Spectrace

Problem: In banking, insurance, and healthcare, every release must demonstrate that each numbered requirement has been implemented and tested. Teams still do this by hand. Someone reads the spec, searches the code for each requirement, checks for tests, writes the missing ones, and updates a spreadsheet, then repeats it all when the spec changes. At about 30 minutes per requirement, our 27-requirement spec would take around 13.5 hours. It is also error-prone. A green test suite only proves the existing tests pass, not that the spec is covered, and when the spec changes but the code doesn't, nothing fails. Solution: SpecTrace turns that work into one command in IBM Bob: /trace docs/requirements.pdf. Bob reads the PDF, extracts every requirement and acceptance criterion word-for-word, then sends one subagent per module to work in parallel. Each subagent finds the implementing code, checks existing tests, writes the missing JUnit tests using the spec's exact values, runs them, and diagnoses any failure down to file and line. The output is a traceability matrix showing what is covered, what is newly tested, what is broken, or what was never built. /fix patches the bugs and re-checks until the rows turn green, /release-notes writes a release-readiness report, and when the spec changes, /trace re-checks only the affected modules. Target users: QA engineers and developers in regulated teams, release managers who need a clear "ready to ship?" answer, and auditors who need evidence. They interact through Bob slash commands and read the results in an HTML dashboard or a Markdown report for pull requests. What makes it unique is that the AI does not grade its own homework. A deterministic checker rebuilds every status from the real test results and the requirement tags in the test code, flags any requirement where a subagent's claim contradicts the evidence, and verifies that every file: line an agent cites exists and sits inside the method it names. Tracing modes can only write tests and reports. Only a separate Fixer mode may change production code, and it may never weaken a test. Results: on a sample Spring Boot banking API with 27 requirements, a live Bob run took 26.2 minutes. Four subagents ran in parallel and wrote 39 tagged tests, with zero agent disagreements and zero bad references. It found 11 requirements covered, 11 newly tested, 2 never implemented, and 3 bugs. Two bugs were planted for the demo: a daily transfer limit off by one, and a loan installment truncated instead of rounded. The third was not planted. Our own login code allowed any logged-in customer to read or move money out of anyone else's account (Broken Object Level Authorization, number one on the OWASP API Security Top 10). SpecTrace caught it by testing the rule through the real HTTP and security stack. Bob also found that a requirement that looked covered was missing a test for one of its acceptance criteria. SpecTrace replaces hours of manual cross-checking with one command, catches spec-versus-code bugs before release, and produces evidence that an auditor can verify.