# Phase 7 5 Code Validation

> Phase 7.5 Code Validation guide. Use when validating threats and mitigations against actual code or reviewing implementation evidence.

- Skill: `awslabs/phase-7-5-code-validation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add awslabs/phase-7-5-code-validation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/awslabs/phase-7-5-code-validation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: awslabs (https://skillmd.com/u/awslabs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/awslabs/phase-7-5-code-validation

---


# Phase 7.5: Code Validation Analysis

## Objective
Inspect the implementation and record evidence for every current threat and mitigation. This phase runs only when source code is detected in the project recorded with `manage_workflow(action="set_project")`.

## Tool

### manage_code_validation(action, values=None)

| Action | Purpose |
|---|---|
| `describe` | Show the finding payload and accepted outcomes |
| `record` | Atomically store findings and update canonical statuses |
| `get` | Show current findings, missing IDs, and stale records |
| `validate` | Check that every current threat and mitigation has fresh evidence |
| `report` | Render the evidence-based report and finalize the current snapshot |
| `clear` | Remove findings before starting a new validation |

`record` accepts `values.threat_findings` and `values.mitigation_findings`. Each finding requires its record ID, an outcome, and at least one non-empty evidence string. `recommendation` is optional.

Threat outcomes:
- `fully_mitigated`
- `partially_mitigated`
- `not_mitigated`
- `not_applicable`

Mitigation outcomes:
- `implemented`
- `partially_implemented`
- `not_implemented`
- `not_applicable`

## Workflow

1. Call `manage_workflow(action="guidance", phase="7.5")`.
2. Call `manage_code_validation(action="describe")`.
3. Inspect the relevant files and identify concrete file, line, configuration, or test evidence.
4. Call `manage_code_validation(action="record", values=FINDINGS)`. Findings may be submitted incrementally.
5. Call `manage_code_validation(action="validate")`; record every missing or stale item.
6. Call `manage_code_validation(action="report")` to finalize the current snapshot.
7. Call `manage_workflow(action="advance")` to proceed to Phase 8.

Observed code behavior belongs in finding evidence. Use
`manage_assumptions(action="add", values=ASSUMPTION)` only when a statement
remains unverified.

## Completion Criteria
- [ ] Every current threat has a fresh finding
- [ ] Every current mitigation has a fresh finding
- [ ] Each finding contains concrete evidence or a not-applicable rationale
- [ ] Validation reports complete coverage
- [ ] The final report has been generated for the current snapshot
- [ ] `manage_workflow(action="advance")` proceeds to Phase 8