/launch-audit

argument-hint: [--dry-run | --skip=ext,multitenant,idor,webhooks,svcrole,hipaa,agents,deps,access | --severity=critical|high|all]

/jat:launch-audit - Pre-Customer-Launch Defensive Audit

The go-live gate. Run this **before delivering a project to a customer** or opening it up to real users. Detects project context (multi-tenant? PHI? webhooks? agents?) and runs a tailored battery of defensive audits the static-scan-only `/jat:security` command can't fully cover.

**Use this when:**

• Pre-launch readiness review for a customer-bound project
• Periodic re-audit before a major release (quarterly recommended)
• After a security incident, to harden the surfaces the incident exposed

**Composes with `/jat:security`:**

• `/jat:security` covers static-code basics (RLS enabled, secrets in repo,

PUBLIC_ env misuse, raw SQL, `{@html}`, npm audit). Run that first.

• This skill picks up where it stops: cross-cutting flows, IDOR/auth

boundary, webhook signatures, agent surfaces, external-leak sweep, HIPAA-specific, operational hygiene.

**Flags:**

• `--dry-run` — Run audits, report findings, don't create any tasks
• `--skip=<comma-list>` — Skip specific sections (see section IDs below)
• `--severity=critical` — Only create tasks for 🔴 findings
• `--severity=all` — Create tasks for every non-green finding

**Non-goals:**

• Active probing of live infrastructure (no curl, no exploit attempts)
• Replacing professional pentesting for high-stakes deployments
• Anything that would trip a WAF, alarm, or rate limiter on the target

This is a **passive code + config + history review** that emits a launch-readiness tasktree.

---

STEP 0 — Recommend `/jat:security` first

Before running this, confirm the user has run `/jat:security` recently (within the last 7 days, on this branch). If not:

This skill assumes /jat:security has already covered static-code basics
(RLS enabled, secrets in repo, env misuse, raw SQL, npm audit). Have you
run it on this branch in the last week?

Use `AskUserQuestion`:

• `Yes, run launch-audit now` — proceed
• `No, run /jat:security first` — exit and suggest `/jat:security`
• `Just run launch-audit anyway` — proceed but flag the gap in the report

---

STEP 1 — Project-Context Detection

Detect what surfaces this project actually has, so we skip irrelevant audits and tailor severity accordingly. Run all probes in parallel where possible.

# === Stack ===
test -f package.json && jq -r '.dependencies // {} | keys[]' package.json 2>/dev/null > /tmp/.la-deps
test -f svelte.config.js && echo "has-sveltekit"
test -d supabase && echo "has-supabase"
test -d supabase/migrations && ls supabase/migrations/*.sql 2>/dev/null | wc -l

# === Multi-tenant signals ===
git grep -lE 'team_id|tenant_id|organization_id|workspace_id' supabase/migrations/ 2>/dev/null | head -3
git grep -lE 'teamContext|requireTeam|locals\.teamId' src/ 2>/dev/null | head -3

# === PHI / healthcare signals ===
git grep -liE 'date_of_birth|medical_history|diagnosis|prescription|patient|HIPAA|PHI|intake|hl7|fhir|icd10' \
  src/ supabase/migrations/ docs/ README.md 2>/dev/null | head -5

# === Stripe / billing ===
grep -l 'stripe' package.json 2>/dev/null && echo "has-stripe"

# === Webhook routes ===
find src/routes -type d -iname '*webhook*' -o -name 'webhook*' 2>/dev/null
find src/routes/api -type f -name '+server.*' 2>/dev/null | xargs grep -l 'constructEvent\|verify.*signature\|x-twilio-signature\|svix-signature' 2>/dev/null | head -10

# === AI agent surfaces ===
grep -lE '@anthropic-ai/sdk|openai|anthropic' package.json 2>/dev/null
git grep -lE 'messages:\s*\[|completion|chat\.completions' src/ 2>/dev/null | head -5
test -d .jat && echo "has-jat-agents"
test -f .jat/jat.db -o -d .jat/logs && echo "has-jat-traces"

# === Auth flavor ===
grep -E '@supabase/ssr|@supabase/supabase-js|next-auth|lucia|auth\.js' package.json 2>/dev/null

# === Deployment ===
test -f wrangler.toml -o -f wrangler.jsonc && echo "has-cloudflare"
test -f vercel.json && echo "has-vercel"
test -f netlify.toml && echo "has-netlify"

# === Repo visibility (private vs public matters for blast radius) ===
gh repo view --json visibility,isPrivate 2>/dev/null

Compile a context summary:

Project: <name>
Stack: SvelteKit 5 / Supabase / Cloudflare Pages
Surfaces detected:
  ✓ Multi-tenant (team_id in 23 migrations, teamContext hook)
  ✓ PHI (intake, diagnosis, prescription keywords found)
  ✓ Stripe billing
  ✓ 4 webhook routes (Stripe, Twilio, Resend, Calendly)
  ✓ AI agents (Anthropic SDK + .jat/ trace dir)
  ✓ Cloudflare deployment
  Repo visibility: private

Save context to `/tmp/.la-context` for later steps. Show the summary to the user and confirm before continuing — they may know about a surface the auto-detect missed.

---

STEP 2 — External-Leak Sweep (`ext`)

**Always run.** Lesson from meadow-ttu7f: secrets that leak into agent trace files also leak into adjacent surfaces. Even a clean repo can co-leak via build logs, AI-tool ingestion, and dev-machine transcripts.

This sweep doesn't *find* leaks — it produces a checklist of surfaces to inspect and asks the user to confirm each is clean. The remediation (rotation) only completes the loop if every surface is checked.

echo "=== External surfaces to verify clean ==="
echo "1. Cloudflare Pages build logs (last 14d retention)"
echo "   → dash.cloudflare.com → Workers & Pages → <project> → Deployments → ... → View build log"
echo
echo "2. GitHub Actions logs"
gh run list --repo $(gh repo view --json nameWithOwner -q .nameWithOwner) --limit 20 2>&1
echo "   → for each run with 'secret' or 'env' in name, gh run view <id> --log | grep <regex>"
echo
echo "3. Local Claude/Cursor session transcripts"
PROJ=$(basename $(pwd))
ls -la ~/.claude/projects/-home-*-${PROJ}/ 2>/dev/null | head -5
echo "   → grep these for any rotated cred values"
echo
echo "4. AI tool ingestion (Cursor index, Sourcegraph, Bedrock KB, Claude Projects)"
echo "   → check each