openspec-audit-change

Audit an OpenSpec change

Spawn an isolated auditor over one change's artifacts, catch cross-artifact drift before code gets written, and never claim a clean audit the checks did not actually confirm.

Steps

1. Select the change. If not given, run openspec list --json, show active (non-archived) changes with schema, and let the user choose. Never guess.
2. Gather artifacts and convention docs. Run openspec status --change "<name>" --json and openspec instructions apply --change "<name>" --json; collect every artifact path from contextFiles plus .openspec.yaml. If the CLI is unavailable, fall back to filesystem discovery under openspec/changes/<name>/. Locate repo-root convention docs (AGENTS.md, CLAUDE.md, CONTRIBUTING.md) and the schema's context/rules if available from /rhdh-spec-driven-schema.
3. Enforce the apply-ready minimum before doing anything else. Build the union of the schema's apply.requires (or CLI applyRequires) and {proposal, design, specs, tasks}. Preferred: every ID in that union must show status: "done" in the status JSON. Filesystem fallback: read .openspec.yaml for the schema name, read that schema's apply.requires, and check each mapped path exists and is non-empty (proposal->proposal.md, design->design.md, tasks->tasks.md, specs->at least one specs/**/spec.md). If the required set cannot be determined, or any required artifact is missing/not done: report CRITICAL, state "Audit blocked (CRITICAL findings remain)", write/update audit.md with the current UTC timestamp, suggest /openspec-continue-change, and stop — do not build the ownership map or spawn the auditor.
4. Build a cross-change ownership map. Resolve sibling changes (reuse openspec list --json from step 1, or filesystem-list openspec/changes/* excluding this change and archive/). For each sibling, read only its proposal.md Canonical Touchpoints section and design.md Decisions section, and build a lightweight capability/namespace/claim -> [change names] map. Pass the map (or condensed claim lines), not full sibling trees, to the auditor. If sibling discovery fails entirely, pass an empty map and note category E ran degraded in the final report — do not fail the whole audit for this alone.
5. Spawn an independent auditor subagent (Task tool, subagent_type: general-purpose). Give it only: change name, absolute artifact paths, the ownership map, convention doc paths, the checklist below, and the required JSON return schema. Explicitly forbid passing authoring rationale or "what we meant" — this is prompt isolation, not a sandbox; instruct it to limit reads to the given paths. Require it to return: