work-unit-audit

Work-unit audit

Task review proves each task was done correctly. Work-unit audit answers the question no task review asks: does the combined result achieve the work unit's intended outcome as a complete, coherent, sufficiently verified system?

Individually accepted tasks can still leave missing cross-task behavior, an incomplete product outcome, conflicting configuration, duplicate mechanisms, code and docs that disagree, unnecessary combined complexity, integrated regressions, or task-level evidence that never proved the final combined state.

Work-unit audit is enabled by default. Unless a human explicitly records work_unit_audit: disabled in .agenticloop/project.md, work-unit closeout cannot publish AGENT_CLOSEOUT_STATUS: complete without a current certificate.

0. Entry guard

This skill governs Agentic Loop-mode work-unit certification. It applies when the Auditor is invoked in Agentic Loop mode to certify or re-audit a tracked work unit against a designated audit record or audit packet.

It does not automatically apply to a standalone Auditor assessment. A standalone auditor takes its scope from the parent request, needs no audit packet, audit record, covered-task set, or frozen candidate, and returns non-certifying findings; it may consult this file as a reference without adopting the procedure. A standalone assessment never satisfies the certification gate below.

1. Preconditions

Do not start an audit until all of the following hold:

• every covered task is accepted or closed under the configured backend;
• the covered artifacts are integrated or composed into one exact candidate;
• the candidate is frozen: a commit SHA or another immutable revision reference;
• final integrated verification evidence exists for that exact candidate;
• an Auditor model is configured at adapters.<host>.roleSettings.auditor.

If auditing is enabled and no Auditor model is configured, that is a blocking setup condition. Report it and stop. Never substitute the Maintainer model.