audit-java

Java Audit

Overview

Audit Java engineering from current repository evidence with explicitly selected risk profiles. Use open-source projects and framework guidance to form questions, not to declare target-repository defects by stylistic comparison.

Consume urn:skills:audit-request:v1; the portable output is urn:skills:audit-findings:v1. When supplied, consume an exact PackageManifest/basis plus compatible graph asset/consumer/impact results. The audit produces findings and validation Observations, not Task/Requirement status or a delivery Receipt.

Rule Priority

Apply current user intent, effective repository guidance, manifests/source/tests, project contracts, this Skill, then external references. A reference architecture never outranks a working local contract.

Workflow

1. Record the Git/build root, revision and relevant Worktree state; read effective guidance and inspect only the selected manifests, source, tests, migrations, configuration ownership, CI, and runtime documentation.
2. Resolve the JDK, Maven/Gradle owner, Wrapper, parent/BOM/platform, modules, packaging, framework generation, executable entries, profiles, and quality commands.
3. Select one or more audit profiles:
   • Build/architecture: dependency direction, modules/packages, public/internal seams, build reproducibility, dependency authority, generated code, and lifecycle.
   • API/security: routes, DTO validation, filters/interceptors, authentication, authorization/data scope, sessions/tokens, CSRF/CORS, upload/download, errors, secrets, and sensitive logging.
   • Persistence/transaction: mappings, query shape, pagination, N+1 risk, locking, migrations, transaction boundaries/propagation, after-commit effects, and database compatibility.
   • Concurrency/integration: executors, async/events, Redis/cache, messages, schedules, retries, idempotency, backpressure, distributed locks, and shutdown.
   • Performance/operations: representative workload, database plans, pools, allocation/serialization, caches, remote calls, metrics, health, and failure modes.
   • Migration/compatibility: JDK, Spring Boot, javax/jakarta, build tool, dependency, database, packaging, or configuration-generation transitions. Activate project grounding only for semantic signals involving runtime/config precedence, packaged artifacts, public contracts, durable data, legacy replacement, auth/security, or cross-repository delivery. Use the grounding chain to bound adjacent evidence; do not scan every profile or repository merely because corresponding files exist.
4. Load Java engineering for every audit. Load codebase design for module/API/testability analysis and code quality only when maintainability is in scope.
5. Consume a compatible graph asset/consumer/impact query or reproduce a bounded inventory of entries, callers, permissions, services, repositories, entities/mappers, migrations, configuration, jobs/listeners, and tests. Reject stale or mismatched graph results; a query miss never proves missing code, and a derived Markdown view is not audit evidence.
6. Trace each candidate issue through trigger, reachable path, owner, state or data consequence, counterevidence, and a falsifiable validation seam. Reject checklist-only findings and style preferences without concrete impact.
7. Capture tracked Worktree state before validation. Do not run known apply/fix or tracked-source generation commands in the audited Worktree. If the repository offers only write-capable validation, skip it and report the gap or hand it to a workflow with an isolated Worktree. Prefer check-only repository commands and representative data. With explicit authorization, use only test-owned ephemeral containers, databases, brokers, or processes; never write shared, staging, or production state. Recheck status/diff afterward. If an otherwise non-mutating command creates tracked drift, stop validation, report the exact contamination, mark affected evidence Not verified, and do not revert it without explicit authorization. Clean up only task-created runtime resources. Compilation alone does not prove authorization, rollback, migration, query, concurrency, or runtime behavior.
8. Stop when the selected profiles are supported or explicitly blocked. Mark all other profiles out of scope.
9. When Forgeway delivery integration is active, bind the audit to an immutable Run, exact input/result PackageManifest, and typed input refs. Attach each finding or validation result as an Observation against that package. Do not hand-edit a Gate, rewrite prior Observations after a retry, or infer reviewed/delivered state.