| name | plan-audit |
| description | Audit a `plan@1` against `plan_rubric@1.0` and refuse to pass below 10/10. REDS a plan that is missing an option (PLAN-OPT-001, fewer than two options weighed), missing a decision (PLAN-DEC-001, zero or more than one decision), or missing the out list (PLAN-OUT-001, an empty or absent `### Out of scope`). Also checks checkable evidence on every option (PLAN-OPT-002), the confidence grade (PLAN-DEC-002), the proposed-task-set shape create-tasks consumes (PLAN-SET-*), the never-writes-tasks discipline (PLAN-SAFE-*), and the verifiable BRAIN chain (PLAN-BRAIN-*). Emits a `score / 10` verdict citing rule ids, never paraphrase. Use when user asks to "audit this plan" or "check the plan". Do NOT use to "draft a new plan" (use plan-author instead). |
| license | Apache-2.0 |
| metadata | {"version":"1.0.0","module":"skill","stage":"a","cyberos-template":"plan@1","cyberos-rubric-target":"plan_rubric@1.0"} |
| allowed_memory_scopes | {"read":["project:*","module:*"],"write":["project:plan/{plan_id}"]} |
| audit | {"row_kind":"plan_audited","required_fields":["plan_id","verdict","score","findings"]} |
| inputs | [{"name":"plan","format":"plan@1","required":true}] |
| outputs | [{"name":"plan_audit","format":"verdict: pass|fail|needs_human + score /10 + findings[]"}] |
| triggers | ["a plan@1 artefact exists and has not passed audit","chained after plan-author (the default)"] |
| blockers | ["artefact is not plan@1 (unknown version) - needs_human, never guess","PLAN-GATE-001 operator verdict is absent - needs_human (a HITL halt cannot be decided by the rubric)"] |
| untrusted_inputs | {"wrap_in_marker":"untrusted_content","injection_scan":"required","on_marker_hit":"surface_to_human"} |
plan-audit
Standalone trigger that runs plan_rubric@1.0 against a plan@1 and writes a verdict citing rule
ids. Refuses to pass below 10/10. Chains naturally after
plan-author. Mirrors the task-audit / architectural-spike-audit
shape: an auditor cites rule ids, it does not paraphrase prose.
prompt_revision: plan_audit@1.0.0
When to invoke this skill
CUO routes a request here when the user wants to:
- "Audit this plan."
- "Check the plan before I hand it to create-tasks."
- "Would this plan pass?"
Also invoked automatically when plan-author chains to it (the default). If the user wants to draft a plan, route to plan-author.
Self-test preamble — emit BEFORE any file action
CONTRACT_ECHO
skill_id: plan-audit
skill_version: 1.0.0
prompt_revision: plan_audit@1.0.0
template_version: plan@1
audit_rubric_version: plan_rubric@1.0 (loaded from ../rubrics/plan_rubric.md; vendored: .cyberos/cuo/rubrics/plan_rubric.md)
audit_path_pattern: <plan_path with extension replaced by ".audit.md">
hitl_policy: needs_human on PLAN-GATE-001 (operator verdict) + unknown version
pass_threshold: 10/10 (refuse below)
inputs:
plan: <path to plan@1 markdown>
phase: AUDIT
§1 Purpose
Make plan verdicts reproducible: an auditor cites PLAN-* / FM-* / SEC-* rule ids from plan_rubric@1.0 instead of paraphrasing prose. Only 10/10 passes. Evidence is checked by RESOLUTION (does the cited file path / command output / URL actually check out at audit time), not by presence — an option whose evidence does not resolve carries zero evidence.
§2 Verdict semantics
- pass = every rubric rule green (10/10).
- fail = any
error rule red. Findings name each rule_id + location + what resolves it.
- needs_human = ambiguity the rubric cannot decide: unknown artefact version, contradictory frontmatter, or the
PLAN-GATE-001 operator-verdict question (a HITL halt the suite cannot simulate — verified against the recorded gate-log transcript).
