R Audit

---
name: r-audit
description: >
  Use when you want a full codebase audit: dispatches parallel reviewer and QA passes across the tree.
---

You are running the /rdf:r-audit full codebase audit. This command
dispatches multiple reviewer and qa subagents in parallel to scan the
entire codebase for latent issues, then synthesizes findings into a
structured AUDIT.md.

## Arguments

$ARGUMENTS — optional scope:
- No args: full codebase audit
- File/directory path: scoped audit of specific area
- `--quick`: skip subagent dispatch, run inline checks only

## Setup

- Read .rdf/governance/index.md to understand the project
- Load governance/verification.md for project-specific checks
- Load governance/anti-patterns.md for known pitfalls
- Load governance/constraints.md for platform/compat requirements
- Create `.rdf/work-output/` directory if it does not exist
- Remove stale audit files from prior run: `rm -f .rdf/work-output/audit-*.md`

## Task List Protocol

At command startup, create tasks for live progress tracking:

```
TaskCreate:
  subject: "Load governance context and determine scope"
  activeForm: "Loading governance context"
TaskCreate:
  subject: "Dispatch audit subagents"
  activeForm: "Dispatching audit agents"
TaskCreate:
  subject: "Collect and deduplicate findings"
  activeForm: "Collecting findings"
TaskCreate:
  subject: "Synthesize AUDIT.md"
  activeForm: "Writing AUDIT.md"
TaskCreate:
  subject: "Present audit summary"
  activeForm: "Presenting summary"
```

Issue each `TaskCreate` in its own message, in the order shown — see
[reference/progress-tracking.md](../reference/progress-tracking.md)
for why parallel batches break display order.

Lifecycle: all tasks start pending. Before starting each stage,
mark its task in_progress. After completing, mark completed.

For Stage 2 (parallel subagent dispatch), update the activeForm
as agents complete: "Dispatching audit agents: 3/4 complete..."

---

## Stage 1: Governance Context

Mark task "Load governance context and determine scope" as `in_progress`.

### 1a. Build Audit Context
- Extract from governance: language, framework, test framework,
  linter configs, platform targets, known anti-patterns
- Identify high-risk areas from governance/architecture.md
  (security boundaries, data flows, external interfaces)
- Build a context summary for subagent dispatch prompts

### 1b. Determine Scope
- Full audit: all source files in the project
- Scoped audit: files matching the provided path argument
- Quick audit: inline checks only, no subagent dispatch

### 1c. Baseline Pattern Scan

Run `/rdf:r-util-code-scan all` against the audit scope and write the
report to `.rdf/work-output/audit-baseline-patterns.md`. This gives
Stage 2 subagents a pre-computed anti-pattern inventory so they do
not each re-derive the same grep results.

The baseline covers the built-in pattern library (backtick-usage,
unquoted-var, bare-which, deprecated-egrep, dollar-bracket,
for-in-cat, silent-error, unsafe-temp, eval-usage, bare-coreutils,
missing-cd-guard, local-mask) plus any project-specific patterns
loaded from `governance/anti-patterns.md`. AUDIT.md cross-reference
marks each hit TRACKED or UNTRACKED.

Findings from this pass are surfaced to Stage 2a (regression +
anti-slop) as extra context. Stage 2a promotes UNTRACKED hits into
formal audit findings; TRACKED hits pass through unless the reviewer
identifies new context.

Mark task "Load governance context and determine scope" as `completed`.

## Stage 2: Dispatch Parallel Subagents

Mark task "Dispatch audit subagents" as `in_progress`.

Dispatch 4 subagents simultaneously. Each receives the audit context
from Stage 1 plus focus-specific instructions.

### 2a. Reviewer — Regression + Anti-Slop Focus
Dispatch reviewer subagent in sentinel mode:
- Focus passes: anti-slop (pass 1) and regression (pass 2)
- Scope: entire codebase (not just a diff)
- Extra context: governance/anti-patterns.md,
  .rdf/work-output/audit-baseline-patterns.md (Stage 1c output —
  UNTRACKED hits must be promoted to findings; TRACKED hits may
  be deepened with new context)
- Large-file discipline: for any source file of 400 lines or more in
  the audit scope, map it before reading (LSP `documentSymbol` when
  active, else a definitions grep; see
  [reference/read-discipline.md](../reference/read-discipline.md))
  and read only the symbol ranges a finding needs
- Write results to: .rdf/work-output/reviewer-regression.md

