id-validatelisted

The read-only infra-delivery STATIC-VALIDATION step (step 6) — statically validate an infra change BEFORE the test/plan/merge steps. A PROCEDURE skill the generic agent runs: resolve the active stack profile, run the directly-allowlisted read-role `tofu validate` + `tofu fmt` verbs (the IaC is well-formed + canonically formatted) plus the active profile's EXISTING read-only `infra_binding.policy` slot (the render + conftest/OPA evaluation), all read-only, SURFACE violations, and record the validation observation as a `.foundry/id-validate-report` STEP-REPORT NOTE. Read-only/never-fix: it NEVER applies, edits the IaC, runs `tofu fmt -write`, or waves a violation through. ADVISORY craft — it does NOT gate, approve, or merge; the merge floor (the adopter's branch protection + CI checks, see docs/merge-floor.md) is the merge authority. Static validation runs no `tofu plan` (no `plan_results`), so it records a STEP-REPORT NOTE — the bespoke `emit_infra_walk_evidence` plan recorder this note used to be contrasted a
lukasrepublic/agentic-foundry · ★ 1 · AI & Automation · score 67

Install: claude install-skill lukasrepublic/agentic-foundry

# id-validate — read-only static VALIDATION of the change (infra-delivery step 6, RO) The `infra-delivery` step sequence (a documented procedure this skill family forms — no workflow engine or state-machine file ships) drives an infra change → merge. Step 6 is the **static-validation step** for the everyday-change loop: a PROCEDURE skill the generic agent **runs** to **statically validate the change** *before* the test / plan / merge steps. It runs read-only **structural + render/policy** checks — **`tofu validate`** and **`tofu fmt`** (the IaC is syntactically well-formed + canonically formatted; both are **directly on the loader's `tofu` read-role allowlist** — `tofu` read-only verbs = `plan`/`validate`/`output`/`fmt`) plus the active profile's **existing read-only `infra_binding.policy`** slot (the render + conftest/OPA evaluation: `kustomize build` / `helm template` → `kubeconform` + `conftest`). It **surfaces violations** (the malformed config, the lint diff, the failing policy rule) and **records the validation observation as a `.foundry/id-validate-report` STEP-REPORT NOTE**. It is a fast **mistake-catcher** feeding the operator + the downstream test/plan steps; **the merge floor** (the adopter's branch protection + CI checks — see `docs/merge-floor.md`) **remains the only merge authority**. ## ADVISORY — not a gate (the merge floor is the merge authority) This skill is **ADVISORY**. It surfaces violations + records a STEP-REPORT NOTE; it does **NOT gate, approve, b