action-validator

name	action-validator
description	Pre-action boundary checking — validates agent tool calls against declared capabilities and task contracts
scope	core
user-invocable	false

Action Validator Skill

Purpose

Advisory pre-action validation layer that checks agent tool calls against declared capabilities, file access scope (R002), and task contracts before execution. Inspired by AutoHarness (Google DeepMind) — enforcing action-space legality at agent boundaries.

This skill does NOT block actions (R021 advisory-first model). It emits warnings when agents attempt operations outside their declared scope.

Validation Checks

Check	What	Against
Tool scope	Tool being called	Agent's tools frontmatter list
File scope	File path in Write/Edit	R002 file access rules
Domain scope	Target file extension	Agent's domain frontmatter
Task contract	Operation type	Task description constraints

Advisory Format

--- [Action Validator] Scope warning ---
  Agent: {agent-name}
  Tool: {tool-name}
  Target: {file-path}
  Issue: {description}
  Declared scope: {agent's declared tools/domain}
  💡 Suggestion: {recommended action}
---

Integration Points

System	How
PreToolUse hooks	Optional hook to check tool calls (advisory only)
pipeline-guards	Complements pipeline stage gates
adversarial-review	Provides action-space-legality criterion
R002 (Permissions)	Validates against declared file access rules
R010 (Orchestrator)	Orchestrator validates subagent scope claims

Policy Cache Pattern

For high-repetition agents (e.g., mgr-gitnerd commit workflows), capture validated decision paths as reusable policies:

policy_cache:
  agent: mgr-gitnerd
  action: git-commit
  validated_steps:
    - tool: Bash
      pattern: "git add *"
      verdict: allow
      hints: { safety: normal, parallel: false, approval: auto }
    - tool: Bash
      pattern: "git commit *"
      verdict: allow
      hints: { safety: normal, parallel: false, approval: auto }
    - tool: Bash
      pattern: "git push *"
      verdict: warn_confirm
      hints: { safety: low, parallel: false, approval: needs_approval }

Policy caching reduces redundant LLM calls for well-understood workflows. Policies are advisory — the orchestrator may override.

Capability Hints

For high-effort frontier roles, tool capability hints improve batched tool-call planning. Declare per-tool metadata in policy cache entries without coupling the policy to a concrete model ID or provider alias:

Field	Values	Effect
safety	normal, low	low triggers confirmation advisory
parallel	true, false	true allows concurrent scheduling
approval	auto, needs_approval	Maps to R002 permission tier

Example: Enhanced Policy Cache with Capability Hints

policy_cache:
  agent: mgr-gitnerd
  action: git-commit
  validated_steps:
    - tool: Bash
      pattern: "git add *"
      verdict: allow
      hints: { safety: normal, parallel: false, approval: auto }
    - tool: Bash
      pattern: "git push *"
      verdict: warn_confirm
      hints: { safety: low, parallel: false, approval: needs_approval }
    - tool: Read
      pattern: "*"
      verdict: allow
      hints: { safety: normal, parallel: true, approval: auto }

Hints are advisory — they inform model scheduling but do not enforce. Inspired by ouroboros PR #353 capability graph pattern.

Code Harness Integration (AutoHarness)

When a synthesized harness exists for an agent (.codex/outputs/harnesses/{agent-name}-*.yaml), action-validator can use it for enhanced validation:

Compatibility artifact protocol

Sensitive-path compatibility note: when delegated work touches .claude/outputs/, .claude/**, or templates/.claude/**, keep .codex/** artifacts on the normal file-write path. On Claude Code v2.1.121+ with bypassPermissions, direct compatibility writes are allowed for .claude/skills/, .claude/agents/, and .claude/commands/; on v2.1.126+ broader protected paths are covered. Use /tmp/<skill>-<timestamp>.md only as a legacy fallback when the runtime is older or still prompts.

Mode	Source	Behavior
Advisory (default)	Prompt-based checks	Emit warnings only
Code-verified	harness-synthesizer output	Run harness validation code, emit advisory results
Hard-enforce (opt-in)	harness-synthesizer --hard-enforce	Block invalid actions (requires explicit opt-in, see R021)

To generate a harness for an agent: /harness-synthesizer --agent {name} --mode verifier

Code harness validation is additive — it supplements prompt-based checks, not replaces them.

Scope

This skill is an advisory layer, not a hard enforcement mechanism:

• Does: Emit warnings, log scope violations, suggest corrections
• Does NOT: Block tool execution, modify agent behavior, override R021
• Future: May integrate with PreToolUse hooks for automated checking (see R021 promotion criteria)