git:20260914.dbab098 to git:20260915.3d7652b

30 added, 210 removed. Audit A to A.

---

name: repo-audit

- description: "Use when a known frontend, Java, or Rust surface needs a scoped, read-only audit of existing architecture, ownership, state, transactions, concurrency, persistence, performance, accessibility, visual fidelity, build/tooling, or unsafe boundaries without a change basis; select one or more language profiles; use repo-review when a Worktree or immutable change basis needs coordination."

+ description: "Use when a bounded read-only frontend, Java, or Rust audit of existing paths without a change basis is needed; use repo-review for a Worktree, commit, range, or review package."

---

# Repository Audit

- Audit existing engineering from repository evidence rather than a universal

- template or an external reference repository. Detect the real languages,

- frameworks, and local contracts, then select only the profiles required by the

- request. This Skill is read-only: use it directly for bounded domain audits or

- as a bounded specialist under `repo-review`; use the matching `dev-*` owner for

- requested changes.

- Consume `urn:skills:audit-request:v1`; the portable output is

- `urn:skills:audit-findings:v1`. When supplied, consume an exact

- PackageManifest/basis plus compatible graph asset/consumer/impact results. The

- audit produces findings and validation Observations, not Task/Requirement

- status or a delivery Receipt. It audits the current state of a declared scope

- and never attributes findings to a change; `repo-review` owns fixed-basis

- change attribution.

- ## Rule Priority

- Resolve conflicts in this order:

- 1. The user's current explicit request.

- 2. Effective repository guidance, including `AGENTS.md`, `CLAUDE.md`, and

- host-provided instructions when present.

- 3. Declared and applicable product/UI contracts: product requirements or

- product Feature Specs define behavior and acceptance; selected-source UI

- Feature Specs and resolved `<design-root>/DESIGN.md` define applicable UI

- and shared visual semantics.

- 4. Live code, toolchain, configuration, and the repository-declared system

- define current implementation facts. They do not override an applicable

- contract; report a conflict as implementation drift.

- 5. This Skill and its selected profiles.

- 6. External reference repositories.

- Never rewrite a working local structure merely to match this Skill or an

- external repository. Open-source references form questions, not

- target-repository defects by stylistic comparison.

- ## Workflow

+ ## Entry Gate

- 1. Resolve the audit scope: repository/build root, module, surface, and the

- requested outcome. Read effective guidance, record the inspected revision

- plus relevant Worktree state for reproducibility, and run `git status

- --short`. This inspection snapshot does not turn the audit into change

- attribution. When `repo-review` delegates paths or a diff, record the exact

- boundary and keep the caller as review coordinator. Stop with

- `scope-ambiguous` when the target surface cannot be determined.

- 2. Select exactly one or more language profiles for the audited surface and

- load only those profiles:

- - [frontend profile](references/frontend-profile.md) for a browser-facing

- frontend surface;

- - [java profile](references/java-profile.md) for Java source or Java-owned

- Spring/build configuration;

- - [rust profile](references/rust-profile.md) for a Rust workspace or

- subsystem.

- A repository containing multiple languages gets one profile per audited

- surface, not a default whole-repository sweep. Do not audit language

- semantics that no profile owns, such as Kotlin, Groovy, or Scala source; a

- bounded framework/configuration audit may proceed only when those language

- risks are explicitly excluded.

- 3. Within each selected language profile, follow its framework, runtime, and

- risk-profile selection rules. State every selected profile and mark every

- unselected profile `Out of scope`. A query miss never proves absence, and a

- derived Markdown view is not audit evidence.

- 4. Map each selected responsibility to its concrete owner: page, feature,

- primitive, service, store, schema, module, crate, command, migration, or

- adapter. Consume a compatible graph asset/consumer/impact query when

- supplied; reject stale or mismatched graph results and reproduce a bounded

- targeted inventory instead.

- 5. Gate every candidate finding on: reachable path or material relevance,

- concrete impact, precise owner and location, attribution limited to the

- declared audit scope, counterevidence, and a falsifiable validation seam.

- Checklist-only matches, style preferences, and external-repository

- comparison do not satisfy this gate. When code-quality concerns materially

- apply, load [code quality](references/code-quality.md) with audit

- semantics; load [codebase design](references/codebase-design.md) for a

- selected module/API/testability audit.

