| name | project-scoped-review |
| description | Audit a managed project's actual end state — code, tests, docs, release surface — against the roadmap/initiative intents that were supposed to produce it, hunting drift (promised-but-absent capabilities, orphaned/half-landed work, doc/code contradictions, silent scope cuts). |
| phase | audit |
| surface | operator-triggered |
| library | true |
| purpose | Compare a project's real end state to its stated intents (done initiatives, brain themes, doc claims) and report drift, classified delivered / drifted / missing / contradicted, every claim backed by file:line evidence. |
| composition | {"skills":[],"tools":[],"mcps":[],"guards":["event-log"]} |
| runtime | {"sdk":"claude","strategy":"fixed","model":"claude-sonnet-4-6"} |
| brainAccess | advisory |
| interactivity | Operator-triggered, on demand against one named project. Fully autonomous once launched — asks no questions, never blocks mid-run. |
| allowed-tools | ["Read","Grep","Glob","Write"] |
| disallowed-tools | ["Edit","MultiEdit","NotebookEdit","Bash","WebFetch","WebSearch","Task","Agent"] |
| budgets | {"maxBudgetUsd":5} |
Project-Scoped Review
Single responsibility
Audit ONE project's real end state against what it was supposed to become, and
report the drift. This codifies — as a re-runnable skill — the method the
2026-07 holistic review's end-state audit ran by hand (that worked example is preserved
in git history at docs/investigations/2026-07-holistic-review/endstate-audit.md; audit
outputs are written to the gitignored docs/investigations/ working area, not committed). That audit found a genuinely-shipped, CI-green, fully-migrated
release that STILL had a silently-dead auth path and a broken protocol
manifest — gaps invisible to per-initiative review because no single
initiative owned "does the finished thing actually work end to end." This
skill is that missing check, made repeatable.
Not a planner, not a dev-loop, not a gate. A read-only analyst that runs
after work has landed, over the checked-out project tree plus forge's
records of what was promised.
Why no execution tools
This skill is deliberately Read/Grep/Glob/Write only — no Bash, no network
tools. It cannot run go build, go test, git describe, gh api, or hit a
live endpoint. Where the source audit used a live command to settle a claim,
this skill instead:
- reads checked-in evidence (test files, CI workflow definitions, committed
release manifests, CHANGELOG entries,
.git/refs/tags/* and
.git/packed-refs as plain files) and cites it, or
- if no static evidence resolves the claim, classifies it
unverifiable and
names the exact command a human or a Bash-enabled follow-up should run
(§ Output contract, section 3) — it never asserts a verdict it cannot back
with a file:line.
This mirrors architect-completeness-critic (judges text it's given, invents
nothing) and project-brain-builder (Read/Grep/Glob/Write, no Bash) — critics
that report, not agents that act.
Inputs
Supplied in the launch prompt (the concrete transport — CLI flag, Studio form
— is out of this skill's scope; this is the interface contract):
- project (required) — a managed project id. Resolves to two locations,
both inside the forge repo:
- the working tree:
projects/<project>/ (code, tests, docs, release
artifacts — read-only)
- Brain 3:
brain/projects/<project>/ (profile.md, themes/*.md,
kb.yaml) — the durable record of what forge already learned about this
project
