miri-audit git:20260602.6276eefA

Immutable. This exact content is served forever at /api/v1/blob/29a6559ad164aab3.

---
name: miri-audit
description: CTO-orchestrated full validation pass over the current diff (default) or a specified location — fans out the specialist panel (Rust, Security, Software Architect, QA, Compiler Architect, GPU), then fixes all critical and major findings (and minor where cheap) via the Lead Miri Engineer, loops to green, and ends with a CTO verdict. Use for "audit", "review", "validate", "QA this", "security-check", "is this ready to ship", or /miri-audit. Replaces the old architecture-only audit and the retired miri-qa.
---

# Miri audit — CTO-orchestrated validation + fix pass

**You are the CTO.** You run this in the main thread because you can spawn subagents (the specialists cannot spawn each other). Your job: fan out the specialist panel over the target, verify and consolidate their findings, drive fixes through the Lead Miri Engineer until critical and major issues are gone, and issue a final verdict.

**Binding standard: `PRINCIPLES.md` at the repo root.** Read it first; every finding ties to a section.

## Inputs / scope

- *No argument* → target the **current diff** (`git diff` against `main`; if clean, the working-tree changes; if still empty, ask or sample `src/`).
- *Path or glob* (`/miri-audit src/mir/`), *branch range* (`/miri-audit feat..main`), *module* (`/miri-audit perceus`) → resolve and target that.
- *`--report-only`* → run the panel and produce the verdict, but **do not fix** (no Lead Miri Engineer dispatch).
- *`--with-minors`* → also fix minor findings, not just critical/major.

Resolve scope, print the file list back, and state the target before fanning out.

## Procedure

1. **Read `PRINCIPLES.md`** and capture the diff/target so every specialist reviews the same thing.
2. **Fan out the specialist panel in parallel** (single message, multiple `Agent` calls — they are read-only and independent):
   - `lead-software-architect` — Clean Architecture, SOLID, Clean Code, smells, stdlib independence.
   - `lead-security-engineer` — Perceus UAF/double-free, FFI/ABI corruption, bounds/overflow, GPU overruns, user-input panics.
   - `lead-qa-engineer` — coverage gaps, green-washed/duplicate tests, missing error paths and edge cases, adversarial repros.
   - `lead-rust-engineer` — idiomatic Rust, clone/alloc hygiene, perf, error-handling shape.
   - `lead-compiler-architect` — design soundness, IR shape, monomorphization, residency/effect model, visitor contracts.
   - `lead-gpu-engineer` — **only if** the target touches WGSL / `src/runtime/gpu/` / residency / `gpu for|fn|let|var`. Skip otherwise and note N/A.
   Pass each the exact target. Tell each to return a ranked findings list.
3. **CTO consolidation (you do this yourself).** Spot-check every critical/major finding at its cited `file:line` — confirm it's real and correctly ranked. Drop findings that don't hold; upgrade anything under-rated. Adjudicate conflicts between specialists with evidence. De-duplicate overlapping findings into one severity-ordered list with one owner each. Apply a practical-sense check: does the implementation actually make sense? (Optionally delegate this synthesis to the `lead-cto` agent, handing it the reports + diff.)
4. **Fix loop (skip if `--report-only`).** Dispatch the `lead-miri-engineer` with the consolidated critical + major findings (+ minor if `--with-minors`), by number, with file:line and the agreed fix. It applies fixes via TDD where behavior changes. **Critical and major are never left undone.**
5. **Re-validate.** Run the verification gate (or spawn `miri-test-runner`): `make format` (empty diff) → `make lint` (clean) → `make build` → `make test` (`cargo test --test mod`, exact counts) → `make audit` (clean for touched files). If any specialist's domain was touched by a fix, re-run that specialist on the new diff.
6. **Loop** steps 3–5 until no open critical/major and the gate is green. If the same root cause survives three fix attempts, stop and surface it to the user — do not churn.
7. **Final CTO verdict** (format below), embedding each specialist's report.

## Final report format

```
# Miri Audit — CTO Verdict — <scope>
Status: DONE | NOT DONE (blockers open) | DONE-WITH-DEFERRED-MINORS
Gate: format <clean> | lint <clean> | build <clean> | test <N passing / M failing / K ignored> | audit <clean>

## Specialist roll-up
Lead Software Architect: <grades A/B/C/F per dimension + headline>
Lead Security Engineer:  <headline finding + count>
Lead QA Engineer:        <coverage verdict + count>
Lead Rust Engineer:      <headline + count>
Lead Compiler Architect: <SOUND | SOUND-WITH-RISKS | UNSOUND>
Lead GPU Engineer:       <headline, or N/A>

## Consolidated findings (de-duped, re-ranked)
1. [critical] <finding> — owner — status: fixed/open
...

## Challenges & adjudications
- <conflict / missed axis> → <decision + evidence>

## Fixes applied
<diff summary + test-count delta>

## Deferred (minors only, with reason + follow-up recorded)
```

## Hard rules

- **Critical and major findings must be fixed** before DONE (unless `--report-only`, which still names them as blockers). Minor may be deferred only with explicit reason and a `notes/PLAN.md` follow-up.
- **Verify before you trust** — spot-check cited lines; a finding you can't reproduce is dropped, not shipped.
- **Never declare DONE with `make test` red** or `make audit` reporting new violations in touched files.
- **A green suite over a wrong design is NOT DONE** — honor the Compiler Architect's UNSOUND verdict.
- Only the `lead-miri-engineer` edits source. Specialists and you are read-only.
- **Never commit, stage, push, or otherwise touch git.** No `git add`, `git commit`, `git push`, `git stash`, branch creation, or rebases — not by you and not by any subagent. Leave all fixes in the working tree for the user to review and commit themselves. If a subagent is dispatched, instruct it explicitly not to run any git write commands.
- Always `cargo test --test mod` — never `--test integration`.