqstool-ai.yaml b/.reqstool-ai.yaml index dde56a6..1a015fb 100644 --- a/.reqstool-ai.yaml +++ b/.reqstool-ai.yaml @@ -9,7 +9,7 @@ urn: reqstool-demo # Revision string for new requirements and SVCs -revision: "0.0.1" +revision: "0.1.0" # System-level reqstool directory (contains the SSOT requirements and SVCs) system: diff --git a/docs/reqstool/requirements.yml b/docs/reqstool/requirements.yml index f6d8bd7..e97c954 100644 --- a/docs/reqstool/requirements.yml +++ b/docs/reqstool/requirements.yml @@ -18,39 +18,39 @@ requirements: description: The system shall display a personalized greeting message based on a given name parameter. rationale: Users need to receive a personalized greeting to confirm their identity when interacting with the system. categories: ["functional-suitability", "maintainability"] - revision: 0.0.1 + revision: 0.1.0 - id: REQ_MANUAL_FAIL title: Calculate item total significance: shall description: The system shall calculate the total price for a given quantity of items. rationale: Accurate price calculation is essential for correct billing and invoicing. categories: ["functional-suitability", "maintainability"] - revision: 0.0.1 + revision: 0.1.0 - id: REQ_NOT_IMPLEMENTED title: Export report as PDF significance: may description: The system should support exporting reports in PDF format. rationale: PDF export enables users to share and archive reports in a portable format. categories: ["functional-suitability", "maintainability"] - revision: 0.0.1 + revision: 0.1.0 - id: REQ_FAILING_TEST title: Validate email format significance: shall description: The system shall validate that a provided email address conforms to standard email format. rationale: Ensuring valid email format prevents delivery failures and improves data quality. categories: ["functional-suitability"] - revision: 0.0.1 + revision: 0.1.0 - id: REQ_SKIPPED_TEST title: Send notification via SMS significance: may description: The system should support sending notifications to users via SMS. rationale: SMS notifications provide an alternative channel for time-sensitive alerts. categories: ["functional-suitability"] - revision: 0.0.1 + revision: 0.1.0 - id: REQ_MISSING_TEST title: Generate audit log entry significance: shall description: The system shall generate an audit log entry for each user action. rationale: Audit logging is required for compliance and security traceability. categories: ["functional-suitability"] - revision: 0.0.1 + revision: 0.1.0 diff --git a/docs/reqstool/software_verification_cases.yml b/docs/reqstool/software_verification_cases.yml index a264d5a..55457c9 100644 --- a/docs/reqstool/software_verification_cases.yml +++ b/docs/reqstool/software_verification_cases.yml @@ -5,46 +5,46 @@ cases: requirement_ids: ["REQ_PASS"] title: "Verify greeting message contains the provided name" verification: automated-test - revision: "0.0.1" + revision: "0.1.0" - id: SVC_020 requirement_ids: ["REQ_MANUAL_FAIL"] title: "Verify total price calculation for given quantity" verification: automated-test - revision: "0.0.1" + revision: "0.1.0" - id: SVC_021 requirement_ids: ["REQ_PASS"] title: "Manually verify greeting is displayed correctly in UI" verification: manual-test - revision: "0.0.1" + revision: "0.1.0" - id: SVC_022 requirement_ids: ["REQ_MANUAL_FAIL"] title: "Manually verify total price is shown on invoice page" verification: manual-test - revision: "0.0.1" + revision: "0.1.0" - id: SVC_030 requirement_ids: ["REQ_NOT_IMPLEMENTED"] title: "Verify PDF export produces a valid document" verification: automated-test - revision: "0.0.1" + revision: "0.1.0" - id: SVC_040 requirement_ids: ["REQ_FAILING_TEST"] title: "Verify email validation rejects invalid formats" verification: automated-test - revision: "0.0.1" + revision: "0.1.0" - id: SVC_050 requirement_ids: ["REQ_SKIPPED_TEST"] title: "Verify SMS notification is sent successfully" verification: automated-test - revision: "0.0.1" + revision: "0.1.0" - id: SVC_060 requirement_ids: ["REQ_MISSING_TEST"] title: "Verify audit log entry is created for user actions" verification: automated-test - revision: "0.0.1" + revision: "0.1.0" From 977a81e3fb1f68b70903a5256406ceb38e894b02 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Mon, 22 Jun 2026 00:25:18 +0200 Subject: [PATCH 9/9] fix(security): add explicit permissions block to build.yml CodeQL flagged this 3 times across commits: the workflow didn't limit GITHUB_TOKEN permissions. Add permissions: contents: read at the workflow root, matching the existing convention in this repo (build-docs.yml, check-semantic-pr.yml). Signed-off-by: Jimisola Laursen --- .github/workflows/build.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 109b43c..61a1591 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -10,6 +10,9 @@ on: - reopened - synchronize +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest