audit-infra

Infrastructure Audit

Runs 12 fixed infrastructure checks and reports each as PASS/WARN/FAIL — the exact enum the /audit command aggregates into its Grand Summary.

Hard Rules

1. Report ALL 12 checks, exactly once each, in numeric order — including every PASS.
2. The only verdicts are PASS / WARN / FAIL. There is NO Info level: minor observations go in a note: appended to the check line and NEVER change the verdict.
3. Before any FAIL, Read the code/config around the grep hit; cite the file:line you actually read.
4. If a check's target is absent from the repo (e.g., no Dockerfile) → PASS with note: not applicable — <missing component>. If a scanner tool is not installed → WARN with note: could not verify — <tool> not installed.
5. Never invent scanner output. Summarize real command output only; if a command errors, quote the error.
6. A clean run (12 PASS) is a valid result — do not manufacture findings.

Phase 0 — Load Project Context

Read if present, skip silently if absent: CLAUDE.md or AGENTS.md; docs/architecture/deployment.md. Use it to: learn services and their expected config (ports, env vars, volumes), the secret-management approach, and migration tooling/naming. Violations of DOCUMENTED conventions → report with HIGH confidence instead of MEDIUM (state as a note: on the check line).

Detection Strategy

Auto-detect components by scanning for:

• docker-compose.yml / Dockerfile — containerized services
• .github/workflows/ / .gitlab-ci.yml / Jenkinsfile — CI/CD pipelines
• *.env* files — environment configuration
• migrations/ — database migration files
• nginx.conf / caddy / reverse-proxy configs
• package.json / go.mod / requirements.txt — dependency manifests

Component not detected → its check is PASS with note: not applicable (Hard Rule 4).

Evidence Gate

Assign FAIL only if all four hold:

1. Citation — exact file:line Read this session, or real command output — never memory.
2. Failure mode — concrete: what leaks or breaks, under what condition.
3. Context — you read the surrounding config/code, not just the grep hit.
4. Verdict you can defend to a skeptic. Uncertain hit → WARN with note: needs verification, never FAIL.