audit-restore

/audit-restore — Remove a False-Positive Exception from the Allowlist

Purpose

Remove an entry from .claude/rules/audit-exceptions.md when an exception turns out to be a real bug — for example, after a refactor changes the threat model or the Council pass (/council audit-review) marks a previously-suppressed finding disputed.

Removal is guarded by an interactive [y/N] prompt that defaults to NO. The full entry block is displayed before the prompt so the user sees exactly what will be deleted.

---

Usage

/audit-restore <file:line> <rule>

Examples:

• /audit-restore src/foo.ts:42 SEC-XSS
• /audit-restore scripts/setup-security.sh:142 SEC-RAW-EXEC

---

When to Use

• After a refactor changes the data flow that justified the original exception.
• After a Council audit-review pass returns disputed for a previously-suppressed entry.
• When the rule itself is removed from the auditor's rule set (the entry is now meaningless).
• DO NOT use to "shut up" a stale exception you don't understand — read the original Reason field first; if the Reason no longer applies, that's a sign you genuinely want to restore.

---

Process

Step 1 — Parse Arguments

Parse the two required positional tokens: <file:line> and <rule>. No reason argument, no flags beyond the two positional tokens.

set -euo pipefail

ARGS=("$@")
if [ "${#ARGS[@]}" -ne 2 ]; then
    printf 'audit-restore: usage: /audit-restore <file:line> <rule>\n' >&2
    exit 2
fi

FILE_LINE="${ARGS[0]}"
RULE="${ARGS[1]}"

PATH_PART="${FILE_LINE%:*}"
LINE_PART="${FILE_LINE##*:}"

case "$LINE_PART" in
    ''|*[!0-9]*)
        printf 'audit-restore: <file:line> must end with :<positive integer>, got %q\n' "$FILE_LINE" >&2
        exit 2
        ;;
esac

EXC_FILE=".claude/rules/audit-exceptions.md"
HEADING="### ${PATH_PART}:${LINE_PART} — ${RULE}"

The em-dash in the HEADING string is a literal U+2014 character —. Type it directly — do not escape as — or —.