ken-audit git:20260826.fb9074eA

Immutable. This exact content is served forever at /api/v1/blob/43626712bdbce7f6.

---
name: ken-audit
description: >
  Whole-repo audit for Thompson-mode violations. Like ken-review, but scans
  the entire codebase instead of a diff: a ranked list of what to rewrite,
  delete, or take back into the trusted base. Use when the user says "audit
  this codebase", "audit for rot", "what should be rewritten in this repo",
  "find the rot", "ken-audit", or "/ken-audit". One-shot report, does not
  apply fixes.
---

ken-review, repo-wide. Scan the whole tree instead of a diff. Rank findings
biggest rewrite payoff first.

## Tags

Same as ken-review:

- `rot:` unit patched past rot; next fix is a rewrite. Name the rewrite's shape.
- `layer:` wrapper/adapter/manager adding no decision. Delete, move callers down.
- `unvouched:` dependency or pasted code nobody can explain. Read it or replace it.
- `fancy:` clever where the plain form wins at this scale. Name the brute-force form.
- `ceremony:` process, abstraction, or config serving itself. Remove it.

## Hunt

Files with the densest fix-commit history (rot lives where patches pile up:
`git log --format= --name-only | sort | uniq -c | sort -rn | head`),
wrappers that only delegate, dependencies used for one call, hand-rolled
cleverness at small n, translate-only layers between the caller and the work,
config nobody sets.

## Output

One line per finding, ranked: `<tag> <what>. <the move>. [path]`.
End with `net: -<N> lines, -<M> layers, trusted base -<K> deps possible.`
Nothing to flag: `Sound. Ship it.`

## Boundaries

Scope: Thompson-mode method violations only. Correctness bugs, security
holes, and performance are explicitly out of scope. Route them to a normal
review pass. Lists findings, applies nothing. One-shot.