harness-audit

harness-audit — is the harness already doing this?

Our automation only ever grows. Nothing in the workflow ever asks "does Claude Code do this natively now?" — so redundant rules accumulate, crowd out the ones that still earn their place under the word budget, and eventually read as deliberate because they have sat there so long.

This skill is that missing question, run on a schedule.

Resolve the repository locator before either pass:

resolve_script() {
  local name="$1" candidate
  for candidate in \
    "$HOME/.claude/skills-worktree/.claude/scripts/$name" \
    "$HOME/.claude/scripts/$name" \
    ".claude/scripts/$name"; do
    if [[ -x "$candidate" ]]; then echo "$candidate"; return 0; fi
  done
  return 1
}
REPO_ROOT_SH=$(resolve_script repo-root.sh || true)
[[ -n "$REPO_ROOT_SH" ]] || { echo "ERROR: repo-root.sh not found (checked all three paths) — harness inventory root unavailable" >&2; exit 1; }

ADVISORY ONLY — NON-NEGOTIABLE. This skill never edits, deletes, moves, or rewrites a rule, skill, script, or hook. Not even an obviously-dead one. Not even when the verdict is unambiguous. Its entire output surface is a report plus GitHub issues. A human reads the verdicts and lands the change through the normal issue → branch → PR flow. If you catch yourself reaching for Edit/Write on an audited artifact, stop — that is the one thing this skill is not allowed to do.

The two-pass shape (and why)

Pass	Cost	Model	What it does
Inventory	Cheap — one script	Whatever is running	Enumerate every artifact. No judgment.
Judgment	Expensive — live research + per-artifact reasoning	Top tier, resolved at run time	Read current harness behavior, verdict each artifact, file issues.

The split exists because of a real constraint. subagent-orchestration.md reserves the top tier for interactive step-ups where a human watches the spend — it is never a spawn default. A monthly tick that quietly burns top-tier tokens unattended contradicts that rule's stated harm model, not merely its wording. So the recurring tick runs only the cheap pass and then offers the judgment pass as a click-to-launch chip. Nobody's budget moves without a human clicking.