straymark-audit-execute

name	straymark-audit-execute
description	Execute an external audit of a Charter inside an auditor-side CLI (gemini-cli, claude-cli, copilot-cli, codex-cli). Reads the resolved audit prompt from the canonical location, audits with tool use, writes the report. Operator invokes one instance per CLI.
allowed-tools	Read, Write, Glob, Grep, Bash(go vet *, go build *, go test *, cargo check *, cargo clippy *, cargo test --no-run, npm run lint, npm run typecheck, npm test --, pytest --co, mypy *, ruff check *, ls *, find *, wc *, git log *, git diff *, git status *)
argument-hint	CHARTER-NN [AUDITOR-SLUG] (auditor id is operator-provided, never self-detected)

StrayMark Audit Execute Skill

Execute an external audit of a Charter inside this CLI session. Read the resolved audit prompt that StrayMark prepared at the canonical location, audit the implementation with tool use (citing path:line of files actually opened), and write the report at the canonical location for the audit-review skill to consolidate later.

When to invoke

This skill runs inside an auditor-side CLI (gemini-cli, claude-cli, copilot-cli, codex-cli, or any agent runtime configured with read-only access to the adopter's repo). The operator opens the CLI in the repo, then invokes /straymark-audit-execute <CHARTER-ID>.

The skill is the second step of the v1 audit cycle:

1. In the main IDE: operator runs /straymark-audit-prompt CHARTER-NN → StrayMark writes .straymark/audits/CHARTER-NN/audit-prompt.md.
2. (this skill) Operator opens an auditor-side CLI in the repo and runs /straymark-audit-execute CHARTER-NN. Repeat in N CLIs (recommended: ≥2 of different model families).
3. When ALL audits commissioned have completed, operator returns to the main IDE and runs /straymark-audit-review CHARTER-NN.

Instructions

1. Resolve the Charter

Two positional arguments: <CHARTER-ID> and an optional <AUDITOR-SLUG> — e.g. /straymark-audit-execute CHARTER-06 deepseek-v4-pro. The second argument is the operator-provided auditor identity (see step 2); it is never inferred from the CLI you are running in.

Case A — Charter provided (/straymark-audit-execute CHARTER-04 [AUDITOR-SLUG]): Use the literal Charter value. Construct the audit dir path: .straymark/audits/CHARTER-04/.

Case B — Charter omitted (/straymark-audit-execute): Auto-discover pending prompts. Resolve the auditor identity (step 2 — from the argument or the operator) and produce its slug. Then:

# List all audit prompts that exist
ls .straymark/audits/*/audit-prompt.md 2>/dev/null

For each found .straymark/audits/<CHARTER-ID>/audit-prompt.md, check whether a report from this model already exists at .straymark/audits/<CHARTER-ID>/report-<slug>.md. The set of "pending" prompts is the ones WITHOUT a corresponding report.

• Exactly one pending → proceed with that CHARTER-ID, announcing the choice to the operator.
• Multiple pending → list them numerically with their Charter titles (read the title from the resolved prompt's # Auditoría de Charter — CHARTER-NN heading) and ask the operator to pick one.
• None pending → message: "No pending audit prompts for this model under .straymark/audits/. Either the operator has not run /straymark-audit-prompt in the main agent yet, or all the prompts already have a report from this model. Verify with the operator."

2. Determine the auditor identity — the operator sets it, never self-perception

The auditor: identity is authoritative input from the operator, not something you infer about yourself. Resolve it, in priority order:

1. Second argument — /straymark-audit-execute <CHARTER-ID> <AUDITOR-SLUG> (e.g. /straymark-audit-execute CHARTER-06 deepseek-v4-pro).
2. What the operator states in chat — "I selected model X", "seleccioné el modelo X", "identify as X", "use X". The CLI you run inside (Qwen Code, Claude Code, Gemini CLI, Copilot CLI, …) is a router, not the model: it routes prompts to a backend LLM the operator picks via /model and confirms in the status bar. The auditor: field must name that backend model (e.g. glm-5-2, qwen3-7-max, deepseek-v4-pro), which routinely differs from the CLI's product name.

Use whatever the operator provides verbatim (after slugging). You are forbidden to introspect, guess, or substitute the CLI/runtime product name. Writing any identifier other than the operator-provided one — including the name of the CLI you are running in (qwen-code, gemini-cli, claude-code, copilot, …) — is a defect that silently corrupts the review step (wrong attribution, false cross-family agreement). Do not refuse a legitimate operator-specified identifier: the operator is the sole authority on which backend model they selected.

Slug rules (applied to the provided string):

• Lowercase ASCII.
• Replace any character that isn't [a-z0-9-] with -.
• Collapse consecutive dashes to one.
• Trim leading/trailing dashes.

