[justinmclean]

Summary

• validate_organization_structure only required README.md and organization.md to exist, so an empty manifest, or one missing a key, passed, and every key it omitted resolved silently to the framework default instead of the organization's value.
• New validate_organization_manifests derives the required set from organizations/_template/organization.md: every key its uncommented yaml blocks declare, which is the organization identity (id, name, url, logo) and the governance vocabulary (seven keys). The template comments out the capability bundle, so those keys stay optional. Each adapter must declare every required key (null is a declared value, as independent uses it), organization_identity.id must match the directory name, and a manifest declaring no keys fails.
• HARD, in the existing organization category, wired into run_validation. Stdlib-only parsing (fenced yaml blocks, two levels deep, comments declare nothing). A tree without the template skips the check.

Plan item org-manifest-content-check (specs/organization-adapters.md).

Type of change

• Python package (tools/*/ with pyproject.toml)
• CI / dev loop (prek, workflows, validators)

Test plan

• 10 new tests: keys parsed from yaml fences only, inline comments stripped, commented blocks declare nothing; complete manifest clean with null values; an omitted required key named; optional blocks may be omitted or added; empty manifest fails; id must match the directory; no template skips; a missing manifest is left to the structure check; reached through run_validation; the in-tree adapters pass.
• Live tree: the ASF and independent adapters pass as they stand (confirmed before landing, as the plan item asks); skill-and-tool-validate exits 0.
• uv run --directory tools/skill-and-tool-validator --group dev pytest: 502 passed, 1 skipped; mypy clean; ruff clean.
• prek run --all-files --skip workspace-pytest: every hook passes except skill-token-count (tokenizer download blocked in the authoring sandbox; no SKILL.md touched). RAT: 0 unapproved.

RFC-AI-0004 compliance

Not applicable (validator only).

Linked issues

None.

Notes for reviewers (optional)

• The template never says "required" in words; it says omitted keys fall through. The live skeleton vs commented-out bundle is the split it does draw, and it is what the website relies on for identity. If a key should be optional after all, comment it out in the template and the check follows.
• Generative-AI disclosure: authored with Claude Code under maintainer direction; the commit carries the Generated-by: trailer.

[potiuk]

Thanks — deriving the required keys from the template keeps the check from drifting, and ASF and independent both pass. I rebased the branch onto main and pushed one fixup commit, 0122d4c (please pull before pushing again):

• organizations/_template/organization.md and organizations/README.md — the template still said "any key you omit falls through to the framework default", which this HARD check now contradicts for the identity and governance-vocabulary keys. Both now say those keys are required (null allowed) and only the commented-out capability bundle falls through.
• organization_manifest_keys read only two-space indented block YAML with LF endings, so a valid four-space or CRLF manifest was reported as "declares no keys". Any indent and CRLF are now read (with a test); the omitted-key message says the validator reads block-style YAML, since a flow mapping (block: { key: value }) still is not.
• tools/spec-loop/specs/organization-adapters.md — the "presence, not content" Known gap is closed, and the enforcement section describes the content check.

GitHub has not yet computed whether this branch merges cleanly with its base.

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The maintainer
approving this PR has read the findings and signed off. If
something feels off, please reply on the PR and a maintainer
will follow up.

More on how Apache Magpie handles maintainer review:
Contributing guide.