Install
$ agentstack add skill-jovesun-lab-arcgram-reconcile ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Reconcile - codediagram @spec bijection validator
Two inputs: a diagram + the code it describes. One question: do the diagram's @spec values still equal the same-named code constants? Returns typed findings; marks, never blocks.
Sibling to Checkpoint: Checkpoint checks structure from the diagram alone; Reconcile checks values across diagram + code. Run both -> the diagram is a faithful, current spec.
Input: the @spec line
A node pins values on one line at the top of desc:
@spec hold_ms=800 fade_ms=200 ` line are for humans - never read.
Reconcile reads **only** the `@spec` line + **named** code constants. No geometry, no prose,
no program behavior.
## Findings
| finding | severity | means |
|---|---|---|
| `spec-drift` | defect | @spec value != the code constant |
| `spec-no-constant` | defect | no same-named constant in the code |
| `malformed-spec` | defect | @spec line is not `key=value` |
| `value-uncovered` | uncovered | constant is computed, not a literal - no verdict |
| `ambiguous-constant` | uncovered | two constants normalize to one name |
| `no-spec-lines` | uncovered | nothing pinned - never a false "clean" |
**Anchored on the `@spec` line** (not the code): drift is caught both ways, but a code constant
on no `@spec` line is normal, not a finding. The extractor is a tolerant, dependency-free scan of
`const/let/var =`, `NAME =`, `NAME:`, `#define`, `:=`, `[modifiers] const|readonly TYPE NAME =`, and
C#/Unity **bare field initializers** `[attr] public|private|static TYPE NAME = value` (ScriptableObject
tuning fields, no const/readonly) (JS/TS/Python/C/Go/C#/Java); numbers normalize (`800` == `800.0` ==
`0x320`, and a C#/Java numeric suffix is dropped so `0.2f` == `0.2`, `800L` == `800`). A Unity bare
field is matched only with a field-only marker (an access modifier, `[Attribute]`, or `static`), so a
method-body local (`int x = 5;`) is never captured.
## Output (same contract as Checkpoint)
{ findings:[{id,type,severity,note}], summary, attestation, clean } self-check ran HH:MM:SS | N findings | M unchecked
**clean only when N=0 AND M=0** - "checked & clean" never looks like "never checked".
Human reads the marker; agent reads the `type`.
## Use
```sh
node reconcile.mjs diagram.html code.js [more.js ...] [--json]
import { reconcile } from './reconcile.mjs';
reconcile({ nodes }, codeText);
Exit 1 on any defect (advisory - never blocks). Verify: node reconcile-selftest.mjs (48 checks). Example: ../../examples/example-workflow.html vs example-workflow.config.cs (clean, reconciles 0 findings).
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: jovesun-lab
- Source: jovesun-lab/arcgram
- License: Apache-2.0
- Homepage: https://arcgram.io
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.