/product-audit

name: product-audit
user-invocable: true
disable-model-invocation: true
version: 4.10.0
metadata:
  opencode/autoinvoke: false
argument-hint: <path-or-area> (optional — defaults to the whole product)
author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
license: MIT
description: >
  Audit the whole product across code, quality, process, docs, roadmap, and
  tooling; it owns the repo-wide bug hunt, security research, and broken-version
  investigation (scoped and budgeted per dimension, as distinct from
  `review-change`'s change-scoped review). Persist one severity-ranked,
  F-numbered report with proposals; never fix or file work. Triggers:
  "product-audit", "audit the product", "full health check", "are we product-ready",
  "CTO review".

Product Audit

Product-wide health check. It only writes `docs/audits/<n>-<YYYY-MM-DD>.md`; every proposed action remains a user decision.

Turn contract

Load and verify the **canonical** [Turn contract](../orchestration-envelope/references/TURN_CONTRACT.md) (11 boxes) before ending every turn; the additions below narrow the sanctioned mutation to the one report file (box 3's commit/push covers it). Skill-specific additions (the `→ Next:` box is canonical-owned and not restated here):

✓ A measured trigger was met (audit-trigger@1) or the owner explicitly requested the sweep — an invocation with none returns the `insufficient-corpus` verdict instead of inventing findings or figures
✓ Either the full PRODUCT AUDIT report was printed in the fixed output format (health by dimension, F-numbered ranked findings, four proposal streams — the roadmap streams always present, `none — <why>` when empty) or the `insufficient-corpus` verdict block was printed (no report written, nothing invented)
✓ The report was WRITTEN to `docs/audits/<n>-<YYYY-MM-DD>.md` (incremental audit id) and committed — the file is the durable deliverable, the chat print is a copy (skipped only by the `insufficient-corpus` verdict, which writes nothing)
✓ Nothing else was fixed, filed, or changed — the report file is the ONLY mutation

Missing reference → STOP. About to end the turn with any box unchecked? The turn is NOT done — complete the missing box first (weak models drop end-of-document duties; this list is first on purpose).

When to use — measured triggers, never calendar

The audit fires on one of three triggers; a periodic cadence ("every few features", a monthly sweep) is retired — it sweeps the same tree whether or not anything drifted:

audit-trigger@1
trigger | source | receipt when unmet
drift signal | `audit-docs` findings above the corpus band (design note 12 of #307; the band is #437's measured design) | insufficient-corpus
threshold debt | accumulated orphans / ARW below the corpus band (design note 11; #437 supplies the measured bands — never invented here) | insufficient-corpus
owner request | the owner explicitly asks for the sweep (a product-ready milestone, a named worry, an area) | — (always met)

An invocation that cites none of the three — a routine or calendar-driven probe — returns the `insufficient-corpus` verdict instead of running a sweep that invents findings or figures:

PRODUCT AUDIT — insufficient-corpus
Triggers checked: drift signal — <the receipt it is unmet | met>; threshold debt — <the receipt>; owner request — <absent | met>
Verdict: insufficient-corpus — no sweep ran; no findings or figures invented
→ Next: /workflow-status — the sensor reads what the current signals recommend

• When you want the broad, honest picture — quality, security, debt, docs, and

roadmap — not the review of a single change (`review-change`) or PR (`audit-pr`).

• **It owns the repo-wide sweep.** Open-ended, repository-wide bug hunting,

security research and broken-version investigation land **here** — scoped, sampled and budgeted per dimension (state what you sampled). The same hunt against one change is `review-change`'s job: neither skill absorbs the other's scope.

Unlike diff, PR, or docs-only reviews, this skill covers the whole product.

Scope

The entire codebase and its process artifacts: source, tests, the docs tree, the roadmap, the fix index, open issues, and every feature folder's planning docs. Accept an optional path/area to focus a partial audit; state the scope and, if you sample rather than exhaust a dimension, **say what you sampled** — never imply full coverage you didn't do.

> **Tip (provisional).** The *user* can turn on `ultracode` (a research-preview > Claude Code session setting — no skill can declare it) so this sweep fans out > across parallel subagents instead of one context window; without it, sweep the > dimensions sequentially — only wall-clock changes, never coverage.

Step 0 — Discover the project (always first)

Per the agent guide's **Workflow conventions** + **documentation map**, then read what THIS skill needs: the roadmap, the fix index, the feature folder layout, and the verification gate. From the map decide the product's nature (web / mobile / console / library / backend / infra). Defer deciding which dimensions apply until `AUDIT_DIMENSIONS.md` has been loaded; that resource is the authoritative applicability matrix. Note any optional platform review skills the project installed (extras, never requirements — the internal pack covers every axis).

Progressive loading — audit route

The reference allowlist is exactly the two paths below. Load both after Step 0, in order; they are normative and one hop from this entrypoint.

1. Read [audit dimensions](references/AUDIT_DIMENSIONS.md), mark every dimension applicable or `n-a: <reason>` (a dimension the project's ceremony profile does not declare is `n-a — not declared by the project's ceremony profile`), state the deterministic-producer pre-pass receipts, and state any sampling. 2. Read [audit process](references/AUDIT_PROCESS.md), execute all ten steps, then return the fixed report below.