Help us improve
Share bugs, ideas, or general feedback.
From vanguard-frontier-agentic
Validates Salesforce deployment packages against sandbox orgs via dry-run, surfacing deployment issues, test failures, and metadata dependency problems without committing changes. Refuses production targets.
npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticHow this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:salesforce-deployment-validator-skillThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Sandbox-only deployment dry-run under T2 scope. This skill validates a
Executes Apex tests against a connected sandbox org, parses results and coverage delta, identifies failures with stack traces, and suggests fixes.
Orchestrates Salesforce metadata deployments with sf CLI v2: dry-run validation, targeted deploys, CI/CD workflow advice, scratch-org management, and failure triage.
Runs Salesforce production deployment checklist: sandbox validation via sf CLI, API limit checks, code quality review, config verification, and rollback planning.
Share bugs, ideas, or general feedback.
Sandbox-only deployment dry-run under T2 scope. This skill validates a
deployment package without committing any changes. It is a preflight check,
not a deployment. Production org targets are a hard refusal — any commit to
production must be routed through salesforce-live-guard-agent with explicit
human approval.
Use salesforce-deployment-validator-skill when the work requires pre-deploy
validation in a non-production environment:
This skill NEVER commits changes. The --check-only flag is always
active. The --dry-run semantic is enforced structurally — no commit path
exists in this skill.
Delegate elsewhere when:
| Situation | Skill to use |
|---|---|
| Target is a production org (any commit) | T3 — salesforce-live-guard-agent (HITL required) |
| Only static metadata review needed (no org) | salesforce-metadata-review-skill |
| Bulk data operations in sandbox | salesforce-bulk-data-ops-skill |
| SCA / code quality review of Apex | salesforce-apex-lwc-code-review-skill |
| Change impact risk assessment after validation | salesforce-change-impact-analyst-agent |
Before running any validation, confirm:
package.xml and the force-app/ tree, or a path to a bare package.xml
manifest. Accept only local filesystem paths, not org-to-org migration paths.--target-org value recognized by
sf org list. Never accept a raw instance URL or session token as input.--test-level RunSpecifiedTests. If the deployment touches Apex, a test
specification is mandatory.salesforce-change-impact-analyst-agent if it has already run. This
pre-populates the risk context in the audit envelope.If any of these are missing, ask before proceeding. Do not guess the target org alias — a wrong guess could validate against the wrong environment.
sf org display --target-org <alias>
Inspect the output for production indicators:
instanceUrl domain matches a known production pattern (see
references/production-refusal-rules.md)isSandbox field is false or absenttrailblazer.salesforce.com or login.salesforce.com in the OAuth
endpoint (non-sandbox pattern)orgType indicates Production or the org ID prefix pattern matches a
known production orgIf any indicator suggests production: STOP. Emit a refusal. Do not proceed.
If Step 1 reveals a production org, emit this refusal immediately:
refusal:
reason: "production_org_detected"
target_org_alias: "<alias>"
detected_indicators: ["<indicator1>", "<indicator2>"]
instruction: "Route to salesforce-live-guard-agent for HITL approval before any production deployment."
audit_timestamp: "<ISO-8601-UTC>"
Do not proceed. Do not run any Metadata API call against a production org.
Confirm the connected user has:
Deploy (Metadata API) permission — required for validationModifyAllData in production scope — enforced at the
Connected App allowlist and profile levelIf the Connected App allowlist does not include the target sandbox org ID, stop and escalate to the org administrator.
sf project deploy validate \
--manifest package.xml \
--target-org <sandbox_alias> \
--test-level RunSpecifiedTests \
--tests <TestClass1> <TestClass2> \
--wait 30 \
--json
Key flags:
--manifest package.xml — always use a manifest (not --source-dir for
validation; manifest gives explicit scope control)--target-org <alias> — never inferred; always explicit--test-level RunSpecifiedTests — preferred for scoped changes (see
references/test-selection-strategy.md for when to use RunLocalTests)--wait 30 — wait up to 30 minutes for async validation; adjust to org
test suite size--json — structured output for downstream parsingDo NOT pass --dry-run with intent to remove it — this flag is not how
Salesforce CLI controls commit vs. validate. The validate subcommand
is inherently non-committing. The deploy commit path is a separate command
(sf project deploy start) which this skill never calls.
From the JSON output, extract:
status — Succeeded / Failed / InProgressdeploymentId — the validation deployment ID (not a commit; does not
persist changes)numberTestsTotal, numberTestsCompleted, numberTestsFailednumberComponentErrorsrunTestResult.codeCoverageWarnings — classes below 75% thresholdrunTestResult.failures — individual test failure messagesdetails.componentFailures — specific metadata component errors and
dependency issuesPopulate and emit the audit envelope (see Audit Envelope Schema). The envelope must be emitted regardless of validation outcome — including on refusals.
Package the validation result, test outcomes, and audit envelope as the
input payload for salesforce-change-impact-analyst-agent for risk
assessment. Required handoff fields:
audit_envelopevalidation_verdicttest_resultscoverage_deltadependency_issuesrefusal_triggers_firedStop immediately and do not proceed if any stop condition is met (see Stop Conditions section).
