chore: initialize OpenSpec

[kyaky]

openspec init --tools claude,codex (CLI 1.10.0), schema spec-driven.

What lands where

path	committed?	why
openspec/config.yaml	yes	schema + project context
openspec/{specs,changes}	structure only	empty today
.agents/skills/ (6)	yes	Codex-facing skills
.claude/skills/, .claude/commands/opsx/	no	.claude/ is already gitignored here

The Claude Code wiring staying local is deliberate — this is a public repo and the per-user agent config is personal. Codex reads .agents/skills/, which is tool-agnostic in location and worth sharing.

Nothing was written to CLAUDE.md. This version of OpenSpec ships skills and slash commands rather than appending an instruction block, so the existing "project-internal docs that should not be public" gitignore stance is untouched.

The part worth reading

openspec/config.yaml's context: block. OpenSpec feeds it to whichever agent generates artifacts, and since CLAUDE.md is gitignored as project-internal, this committed file is the right home for the shareable subset: crate layout, the libopenconnect-owns-the-tunnel / Rust-owns-everything-else split, the anyhow vs thiserror and no-unwrap-in-libraries rules, and the _refs/ read-only rule.

It also records three things that have actually cost time in this repo, so they do not get rediscovered:

• bins/opc-gui is outside the workspace. cargo build --workspace and cargo fmt --all do not reach it, and it cannot build on Linux at all (eframe without x11/wayland → winit refuses). This is what killed the v0.2.0-alpha.21 release.
• CI is ubuntu-only. The macOS and Windows compilers are first exercised during a release, on a v* tag push.
• gp-route / gp-dns backends are cfg-gated per OS, so a change to one needs checking against all three targets.

Verification

• openspec doctor → root ok
• openspec list / openspec list --specs → clean
• config.yaml parses as YAML; all 12 generated skills have valid frontmatter; all six /opsx:* commands carry descriptions

No .gitkeep files: I checked that OpenSpec behaves identically with openspec/specs and openspec/changes/archive absent, as they would be in a fresh clone, so committing placeholders would be clutter.

One wrinkle for Codex users

.codex in the repo root is an empty, read-only file — a session marker dropped by other tooling, and already gitignored. openspec init therefore could not probe .codex/prompts and logged:

Unable to check if directory exists at .../.codex/prompts: ENOTDIR: not a directory

Harmless: Codex reads .agents/skills/, and OpenSpec skipped the prompts step by design (Commands skipped for: codex (uses skills)). But the warning will recur on every openspec update until that file is removed. Left alone here since another tool owns it.

Getting started

• Claude Code: /opsx:propose "your idea"
• Codex: $openspec-propose "your idea"

[kyaky]

Merging without a CI run, deliberately, and recording why.

GitHub Actions is in a major outage (githubstatus.com component Actions = major_outage, updated 15:11Z). No workflow run was ever created for this PR — and none was created for the main push that merged #32 either. The last CI run of any kind on this repo was 13:27Z. Close/reopen and a force-push both failed to trigger it, which is consistent with the outage rather than anything about this branch. CodeQL still ran and passed, since default-setup scans run on a different path.

This PR changes openspec/config.yaml and six .agents/skills/*.md files. Nothing under bins/, crates/, Cargo.toml, Cargo.lock, rust-toolchain.toml or .github/ — so it cannot affect a build. Verified: git diff --name-only v0.2.0-alpha.22 chore/openspec-init lists only those eight paths.

Ran CI's checks locally in its place, on this branch, aarch64 Linux:

check	result
cargo fmt --all --check	clean
cargo test --workspace --locked	291 passed, 0 failed
cargo clippy --workspace --all-targets -- -D warnings	clean
cargo deny check	advisories ok, bans ok, licenses ok, sources ok
cargo check --manifest-path bins/opc-gui/Cargo.toml --target x86_64-pc-windows-msvc --locked (the job #32 just added)	clean

Rebased onto main after #32 merged, so this is current.