Operator-provided identifier	Slug
claude-sonnet-4-6	claude-sonnet-4-6
gemini-2.5-pro	gemini-2-5-pro
deepseek-v4-pro	deepseek-v4-pro
gpt-5.3-codex	gpt-5-3-codex

Fallback — only if the operator provided no identifier by either route: ask them for the backend model id before proceeding. Do NOT fabricate a slug, and do NOT fall back to your CLI product name — collisions or wrong identifiers corrupt the review step.

3. Read the audit prompt

cat .straymark/audits/<CHARTER-ID>/audit-prompt.md

The prompt is self-contained: it includes the Charter content, originating AILOGs, git diff, and the discipline rules (REGLA ABSOLUTA — SOLO LECTURA, evidence-citation discipline, severity calibration). Read it carefully before auditing.

4. Audit with tool use

Follow the prompt literally, with these expectations:

• Read-only: never write to project files. The only output you are allowed to produce is the report at the canonical path in step 5.
• Tool-use evidence: every finding you record must cite path:line of files you actually opened via Read, Grep, or equivalent. Do not infer behavior from file names alone.
• Severity calibration: open the active configuration (factories, env defaults, build tags, deployment scaling) before declaring Critical/High severity. The Etapa 12 example in the prompt is a real case of inflation that the calibration discipline catches.
• Scope discipline: only report findings inside the Charter's declared scope. Out-of-scope observations go in their own section, not as defects.

Track how many path:line citations you accumulate — it goes in the report frontmatter as evidence_citations.

5. Write the report

Output path:

.straymark/audits/<CHARTER-ID>/report-<slug>.md

If a report at that exact path already exists (re-run on the same Charter with the same model), warn the operator before overwriting. The default is to overwrite — re-runs replace stale reports rather than coexist with them.

If, by some unusual reason, two distinct sessions of the SAME model audited the same Charter and the operator wants both, append a numeric suffix manually: report-<slug>-2.md.

The report frontmatter MUST conform to audit-output.schema.v0.json:

---
audit_role: auditor
auditor: <auditor-slug>           # operator-provided model id — NEVER the CLI product name (qwen-code, gemini-cli, …)
charter_id: <CHARTER-ID>
git_range: "<range from prompt>"
prompt_used: audit-prompt.md
audited_at: <YYYY-MM-DD>
findings_total: <N>
findings_by_category:
  hallucination: <N>
  implementation_gap: <N>
  real_debt: <N>
  false_positive: <N>
evidence_citations: <N>           # how many path:line citations the body contains
audit_quality: high | medium | low
---

# (body following the format declared in the prompt's "Formato de salida" section)

Guard — verify the identity before you finish (mandatory). Re-open the file you just wrote and confirm that BOTH the frontmatter auditor: field AND the report's # Auditoría: <CHARTER-ID> por <X> header equal the operator-provided slug exactly. If either shows anything else — especially the CLI product name you are running in (qwen-code, gemini-cli, …) — rewrite them. The filename report-<slug>.md, the auditor: field, and the header must all carry the same operator-provided slug.

6. Notify the operator — with the wait warning

After writing the report, print this message verbatim (substituting <CHARTER-ID>, <slug>, and the finding count):

Audit complete for <CHARTER-ID> (this auditor: <auditor-slug>).

  Report: .straymark/audits/<CHARTER-ID>/report-<slug>.md
  Findings: <N> total (<by-category breakdown>)

IMPORTANT: do NOT return to the main agent for /straymark-audit-review yet
unless ALL audits you commissioned have completed.

If you opened other auditor CLIs (gemini-cli, copilot-cli, codex-cli, ...)
and have not yet seen their /straymark-audit-execute finish, wait for them.
Invoking /straymark-audit-review with incomplete reports produces a partial
consolidated analysis that you will have to discard or re-run — costing
you the audit cycle.

When and only when ALL audits you commissioned are complete, return to
your main IDE and run:

    /straymark-audit-review <CHARTER-ID>

This wait warning matters: an operator with three CLIs open in parallel can be tempted to invoke review as soon as the first audit finishes. The review skill iterates whatever reports are present at the time it runs; it cannot wait for additional reports to arrive.

Notes

• No HTTP API calls. This skill runs inside an auditor CLI that the operator chose; that CLI handles all model invocation, API keys, and rate limits. StrayMark orchestrates prompt resolution and report shape — nothing else.
• Re-runs: if you invoke this skill on a Charter whose report from this model already exists, the existing one is overwritten. The previous report is lost — if you wanted to keep it, copy it manually before re-running.
• Multiple Charters in the same CLI session: invoke the skill once per Charter. Reports do not collide because the filename is keyed on Charter id + model slug.
• Heterogeneity inter-family: the skill does not enforce that the operator uses different model families across the N audit-execute invocations. The recommendation is in the audit prompt itself and in AGENT-RULES.md §12; trust the operator.