Skip to content
Back to skills

In Tca Audit

ASecurity

TCA audit: execute component audits with sub-agents, track progress, manage context

  • 26 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added May 27, 2026
data-airustswiftshellbashgit

Works with

  • claude code

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned September 21, 2026

npx -y skills add matthewsinclair/intent --skill in-tca-audit --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of In Tca Audit?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for In Tca Audit
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/matthewsinclair-in-tca-audit/badge)](https://www.skillsdirectory.com/skills/matthewsinclair-in-tca-audit)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
description: "TCA audit: execute component audits with sub-agents, track progress, manage context"
chains_to: ["in-tca-synthesize"]
---

# TCA Audit

Executes the component audit phase (Phase 1) of a Total Codebase Audit. Manages sub-agent launches, progress tracking, context management, and commit discipline.

For reference: `intent/docs/total-codebase-audit.md`

## Procedure

### 1. Check progress

Run the progress script to see current state:

```bash
bash "$(find ~/.claude/skills/in-tca-audit -name tca-progress.sh 2>/dev/null | head -1)" \
  --tca-dir intent/st/STXXXX
```

This lists each WP as Complete (non-empty `socrates.md`) or Pending (missing or empty). Its Violations/High/Med/Low columns read `| High`, `| Medium`, `| Low` and `| Total` table rows, which a verbatim critic report does not carry, so they read 0 -- take counts from each WP's `Summary:` line.

### 2. Select next WP batch

From the batch ordering in `design.md`, identify the next batch of WPs to audit. WPs within a batch can run in parallel if they don't share files.

### 3. Pre-flight checklist (per WP)

Before launching each sub-agent:

1. **Run `/compact`** to reclaim context window space
2. **Verify file manifest** -- confirm all files in the WP's `info.md` exist:
   ```bash
   for f in $(grep "^- \`" WP/NN/info.md | sed 's/.*`\(.*\)`.*/\1/'); do
     [ -f "$f" ] || echo "MISSING: $f"
   done
   ```
3. **Check context usage** -- if above 70%, consider fresh session
4. **Verify previous WP committed** -- no uncommitted audit files

### 4. Dispatch the critic

Per WP, dispatch the language critic against the WP's file set. There is no custom prompt template -- the critic enforces the rule library automatically and emits a stable severity-grouped report (see `intent/docs/critics.md`).

```
Task(subagent_type="critic-<lang>", prompt="review <file1> <file2> ...")
```

For test files in the WP's manifest, also run `test-check`:

```
Task(subagent_type="critic-<lang>", prompt="test-check <test_file1> <test_file2> ...")
```

`<lang>` is the WP's language per `info.md`. Polyglot WPs run one dispatch per language. The critic auto-loads the right rule packs (agnostic + language code/test + framework subdirs) and honours the project's `.intent_critic.yml`.

**Critic selection**: read the project's declared languages from `intent/.config/config.json` (`jq -r '(.languages // []) | .[]' intent/.config/config.json`) and dispatch one critic per language listed:

| Language entry | Critic to dispatch |
| -------------- | ------------------ |
| `elixir`       | `critic-elixir`    |
| `rust`         | `critic-rust`      |
| `swift`        | `critic-swift`     |
| `lua`          | `critic-lua`       |
| `shell`        | `critic-shell`     |

This is the code-language half of the `/in-review` stage-2 dispatcher. `/in-review` also sends `author` and `content` to `critic-prose`, which reviews prose, not code, and has no place in a TCA component WP.

### 4a. Capture the critic report

Write the captured critic output to `WP/{NN}/socrates.md` verbatim, with a small header for context:

```markdown
# WP-{NN} {Component Name} -- Critic Audit

**Critic**: critic-<lang> (review + test-check)
**Files**: {N} ({code count} code, {test count} test)
**Date**: {YYYY-MM-DD}

<critic report verbatim, including all severity sections and the Summary line>

## Cross-WP Highlander notes

- vs. WP-XX: {what to investigate at synthesis}
- vs. WP-YY: {what to investigate at synthesis}
```

The critic report itself owns the rule IDs (IN-\*), severities (CRITICAL/WARNING/RECOMMENDATION/STYLE), file:line citations, and one-line violation descriptions. The wrapper only adds component identity, dispatch metadata, and cross-WP Highlander handoffs that synthesis will consume.

If the critic emits zero findings, the report still includes the bare `Summary: 0 critical, 0 warning, 0 recommendation, 0 style.` line -- record it. Absence of findings is a first-class outcome.

### 5. Post-WP

After each critic dispatch completes:

1. **Record metadata** at the top of `WP/{NN}/socrates.md` immediately under the H1. Format: `**Critic**: critic-<lang>; **Files**: N (code:M test:K); **Findings**: critical=A warning=B recommendation=C style=D; **FPs noted**: N`. The findings counts come straight from the critic's `Summary:` line; FPs noted is the number of this WP's findings marked false positive against design.md's False Positive Guidance and the Phase 0.5 pre-filter baseline. This line is queryable across audits and feeds the `Sub-Agent Effectiveness` section of the `tca-report.sh` template.
2. **Record it in the store**: `intent st attach STXXXX WP/{NN}/socrates.md --from intent/st/STXXXX/WP/{NN}/socrates.md`, then `intent wp done STXXXX/{NN}` (run `intent wp start STXXXX/{NN}` before the dispatch). The progress script reads only `socrates.md`, so without these the store's WP status never moves.
3. **Commit immediately**: `git add WP/{NN}/socrates.md && git commit -m "audit: WP-{NN} {component}"`
4. **Log the summary** in your running tally
5. **Run progress check** to update status

### 6. Repeat

Continue dispatching the critic for each WP in the current batch, then move to the next batch per the ordering in design.md. WPs within a batch can run in parallel if they don't share files; dispatch them in the same message so the critics run concurrently.

**Critic registration freeze**: if any critic was installed mid-session (`intent claude subagents install critic-<lang>`), the `Task()` dispatch will fail with "subagent not found" until the next session starts. Restart Claude Code before launching the audit. See `intent/docs/critics.md` §Operational note.

### 7. Final check

After all component WPs are done, run the progress script one final time:

```bash
bash "$(find ~/.claude/skills/in-tca-audit -name tca-progress.sh 2>/dev/null | head -1)" \
  --tca-dir intent/st/STXXXX
```

At this point the synthesis WP is still empty, so expect exit 1 with `hint: 1 of N work packages pending`. Confirm the one pending WP is the synthesis WP, then proceed to `/in-tca-synthesize`. Exit 0 means every WP, synthesis included, has a non-empty `socrates.md`.

## Crash Prevention

| Risk             | Mitigation                                                         |
| ---------------- | ------------------------------------------------------------------ |
| Context overflow | `/compact` before each WP                                          |
| Lost work        | Commit after every WP (never batch)                                |
| Critic not found | Restart session before audit if critics were installed mid-session |
| Session crash    | Keep a running log outside the session                             |
| WP too large     | Split a WP with >60 files into two flat WPs (`intent wp new`)      |
| File manifest    | Verify files exist before each WP                                  |

## Important Notes

- Never batch commits -- commit after every single WP
- Capture the critic report verbatim. Critics never invent IN-\* IDs and never invent file:line citations; the report is ground truth for synthesis.
- Cross-WP Highlander notes are the wrapper's job -- the critic does not see other WPs.
- If context usage exceeds 70%, start a fresh session rather than risk truncation.

Files in this skill

  • SKILL.md6.2 KB
  • scripts/tca-progress.sh3.3 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.