chore: pin openspec CLI to repo-local 1.5.0

[George-RD]

Pins the openspec validator repo-locally instead of relying on a global PATH install (previously 1.3.1, npm latest 1.5.0).

• Root package.json/package-lock.json pin @fission-ai/openspec@^1.5.0.
• scripts/check.sh and .github/workflows/ci.yml now invoke npx --no-install openspec ... instead of bare openspec.
• CI installs node deps via npm ci instead of a global npm install -g ... @1.3.1.
• No openspec 1.5.0 'stores' feature adopted — pin only.

Verification: ./scripts/check.sh passes end-to-end; npx --no-install openspec --version prints 1.5.0.

GitHub Actions is billing-blocked in this repo; local gate is the real check.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a7c3f3fa-d5ed-47b9-ab62-5a8a15868973

📥 Commits

Reviewing files that changed from the base of the PR and between 6500d8d and 88a9b4b.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• .gitignore
• graphify-out/GRAPH_REPORT.md
• package.json
• scripts/check.sh

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Improved validation checks in the CI workflow to use the project’s installed dependencies.
  • Updated the check script to run validation in a more consistent way.

• Chores

  • Added node_modules/ to ignored files.
  • Updated the generated report date.

Walkthrough

This PR replaces the global installation of the openspec CLI with a locally declared npm dependency. A new package.json declares @fission-ai/openspec as a devDependency, scripts/check.sh invokes it via npx --no-install, the CI workflow runs npm ci, .gitignore excludes node_modules/, and a generated report date is bumped.

Changes

OpenSpec Dependency Migration

Layer / File(s)	Summary
Declare local dependency package.json, .gitignore	New package.json declares @fission-ai/openspec@^1.5.0 as a devDependency for the private openspine-dev-tools package; .gitignore now excludes node_modules/.
Wire dependency into scripts and CI scripts/check.sh, .github/workflows/ci.yml	check.sh now runs OpenSpec validation through npx --no-install openspec validate ... --strict for both single change-id and --all modes; the CI "check" job installs dependencies via npm ci instead of globally installing @fission-ai/openspec@1.3.1.
Generated report update graphify-out/GRAPH_REPORT.md	Report header date updated from 2026-07-02 to 2026-07-03.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Poem

A rabbit hops through node_modules deep,
No more globals, dependencies to keep,
`npx` whispers where the CLI hides,
`npm ci` now smoothly guides,
Hop hop hooray, the build's asleep! 🐇✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}