REVIEW-auth-refresh
AC-001 pass
Evidence: `npm test auth-refresh` pasted, exit 0.
AC-002 unverified
Evidence missing. Human attention required before merge.
No evidence, no Pass.
Structured agent work, checked at every step.
Define the work, run agents, verify outputs, keep the evidence.
Plain markdown
Readable in any repo.
Any agent
Bring the tool you already use.
Human review
Checks provide evidence, not verdicts.
loop preview
# current run
$ corpus review
PASS AC-001 — output pasted
UNVERIFIED AC-002 — manual resize pending
HUMAN ATTENTION — retry.ts changed outside scope
REVIEW-auth-refresh
AC-001 pass
Evidence: `npm test auth-refresh` pasted, exit 0.
AC-002 unverified
Evidence missing. Human attention required before merge.
No evidence, no Pass.
A useful run leaves a trail: request, scope, checks, evidence, and findings.
INTAKE
Keep the request. Turn it into checkable requirements.
SCOPE
Name the files, limits, and checks before the run starts.
EVIDENCE
A Pass needs output, a CI link, or a named observation.
LEDGER
Save useful lessons so later tasks can reuse them.
Pull, Spec, Task, Run, Review, Close. Each step writes or checks a record.
workflow / six steps
Six steps around the hexagon; the inscribed triangle is the spine — Spec, Run, Close. Each pass leaves a file the next step can use.
Point the spec's sources at the origin, or capture the raw request verbatim in an intake file first.
State the requirements one per id, each with the check that verifies it. The spec is the unit.
When one spec splits into parallel slices, hand each agent a bounded packet. Most work needs none.
The worker implements the spec, runs every check, and pastes the real output beside each requirement.
A non-implementer checks the evidence per requirement; the full review packet is reserved for substantial changes.
Merge, record the decision, save any durable finding, and update the board. Close feeds the next pull.
Close feeds the next Pull — the loop closes
Specs and reviews are working records. Keep commands, notes, and results in the same place.
SPEC-auth-refresh
AC-003 — Expired refresh token redirects to login
The client must clear local session state and route the user to `/login`.
Verify with: auth-refresh-expired.test
Write the contract. Hand the agent a bounded task.
Show evidence per requirement. Escalate the gaps.
One task, one branch, one diff to inspect.
Mark what is convention, checklist, toolable, or enforced.
No. Your coding tool writes code. Corpus structures the work around it.
No. Checks produce evidence. Review decides what it means.
No. Corpus works as markdown. The CLI handles setup and checks.
The six points are the six steps: Pull, Spec, Task, Run, Review, Close.
Copy the kit, write one contract, run one bounded task, review the evidence.