joeljuca

OpenSpec 101 🚀

OpenSpec is an AI-native system for spec-driven development. It helps you plan and track software changes using structured specifications.

Core Concepts

1. Specs (Specifications)

These are the living documents that describe your project's current state. They're like a source of truth for what exists.

joeljuca

In Sep 10, '26, I'm running an AI audit over OpenClaw's latest release, v2026.9.3. I'm mostly interested in understanding the project from an architectural/security POV.

Here are the material (prompts, answers, reports, etc.) involved.

FWIW, I used pi 0.84.3 with MiMo-V2.5-Pro to accomplish this.

---

Prompt:

joeljuca

On secret management

I been working these days on my free time to come up with a decent setup to manage secrets across environments, CI/CD, AI agents, and devs' multiple machines. I believe I finally got a good one.

The requirements

• NO secrets in .env, nor in any other plain-text and/or unprotected store
• loading secrets must be easy, one-cmd away
• production secrets must be super-protected (aka: accessible to trusted ICs only)
• staging and CI/CD considered super-sensitive as well (I don't like being hacked)

joeljuca

# I wont use it anymore, but it sounded like a nice way to
# validate map fields with a dedicated schema

defmodule M do
  @spec validate_meta(changeset :: Ecto.Changeset.t()) ::
          Ecto.Changeset.t()
  defp validate_meta(%Ecto.Changeset{valid?: false} = changeset), do: changeset

  defp validate_meta(changeset) do
    params = changeset |> get_change(:meta)

joeljuca

defmodule MyApp.Accounts do
  # (...)

  @spec sign_up(params :: %{String.t() => String.t()}) ::
          {:ok, User.t()} | {:error, Ecto.Changeset.t()}
  def sign_up(%{} = params) do
    # Here, a list of params and their types
    params_schema = %{
      name: :string,
      # (...)

joeljuca

var SlotMachine = (function () {
  //prettier-ignore
  var invalidBetError = new Error("Bet should be a number between 1 and 10");

  /**
   * @params params Object { maxRounds: number, maxWins: number }
   */
  var SlotMachine = function (params) {
    var winCount = 0;
    var roundCount = 0;

joeljuca

defmodule MyApp.Accounts do
  # (...)
  
  def sign_up(%{} = params) do
    params_schema = %{
      name: :string,
      email: :string,
      phone: :string,
      password: :string
    }

joeljuca

defmodule MyApp.Accounts do
  import Ecto.Changeset

  def sign_up(%{} = params) do
    params_schema = %{
      name: :string,
      email: :string,
      phone: :string,
      password: :string
    }

joeljuca

const change = (payment, coins) => {
  let _change = {},
    remaining = payment;

  for (let i = 0; i < coins.sort((x, y) => (x < y ? 1 : -1)).length; i++) {
    const coin = coins[i];

    console.log({ coin });

    _change[`${coin}`] = Math.floor(remaining / coin);

joeljuca

#!/usr/bin/env bash

rm_old_branches() {
  # rm_old_branches
  #
  # Quo corporis ea tempore quisquam ducimus. At tempore nemo qui et distinctio
  # consectetur quia quaerat. Et quia aliquam ad sed aut libero.
  #
  # Non deleniti eligendi est explicabo harum qui. Consequatur et assumenda
  # aperiam eligendi ut error odit aut. In ut dolores nobis harum facilis vero