Score the validation execution quality before emitting results. The production-refusal gate must pass — failure voids the score.
| Dimension | Points | What earns full marks |
|---|---|---|
| Production refusal gate | CRITICAL | Sandbox verified before any API call; production target causes immediate refusal |
| Test coverage | 25 | All changed Apex classes covered by specified tests; aggregate coverage ≥ 75%; no coverage warnings |
| Validation result clarity | 25 | JSON output parsed; all component errors enumerated with type and detail; no silent failures |
| Dependency analysis | 20 | All componentFailures with problemType: Missing enumerated; missing dependencies identified by name |
| Audit envelope | 15 | All required audit fields present; package manifest hash computed; timestamp accurate |
| Handoff routing | 15 | Structured payload prepared for salesforce-change-impact-analyst-agent; refusal triggers enumerated |
Scoring penalties:
--wait timeout expired with inconclusive result: −15Stop immediately and emit a refusal envelope when any of these conditions are detected:
| Trigger | Action |
|---|---|
| Target org identified as production | Hard refusal — do not proceed; route to salesforce-live-guard-agent |
Validation request implies commit (sf project deploy start) | Refuse — this skill never calls the commit command |
| Test specification missing for deployment containing Apex changes | Stop — require test class list before proceeding |
| Cross-org deploy from a production sandbox refresh (prod-sourced sandbox with prod data) | Escalate — treat as production-equivalent for data privacy |
| Connected App allowlist does not include target sandbox | Stop — escalate to org administrator |
--check-only false equivalent intent expressed | Refuse — this skill is validate-only |
Every validation emits an audit envelope. The envelope travels with the validation result to any downstream skill or agent.
audit_envelope:
skill_id: "salesforce-deployment-validator-skill"
skill_version: "0.1.0"
target_org_alias: "<alias>"
target_org_type: "sandbox" # must be 'sandbox'; never 'production'
package_manifest_path: "<local path to package.xml>"
package_manifest_hash: "<sha256 of package.xml content>"
validation_id: "<deploymentId from sf CLI JSON output>"
test_level_used: "RunSpecifiedTests | RunLocalTests | RunAllTestsInOrg"
tests_specified: ["<TestClass1>", "<TestClass2>"]
test_results_summary:
total: <integer>
passed: <integer>
failed: <integer>
failures: ["<ClassName.methodName: failure reason>"]
coverage_delta:
classes_below_threshold: ["<ClassName>"]
aggregate_coverage_percent: <0-100>
deployment_proposed: false # always false — this skill never commits
component_errors:
- component: "<MetadataType>.<ApiName>"
problem_type: "<Missing|Error|Warning>"
problem: "<error message>"
refusal_triggers_fired: ["<trigger name or 'none'>"]
audit_user_role: "<Connected App OAuth username>"
timestamp: "<ISO-8601-UTC>"
validation_verdict: "Succeeded | Failed | Refused | Inconclusive"
test_results:
total: <integer>
passed: <integer>
failed: <integer>
coverage_warnings: ["<ClassName: X% coverage>"]
failures:
- class: "<TestClassName>"
method: "<testMethodName>"
message: "<failure detail>"
coverage_delta:
aggregate_coverage_percent: <0-100>
classes_below_75_percent: ["<ClassName>"]
notes: "<coverage trend vs. last known baseline if available>"
dependency_issues:
- type: "<MetadataType>"
api_name: "<ApiName>"
problem: "<what is missing or broken>"
refusal_triggers_fired:
- "<trigger name or 'none'>"
change_impact_handoff:
target_agent: "salesforce-change-impact-analyst-agent"
payload_ready: true | false
notes: "<what the analyst agent should focus on>"
missing_evidence:
- "<what would strengthen the validation — e.g., missing test classes, missing dependencies>"
assumptions:
- "<explicit list of assumptions made>"
audit_envelope:
<see Audit Envelope Schema>
| Situation | Hand off to |
|---|---|
| Validation complete — risk assessment needed | salesforce-change-impact-analyst-agent |
| Static Analysis / SCA findings from Apex code | salesforce-apex-lwc-code-review-skill or salesforce-devsecops-pipeline-skill |
| Production commit approved after validation | salesforce-live-guard-agent (HITL required) |
| Metadata review (static, no org) | salesforce-metadata-review-skill |
Required handoff fields for all outbound payloads: audit_envelope,
validation_verdict, refusal_triggers_fired, missing_evidence,
assumptions.
Stop immediately and do not continue if:
sf org display indicates isSandbox: false
or production URL pattern. Stop, emit refusal envelope, route to
salesforce-live-guard-agent.sf project deploy start or
equivalent. This skill does not call the commit command. Refuse and explain.--wait timeout exceeded with no result — emit an Inconclusive verdict
with the partial output and note the timeout. Do not re-run automatically.sf project deploy validate command is inherently non-committing
but production refusal is enforced at the org-type check level before any API
call is made.sf project deploy validate only —
never sf project deploy start. The commit path does not exist in this skill's
allowed-tools scope.sf org display before proceeding.sf project deploy validate makes no persistent changes to
the target org. The validation deployment ID is transient and does not alter
metadata in the org.salesforce-live-guard-agent.| File | When to read |
|---|---|
references/cli-commands.md | sf CLI deploy validate command flags, sf apex run test, sf org display, manifest formats |
references/production-refusal-rules.md | Detection rules for production orgs, refusal audit emission, live-guard routing |
references/test-selection-strategy.md | RunSpecifiedTests vs. RunLocalTests vs. RunAllTestsInOrg; 75% coverage; test list construction |