- 6. When the selected surface crosses reachable runtime/configuration,

- packaging, public contracts, durable data, replacement compatibility,

- auth/security, deployment, or another repository, load

- [project grounding](references/project-grounding.md) and bound the audit

- through its signal-to-evidence chain. Activate it from semantic

- reachability, never from directories, framework presence, or literals

- alone.

- 7. Validate with non-mutating repository-defined commands and representative

- data. Do not run known apply/fix or tracked-source generation commands in

- the audited Worktree. If the repository offers only write-capable

- validation, skip it and report the gap or hand it to a workflow with an

- isolated Worktree. With explicit authorization, use only test-owned

- ephemeral containers, databases, brokers, or processes; never write shared,

- staging, or production state. Recheck status/diff afterward. If an

- otherwise non-mutating command creates tracked drift, stop validation,

- report the exact contamination, mark affected evidence `Not verified`, and

- do not revert it without explicit authorization. Request browser or

- real-client evidence through `ops-browser`/`ops-client` only when a

- selected claim cannot be proven statically. Compilation alone does not

- prove authorization, rollback, migration, query, concurrency, or runtime

- behavior.

- 8. Stop when the selected profiles are supported by evidence or explicitly

- blocked. Do not perform shallow checks for excluded profiles merely to

- imply coverage.

- 9. Report severity-ranked P0-P3 findings with exact location, profile-specific

- evidence, impact, remediation owner/direction, validation gap, selected

- profiles, and excluded profiles. In specialist mode, return findings to the

- coordinating `repo-review` without issuing the final readiness verdict.

- 10. When Forgeway delivery integration is active, bind the audit to an

- immutable Run, exact input/result PackageManifest, and typed input refs.

- Attach each finding or validation result as an Observation against that

- exact package. Do not hand-edit a Gate, rewrite prior Observations after a

- retry, or infer reviewed/delivered state.

+ Audit declared existing path scope only. Require a language/profile and evidence basis;

+ do not turn broad exploration into a change-basis review, source fix, or runtime claim.

- ## Hard Rules

+ ## Route Map

- - Resolve toolchain, layout, ownership, and API expectations from repository

- evidence, not machine defaults, framework convention, or a reference

- project's structure. Treat annotations, dependencies, scanner matches,

- lints, and code shape as signals that still require reachability, impact,

- and counterevidence.

- - Select profiles before applying detailed checklists and load only the

- selected language, framework, and risk references. Do not cross-apply an

- unselected profile or imply its coverage.

- - Separate source/config evidence from packaged and rendered-runtime proof;

- report unsupported claims as `Not verified`, not generic defects. Use `Not

- found` only for a searched-for repository fact that is absent.

- - Do not claim dependency vulnerability, exploitability, secret exposure, or

- complete security coverage without the matching evidence. When a selected

- profile exposes a security-relevant condition, return the domain evidence,

- authoritative control boundary, counterevidence, and proof gap without

- claiming exploit validation or fix completion; route an explicit

- vulnerability scan, attack-path, or PoC-validation request to an available

- host security workflow.

- - Do not edit, stage, commit, post review comments, or deliver code in audit

- mode. Route accepted remediation to the matching `dev-*` owner.

- `repo-review` owns Worktree and immutable review coordination;

- `repo-delivery` alone owns Git mutation.

+ | Request condition | Read | Result |

+ | --- | --- | --- |

+ | Any audit route | [rule priority](references/rule-priority.md) | Resolved evidence authority |

+ | Frontend baseline | [frontend profile](references/frontend-profile.md) and [frontend checklist](references/frontend-review-checklist.md) | Selected frontend concerns |

+ | Frontend architecture, state/data, or component ownership applies | [architecture](references/frontend-architecture-and-ownership.md), [state/data](references/frontend-state-data-and-forms.md), and/or [components](references/frontend-component-system.md) | Concern-specific findings |

+ | Frontend styling, CSS, layout, or design-system concern applies | [styling systems](references/frontend-styling-systems.md), [style/layout](references/frontend-styling-and-layout.md), [CSS](references/frontend-css-governance.md), and/or [layout governance](references/frontend-layout-governance.md) | Concern-specific findings |

