verify

# Verify `/verify` is opt-in. Do not invoke it automatically before push or PR creation: the default pre-PR evidence is TDD plus the exact task-defined tests and E2E commands. Use this skill only when the user explicitly asks for a broad local audit or when a PR/CI finding needs it. Supply the `/commit` hook receipt and last successfully verified SHA when available. ## What to do Run the selected commands once in the primary session. Avoid overlapping full suites in the same checkout; wait for a running command to finish before starting another. Capture targeted failure evidence instead of repeatedly rerunning a broad suite. - If verify passes cleanly: report success. - If verify fails: fix the reported cause in the same conversation, rerun the relevant targeted checks, commit if needed, and restart verification. - If verify reports that required sandbox capabilities could not be authorized, stop before push or PR delivery and surface its required user action. On Codex, tell the user exactly: "Switch the mode selector to `Agent (full access)`, then retry verification." Explain that push and PR delivery are waiting on mandatory verification; do not imply that Codex or GitHub cannot create PRs or ask whether to proceed unverified. ## Verification Procedure Resolve the PR base and verification scope base, then collect `scope-base...HEAD`, staged, unstaged, and untracked paths. The supplied last verified SHA may be the scope base only when it is an ancestor of `...