aaif-audit-slack

AAIF Slack Audit

Three engines over one workspace, same house rules — everything is read-only.

Three reports, one measurement layer.

Run whichever the user asked for. "Audit Slack" with no side named means all three reports. Order is fixed: organizers → activity → topics → members. The organizer engine goes first because it is the one with decisions attached. Activity must precede topics and members because its cache is what supplies the topic report's dormancy figures and the member report's "posted recently" line — run either first and those numbers are missing from a report you have already handed over. Topics additionally reads the organizer engine's audit.json to exclude chapter rooms from its unclassified list, so it goes after organizers.

The output is ONE HTML report. Run the four collectors — they exist to fill the cache and to be run standalone when someone wants just one side — then summarize_audits.py composes the deliverable:

for s in organizers activity topics members; do
  python3 ${CLAUDE_SKILL_DIR}/scripts/audit_$s.py
done
python3 ${CLAUDE_SKILL_DIR}/scripts/summarize_audits.py   # -> slack-full-audit.html
rm -f slack-organizers-audit.html slack-topics-audit.html \
      slack-members-audit.html slack-activity-audit.html   # scaffolding, holds PII

Do not hand over four separate reports. Four files drift out of step with each other the moment one is re-run, and the person reading them has to work out the ranking that summarize_audits.py already did. Delete the four standalone files once the combined one is written, for the same reason the caches are 0600 — a second copy of every member name and address in the working directory is a liability, not a convenience.

Activity is not opt-in. Asking for the organizer or member side alone still runs it, because its numbers are the only measured engagement in this skill and every other activity signal here is a proxy the reports refuse to use. Skip it only when the token lacks channels:history (the engine says so and exits) or the user explicitly asks you not to. It needs a history-scoped token — see the ceiling below — and answers questions about dead channels, engagement and posting volume.

Tooling rule — gws + Python only. Every read, edit, and write of a Drive file goes through the gws CLI, driven from Python. Prefer native Google formats: edit application/vnd.google-apps.* files with the Docs/Sheets/ Slides API. Drop to byte-level OOXML surgery on the .docx/.pptx/.xlsx zip parts (embedded fonts and untouched parts survive) only when the file genuinely is a stored Office file. Never use LibreOffice / soffice — not to edit, not to convert, and not to render a "just checking it locally" preview: it substitutes local system fonts for the brand fonts and drops OOXML it doesn't understand, so its output and its renders both misrepresent the real file. Same for unoconv and any desktop office suite. To see a file, render it through the API instead — a slide via aaif_events.slides_export.render_slide_png, a doc via gws drive files copy to a Google Doc → gws drive files export to PDF → trash the copy. Never round-trip a native Doc through .docx — it strips native features like Tabs.