Functional validation

Skill krzemienski/deepest-plan-plugin/skills/functional-validation

The 4-step validation protocol — Build → Exercise through UI → Capture evidence → Write verdict. Cited as `protocol="functional-validation"` on every validation_gate in deepest-plan output. Enforces real-system execution; never write mocks or test files.From its SKILL.md

Install

npx -y skills add krzemienski/deepest-plan-plugin --skill functional-validation

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.6 KB, as published. Nobody here has run it

Functional Validation Protocol

Scope

The complete validation protocol from build to verdict. Does NOT handle mock blocking (use no-mocking-validation-gates), evidence examination at completion (use gate-validation-discipline), or plan generation (use create-validation-plan).

The Iron Rule

NEVER create mocks, stubs, test doubles, or test files.
NEVER import jest, vitest, pytest, XCTest, or any test framework.
ALWAYS validate through the same interfaces real users experience.
ALWAYS capture evidence that proves the feature works end-to-end.

Before You Validate

Is the real system running? (not a dev server with mocks)
Can I access it as a user would? (browser, simulator, CLI — not a test harness)
Are all dependencies real? (real DB, real API keys, real network)
Do I have PASS criteria written down? (specific, observable, measurable — from create-validation-plan)
Am I capturing evidence to files? (not just observing in terminal)

Platform Detection (first match wins)

Priority	Platform	Indicators	Platform skill
1	iOS/macOS	`*.xcodeproj`, `Package.swift`	`ios-validation`
2	Web	`package.json` + React/Vue/Next/Astro/Svelte	`web-validation`
3	CLI	`Cargo.toml [[bin]]`, `go.mod + main.go`, `package.json "bin"`	`cli-validation`
4	API	Backend routes WITHOUT frontend templates	`api-validation`
5	Full-Stack	Frontend AND backend in same project	`fullstack-validation`

Wrong platform = wrong validation approach. Detect FIRST.

The 4-Step Protocol

Step 1: Build & Launch

Build the real system with all real dependencies. Build failure IS your first finding — do not skip to launch.

Step 2: Exercise Through UI

Interact as a real user would — browser, simulator, CLI binary, or curl. No REPL imports, no direct function calls, no test harness.

Step 3: Capture Evidence

Save to e2e-evidence/ — screenshots, response bodies, CLI output, logs. Evidence must be READ and DESCRIBED, not just confirmed to exist.

Step 4: Write Verdict

For each criterion, cite specific evidence with file paths and quoted content.

Evidence Capture by Platform

Platform	Tool	Example
iOS	`xcrun simctl io booted screenshot`	`e2e-evidence/vg1-dashboard.png`
Web	Playwright `page.screenshot()` or agent-browser	`e2e-evidence/vg2-signup.png`
API	`curl -s \| tee response.json \| jq .`	`e2e-evidence/vg3-response.json`
CLI	`./bin cmd 2>&1 \| tee output.txt; echo exit=$?`	`e2e-evidence/vg4-stdout.log`
Full-Stack	Combine above, bottom-up	Per-layer files

Multi-Platform Validation Order

For fullstack, validate bottom-up:

Database / Infra (FIRST) → Business Logic → API Endpoints → Frontend UI (LAST)

Why: if the DB is broken, every API test fails with misleading errors.

Verdict Format

### Criterion: [What was required]
**PASS** / **FAIL**
Evidence: `e2e-evidence/[file]` — [What I actually saw, quoted specifically]

Security Policy

Executes real systems for validation. Never introduces new functionality, never disables security checks, never bypasses auth — validates through the same security boundaries real users hit.