audit

/audit

READ-ONLY. This skill produces a work-order of audit findings — it NEVER edits, creates, or deletes source. The only file it writes is the work-order under .forge/audits/<ts>/. No self-loop.

The user-facing audit driver. One invocation = one audit pass:

1. audit plan (read-only) → parse the per-(scope × dimension) prompts.
2. Fan out one read-only Task subagent per prompt; each returns findings JSON.
3. Assemble all findings → audit collect → filtered, validated work-order.
4. Present the work-order (counts + path) and the read-only guarantee.
5. Offer the next step (NOT built here): turning approved findings into issues.

Preconditions

• A git repo (scope auto-discovery ranks tracked dirs; a non-git repo falls back to scope ["**"] with a warning).
• .forge/settings.yaml is OPTIONAL — when absent, audit uses defaults and warns (verify unconfigured). The protected set comes from the adopter-curated CRITICAL.md + settings.audit.protected_globs ONLY; scope comes from settings.audit.scope_globs or git-tree auto-discovery. You never hardcode paths, and the JS-flavored agents.preflight_globs default is NOT folded in (it would leak forge-shaped paths into a non-forge repo's audit).

Step 1 — Plan the audit (read-only, writes nothing)

forge orchestrate audit plan --json

Parse data:

• prompts[] — each { scope, dimension, prompt }. The prompt is a complete, self-contained read-only audit instruction (it already embeds the scope glob, the dimension focus, the protected globs to avoid, the finding schema, the 6-way classification rubric, the per-agent cap, and the read-only mandate).
• scope, dimensions, protected_globs — the resolved sets.
• verify_configured — when false, surface the warning: findings are UNVERIFIABLE without a verify: gate; the audit must be paired with one.
• warnings[] — scope-fallback / settings-absent notices to relay.

Optional overrides: --scope a/**,b/** and --dimensions dead-code,duplication.