Verify Code Against Specifications

This skill determines whether a codebase implements exactly what its documentation states - across logic, invariants, flows, assumptions, math, and security guarantees - acting as a senior-level blockchain compliance auditor. Its work is deterministic, evidence-grounded, traceable, and non-hallucinatory: it never infers unspecified behavior, always cites exact evidence (documentation section/quote and code file/line numbers), always assigns a confidence score (0-1), and classifies ambiguity explicitly rather than guessing, using only the provided materials rather than prior knowledge of known protocols. It rejects specific rationalizations ("spec is clear enough," "code obviously matches," "I'll note this as partial match") that would let genuine divergence slip through undetected. The workflow runs through Phase 0 (Documentation Discovery - identifying all spec-like content, even unlabeled, into a unified spec corpus), Phase 1 (Universal Format Normalization - converting PDF/Markdown/DOCX/HTML/transcripts into a clean canonical corpus while preserving headings, formulas, tables, and invariant definitions), Phase 2 (Spec Intent IR - extracting every intended behavior into an intermediate representation covering protocol purpose, actors/trust boundaries, preconditions/postconditions, explicit and implicit invariants, math formulas, expected flows, economic assumptions, and security "must/never/always" requirements, each with source excerpt and confidence score), Phase 3 (Code Behavior IR - true line-by-line and block-by-block semantic analysis of the entire codebase capturing state reads/writes, conditional branches, revert conditions, external calls, math/rounding behavior, and per-function control flow, call graphs, and authorization mappings), Phase 4 (Alignment IR - comparing each Spec-IR item against Code-IR to produce records classified full_match/partial_match/mismatch/missing_in_code/code_stronger_than_spec/code_weaker_than_spec, each with reasoning trace, confidence, and evidence links, also surfacing undocumented code behavior and spec self-contradictions), Phase 5 (Divergence Classification - ranking misalignments Critical/High/Medium/Low by exploitability and fund-at-risk severity, each with remediation), and Phase 6 (a 16-section Final Audit-Grade Report covering executive summary, spec/code IR breakdowns, the full alignment matrix, divergence findings, missing invariants, access control drift, undocumented behavior, ambiguity hotspots, and a final risk assessment). Its anti-hallucination rules are absolute: spec silence is classified UNDOCUMENTED, code behavior beyond the spec is classified UNDOCUMENTED CODE PATH, unclear cases are classified AMBIGUOUS, and every claim must quote source text or line numbers with zero speculation. A companion spec-compliance-checker agent runs the full workflow autonomously and produces the complete IR artifact set plus final report.

Use it when verifying that code implements exactly what documentation specifies, auditing smart contracts against whitepapers or design documents, finding gaps between intended and actual behavior, or performing compliance checks for blockchain protocol implementations - specifically when both a specification and a codebase are provided together. Do NOT use it for codebases without a corresponding specification document, for general code review or vulnerability hunting (a separate audit-context-building approach fits that instead), for writing or improving documentation (it only verifies compliance, it doesn't author docs), or for non-blockchain projects without formal specifications.

Inputs: a specification/whitepaper/design-document corpus (any format) and the corresponding codebase to verify against it.
Outputs: a Spec-IR (intended behavior), a Code-IR (line-by-line actual behavior), an Alignment-IR (spec-to-code match records with confidence scores), severity-classified divergence findings with remediation, and a 16-section final compliance report.

Blockchain auditors and protocol teams who need a rigorous, evidence-cited, line-by-line verification that a smart contract's actual behavior matches its whitepaper or design specification, surfacing undocumented behavior and unimplemented claims rather than a general vulnerability scan.