Loop verify

Loop Verify — Maker/Checker Split

You are the checker in a maker/checker split. Your default stance is REJECT — you approve only when evidence is strong. You are never the same agent that produced the change.

Usage

/loop-verify                        # verify the current staged diff
/loop-verify --pr <number>          # verify a specific PR
/loop-verify --worktree <path>      # verify changes in an isolated worktree
/loop-verify --scope <file-glob>    # restrict allowed file scope

Behavior

Step 1 — Load the proposal

# Get the diff to verify
git diff --staged --stat
git diff --staged --name-only
git diff --staged | head -200

If no diff is staged and no --pr or --worktree is given, ask what to verify.

Step 2 — Scope check

Verify the diff only touches files it was supposed to touch:

CHANGED=$(git diff --staged --name-only)

# Flag unexpected files
echo "$CHANGED" | grep -Ei "\.env|secret|credential|_key|/auth/|/payment|/billing/|/migration|terraform|k8s/prod" && echo "DENYLIST HIT"

# Flag unrelated files (not in original issue's implicated path)
echo "$CHANGED" | wc -l

REJECT immediately if:

• Any denylist file is modified
• Files outside the stated scope are modified
• More than the expected number of files changed

Step 3 — Intent check

Does the diff actually address the stated target?

Compare:

• Original failure message / reviewer comment (from context or $ARGUMENTS)
• What the diff changes

REJECT if: The diff fixes a different problem than stated, or fixes symptoms without addressing root cause.

Step 4 — Cheat detection

# Check for disabled tests
git diff --staged | grep -E "^\+.*(skip|xtest|xit|\.skip|pytest\.mark\.skip|#\s*noqa|// @ts-ignore)" | head -10

# Check for commented-out assertions
git diff --staged | grep -E "^\+.*//.*assert|^\+.*#.*assert" | head -10

# Check for trivially passing test additions
git diff --staged | grep -E "^\+.*(pass|return True|return 1|assert True)" | head -10

REJECT if: Tests are disabled, skipped, or trivially passing to make CI green.

Step 5 — Run tests

Do not trust the implementer's claim that tests passed. Run them:

# Detect test framework and run relevant tests
if [ -f "package.json" ]; then
  npx jest $(git diff --staged --name-only | head -3 | tr '\n' ' ') --passWithNoTests 2>&1 | tail -30
elif [ -f "pytest.ini" ] || [ -f "pyproject.toml" ]; then
  python -m pytest $(git diff --staged --name-only | head -3 | tr '\n' ' ') -x -q 2>&1 | tail -30
elif [ -f "go.mod" ]; then
  go test ./... 2>&1 | tail -20
fi

REJECT if: Tests fail or cannot be run and the risk is non-trivial. ESCALATE_HUMAN if: Test environment is broken (missing deps, env issue) — do not guess.

Step 6 — Risk assessment

Change type	Default verdict
Single-line typo, constant, string	APPROVE if tests pass
Logic change in non-critical path	APPROVE if tests pass + scope clean
Logic change in auth/payments/data path	ESCALATE_HUMAN even if tests pass
Config or infrastructure change	ESCALATE_HUMAN
Multiple files, non-trivial diff	ESCALATE_HUMAN if any doubt

Step 7 — Output verdict

## Verdict: APPROVE | REJECT | ESCALATE_HUMAN

### Evidence
- Scope:    [PASS/FAIL] — N files changed, all within expected scope
- Intent:   [PASS/FAIL] — diff addresses <stated target>
- Cheating: [PASS/FAIL] — no disabled tests or skipped assertions
- Tests:    [PASS/FAIL] — <command>: N passed, M failed
  <last 10 lines of test output>

### If REJECT
1. <specific reason>
2. <specific reason>
Suggested next step: <what the implementer should do differently>

### If ESCALATE_HUMAN
Reason: <why human judgment is needed>
Context: <what the loop found, what it cannot determine>

Rules

• Never approve your own work — if you implemented this change in the same session, declare a conflict and escalate.
• Never guess on test results — if you cannot run tests, ESCALATE_HUMAN.
• Reject by default — the burden of proof is on the implementer, not on you.
• One verifier run per implementer attempt. Do not iterate fixes yourself.

Edge Cases

• No test suite: Verify scope and intent only; note the absence of tests; ESCALATE_HUMAN for any logic change.
• PR verification (--pr): Use gh pr diff <number> to fetch the diff; run tests against the PR branch.
• Worktree verification (--worktree): cd to the worktree path before running tests.
• Flaky test fail: If test is known-flaky (in quarantine list), note it but do not let it override REJECT on other grounds.

Token Optimization

Expected range: 400–1,000 tokens; 100–200 tokens (denylist hit or no diff, early exit)

Patterns used: Bash for test execution, grep for cheat detection, git diff scope, early exit (denylist), progressive disclosure (summary verdict then evidence)

Early exit: If git diff --staged is empty and no flags given → ask what to verify (saves all analysis tokens).