ck_validate
Validate code, config, shell commands, or text against policy before execution. Returns violations and blocks unsafe actions.
Instructions
Validate proposed code, config, shell commands, or text against CK policy before execution. Read-only — no changes are applied to the project. Returns a validation result with any policy violations as findings. content is required. kind classifies the artifact (code/config/shell/text) for policy routing. source_type identifies the content's origin (developer, tool_output, human_review, issue, pull_request, web) for trust-boundary checks; untrusted sources receive stricter scrutiny. domain_pack applies a domain-specific policy pack (e.g., hipaa, owasp). requested_capabilities declares what the content needs (network, filesystem, shell, deploy) so the trust boundary can evaluate the request. Call ck_validate before writing files, running shell commands, or executing generated code. If validation returns blocked findings, do not proceed — use ck_finding to record them.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| artifact_type | No | Canonical artifact type. Compatibility aliases `instruction` and `text` are accepted and normalized to `source`. | |
| content | Yes | The content to validate or process: source code, config text, shell command, or freeform text. | |
| domain_pack | No | Domain-specific policy pack to apply during validation. | |
| intended_use | No | How the validated content will be used after validation. | |
| kind | No | Artifact kind classification for validation routing. | |
| path | No | File or directory path relative to the project root. | |
| policy_packs | No | Additional explicit policy packs to apply. Currently supports ai_tools for AI tool configuration review. | |
| requested_capabilities | No | ||
| security_workflow_phase | No | Canonical workflow phase. Compatibility aliases such as `preflight`, `analysis`, and `pre_edit` are accepted and normalized. | |
| session_id | No | Unique session identifier for correlating findings, proofs, budget, and audit trail. | |
| source_type | No | Origin category of the record (e.g., developer, tool_output, human_review). | |
| target_scope | No | Deployment scope of the artifact being validated. | |
| task_id | No | Task identifier within the session for scoped operations. | |
| trust_level | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| advisory | No | ||
| allowed | No | ||
| decision | No | ||
| findings | No | ||
| fix_prompts | No | ||
| precedent | No | ||
| scanned_at | No | ||
| summary | No | ||
| trust_policy_advisory | No |