[devin-ai-integration]

Summary

syspi verify [-C dir] [-offline] [-q] — the third of the commands 0.1.0 lacks. Independent of #10 (remove) and #13 (list); like them it adds the identical new file internal/install/libpath.go, so the three merge in any order without a conflict.

• install.Verify(root) is offline by nature (it reads .project.json, the lock and lib/, contacts no repository) and writes nothing. It returns every discrepancy, not the first, plus the number of lock entries checked; the command prints one line per discrepancy and exits 1 when there is any.
• What is checked, per lock entry, in resource order:
  • vcs: the tree lib/<publisher>-<name>_<version> exists; digest.TreeExcept (skipping .meta.json when metaGenerated) equals sha256; .meta.json is present and every checksum it records matches (project.MismatchedChecksums, new — VerifyChecksums stops at the first mismatch); .project.json says the locked publisher/name/version; the usages it declares equal the entry's usage (both directions reported).
  • archive: the .kpar exists and its SHA-256 equals sha256; project.OpenArchive verifies the members against its .meta.json; same .project.json and usage checks.
  • local: the directory is still there and its .project.json says what the lock recorded.
  • standard: nothing is installed, nothing to check.
• Before the entries: every usage of the project's own .project.json has a lock entry (vcs by repository key, others by resource), else …: usage of .project.json has no lock entry; run syspi lock.

$ syspi verify
lib/Open-MBEE-OpenSysML_Extensions_Library_1.0.0: tree SHA-256 1d40d4… differs from the locked db8e8f…
lib/Open-MBEE-OpenSysML_Extensions_Library_1.0.0: checksum mismatch for libraries/OOSEM.sysml: .meta.json records SHA256 7845c9…, content has 22bef8…
syspi: 10 package(s) checked against .project.lock.json: 2 discrepancy(ies)
$ syspi install && syspi verify
10 package(s) checked against .project.lock.json: no discrepancy

Tests: internal/install/verify_test.go (ten discrepancies of every kind in one project, all reported, nothing written or repaired; missing tree; missing .meta.json) and tests/e2e/verify_test.go (pass, tamper + delete, install repairs, -q, -C, the git/hg/svn fixtures with a deleted member). Docs: README "Commands", docs/packages.md "Install layout", changes/unreleased/verify.added.md.

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/888897f71c264c89a8abc11e9a432241
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/888897f71c264c89a8abc11e9a432241?variant=devin
Requested by: @HuiJun

---

🟢 Devin fixed all 4 findings · Follow Devin's work

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 4 findings. Devin automatically fixed all 4 findings.

Fixed by Devin (4)

• Changed version requirement passes verification — verifyUsage now checks the lock entry's version against the usage's constraint (the lock entry is at 1.1.0, the usage wants ^1.2.0); tested.
• Missing transitive dependency passes verification — Every usage a lock entry recorded is checked the same way as the project's own: missing entry or unsatisfied constraint is a discrepancy; tested with a hand-added locked package.
• Relative local packages fail with -C — verifyLocal resolves a relative source against the project root as resolveLocalDir does; TestVerifyRelativeLocalDir runs from another working directory.
• Changed repository location passes verification — lockedEntry also requires locationKey(entry.Source) == locationKey(usage source), as lockedRepository does; a repo vs repo.git spelling is now no lock entry; tested.

View findings in Devin Review · Follow Devin's work