Post-Patch Validation

Validate a security patch against the reported bug and the surrounding code it affects. Give the patch author reproducible failures to fix and identify what still needs testing. Apply the same checks to human and agent patches. The diff, author, upstream implementation, and original proof of concept alone cannot establish correctness.

When to Use

• A security fix, remediation commit, patch file, or pull request already exists.
• An AI-generated patch needs validation before human review or merge.
• A fix may cover one exploit path while missing variants of the same root cause.
• A security fix may alter legitimate behavior or introduce a new vulnerability.
• A patch author needs concrete failures and coverage gaps before another revision.

When NOT to Use

• No patch exists yet; use vulnerability discovery or fix implementation first.
• The task is to review an audit finding against a report without executing patch evidence.
• The task is only to convert a finding into a permanent project test.
• The target is remote or production. This skill executes local code and tests only.
• The user has not authorized execution of the repository's code or test suite.

Quick Start

1. Pin the vulnerable base and patched input. Prefer immutable commits. For uncommitted work, create a binary patch file first; do not validate in the user's working tree.

2. Scaffold a pinned plan:

   uv run {baseDir}/scripts/post_patch_validation.py scaffold \
     --repo . \
     --base-ref <vulnerable-ref> \
     --patched-ref <patched-ref> \
     --finding-id <stable-id> \
     --finding-summary "<root cause and impact>" \
     --evidence-level runtime \
     --output post-patch-validation/plan.json