alibabacloud-validate

Alibaba Cloud Validate

AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE

This skill performs dual review: requirement compliance AND code quality. Both reviews MUST be dispatched as independent subagents running in parallel.

Remote Terraform syntax validation (aliyun iacservice validate-module) is owned by alibabacloud-terraform-codegen Step 6 — by the time control reaches this skill, syntax has already passed remotely. Do NOT re-invoke iacservice validate-module here.

PREREQUISITE CHECK (internal — do not expose these checks to user)

Before proceeding, verify:

tasks/status.json exists with status: "plans-written"

designs/terraform/ contains generated .tf files

If missing, STOP and inform the user that code generation needs to complete first.

Triggers

Activate when:

Writing-plans phase is complete
User explicitly asks to validate Terraform code
User asks for code review of infrastructure code

Rules

Mode-aware validation — Check tasks/status.json for "mode" field to determine validation depth
Independent subagents — In Full Mode, Stage 1 and Stage 2 MUST use the Agent tool in parallel
Fix before passing — Do not set status to "validated" with unresolved issues
Record proof — Write validation results to tasks/validation-report.md
No execution — This skill validates only, never runs terraform apply

Mode Detection

Read tasks/status.json and check the "mode" field:

Mode	Validation Depth	Stages
`"fast-track"`	None — trust codegen	Skip both reviews; transition straight to `validated`
`"full"` or absent	Spec compliance + code quality	Stage 1 + Stage 2 (parallel subagents)

Fast Track Validation

If mode is "fast-track", skip both Stage 1 and Stage 2. Syntax has already been validated remotely by terraform-codegen Step 6, and the simplified design opts out of deeper review. The action sequence is:

Silently update tasks/status.json to status: "validated"
Inform user: "Quick validation passed, the code can be executed. Do you want to continue with deployment?"

No iacservice call is required here — the validation contract was satisfied in code generation.

Full Mode Process

Stage 1 & 2: Parallel Subagent Reviews

CRITICAL: You MUST dispatch BOTH reviewers as independent subagents using the Agent tool in a SINGLE message (parallel execution). Do NOT perform the reviews yourself — delegate to specialized agents.

Dispatching Instructions

Use the Agent tool with subagent_type to dispatch both reviews simultaneously:

# In a SINGLE message, make TWO Agent tool calls:

Agent call 1 - Spec Compliance Review:
  subagent_type: "alibabacloud-spec-ops:spec-reviewer"
  description: "Spec compliance review"
  prompt: |
    Review the following Terraform code against the design specification.

    ## Design Document (design.md):
    {paste full content of .aliyun-ai-ops-spec/{name}/designs/design.md}

    ## Terraform Files:
    {paste full content of each .tf file}

    Follow your review checklist and produce the structured output format.
    Return PASS or FAIL with the coverage matrix and issues list.

Agent call 2 - Code Quality Review:
  subagent_type: "alibabacloud-spec-ops:code-quality-reviewer"
  description: "Code quality review"
  prompt: |
    Review the following Terraform code for quality, security, and best practices.

    ## Terraform Files:
    {paste full content of each .tf file}

    Follow your review checklist and produce the structured output format.
    Return PASS or FAIL with categorized issues list.

Key points:

Both calls go in the SAME message so they execute in parallel
Each subagent receives ALL necessary context in its prompt (files content inline)
Each subagent produces an independent review result
Neither subagent depends on the other's output

Handling Results

After both subagents complete:

If BOTH pass → proceed to the After Validation Passes section
If either fails → fix the reported issues in the TF files, then re-dispatch the failing subagent(s)
If fixes are needed → fix issues, then re-run ONLY the failed review(s)

Do NOT call aliyun iacservice validate-module here. Remote syntax was validated by alibabacloud-terraform-codegen Step 6 before this skill ran. Re-running it would be duplicate work and waste an IaC Service quota slot.

Validation Report Template

Write to .aliyun-ai-ops-spec/{name}/tasks/validation-report.md:

# Validation Report - {Requirement Name}

## Timestamp
{ISO timestamp}

## Stage 1: Spec Compliance (Subagent: spec-reviewer)
- Status: PASS/FAIL
- Issues found: {count}
- Details: {full output from spec-reviewer subagent}

## Stage 2: Code Quality (Subagent: code-quality-reviewer)
- Status: PASS/FAIL
- Issues found: {count}
- Details: {full output from code-quality-reviewer subagent}

## Remote Syntax (handled upstream)
- Validated by: alibabacloud-terraform-codegen Step 6 (iacservice validate-module)
- Status at codegen: PASS (precondition — code generation does not hand
  off to this skill unless validate-module succeeded)

## Final Result
- Overall: PASS/FAIL
- Both review stages must PASS to proceed to execution

After Validation Passes

Silently update tasks/status.json to status: "validated" — do NOT mention this to the user
Update the user-facing TODO list via TodoWrite: mark "Dual-track review: spec compliance + code quality" → completed. (Leave "Deployment execution" as pending — only the user can promote it to in_progress by confirming.)
Inform user and ask for execution approval (this is the execution gate — keep it):

"Validation complete — all checks passed.

Spec compliance: ✅

Code quality: ✅

Remote syntax: ✅ (validated upstream by terraform-codegen)

Next step: Do you want to proceed to deployment now?

Deployment will be executed remotely via IaC Serviceautomaticallyexecute terraform plan and apply——replying "deploy" once authorizes the entire chain to complete,actually creating resources in the cloud and incurring costs. I will show you the plan result, but will not stop again for a second confirmation; if the plan contains unexpected destructive changes (for example, destroying resources during Day-2), I will proactively stop and ask.

Reply "deploy" / "yes" → proceed to alibabacloud-spec-ops:alibabacloud-executing-plans, automatically completing plan + apply. Want to adjust the code further or pause? Tell me directly, or interrupt me at any time (Esc / abort the current message)."

Wait for explicit user approval. This is the last user gate before money gets spent — never skip.
When the user confirms:
- Update TodoWrite: mark "Deployment execution: terraform plan/apply via IaC Service" → in_progress
- Invoke alibabacloud-spec-ops:alibabacloud-executing-plans

IMPORTANT: Do NOT automatically invoke executing-plans without explicit user confirmation. The previous step in the workflow (writing-plans → validate) is read-only and auto-chains; this step is where the workflow stops to ask, by design.

Why Subagents?

Using independent subagents for review provides:

Separation of concerns — Each reviewer focuses on one dimension only
Parallel execution — Both reviews run simultaneously, saving time
Independent judgment — No cross-contamination between spec compliance and code quality assessments
Specialized prompts — Each agent has a tailored system prompt with domain-specific checklists
Auditability — Each review produces a standalone report that can be traced back to its agent

Key Principles

Never skip a required stage — Full mode requires BOTH spec and quality reviews to PASS
Always use subagents — Never perform spec/quality review inline yourself
Parallel dispatch — Both Agent calls in a single message
No re-validation of syntax — Trust the upstream terraform-codegen Step 6 result; do NOT re-call iacservice validate-module
Fix and re-validate — Don't pass with known issues
Record everything — Validation proof in tasks/
Human gate — User must explicitly choose to proceed to execution