Verify and Stop Skill: Check Acceptance Criteria, No Extra Scope

DemoReal run · claude-opus-5-5 · October 2026

Can you check whether this ticket is done? I only want to know if the acceptance criteria are met. Ticket ACME-88 acceptance criteria: 1. `GET /health` returns HTTP 200 with JSON body `{"status": "ok"}`. 2. The endpoint does not require authentication. 3. A test covers the endpoint. The developer's diff: ```python # app/routes.py @app.get("/health") @require_login def health(): return {"status": "ok"}, 200 ``` ```python # tests/test_health.py def test_health(client, logged_in_user): resp = client.get("/health") assert resp.status_code == 200 assert resp.json == {"status": "ok"} ``` CI output: `tests/test_health.py::test_health PASSED` and `142 passed in 8.31s`.

Skill: verify-and-stop

No, ACME-88 isn't done. Criterion 2 fails, and the test that's supposed to cover the endpoint wouldn't catch that failure.

#	Criterion	Result	Evidence
1	`GET /health` returns 200 with `{"status": "ok"}`	Pass, but only for logged-in users	The handler returns `{"status": "ok"}, 200`. The test checks both the status code and the JSON body, and CI shows it passing.
2	No authentication required	Fail	`app/routes.py` puts `@require_login` on `health()`, so the endpoint requires login.
3	A test covers the endpoint	Partial	`test_health` exists and passes. But it uses the `logged_in_user` fixture, so it only tests a logged-in request. That's why CI passes even though criterion 2 fails.

To close the ticket:

Remove @require_login from health().
Remove logged_in_user from the test so it makes the request without logging in. That way the test also proves criterion 2.

How I checked: There's no repository in this workspace, so I didn't run anything. This is based only on the diff and CI output you pasted. I'm also assuming @require_login blocks requests that aren't logged in (with a 401, 403 or a redirect), as its name suggests. I couldn't see its code to confirm that.

Real run recorded with claude-code / claude-opus-5-5. Output is shown verbatim, unmodified.

What it does

A working rule for validation-only tasks: turn the acceptance criteria into the smallest set of checks that proves them, report, and stop.

How it works

Maps each acceptance criterion to the smallest sufficient proof, reusing results that still match the current code.
Runs focused checks before broader ones and reports each result exactly as pass, fail, unavailable or blocked.
Does not edit product code unless asked, and adds no polish, cleanup or extra tests once the criteria pass.

Good for

"Is this ticket done?" checks, pre-merge verification and last-mile proof.

Worth knowing

One of the general work patterns from the open-source Caveman project. The instructions themselves carry no Caveman branding and work in any project.

Notes & risks

Pure instruction file: no scripts, no network access and no file writes. The package also contains LICENSE, NOTICE and agents/openai.yaml (display name and default prompt for Codex).