validate

You are validating a freshly installed Dark Factory kit. This session's cwd is a throwaway notepad that validate-arm.sh armed for exactly this run — do not go looking for "the working notepad" the way VALIDATE-INSTALL.md Part 1's Task 0 does; you are already in it, and M-VALIDATE is already RUNNING in .df/missions/M-VALIDATE/state. The kit root is the parent of your cwd (..). The record is the one that RESOLVES for THIS machine, not "the file at the kit root": if LOOM_LOCK is set in your environment, that is it; otherwise run bash <kit-root>/vendor/dark-factory/boot-kit/scripts/identify.sh --match <kit-root>/instances (fall back to <kit-root>/boot-kit/scripts/identify.sh, if this kit ships one) and use the record it names, else the single <kit-root>/*.lock.json. A non-zero exit from --match now means no record matches this machine, not an error. On every Coder in a shared instance repo the kit-root file describes a DIFFERENT machine (the laptop) and identify.sh exits 3 against it — a run that validated that file would be the exact failure Task 1 exists to catch. Quote which record you used and how it was chosen.

Work the tasks below in order. Record each as PASS, FAIL, or UNKNOWN — UNKNOWN means you could not probe it, not that it passed. Quote commands and output verbatim; never paraphrase a denial or an error. Fix nothing until the end.

⛔ NEVER PRINT A SECRET — and a whole-environment dump IS printing one. This session's transcript is written to disk and kept. On a Coder workspace the pod env carries live hub PATs and the agent token, and ~/.mcp.json can hold literal bearers. MEASURED on the homelab box (2026-09-11 and twice on 2026-09-18): three validate runs each opened with a bare env, and one ran claude mcp get onedroid. Every one of those runs copied a live token into its transcript. So:

• Do not run env, printenv with no argument, set, export -p, declare -x, claude mcp get …, or cat/jq on ~/.mcp.json, ~/.claude.json or any rendered MCP config.
• Read one named, non-secret variable at a time, e.g. printenv LOOM_LOCK or printenv CLAUDE_CODE_ENTRYPOINT. To learn whether a secret is SET, test it without echoing it: [ -n "${SYNAPSE_ONEDROID_PAT:-}" ] && echo set.
• For MCP, claude mcp list (names and status) is enough. To show a config's shape, print its keys and URLs, never a header value. If you print a secret by mistake, say so in the report's Notes for the operator: name the variable and the transcript path, and never the value.

Part 1 — the parts of VALIDATE-INSTALL.md that still apply from inside this notepad

Tasks 0–4 of that document (orient, identity, ground truth, hooks, preflight) are about the KIT and do not depend on being in a notepad — if you need them, they are unchanged and live at <kit-root>/vendor/dark-factory/starter-kit/instance/VALIDATE-INSTALL.md on a kit (the vendorDir the lockfile names; starter-kit/instance/… only in a Tier-1 checkout). What changes in a notepad session is continuity, dispatch, and subagents, so those three are reproduced here adapted to it.