/audit

description: "Truth-seeking umbrella audit for llm-wiki. Combines active wiki maintenance, output drift checks, provenance review, and fresh research when trust is in doubt."
argument-hint: "scan [--artifact <path>] [--project <slug>] [--wiki-only] [--outputs-only] [--quick] [--fresh] [--include-archived] | report [--wiki <name>] [--local]"
allowed-tools: Read, Write, Edit, Glob, Grep, Bash(ls:*), Bash(wc:*), Bash(date:*), Bash(mkdir:*), WebFetch, WebSearch, Agent

Your task

**Resolve the wiki.** Do NOT search the filesystem or read reference files until the wiki location is known — follow these steps: 1. Read `$HOME/.config/llm-wiki/config.json`. If it has `hub_path`, expand leading `~` only (not tildes in `com~apple~CloudDocs`) and prefer that path; use `resolved_path` only as a fallback cache when the expanded `hub_path` is unavailable and `resolved_path` is initialized. If config has only `resolved_path`, use it. If the configured path can be statted but reading `wikis.json` or listing `topics/` fails with `Operation not permitted`, stop and ask the user to grant Full Disk Access/iCloud Drive access to the launcher; do not fall back to `~/wiki` or `resolved_path`. Do not write machine-specific `resolved_path` into shared configs. 2. If no config -> read `$HOME/wiki/_index.md`. If it exists -> HUB = `$HOME/wiki`. If nothing found, ask the user where to create the wiki. 3. **Wiki location** (first match): `--local` -> `.wiki/` in CWD; `--wiki <name>` -> `HUB/wikis.json` lookup with portable path resolution (`<HUB>`, `~`, absolute, or HUB-relative); if the registry path is stale, fall back to `HUB/topics/<name>`; CWD has `.wiki/` -> use it; else -> HUB. 4. Read `<wiki>/_index.md` to verify. If missing -> stop with "No wiki found. Run `/wiki init` first."

Read the audit reference at `skills/wiki-manager/references/audit.md`. If you need a fresh wiki-only pass, also read `commands/librarian.md` and reuse its scan protocol rather than inventing a parallel one.

Inventory awareness: audit findings that require future action should be offered as inventory candidates, not only buried in `.audit/REPORT.md`. Examples include blocked verification work, stale source queues, watch items, and important missing corpora. Show a small sample before creating more than a few records, and never treat inventory records as evidence for factual verdicts.

Parse $ARGUMENTS

Default subcommand is `scan`.

• **scan**: Run the umbrella trust audit
• **report**: Display the latest `.audit/REPORT.md`

Flags:

• **--artifact <path>**: Audit one artifact relative to the wiki root. Supports `wiki/...` articles or `output/...` artifacts.
• **--project <slug>**: Audit outputs in `output/projects/<slug>/`
• **--wiki-only**: Only run the wiki-content pass
• **--outputs-only**: Skip the wiki-wide pass and focus on outputs plus their dependency chains
• **--quick**: Local-only audit. Skip fresh web research unless the user explicitly demands it.
• **--fresh**: Ignore cached `.librarian/scan-results.json` and run a fresh wiki-content pass first
• **--include-archived**: Explicitly include archived topic wikis. Default full

audits skip archived material unless the target artifact depends on it.

• **--wiki <name>**: Target a specific topic wiki
• **--local**: Use project-local `.wiki/`

Scan Protocol

0. Initialize scope

1. Create `.audit/` if it does not exist. 2. Derive the audit scope:

• `--artifact` -> just that artifact
• `--project` -> markdown deliverables under `output/projects/<slug>/`, excluding `WHY.md`
• `--wiki-only` -> all wiki articles
• `--outputs-only` -> all markdown outputs under `output/`, excluding `_index.md` and `WHY.md`
• default -> full umbrella audit

3. Record the scope, timestamp, and selected flags for the report.

Archive rule: default full-scope audit skips archived topic wikis. If the targeted artifact/source chain explicitly cites archived material, follow that dependency and label it as archived. For broad archived audits, require `--include-archived`.

1. Wiki-content pass

Skip this pass only when `--outputs-only` is set and the targeted artifact does not depend on wiki articles.

1. If `.librarian/scan-results.json` exists and is recent enough for the current task, reuse it unless `--fresh` is set. 2. Otherwise run the librarian scan protocol from `commands/librarian.md`. 3. Pull forward the findings that matter for trust:

• stale wiki articles
• low-quality wiki articles
• weak or broken source chains

2. Output dependency and drift pass

Skip this pass only when `--wiki-only` is set.

1. Build the output artifact list from scope. 2. For each artifact:

• Read frontmatter and capture `sources:`, `generated:`, `project:`
• Flag `missing-provenance` if `sources:` is absent or empty
• Resolve every dependency path
• Flag `broken-source-ref` if a dependency does not exist
• Compare dependency dates (`updated:`, `ingested:`, `generated:`) against the artifact's `generated:` date
• Flag `drifted-dependency` if any dependency is newer than the artifact
• If a dependency is a wiki article, inherit relevant librarian findings
• If a dependency is another output artifact, recurse one hop into its `sources:` chain

3. Classify each artifact as `clean`, `drifted`, `provenance-gap`, `weak-evidence`, `contradicted`, or `unresolved`.

3. Truth escalation pass

This is the defining behavior of `/wiki:audit`. Do not stop at "it looks stale" if the truth can be resolved with more investigation.

Escalate when:

• the user explicitly asks whether they can trust an artifact
• an output is drifted or has a provenance gap
• upstream wiki material is stale, weak, or contradictory
• the topic is volatile or the stakes are high

For each escalated item:

1. Re-read the artifact and identify the specific claims under scrutiny. 2. Re-read local dependencies and any cited raw sources. 3. If raw sources map to live URLs, fetch th