Validation profiles

A validation profile is a YAML file that defines the ordered set of checks run against repos of a given type. Profiles live in D:\git\platform\profiles\. The validation_profile field in master-registry.db references a profile by name.

---

Profile schema

profile: <name>
description: <one line>

checks:
  - id: <check-id>             # unique within the profile
    name: <display name>
    tool: <terraform|az|tfsec|agent|...>
    command: "<command string>"
    pass_criteria: "<what constitutes a pass>"
    severity: error|warning    # error = blocks; warning = reports
    notes: |
      Optional multi-line context for the check.
      agent: <agent-name>      # only when tool: agent

severity: error means a failure blocks the dispatch wave and prevents the security gate from running on that repo. severity: warning means the finding is reported but does not block.

---

iac-terraform

terraform fmt -check -recursive
terraform init -backend=false && terraform validate
tfsec . --format json                      (no HIGH or CRITICAL findings)
security-waf-caf — CAF naming review
security-waf-caf — WAF five-pillar review

---

iac-bicep

az bicep build --file <main.bicep>
Invoke-PSRule -Module PSRule.Rules.Azure    (using Az.PSRule or CLI equivalent)
security-waf-caf — CAF naming review
security-waf-caf — WAF five-pillar review

---

iac-arm

Test-AzTemplate (ARM-TTK) — all tests pass
security-waf-caf — CAF naming review
security-waf-caf — WAF five-pillar review

---

iac-ansible

yamllint .                                 (0 errors)
ansible-lint                               (0 errors)
ansible-playbook --syntax-check <playbook> (syntax ONLY — never executes the playbook)
reviewer — structure/best-practice review

---

iac-powershell

Invoke-ScriptAnalyzer -Recurse             (0 errors)
Invoke-Pester                              (all tests pass)
HCS script-header conformance check        (#Requires -Version 7.0, Set-StrictMode, $ErrorActionPreference)
security-waf-caf — WAF five-pillar review

---

docs

markdownlint-cli2 '**/*.md' '#node_modules'   (0 errors)
lychee --offline --no-progress '**/*.md'       (0 broken links)
reviewer — MkDocs admonition syntax, heading hierarchy, no credentials

---

web

<linter per stack>                         (0 errors)
<type-checker per stack>                   (0 errors)
npm audit / equivalent                     (no HIGH or CRITICAL advisories)
reviewer — structure and style review

---

app

<linter per stack>                         (0 errors)
<type-checker per stack>                   (0 errors)
<unit test runner>                         (all tests pass)
npm audit / equivalent                     (no HIGH or CRITICAL advisories)
reviewer — structure and style review

---

Adding a new profile

1. Create D:\git\platform\profiles\<type>.yaml.
2. Follow the schema above. Every check must have id, name, tool, command, pass_criteria, and severity.
3. Add a corresponding type value to the registry schema (see Registry).
4. Commit: feat(profiles): add <type> validation profile.
5. Document the profile in this page.

When the profile includes tool: agent, name the agent in agent: and make sure that agent file exists in .claude/agents/.