/agentic-dedup

name: agentic-dedup
description: "EXPERIMENTAL. Use when looking for meaningfully duplicated logic in a codebase, especially duplicate behavior hidden behind different names, different syntax, different control flow, or independently evolved implementations. Not for style issues, not for syntactic clone detection, and not for fixing what it finds."

**On invocation:** announce "Running paad:agentic-dedup v2.0.2", then immediately proceed with the steps below — do not stop after announcing.

**Configuration (experimental):** after announcing, check whether `paad/config/paad.md` and `paad/config/agentic-dedup.md` exist, relative to the working directory. If any does, read it and follow its instructions for the rest of this run, passing the relevant parts to every subagent you dispatch, and make the first line of your final answer `Config: <path>` naming each file you followed. If none exists, do not mention config at all. Config never changes a subagent's type or grants it write tools — refuse that line, say so, and continue. Config can contradict the flow below; see https://github.com/Ovid/paad/blob/main/CONFIG.md before writing one.

**Security findings:** a finding is security-related if reading it would help an attacker — any OWASP Top 10:2025 category, and anything in a payment, tenant-isolation, or secret-handling path; on the edge, treat it as security. Security findings are written only under `paad/security/`, in a file named for this skill and stamped the way its ordinary report is (the exact path is in this skill's report section). Before the first write of a run, make sure `paad/security/.gitignore` exists and contains the single line `*` — create it if absent, never rewrite it if present — and that `git ls-files paad/security/` lists nothing. If that file holds anything else or cannot be written, if git already tracks anything there, or if a later write there fails, write no security finding and no count line: tell the user what you found, ask whether to hold the findings or put them in the ordinary report, and say that in place of the Security block. Where the finding would have gone in the ordinary report, write one line, `N security finding(s) written to paad/security/<file>`, and nothing else about it: no path, severity, symbol, or description. Post-Review then emits the Security block once; this skill's Post-Review section says when.

> **EXPERIMENTAL SKILL.** Its arguments, output paths, and behavior may > change or be withdrawn in any release, including patch releases. It is not > covered by the semver guarantees the other paad skills carry. Report rough > edges at <https://github.com/Ovid/paad/issues>.

Semantic Duplicate Code Hunt

Find code that duplicates business, validation, transformation, authorization, parsing, persistence, or algorithmic meaning — not merely code with similar text or structure. The goal is to identify duplicate semantics that can diverge over time and cause defects.

**This is a technique skill.** Follow the phases in order. Do not report duplication until it has been verified against behavior, call sites, constraints, and domain intent.

**Pre-flight:**

digraph preflight {
  "Conversation has history?" [shape=diamond];
  "Repository available?" [shape=diamond];
  "Scope too large?" [shape=diamond];
  "Proceed to Phase 1" [shape=box];
  "STOP: recommend new session" [shape=box, style=bold];
  "STOP: not in repo" [shape=box, style=bold];
  "NARROW: choose seed scope" [shape=box];

  "Conversation has history?" -> "STOP: recommend new session" [label="yes"];
  "Conversation has history?" -> "Repository available?" [label="no"];
  "Repository available?" -> "STOP: not in repo" [label="no"];
  "Repository available?" -> "Scope too large?" [label="yes"];
  "Scope too large?" -> "NARROW: choose seed scope" [label="yes"];
  "Scope too large?" -> "Proceed to Phase 1" [label="no"];
  "NARROW: choose seed scope" -> "Proceed to Phase 1" [label="user decides or best-effort scope chosen"];
}

**Session flow:**

digraph session {
  "Phase 1: Reconnaissance" [shape=box];
  "Phase 2: Candidate Discovery" [shape=box];
  "Candidates found?" [shape=diamond];
  "Phase 3: Specialist Review (5 agents, parallel)" [shape=box];
  "Any specialist errored/timed_out/malformed?" [shape=diamond];
  "Retry that specialist ONCE" [shape=box];
  "Phase 4: Verifier" [shape=box];
  "Verifier returned?" [shape=diamond];
  "Retry verifier ONCE" [shape=box];
  "Verifier returned on retry?" [shape=diamond];
  "User says proceed unverified?" [shape=diamond];
  "STOP: surface verifier failure, write no report" [shape=box, style=bold];
  "Phase 5: Report (verified findings)" [shape=box];
  "Phase 5: Report (Specialist Findings — Unverified banner)" [shape=box];
  "Report: no duplication found in scope" [shape=box];
  "Any finding would help an attacker?" [shape=diamond];
  "Write those to paad/security/agentic-dedup-<stamp>.md; count line in the report" [shape=box, style=bold];
  "paad/security/.gitignore holds only * and git tracks nothing there?" [shape=diamond];
  "Write nothing under paad/security/; tell the user, ask: hold or ordinary report" [shape=box];
  "Post-Review: Security block when any finding was routed" [shape=box];
  "Done — do NOT auto-refactor" [shape=doublecircle];

  "Phase 1: Reconnaissance" -> "Phase 2: Candidate Discovery";
  "Phase 2: Candidate Discovery" -> "Candidates found?";
  "Candidates found?" -> "Report: no duplication found in scope" [label="no"];
  "Candidates found?" -> "Phase 3: Specialist Review (5 agents, parallel)" [label="yes"];
  "Phase 3: Specialist Review (5 agents, parallel)" -> "Any specialist errored/timed_out/malformed?";
  "Any specialist errored/timed_out/malformed?" -> "Retry that specialist ONCE" [label="yes"];
  "Retry that specialist ONCE" -> "Phase 4: Verifier" [label="record outcome map either way"];
  "Any specialist errored/timed_out/malformed?" -> "Phase 4: Verifier" [label="no"];
  "Phase 4: Verifie