+ | Frontend framework, build, accessibility/performance, desktop, or anti-pattern concern applies | [framework](references/frontend-framework-profiles.md), [build](references/frontend-build-tooling.md), [accessibility/performance](references/frontend-accessibility-and-performance.md), [desktop](references/frontend-desktop-tauri.md), and/or [anti-patterns](references/frontend-anti-patterns.md) | Concern-specific findings |

+ | Frontend selected-source, visual, or DESIGN authority applies | [visual evidence](references/frontend-visual-evidence.md), [DESIGN compliance](references/frontend-design-md-compliance.md), [visual direction](references/visual-direction-and-anti-slop.md), and/or [specification authorities](references/specification-authorities.md) | Qualified visual findings/gaps |

+ | Frontend protocol concern applies | [frontend protocol contracts](references/frontend-protocol-contracts.md) | Qualified contract findings |

+ | Java baseline or engineering concern applies | [Java profile](references/java-profile.md), [Java checklist](references/java-checklist.md), and [Java engineering](references/java-engineering.md) | Selected Java concerns |

+ | Java protocol concern applies | [Java protocol contracts](references/java-protocol-contracts.md) | Qualified contract findings |

+ | Rust baseline, architecture, ownership, API, async, or memory concern applies | [Rust profile](references/rust-profile.md), [Rust checklist](references/rust-review-checklist.md), [baseline/lifecycle](references/rust-project-baseline-and-lifecycle.md), [architecture](references/rust-architecture-and-modules.md), [ownership/resources](references/rust-ownership-and-resources.md), [errors/API](references/rust-errors-and-api-design.md), [async](references/rust-async-and-concurrency.md), and/or [memory](references/rust-memory.md) | Selected Rust concerns |

+ | Rust unsafe/security, web/desktop, SQLite, performance, testing, or anti-pattern concern applies | [unsafe/security](references/rust-unsafe-and-security.md), [web/desktop](references/rust-web-and-desktop-boundaries.md), [SQLite](references/rust-sqlite.md), [performance](references/rust-performance.md), [testing](references/rust-testing-and-quality.md), and/or [anti-patterns](references/rust-anti-patterns.md) | Concern-specific findings |

+ | Rust agent-runtime concern applies | [agent runtime](references/rust-agent-runtime-profile.md) | Runtime-boundary findings/gaps |

+ | Cross-profile quality, OpenAPI, grounding, or design concern applies | [codebase design](references/codebase-design.md), [code quality](references/code-quality.md), [OpenAPI governance](references/openapi-contract-governance.md), and/or [project grounding](references/project-grounding.md) | Cross-boundary findings/gaps |

- ## Do Not Use For

+ ## Invariants

- - Repository orientation, commands, reuse inventory, or docs/code alignment

- without an audit request; use `repo-map`.

- - Implementation, modification, refactoring, or migration in any profiled

- language; use `dev-frontend`, `dev-typescript`, `dev-java`, or `dev-rust`.

- - Root-cause diagnosis of a concrete failure; use the host's built-in

- diagnosis under effective instructions.

- - Owning Worktree readiness or immutable repository/range/PR/release

- coordination; use `repo-review`, which may delegate a bounded surface here.

- - Actual staging, commit, rebase/squash, push, or delivery; use

- `repo-delivery`.

- - Browser or real desktop runtime operation; use `ops-browser` or

- `ops-client`.

- - Creating a resolved `<design-root>/DESIGN.md` or selected-source Feature

- Specs; use `ui-spec`.

- - A general repository/path vulnerability scan or explicit exploit validation;

- use an available host security workflow.

+ - Audit only the declared profile/path scope; a miss or static signal is not absence/runtime proof.

+ - Findings need owner, reachability, concrete impact, and falsifiable validation.

+ - Do not edit source, mutate Git, replace `repo-review`, or claim browser/client/runtime coverage without that evidence.

