What Checks Does verify-routing-coherence.ps1 Perform? Complete PowerShell Validation Guide

verify-routing-coherence.ps1 performs 20 distinct validation checks across routing data integrity, benchmark consistency, generated artefacts, ops-layer assets, hub-link sanity, RULES gate enforcement, template completeness, role-map coverage, functional routing tests, supply-chain pinning, and identity document constraints.

The verify-routing-coherence.ps1 script in the zhaoxuya520/reverse-skill repository serves as a comprehensive pre-flight sanity check for the entire routing infrastructure. Located at skills/scripts/verify-routing-coherence.ps1, this PowerShell script validates that all repository artefacts remain coherent before any routing operation proceeds. Any violation causes immediate termination with a non-zero exit code.

Routing Data Integrity Checks

The foundation of verify-routing-coherence.ps1 begins with validating the core routing configuration at skills/config/routing.json.

The script enforces four strict requirements:

• File existence and size: routing.json must exist and contain at least 30 routes
• Mandatory fields: Every route requires label, skill, and keywords properties
• Git-tracked verification: All referenced skill files must exist and be tracked by Git
• Priority alignment: The routing.json.priority array must exactly match the set of route IDs

Benchmark Consistency Validation

Benchmark integrity verification (lines L51-L63) ensures that test data stays synchronized with production routing rules.

verify-routing-coherence.ps1 checks skills/tests/routing-benchmark.json for:

• Minimum 100 test cases
• expect fields matching the R<digits> pattern (e.g., R4, R38)
• Cross-reference validation that every benchmark expectation exists in routing.json

Generated Artefacts and Documentation

The script validates that documentation generation pipelines execute correctly (lines L68-L76).

Two critical assertions apply:

• INDEX.md presence: Confirms extract-summaries.ps1 successfully generated the index
• master-route.ps1 purity: Ensures no hard-coded routing table exists in the master routing script

Ops-Layer Asset Verification

Lines L78-L103 implement a file-manifest check covering 23 required files under ops/ and references/ directories.

Key files include:

• ops/IDENTITY.md
• ops/scope-contract.md
• references/evidence-finding-path.md

Hub-Link Sanity Checks

Documentation cross-linking validation (lines L116-L124) examines three hub documents:

• MASTER-ROUTING.md
• SKILL.md
• routing.md

Each must contain links to scope, identity, and case-init artefacts to pass verify-routing-coherence.ps1.

RULES Gate Enforcement

Security gate validation (lines L135-L158) parses both RULES.md and RULES_zh.md for contract compliance.

Required elements include:

• case-init and scope-related keywords
• Hard-gate language patterns: auth.status = granted, 禁止对目标 ACT (prohibition against targeting ACT)
• Proximity constraint: case-init or scope must appear near an ACT statement

Template Field Completeness

Lines L161-L190 invoke Assert-Fields across a dozen markdown templates to verify required headings and keywords exist in:

• Operations documents
• Reference sheets
• Vendor rules templates

Role-Map Coverage Validation

The ops/role-map.md file (lines L223-L227) must mention each primary skill family:

• attack-chain
• pentest-tools
• ida-reverse
• docs-generator
• llm-security

Master-Route Functional Testing

The most extensive functional validation (lines L229-L265) executes master-route.ps1 for every predefined case (R4, R1, through R38).

Each execution verifies:

• Generated route-scope.md contains the expected primary route ID
• Referenced skill markdown files exist on disk

Output Directory and Isolation Tests

Default OutDir handling (L267-L270)

Runs master-route.ps1 without -OutDir parameter and confirms output lands under work/.

Project-root isolation (L272-L301)

Validates that when -ProjectRoot is supplied, all artefacts remain within that folder. The same constraint applies to default (caller-project) execution.

Case-Init Sanity Verification

Lines L303-L318 execute case-init.ps1 in both regular and project-root modes, then inspect output for:

• scope.md with required keys: auth, network_profile, in_scope, ready_for_act
• timeline.md presence
• workitems.md presence

Ghost DSL Detection

Hub file scanning (lines L349-L357) identifies unqualified dsl-vm-reverse/ references that could indicate stale or "ghost" infrastructure dependencies.

