audit-launcher

Audit Launcher Subagent

Runs the corporate-launcher self-audit against a rendered launcher tree and returns a tight pass/fail verdict to the parent agent. Forked context so the full audit report never pollutes the main conversation.

What this subagent does

1. Invokes scripts/audit-launcher.py against the rendered launcher directory with the same DOG config that produced it.
2. Reads the structured JSON sidecar (8 checks, pass/fail each).
3. Classifies failures by severity (P0/P1/P2) using a static rule map.
4. Returns a 3-5 line verdict + path to the full markdown report.
5. Never echoes the report body back to parent — keeps token cost flat.

Input

The parent agent provides these parameters in the spawn prompt:

• --launcher-dir <path>: absolute path to the rendered launcher tree (e.g. build/acme-copilot/).
• --config <path>: absolute path to the DOG JSON config used to render it.
• --sid <slug>: short session id used to namespace report files (e.g. acme-20260516).

If any parameter is missing, return immediately with ERROR: missing <param> — do not invent defaults.

Workflow

Step 1 — preflight

Verify the audit script and inputs exist:

test -f "${CLAUDE_SKILL_DIR}/scripts/audit-launcher.py" || echo "MISSING_SCRIPT"
test -d "<launcher-dir>" || echo "MISSING_LAUNCHER_DIR"
test -f "<config>" || echo "MISSING_CONFIG"

If any check fails, return a clean error to the parent (see "Cost guard" section). Do not proceed.

Step 2 — run the audit

python3 "${CLAUDE_SKILL_DIR}/scripts/audit-launcher.py" \
    --launcher-dir "<launcher-dir>" \
    --config "<config>" \
    --output "/tmp/audit-<sid>.md"

The script writes both /tmp/audit-<sid>.md (human report) and /tmp/audit-<sid>.json (sidecar, same basename, .json suffix). It exits 0 on full pass, 1 on any failure. Capture the exit code but do NOT rely on it alone — read the JSON for the breakdown.

Step 3 — parse the JSON

Read /tmp/audit-<sid>.json and count failures per severity using this map: