auditing-devforgeai

name

auditing-devforgeai

description

Audit DevForgeAI through Prompts 0–8 and maintain a provenance-preserving audit bundle. Use when Codex must perform, resume, refresh, or synthesize an enterprise review of DevForgeAI skills, hooks, commands, agents, process gates, Claude↔Codex parity, or Codex-native behavior; regenerate scope after framework components change; archive a prior audit before updating it; or produce the self-contained audit workflow HTML and remediation roadmap.

Audit DevForgeAI

Use the bundled prompt suite as the audit contract and the bundle manager as the state boundary.

Prepare the run

Resolve the repository root, then run:

python3 <skill-dir>/scripts/audit_bundle.py prepare \
  --project-root <repo-root> \
  --audit-root <repo-root>/tmp/Audit

Read <audit-root>/current/run.json and inventory.json. Treat the inventory and its delta_from_previous as the current scope; do not reuse old component counts or assume that a previously absent skill, hook, command, agent, rule, config, or CI file is still absent.

prepare archives an existing canonical run, imports legacy audit documents once, records hashes, initializes all nine report files, embeds the prompt suite/templates, and renders the HTML workflow document.

Execute Prompts 0–7

Read references/audit-protocol.md completely before the first phase. For each phase:

1. Read its complete prompt from current/internal/DevForgeAI_Audit_Prompt_Suite.md.
2. Inspect every relevant current component from inventory.json, including additions and changes since the prior run.
3. Write only grounded findings to the assigned file under current/reports/ using the bundled scorecard and finding schemas.
4. Record exact paths, lines, commands, outputs, and confidence. Mark a dependency on unseen evidence Plausible and name the missing artifact.
5. Re-render after material inventory or report changes:

python3 <skill-dir>/scripts/audit_bundle.py render --audit-root <repo-root>/tmp/Audit

Do not use model APIs. Use local files, CLI validation, hooks, git/CI configuration, and the active Claude Code/Codex terminal surfaces.

Execute Prompt 8

Synthesize only the completed Prompt 0–7 reports. De-duplicate findings, state conflict resolutions, set one final score per Appendix C dimension, rank concrete cross-provider remediation, and list exact residual artifacts. Do not re-audit raw artifacts during synthesis except to resolve a documented conflict.

Validate and import completed content

Before finalization, run devforgeai-validate audit-content-validate against the managed Prompt 0–8 report directory and exact audited snapshot. HALT on a missing CLI, exit 127, malformed JSON, template marker, placeholder, incomplete Appendix B record, duplicate ID, phase-map error, snapshot mismatch, or Prompt 8 input-hash mismatch.

When durable remediation intake is requested, use audit-import-completed followed by audit-findings-build. Never edit archive bytes or remediation state directly. Corrections create provenance in a new managed import; the original hash remains immutable.

Validate and finalize

Run:

python3 <skill-dir>/scripts/audit_bundle.py validate --audit-root <repo-root>/tmp/Audit
python3 <skill-dir>/scripts/audit_bundle.py finalize --audit-root <repo-root>/tmp/Audit

Do not report completion when validation fails. Return the final report paths, archive lineage, inventory delta, and validation result.

Bundled resources

• assets/DevForgeAI_Audit_Prompt_Suite.md: immutable per-skill prompt contract copied into each run.
• assets/templates/: Appendix B/C-derived finding, scorecard, phase-report, and synthesis templates.
• assets/DevForgeAI-Audit-Workflow.html: self-contained workflow illustration with the prompt suite and templates embedded as internal assets.
• references/audit-protocol.md: phase-to-artifact contract, adaptive discovery rules, and provenance semantics.
• scripts/audit_bundle.py: deterministic inventory, archive, render, validate, and finalize operations.