wl validate
Validate a Workloom manifest file against its schema.
Synopsis
wl validate <path>
Description
Validates the file at <path> against its schema. Auto-detects the manifest type and applies the appropriate Zod schema. Checks file structure, required fields, type constraints, and trust classification rules.
Supported Types
The validator auto-detects and validates:
| Type | Example File |
|---|---|
| Workspace manifest | workspace.json |
| Package manifest | my-package.json |
| Lock file | .workloom/lock.toml |
| State file | .workloom/state.toml |
| Binding config | .loom/binding.toml |
| Telemetry event | telemetry event JSON |
| Provider capability | provider-specific file |
Trust Gate Checks
For workspace manifests, wl validate also scans sibling packages for trust metadata and verifies the workspace projection policy is compatible:
wl validate workspace.json
# Scans referenced packages for trust classification
# Checks that trust policy allows the assets
# Reports policy violations as exit code 5
Exit Codes
| Code | Meaning |
|---|---|
0 | Valid manifest |
1 | Validation failed — schema error |
5 | Trust gate violation — policy conflict |
Examples
Validate a Workspace Manifest
wl validate fixtures/workspaces/simple-workspace.json
# Output:
# Valid workspace manifest: fixtures/workspaces/simple-workspace.json
# Workspace: Simple Workspace (wksp_simple_01)
# Targets: root
# Revision: 1
# Exit code: 0
Validate a Package Manifest
wl validate fixtures/packages/workloom-baseline-v1.json
# Output:
# Valid package manifest: fixtures/packages/workloom-baseline-v1.json
# Package: @workloom/baseline@1.0.0
# Trust class: passive_text
# Assets: 5 (2 instructions, 2 skills, 1 settings)
# Exit code: 0
Validation Failure
wl validate bad-manifest.json
# Output:
# Invalid workspace manifest: bad-manifest.json
# Error: Missing required field "workspaceId"
# At: $.workspaceId
# Exit code: 1
Trust Policy Violation
wl validate policy-denied-hooks.json
# Output:
# Trust gate violations in workspace manifest: policy-denied-hooks.json
# - Target "root" provider "claude" uses projection policy "generated_local"
# which is too permissive for trust-sensitive package "@workloom/secure-hooks@1.0.0"
# (trust class: executable_hook requires approval_required policy)
# Exit code: 5
Validation Rules
The validator enforces:
- Schema conformance. All required fields present, correct types.
- Version constraints. Valid semver version constraints (e.g.,
^1.0.0). - Package references. Referenced packages exist and are accessible.
- Circular dependencies. No cycles in package dependencies.
- Trust classification. Assets match their declared trust class.
- Trust policy. Workspace policy is compatible with package trust classes.
- Forbidden telemetry fields. No prompts, secrets, or file contents in telemetry events.
Common Errors
Missing Required Field
Error: Missing required field "packages"
At: $.targets[0].packages
Add the missing field to your manifest.
Invalid Version Constraint
Error: Invalid version constraint: "latest"
At: $.targets[0].packages[0].versionConstraint
Use valid semver: ^1.0.0, ~1.2.0, 1.0.0, etc.
Trust Policy Too Permissive
Error: Target "root" provider "claude" policy "generated_local"
is too permissive for package "@acme/hooks@1.0.0"
(trust class: executable_hook requires approval_required)
Either:
- Update workspace policy:
"claude": "approval_required" - Or remove the package from this target
Next Steps
- Create your first workspace manifest — Monorepo guide
- Author a package manifest — Packages and assets
- Set up CI validation — CI/CD guide