action-validator

Action Validator Skill

Purpose

Advisory pre-action validation layer that checks agent tool calls against declared capabilities, file access scope (R002), and task contracts before execution. Inspired by AutoHarness (Google DeepMind) — enforcing action-space legality at agent boundaries.

This skill does NOT block actions (R021 advisory-first model). It emits warnings when agents attempt operations outside their declared scope.

Validation Checks

Advisory Format

--- [Action Validator] Scope warning ---
  Agent: {agent-name}
  Tool: {tool-name}
  Target: {file-path}
  Issue: {description}
  Declared scope: {agent's declared tools/domain}
  💡 Suggestion: {recommended action}
---

Integration Points

Policy Cache Pattern

For high-repetition agents (e.g., mgr-gitnerd commit workflows), capture validated decision paths as reusable policies:

policy_cache:
  agent: mgr-gitnerd
  action: git-commit
  validated_steps:
    - tool: Bash
      pattern: "git add *"
      verdict: allow
      hints: { safety: normal, parallel: false, approval: auto }
    - tool: Bash
      pattern: "git commit *"
      verdict: allow
      hints: { safety: normal, parallel: false, approval: auto }
    - tool: Bash
      pattern: "git push *"
      verdict: warn_confirm
      hints: { safety: low, parallel: false, approval: needs_approval }

Policy caching reduces redundant LLM calls for well-understood workflows. Policies are advisory — the orchestrator may override.

Capability Hints

For high-effort frontier roles, tool capability hints improve batched tool-call planning. Declare per-tool metadata in policy cache entries without coupling the policy to a concrete model ID or provider alias:

Example: Enhanced Policy Cache with Capability Hints

policy_cache:
  agent: mgr-gitnerd
  action: git-commit
  validated_steps:
    - tool: Bash
      pattern: "git add *"
      verdict: allow
      hints: { safety: normal, parallel: false, approval: auto }
    - tool: Bash
      pattern: "git push *"
      verdict: warn_confirm
      hints: { safety: low, parallel: false, approval: needs_approval }
    - tool: Read
      pattern: "*"
      verdict: allow
      hints: { safety: normal, parallel: true, approval: auto }

Hints are advisory — they inform model scheduling but do not enforce. Inspired by ouroboros PR #353 capability graph pattern.

Code Harness Integration (AutoHarness)

When a synthesized harness exists for an agent (.codex/outputs/harnesses/{agent-name}-*.yaml), action-validator can use it for enhanced validation:

Compatibility artifact protocol

Sensitive-path compatibility note: when delegated work touches .claude/outputs/, .claude/**, or templates/.claude/**, keep .codex/** artifacts on the normal file-write path. On Claude Code v2.1.121+ with bypassPermissions, direct compatibility writes are allowed for .claude/skills/, .claude/agents/, and .claude/commands/; on v2.1.126+ broader protected paths are covered. Use /tmp/<skill>-<timestamp>.md only as a legacy fallback when the runtime is older or still prompts.

To generate a harness for an agent: /harness-synthesizer --agent {name} --mode verifier

Code harness validation is additive — it supplements prompt-based checks, not replaces them.

Scope

This skill is an advisory layer, not a hard enforcement mechanism:

• Does: Emit warnings, log scope violations, suggest corrections
• Does NOT: Block tool execution, modify agent behavior, override R021
• Future: May integrate with PreToolUse hooks for automated checking (see R021 promotion criteria)