/phx-audit

name: phx-audit
description: Project health audit and health check — architecture, performance, tests,
  dependencies, code quality. Use when assessing overall project health, before releases,
  or after refactors.

Project Health Audit

Comprehensive project-wide health assessment across five independent concern tracks.

Usage

phx-audit              # Full audit (default)
phx-audit --quick      # 2-3 minute pulse check
phx-audit --focus=security   # Deep dive single area
phx-audit --focus=performance
phx-audit --since abc123   # Incremental audit since commit
phx-audit --since HEAD~10  # Audit last 10 commits

When to Use

• **Quarterly** health checks
• **Before major releases**
• **After large refactors**
• **New team member onboarding** (understand codebase health)

Iron Laws

1. **Complete every selected track before synthesizing** — partial results make cross-category scores misleading 2. **Scope each track to concrete directories and checks** — vague project-wide analysis produces generic findings 3. **Never compare scores across projects** — track trends only within the same codebase 4. **Run quick mode before full mode** — catch basic failures before expensive analysis

Portable Audit Workflow

1. Create `.claude/audit/reports/` and `.claude/audit/summaries/`. 2. Run the quick checks below. Stop and report a blocker when the project cannot compile or its test command cannot start. 3. Complete five tracks: architecture, performance, security, tests, and dependencies. Native generic workers may run independent tracks in parallel when the runtime provides them; otherwise run every track sequentially in this session. Never require named custom agents. 4. Write one evidence-focused report per track under `.claude/audit/reports/`. Report issues only, cite paths and lines, and use one summary line for a clean area. 5. After all selected reports exist, deduplicate findings, identify cross-category correlations, calculate scores using `references/scoring-methodology.md`, and write `.claude/audit/summaries/project-health-{date}.md`.

If two or more optional workers fail or hit limits, finish the missing tracks sequentially. Never present an incomplete track as audited.

Output Format

Report an executive health score, per-category scores for Architecture, Performance, Security, Tests, and Dependencies, critical issues, top recommendations, and an Immediate/Short-term/Long-term action plan.

Quick Mode (`--quick`)

Only run essential checks (~2-3 minutes):

Run `mix compile --warnings-as-errors`, then `mix hex.audit && mix deps.audit`, then `mix xref graph --format stats`, then `mix test --trace 2>&1 | tail -20`.

Skip: Full security scan, N+1 analysis, test quality metrics, architecture deep dive.

Focus Mode (`--focus=area`)

Run only the selected concern track with its deeper checks:

| Focus | Extra checks | |-------|--------------| | `security` | Full OWASP review, Sobelow, manual authorization patterns | | `performance` | Query plans, N+1 inventory, profiling evidence | | `architecture` | Full xref graph, coupling matrix, cohesion | | `tests` | Coverage by context, isolation, flaky-test indicators | | `deps` | Vulnerabilities, licenses, maintenance status |

Incremental Mode (`--since <commit>`)

Analyze only changes since a specific commit. Useful for pre-merge checks:

Run `git diff --name-only <commit>...HEAD` to identify changed files, then run targeted audits on changed files only (skips full project scan).

Combines with other flags: `phx-audit --since HEAD~5 --focus=security`

Relationship to Other Commands

| Command | Scope | Frequency | |---------|-------|-----------| | `phx-review` | Changed files (diff) | Every PR | | `phx-audit` | Entire project | Quarterly | | `phx-boundaries` | Context structure | On-demand | | `phx-verify` | Compile/test pass | Anytime |

References

• `references/scoring-methodology.md` - How scores are calculated
• `references/architecture-checks.md` - Detailed architecture criteria