---
name: cross-validate-stack
description: Cross-stack validation backend .NET / frontend React — 5 coherence checks
group: validation
cli: cli/
allowed-tools: [Read, Glob, Grep, Bash]  # Bash: CLI invocation
---

# Skill: Cross-Validate Stack

> Verifies coherence between .NET backend and React frontend.
> Analysis via file scanning + JSON specs — lightweight and fast.

## When to use this skill

- After backend + frontend code generation for a module
- Before a merge/PR to verify both sides are aligned
- To audit that no route, permission or resource is missing

## The 5 Checks

| # | Check | Source / Target |
|---|-------|-----------------|
| 1 | `routes-have-endpoints` | Each endpoint in JSON specs has a corresponding .NET controller |
| 2 | `endpoints-are-consumed` | Each .NET endpoint is called by at least one React service |
| 3 | ~~`permissions-aligned`~~ | **RETIRED (2026-08, chantier 4.3)** — it compared .NET const-EXPRESSIONS against React kebab STRING keys: two sets disjoint by construction, 100 % noise. Replaced where the axis really lives: **DEV-API-033** (every endpoint guarded), **DEV-API-021** (constants ⊆ seeded grants), **DEV-UI-011** (page guard ↔ pagespec permission, const-expressions resolved). The id stays in the report (`status: "skipped"` + note) so the shape is stable. |
| 4 | `resources-have-screens` | Each resource (meta.json) has a .NET controller and at least one .tsx page |
| 5 | ~~`rbac-consistent`~~ | **RETIRED (2026-08, chantier 4.3)** — it read the MCP-era `permissions.json` spec layout the v5 flow never produces, so it skipped on every real run (a check that could not fail). Replaced by **DEV-CORE-011** (bidirectional rbac.md ⇄ seed-state grant parity) + **DEV-API-021**. Id kept in the report (`status: "skipped"` + note). |

## CLI Invocation

```bash
# Complete cross-stack validation
npx --prefer-offline tsx skills/validation/cross-validate/cli/index.ts --specs <specs-dir> --src <src-dir>
```

## Arguments

| Argument | Description | Required |
|----------|-------------|----------|
| `--specs` | Directory containing JSON specs (meta.json, endpoints.json, permissions.json) | Yes |
| `--src` | Directory containing source code (.cs and .tsx/.ts) | Yes |
| `--help` | Display help | No |

## JSON Output

```json
{
  "timestamp": "2026-03-31T...",
  "checks": [
    { "id": "routes-have-endpoints", "status": "ok", "count": 5 },
    { "id": "permissions-aligned", "status": "skipped", "details": "RETIRED — … DEV-API-033 + DEV-API-021 … DEV-UI-011." }
  ],
  "errors": 0,
  "warnings": 0
}
```

## Expected Behavior

1. User requests a cross-stack validation
2. Claude Code identifies the specs directory and source directory
3. Claude Code calls the CLI with `--specs` and `--src`
4. CLI returns JSON with the results of 5 checks
5. Claude Code presents results and suggests corrections

## Conversation Example

```
User: Verify that my backend and frontend are coherent
Claude Code: Launching cross-stack validation...
> npx --prefer-offline tsx skills/validation/cross-validate/cli/index.ts --specs ./specs --src ./src
< { "checks": [...], "errors": 0, "warnings": 0 }
Claude Code: All 5 cross-stack checks pass. Backend and frontend are aligned.
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Success — no errors |
| 1 | Errors detected |
| 2 | Internal CLI error (invalid input, missing directory) |