ck_validate
Validate code, config, shell commands, or text against CK policy before execution. Returns policy violations as findings to block non-compliant actions.
Instructions
Validate proposed code, config, shell commands, or text against CK policy before execution. Read-only — no changes are applied to the project. Returns a validation result with any policy violations as findings. content is required. kind classifies the artifact (code/config/shell/text) for policy routing. source_type identifies the content's origin (developer, tool_output, human_review, issue, pull_request, web) for trust-boundary checks; untrusted sources receive stricter scrutiny. domain_pack applies a domain-specific policy pack (e.g., hipaa, owasp). requested_capabilities declares what the content needs (network, filesystem, shell, deploy) so the trust boundary can evaluate the request. Call ck_validate before writing files, running shell commands, or executing generated code. If validation returns blocked findings, do not proceed — use ck_finding to record them.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | Artifact kind classification for validation routing. | |
| path | No | File or directory path relative to the project root. | |
| content | Yes | The content to validate or process: source code, config text, shell command, or freeform text. | |
| task_id | No | Task identifier within the session for scoped operations. | |
| session_id | No | Unique session identifier for correlating findings, proofs, budget, and audit trail. | |
| domain_pack | No | Domain-specific policy pack to apply during validation. | |
| source_type | No | Origin category of the record (e.g., developer, tool_output, human_review). | |
| trust_level | No | ||
| intended_use | No | How the validated content will be used after validation. | |
| policy_packs | No | Additional explicit policy packs to apply. Currently supports ai_tools for AI tool configuration review. | |
| target_scope | No | Deployment scope of the artifact being validated. | |
| artifact_type | No | Canonical artifact type. Compatibility aliases `instruction` and `text` are accepted and normalized to `source`. | |
| requested_capabilities | No | ||
| security_workflow_phase | No | Canonical workflow phase. Compatibility aliases such as `preflight`, `analysis`, and `pre_edit` are accepted and normalized. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| allowed | No | ||
| summary | No | ||
| advisory | No | ||
| decision | No | ||
| findings | No | ||
| precedent | No | ||
| scanned_at | No | ||
| fix_prompts | No | ||
| trust_policy_advisory | No |