Introducing the OpenSpec Cloud Agent
2026-08-28
We're bringing the OpenSpec Cloud Agent into early access.
It's an always-on layer for teams using OpenSpec across one or more repositories. It works with the specs already in those repositories, starting with drift detection.
A pull request can change how your product behaves without updating the spec that describes it.
The OpenSpec Cloud Agent compares pull requests with your requirements and cites the exact lines when they disagree.
Across your connected repositories, it shows what is in sync, what has drifted, and what needs a decision.
api
web
workers
When something drifts, the agent shows your team the requirement, the code that contradicts it, and what needs to happen next.
Customers lose access when they cancel
This PR ends workspace access before the paid billing period is over.
Requirement
openspec/specs/billing/spec.md:64
Canceled subscriptions remain active through current_period_end.
Billing change
src/billing/cancel-subscription.ts:37
The cancellation path sets the subscription status to canceled immediately.
Access check
src/workspaces/can-access.ts:52
Only active subscriptions can open the workspace.
NextKeep access active through current_period_end, or revise the cancellation requirement.
Token revocation
This PR no longer guarantees that a revoked API token stops working immediately.
Requirement
openspec/specs/auth/spec.md:42
A revoked API token must stop working immediately.
Implementation
src/auth/revoke.ts:88
Revocation now runs as a background job, so the token can remain valid until it runs.
NextKeep revocation synchronous, or revise the requirement before merging.
Outside pull requests, it scans your connected repositories each day. When it finds drift, it can open a corrective PR for your team to review.
Restore immediate API token revocation #482
openspec-cloud wants to merge into main
Why this PR
A background job left revoked tokens valid until it ran. This change revokes the token immediately, then queues the remaining cleanup.
Changed
src/auth/revoke.ts
+6 −2Requirement
openspec/specs/auth/spec.md:42
Token revocation is back in sync
Ready for human review
You choose which repositories the agent can access. It uses a temporary clone for each scan and deletes it when the scan finishes.
Early-access teams get a free trial. We onboard each team personally, and setup takes less than 15 minutes. Reserve your slot below.
Can’t find a suitable time or have a question? Email the founder directly at [email protected].