Script Syntax and Manifest Validation

Refresh-tool-index parsing (L360-L364)

Ensures refresh-tool-index.ps1 parses without syntax errors before deployment.

Bootstrap-manifest parity (L665-L685)

Compares skills/scripts/bootstrap-manifest.json against kali/scripts/bootstrap-manifest.json:

• Skills-side capabilities must number 10 or more
• Any mismatches are reported for remediation

Supply-chain pin gate (L890-L931)

Walks every bootstrap dependency and auto-install capability in both manifests, asserting that version, commit, pinPolicy, or asset SHA is explicitly declared.

Identity Document Constraints

Platform-gate validation (lines L934-L438, note: source analysis indicates L934-L438, likely L934-L938) enforces that ops/IDENTITY.md:

• Explicitly rejects platform-specific stacks (FastAPI, React)
• Contains core DNA keywords: tool-index, bootstrap, field-journal, 路由

Issue #77 Anchor Verification

Analysis Decision Framework (ADF) anchors (L445-L477)

Checks for ADF section presence in:

• analysis-decision-framework.md
• evidence-finding-path.md
• re-agent-workflow.md
• RULES.md

Blindspot Cookbook anchors (L480-L495)

Validates that ops/analysis-blindspot-cookbook.md contains all required R-ids (R52-R81) with associated tags.

Running verify-routing-coherence.ps1

Basic execution

# From repository root

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/verify-routing-coherence.ps1

With custom scratch directory

$tmp = Join-Path $env:TEMP "rs-verify-$(Get-Date -Format 'yyyyMMddHHmmss')"
powershell -File skills/scripts/verify-routing-coherence.ps1 -ScratchDir $tmp

Expected output patterns

Success:

ALL ROUTING COHERENCE CHECKS PASSED

Failure example:

[FAIL] routing.json route count suspicious (<30)
[FAIL] missing ops/IDENTITY.md
[FAIL] R4 benchmark expectation not found in routing.json
FAILED 3

Summary

• verify-routing-coherence.ps1 executes 20 validation categories before permitting routing operations
• Routing data integrity requires ≥30 routes with complete metadata and Git-tracked skill files
• Benchmark consistency demands ≥100 cases with valid R<digits> expectations that exist in routing
• Functional testing invokes master-route.ps1 across all predefined cases and validates output artefacts
• Security gates enforce hard-language constraints in RULES files and identity documents
• Supply-chain validation ensures every dependency has explicit version pinning
• Exit codes: 0 for pass, 1 for any failure, with verify.txt or failures.txt written accordingly

Frequently Asked Questions

What happens if verify-routing-coherence.ps1 finds a routing.json with only 25 routes?

The script aborts with exit code 1 and logs [FAIL] routing.json route count suspicious (<30) to stderr. This check at lines L24-L46 enforces a minimum viable routing table size to prevent incomplete deployments.

Can I run verify-routing-coherence.ps1 without checking all 23 ops-layer files?

No. The file-manifest validation at lines L78-L103 is mandatory. The script does not provide granular skip flags—any missing required file under ops/ or references/ triggers immediate failure.

How does verify-routing-coherence.ps1 validate that master-route.ps1 has no hard-coded routing table?

Lines L68-L76 perform a pattern scan of skills/scripts/master-route.ps1 for hard-coded routing structures. The script must derive all routing decisions from routing.json; any embedded route definitions cause validation failure.

Why does verify-routing-coherence.ps1 check both RULES.md and RULES_zh.md separately?

Bilingual gate enforcement at lines L135-L158 ensures security constraints propagate to both language versions. The script validates that Chinese and English RULES files both contain case-init keywords, hard-gate language (auth.status = granted, 禁止对目标 ACT), and proper proximity of scope terms to ACT statements.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}