# Validate

> Framework health check combining isolation and mechanism compliance. Two modes: (1) Isolation — scan for multi-company contamination (scope headers, memory tags, cross-company conflicts). (2) Mechanisms — static smoke test of behavioral canaries from mechanism-registry.md. Trigger: "validate", "檢查", "health check", "validate isolation", "檢查隔離", "validate mechanisms", "檢查機制", "/validate".

- Skill: `aibot88/validate` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/validate`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/validate/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/validate

---


# Validate — Framework Health Check

Two modes, run individually or together.

## Mode Selection

| Input | Mode |
|-------|------|
| "validate" / "檢查" | Run both |
| "validate isolation" / "檢查隔離" | Isolation only |
| "validate mechanisms" / "檢查機制" | Mechanisms only |

---

## Mode 1: Isolation

Scans for multi-company contamination issues.

### Checks

1. **L2 scope headers** — every `.md` in `.claude/rules/{company}/` must have `> **Scope: {company}**`
2. **Cross-company conflicts** — contradictory rules across companies, hardcoded cross-company references
3. **Memory company tags** — company-specific memories must have `company:` frontmatter
4. **MEMORY.md index format** — company-scoped entries need `[company]` prefix
5. **User data leak** — run `scripts/scan-user-data-leak.sh` to detect hardcoded user-specific data (GitHub username, email) in shared rules. See DP-007

### Report format

```
### Isolation
✅ {company-a}: 5/5 scope headers OK
🔴 {company-b}: 2/4 missing scope headers
🟡 3 memories appear company-specific but lack company: field
```

---

## Mode 2: Mechanisms

Static smoke test of canaries from `rules/mechanism-registry.md`.

### Checks

1. **Scope headers** (overlaps isolation mode — skip if already run)
2. **Bash patterns** — check settings.json for `cd *` patterns that encourage `cd` usage
3. **Skill routing completeness** — every routed skill exists, every skill has routing entry
4. **Memory company isolation** — same as isolation mode (skip if already run)
5. **Sub-agent role definitions** — `sub-agent-roles.md` has mandatory standards
6. **Feedback memory frontmatter** — `trigger_count` + `last_triggered` present
7. **Registry freshness** — mechanism source files still exist
8. **Ghost references** — no references to deleted skills (e.g., `dev-guide`)
9. **Hardcoded paths** — no `~/work/` literals in generic SKILL.md files
10. **Hooks in settings.local.json** — scan each project's `.claude/settings.local.json` for a top-level `hooks` key → 🟡 WARN. All hooks must live in `settings.json`; `settings.local.json` with `hooks` causes shallow merge to silently override the entire `hooks` object, disabling all shared PostToolUse/PreToolUse hooks
11. **L2 embedding integrity** — run `scripts/validate-l2-embedding.sh` against `skills/references/l2-embedding-registry.md`. Validates every registered DP-030 canary's script exists, SKILL.md step anchor matches, L1 hook file + settings.json registration exist, and Layer declaration is consistent. Exit 1 → 🔴 FAIL (surface per-entry errors to user); exit 2 → 🔴 FAIL (registry meta error)

### Report format

```
### Mechanisms
| Check | Status | Details |
|-------|--------|---------|
| Scope headers | ✅ PASS | 5/5 OK |
| Bash patterns | ✅ PASS | No cd patterns |
| Routing table | 🟡 WARN | 2 skills not in routing |
| ... | ... | ... |
```

---

## Combined Summary

```
## Validate Report — {date}

{isolation results}
{mechanism results}

Summary: {total} checks | {pass} ✅ | {warn} 🟡 | {fail} 🔴
```

For each 🔴 FAIL: propose a specific fix, ask user before applying.
For each 🟡 WARN: note in report, don't block.

## What This Does NOT Check

Conversation-level mechanisms (skill-first-invoke, delegate-exploration, etc.) require observing live behavior — covered by post-task audit, not this skill.

## Post-Task Reflection (required)

> **Non-optional.** Execute before reporting task completion.

Run the checklist in [post-task-reflection-checkpoint.md](../references/post-task-reflection-checkpoint.md).