CodexSkin Tools True MVP — Enhanced only
LOCAL VALIDATOR · FILES NEVER EXECUTED

Validate Enhanced Theme Files

Select one theme.json and its referenced image. Run strict structural checks locally, then read Runtime status separately.

  1. 01Select pair
  2. 02Run checks
  3. 03Resolve results
01 · SELECT LOCAL PAIR

Files to inspect

Choose the JSON and the exact image it references.

One Enhanced theme JSON. Native input is disabled in the True MVP.
The image file referenced by the theme JSON.
Technical file metadata
File metadata (computed locally)
theme.json size
Not available — no file selected
image size
Not available — no file selected
image dimensions
Not available — no file selected
SHA-256 (theme.json)
Not available — no file selected
SHA-256 (image)
Not available — no file selected
02 · STRUCTURAL REPORT

Validation result

Resolve every FAIL and review WARN before local use.

No report yet
Select the supported local files to begin validation. Nothing has been uploaded.
Structural status
Not run
Runtime status
NOT_VERIFIED
Validator does not create formal runtime evidence by itself.

Choose the files to inspect

Select a theme JSON and its referenced PNG, JPEG, or WebP image, or a supported package when the implementation explicitly accepts it. Validator processes the selected content in the browser under the True MVP contract. It does not upload the files, execute theme packages, operate Codex, or connect to the local Engine.

Checks performed

The report may inspect JSON syntax and root shape, frozen schema version, required fields, enum and color formats, image basename and type, image dimensions and metadata, file counts, archive structure, unexpected executable or script content, traversal paths, nested archives, and available SHA-256 values. The UI must list the check, result, evidence, and corrective action instead of showing only a total score.

Structural result meanings

PASS means known structural checks passed for the supplied files. WARN means the structure can be read but a non-blocking condition needs review. FAIL means a known blocking rule was violated. CANNOT_VERIFY means the checker could not complete a required check because an input, counterpart file, parser, metadata decoder, hashing capability, browser feature, or target evidence was unavailable.

  • Do not rename PASS as a compatibility result.
  • Do not hide WARN details behind color alone.
  • Do not offer an apply action after FAIL.
  • Keep CANNOT_VERIFY visible until the missing check can actually run.

Runtime is a separate record

Validator does not create formal runtime evidence by itself. Runtime status must remain NOT_VERIFIED unless a record names the exact OS and architecture, Codex build, Engine version, Runtime SHA, artifact hash, date, evidence hash, and Restore evidence. Reference material may be labeled REFERENCE_ONLY. A build or artifact change requires REVERIFY_REQUIRED.

Integrity values

When available, SHA-256 values let a user compare the exact theme JSON, image, or package against a published record. A matching value supports integrity comparison only. It is not a digital signature, identity proof, malware review, safety certificate, license grant, or evidence that the theme works on a platform.

Read and act on the report

Resolve every FAIL before considering local use. Review WARN items and decide whether the documented fallback is acceptable. For CANNOT_VERIFY, provide the missing counterpart file or use a supported browser rather than assuming a positive result. After a clean structural review, read source rights and platform runtime evidence, then follow Install, macOS, or Windows instructions.

Package boundaries

Do not continue with scripts, executable content, nested archives, path traversal, symlink entries, encrypted or unsupported archives, unexpected files, or a package whose image and JSON references do not agree. Validator reports structure; users must still review source, license, redistribution permission, and local Engine instructions.

Clear local data

Reset removes the current report and revokes temporary object URLs in the tab. The current implementation does not promise persistence after refresh. If a report download is offered, it should contain the selected results and available hashes without silently uploading the source files.

Independent boundary

Enhanced themes require the independent Codex Dream Skin local engine. Validator does not directly control Codex and cannot turn missing runtime evidence into a claim. CodexSkin Tools is an independent project and is not affiliated with, endorsed by, or sponsored by OpenAI.

States

empty
Select the supported local files to begin validation. Nothing has been uploaded.
validating
Running local structural checks in this tab…
pass
Structural status: PASS. Known checks passed; review Runtime status separately.
warn
Structural status: WARN. Review the listed non-blocking conditions.
fail
Structural status: FAIL. Do not proceed until blocking results are corrected.
cannot_verify
Structural status: CANNOT_VERIFY. One or more required checks could not run.

Errors

json_parse
The theme JSON could not be parsed. Correct the syntax and run validation again.
counterpart_missing
The referenced image or theme JSON counterpart is missing, so the pair cannot be verified.
unsupported_package
This package structure or compression method is not supported. No positive result was produced.
local_check_failed
A local browser check failed unexpectedly. Clear the report and retry without assuming a PASS result.

Frequently asked questions

What does the Validator check?

It checks supported structural rules for the supplied JSON, image, or accepted package, and reports each completed, warning, failed, or unavailable check.

Why can Validator return CANNOT_VERIFY?

A required input, counterpart file, parser, metadata decoder, hashing capability, browser feature, or evidence item was unavailable, so the checker cannot honestly produce a positive or negative result.

Does a matching SHA-256 prove a theme is safe or compatible?

No. A matching hash supports byte-for-byte integrity comparison only; it is not a signature, certification, malware review, rights grant, or runtime test.