validate

name	validate
description	Framework health check combining isolation and mechanism compliance. Two modes: (1) Isolation — scan for multi-company contamination (scope headers, memory tags, cross-company conflicts). (2) Mechanisms — static smoke test of behavioral canaries from mechanism-registry.md. Trigger: "validate", "檢查", "health check", "validate isolation", "檢查隔離", "validate mechanisms", "檢查機制", "/validate".
metadata	{"author":"Polaris","version":"1.0.0"}
user-invocable	true

Validate — Framework Health Check

Two modes, run individually or together.

Mode Selection

Input	Mode
"validate" / "檢查"	Run both
"validate isolation" / "檢查隔離"	Isolation only
"validate mechanisms" / "檢查機制"	Mechanisms only

---

Mode 1: Isolation

Scans for multi-company contamination issues.

Checks

1. L2 scope headers — every .md in .claude/rules/{company}/ must have > **Scope: {company}**
2. Cross-company conflicts — contradictory rules across companies, hardcoded cross-company references
3. Memory company tags — company-specific memories must have company: frontmatter
4. MEMORY.md index format — company-scoped entries need [company] prefix
5. User data leak — run scripts/scan-user-data-leak.sh to detect hardcoded user-specific data (GitHub username, email) in shared rules. See DP-007

Report format

### Isolation
✅ {company-a}: 5/5 scope headers OK
🔴 {company-b}: 2/4 missing scope headers
🟡 3 memories appear company-specific but lack company: field

---

Mode 2: Mechanisms

Static smoke test of canaries from rules/mechanism-registry.md.

Checks

1. Scope headers (overlaps isolation mode — skip if already run)
2. Bash patterns — check settings.json for cd * patterns that encourage cd usage
3. Skill routing completeness — every routed skill exists, every skill has routing entry
4. Memory company isolation — same as isolation mode (skip if already run)
5. Sub-agent role definitions — sub-agent-roles.md has mandatory standards
6. Feedback memory frontmatter — trigger_count + last_triggered present
7. Registry freshness — mechanism source files still exist
8. Ghost references — no references to deleted skills (e.g., dev-guide)
9. Hardcoded paths — no ~/work/ literals in generic SKILL.md files
10. Hooks in settings.local.json — scan each project's .claude/settings.local.json for a top-level hooks key → 🟡 WARN. All hooks must live in settings.json; settings.local.json with hooks causes shallow merge to silently override the entire hooks object, disabling all shared PostToolUse/PreToolUse hooks
11. L2 embedding integrity — run scripts/validate-l2-embedding.sh against skills/references/l2-embedding-registry.md. Validates every registered DP-030 canary's script exists, SKILL.md step anchor matches, L1 hook file + settings.json registration exist, and Layer declaration is consistent. Exit 1 → 🔴 FAIL (surface per-entry errors to user); exit 2 → 🔴 FAIL (registry meta error)

Report format

### Mechanisms
| Check | Status | Details |
|-------|--------|---------|
| Scope headers | ✅ PASS | 5/5 OK |
| Bash patterns | ✅ PASS | No cd patterns |
| Routing table | 🟡 WARN | 2 skills not in routing |
| ... | ... | ... |

---

Combined Summary

## Validate Report — {date}

{isolation results}
{mechanism results}

Summary: {total} checks | {pass} ✅ | {warn} 🟡 | {fail} 🔴

For each 🔴 FAIL: propose a specific fix, ask user before applying. For each 🟡 WARN: note in report, don't block.

What This Does NOT Check

Conversation-level mechanisms (skill-first-invoke, delegate-exploration, etc.) require observing live behavior — covered by post-task audit, not this skill.

Post-Task Reflection (required)

Non-optional. Execute before reporting task completion.

Run the checklist in post-task-reflection-checkpoint.md.