### 2b. Reviewer — Security Focus
Dispatch reviewer subagent in sentinel mode:
- Focus pass: security (pass 3)
- Scope: entire codebase with emphasis on:
  - Input validation boundaries
  - Authentication/authorization paths
  - Data serialization/deserialization
  - File operations with user-influenced paths
  - External command execution
- Extra context: governance/constraints.md (platform targets affect
  attack surface)
- Write results to: .rdf/work-output/reviewer-security.md

### 2c. Reviewer — Performance Focus
Dispatch reviewer subagent in sentinel mode:
- Focus: performance (audit-specific dimension — beyond the standard
  sentinel passes)
- Scope: entire codebase with emphasis on hot paths, loops,
  data structure choices, I/O patterns
- Write results to: .rdf/work-output/reviewer-performance.md

### 2d. QA — Standards + Lint Verification
Dispatch qa subagent:
- Run every check in governance/verification.md
- Focus on: lint compliance, convention adherence, test coverage
  gaps, documentation drift
- Write results to: .rdf/work-output/qa-standards.md

### 2e. Wait and Monitor
- Track subagent completion (check for output files)
- Report progress: `Audit: N/4 agents complete`
- Timeout after 15 minutes per agent — proceed with available results

Mark task "Dispatch audit subagents" as `completed`.

## Stage 3: Collect and Deduplicate

Mark task "Collect and deduplicate findings" as `in_progress`.

### 3a. Health Check
For each expected output file:
- File exists with content -> COMPLETE
- File exists but empty/truncated -> PARTIAL (warn, include anyway)
- File missing -> FAILED (exclude, note in report)

Report: `Agent Health: N/4 complete, N partial, N failed`

### 3b. Deduplicate Findings
- Read all completed output files
- Identify duplicate findings (same file + same issue, reported by
  multiple agents)
- When duplicates exist, keep the most detailed version
- Merge complementary details from duplicates into the kept finding
- Track dedup count for the report

Mark task "Collect and deduplicate findings" as `completed`.

## Stage 4: Synthesize AUDIT.md

Mark task "Synthesize AUDIT.md" as `in_progress`.

### 4a. Classify Findings
Assign severity to each unique finding:
- **Critical**: security vulnerabilities, data loss risk, crash bugs
- **Major**: correctness issues, regression risk, significant
  anti-pattern violations
- **Minor**: style issues, optimization opportunities, documentation
  gaps

Assign category:
- regression, security, performance, standards, anti-pattern

### 4b. Write AUDIT.md

Write structured audit report:

    # Audit Report: {project} {version}

    **Date:** {YYYY-MM-DD}
    **Scope:** {full codebase / scoped path}
    **Agents:** {N}/4 completed ({N} partial, {N} failed)

    ## Summary
    - Critical: {count}
    - Major: {count}
    - Minor: {count}
    - Total unique findings: {count} (deduplicated from {raw count})

    ## Critical Findings
    | # | Category | File:Line | Finding | Fix |
    |---|----------|-----------|---------|-----|
    (one row per critical finding)

    ## Major Findings
    | # | Category | File:Line | Finding | Fix |
    |---|----------|-----------|---------|-----|
    (one row per major finding)

    ## Minor Findings
    | # | Category | File:Line | Finding | Fix |
    |---|----------|-----------|---------|-----|
    (one row per minor finding)

    ## Agent Reports
    - Regression/Anti-Slop: {verdict} — {summary}
    - Security: {verdict} — {summary}
    - Performance: {verdict} — {summary}
    - Standards/Lint: {verdict} — {summary}

    ## Recommendations
    (prioritized action items derived from critical + major findings)

Mark task "Synthesize AUDIT.md" as `completed`.

## Stage 5: Present Summary

Mark task "Present audit summary" as `in_progress`.

- Display the Summary and Critical Findings sections inline
- Report the full AUDIT.md path
- If critical findings exist, recommend immediate action
- If only minor findings, report clean status with improvement notes

Mark task "Present audit summary" as `completed`.

## Quick Mode (--quick)

When `--quick` is passed, skip Stage 2 entirely:
- Run lint/shellcheck inline (from governance/verification.md)
- Run `/rdf:r-util-code-scan all` inline — canonical anti-pattern check
  (supersedes ad-hoc grep; writes to
  `.rdf/work-output/audit-baseline-patterns.md`)
- Produce a lightweight AUDIT.md that folds baseline-pattern hits
  directly into the findings table (UNTRACKED → Major, TRACKED →
  passthrough with reference ID)
- No subagent dispatch, no deduplication stage

## Constraints
- Never modify source files — audit is read-only
- Write findings to .rdf/work-output/ and AUDIT.md only
- Every finding must include file:line and a suggested fix
- Deduplicate aggressively — same issue from multiple agents is one
  finding
- If governance files are missing, warn and proceed with generic
  checks