- ## Output Contract

+ ## Output Map

- Lead with one capability ID per selected language profile

- (`frontend.surface.audit`, `java.surface.audit`, `rust.surface.audit`), typed

- audit-findings/Observation refs, Run and PackageManifest refs when integration

- is active, the inspection snapshot, selected language/framework/risk profiles,

- explicitly excluded profiles, and the coordinating owner when delegated. For

- each finding, report impact, exact location, profile-specific evidence,

- counterevidence, remediation owner/direction, and validation gap. Then

- summarize inspected guidance/manifests/source/tests/commands, existing reuse

- candidates, the ownership map, selected-profile evidence, commands and

- ephemeral resources used, cleanup, and all `Not found` or `Not verified`

- residual risks. Mark each profile's applicability (`Applicable`/`Not

- applicable`) separately from its evidence status (`Verified`/`Failed`/`Not

- verified`).

+ Return profile, scope/basis, findings, evidence, checks, exclusions, and `Not verified` gaps.

- ## References

+ ## Reference Map

- - Language profiles: [frontend](references/frontend-profile.md),

- [Java](references/java-profile.md), [Rust](references/rust-profile.md).

- - Shared depth: [code quality](references/code-quality.md),

- [codebase design](references/codebase-design.md),

- [grounding](references/project-grounding.md),

- [OpenAPI governance](references/openapi-contract-governance.md).

- - Frontend specialty: [architecture](references/frontend-architecture-and-ownership.md),

- [frameworks](references/frontend-framework-profiles.md),

- [components](references/frontend-component-system.md),

- [state/data/forms](references/frontend-state-data-and-forms.md),

- [layout/style](references/frontend-styling-and-layout.md),

- [styling systems](references/frontend-styling-systems.md),

- [CSS governance](references/frontend-css-governance.md),

- [layout governance](references/frontend-layout-governance.md),

- [visual evidence](references/frontend-visual-evidence.md),

- [visual direction](references/visual-direction-and-anti-slop.md),

- [DESIGN.md](references/frontend-design-md-compliance.md),

- [specs](references/specification-authorities.md),

- [protocol contracts](references/frontend-protocol-contracts.md),

- [Tauri](references/frontend-desktop-tauri.md),

- [accessibility/performance](references/frontend-accessibility-and-performance.md),

- [build](references/frontend-build-tooling.md),

- [checklist](references/frontend-review-checklist.md),

- [anti-patterns](references/frontend-anti-patterns.md),

- [sources](references/frontend-reference-corpus.md).

- - Java specialty: [Java engineering](references/java-engineering.md),

- [protocol contracts](references/java-protocol-contracts.md),

- [checklist](references/java-checklist.md).

- - Rust specialty: [architecture](references/rust-architecture-and-modules.md),

- [baseline/lifecycle](references/rust-project-baseline-and-lifecycle.md),

- [ownership](references/rust-ownership-and-resources.md),

- [errors/API](references/rust-errors-and-api-design.md),

- [web/desktop boundaries](references/rust-web-and-desktop-boundaries.md),

- [agent runtime](references/rust-agent-runtime-profile.md),

- [async/concurrency](references/rust-async-and-concurrency.md),

- [performance](references/rust-performance.md),

- [memory](references/rust-memory.md),

- [SQLite](references/rust-sqlite.md),

- [testing](references/rust-testing-and-quality.md),

- [unsafe/security](references/rust-unsafe-and-security.md),

- [checklist](references/rust-review-checklist.md),

- [anti-patterns](references/rust-anti-patterns.md),

- [sources](references/rust-reference-corpus.md).

- - Evaluation: [eval cases](references/eval-cases.md),

- [frontend scenarios](references/frontend-eval-scenarios.md),

- [Java scenarios](references/java-eval-scenarios.md),

- [Rust scenarios](references/rust-eval-scenarios.md).

+ - Read [rule priority](references/rule-priority.md) for every audit route.

+ - Load only the concern-specific references in the selected Route Map row; do not load an entire language group by default.

+ - Maintainers/calibration only: read [eval cases](references/eval-cases.md), [frontend scenarios](references/frontend-eval-scenarios.md), [Java scenarios](references/java-eval-scenarios.md), [Rust scenarios](references/rust-eval-scenarios.md), [frontend corpus](references/frontend-reference-corpus.md), or [Rust corpus](references/rust-reference-corpus.md); do not load them during ordinary runtime.