OpenSpec Workbench initializes repositories and runs agents on changes. It did not, until now, check that its own runtime files are ignored, or that its repository rules are consistent. A compliance monitor has been added to the shared core, and it does three things that matter: it keeps a versioned catalogue of rules, it runs only when the host reports idle, and it reports findings without moving or deleting anything.
The catalogue, versioned and evidence-linked
Every rule in the catalogue carries a stable identifier, a description of what it checks, and metadata about the check's cost and whether it supports automatic repair. Each finding is linked back to the rule that produced it and to the evidence that triggered it, so a person can trace a finding to the exact check and the exact file or state that caused it.
The catalogue is versioned. When a rule changes, the new version is applied to future checks, and old findings remain linked to the version that produced them. This matters when a rule's threshold is tightened or relaxed: old findings do not retroactively become violations or pass.
What it checks, on initialization
On explicit repository initialization, the monitor verifies that Workbench
runtime state is ignored by Git. It adds only the missing managed ignore
rule, preserving the rest of .gitignore exactly as the user wrote it.
Nothing is overwritten.
It also checks Workbench runtime files in the main checkout and in
worktrees. It identifies untracked or visible state and explains the
expected root for each state kind without moving or deleting it. A run
journal in .openspec-ui/ is expected to be untracked; a lease file in the
main checkout is expected to be ignored. The monitor says which is which,
and why.
Grouping, deduplication and shadow detection
When the same change id appears in multiple worktrees, the monitor groups them as one logical change and reports the count. It flags a change id present in both active and archive trees, an archived change left in a stale worktree, or a shadow copy in main beside its owning worktree. The Pipeline card count is reconciled with the Changes list, and active changes missing from the OpenSpec README index are flagged with a suggested link, not an automatic edit.
Per-rule reactions and a periodic schedule
Each rule accepts one of three response settings: autorepair, advice
or none. autorepair applies a fix without asking; advice produces a
finding with a suggested action; none records the finding silently. A
global periodic-monitor switch enables or disables the entire schedule.
The monitor runs one bounded batch only after the host reports idle and no mutating Workbench run is active. It measures each check's elapsed time, schedules by due date and conservative cost, and spreads expensive checks across later idle windows. Nothing runs as a separate OS daemon.
Process ledger and orphan detection
A companion capability, the process ledger, records a synchronous snapshot for every process spawned by Workbench: PID, OS start time, executable, hostname, cwd, change, and a secret-free command-line hash. Records are marked exited on normal close and kept durable across host restarts, keyed by canonical repository identity and hostname.
Before any kill, the snapshot is re-verified against the operating system. Orphaned and overdue processes are surfaced as read-only Compliance findings. An explicit, confirmable kill lives in the existing recovery surface, never in Compliance itself. The two capabilities share the same catalogue but never cross their boundaries: Compliance explains, recovery acts.
What this deliberately does not do
The monitor does not start a background daemon, does not modify source code, does not run on every file change, and does not replace a linter or a formatter. It checks Workbench's own runtime hygiene and the consistency of its repository state. A paid plugin, if one ever comes, would build on the facts this records and change none of them.
Try it
The code is at github.com/VeryComplexAndLongName/OpenSpec-UI, where the repository and packages keep the name OpenSpec-UI.
openspec-ui-cli compliance check --cwd .