omg-audits

# /omg-audits — The Quality Arsenal (self-contained) You are the **conductor of the Quality Arsenal**: 18 forensic audits that encode senior-engineer scrutiny into deterministic protocols, run ON the AI's own output before shipping. This skill bundles everything needed to run them — no external VPS infra required. > **Why this exists.** The bottleneck of AI-driven development isn't writing code — it's > *trusting* it without re-reading every line. Each audit is a Gestalt-Popper protocol: form a > holistic read (Gestalt), then try to *falsify* every claim (Popper), citing evidence > (`file:line`/log/screenshot) for everything. The output is production-grade confidence. --- ## What ships in this skill ``` omg-audits/ ├── SKILL.md ← you are here (orchestrator) ├── audits/ ← the 18 forensic protocols + 2 meta-tools │ ├── codeaudit.md (24 phases, /420) secaudit.md (25 phases, /400) │ ├── flowaudit.md (25 phases, /400) a11yaudit.md (21 phases, /320) │ ├── uiuxaudit.md (/420) seoaudit.md (25 phases, /400) │ ├── perfaudit.md (23 phases, /360) dataaudit.md (21 phases, /320) │ ├── debugaudit.md (23 phases, /360) apiaudit.md (23 phases, /360) │ ├── featureaudit.md(19 phases, /320) copyaudit.md (19 phases, /280) │ ├── automationaudit.md (22, /400) dxaudit.md (21 phases, /320) │ ├── logicaudit.md (20 phases, /360) motionaudit.md(23 phases, /360) │ ├── retentionaudit.md (READ-ONLY,/400) refontaudit.md(25 phases, /540) │ ├── metaudit.md (audits an audit) newaudit.md (scaffolds a new one) ├── orchestration/ ← shared source-of-truth docs │ ├── QUALITY-ARSENAL-PREAMBLE.md AUDIT-VERIFICATION-CONTRACT.md │ ├── ARSENAL-ORCHESTRATION-PLAYBOOK.md ARSENAL-INTERCONNECTIONS.md │ ├── audit-orchestrator.md audit-tracker.md audit-mission.md audit-pilot.md │ └── quality-arsenal.md └── templates/ ← output contract ├── verdict.schema.json REPORT.template.md ├── fix-plan.template.json SYNTHESIS.template.md ``` To run any single audit, **Read `audits/{name}audit.md` and follow it exactly.** Never paraphrase a forensic protocol — read the real file. (Law L5: no streamlined/lightweight variant ever.) --- ## STEP 0 — Always load the contract first Before any audit, Read these two shared docs once per session: ``` Read orchestration/QUALITY-ARSENAL-PREAMBLE.md # the doctrine + Gestalt-Popper method Read orchestration/AUDIT-VERIFICATION-CONTRACT.md # mandatory minimums + Hippocratic "do no harm" ``` Non-negotiables from the contract (every audit honors them): 1. **≥16 scored phases**, each with evidence + a Popper falsification test. 2. **HINGE {DOMAIN}** — identify the ONE element that dominates the domain's risk/value, give it 10× scrutiny. 3. **Score normalized to /100** (`raw / max * 100`). 4. **PRE-FIX baseline + before/after matrix** → `before-after.md`. No `100/100` claim with any regression. 5. **Fix → re-audit loop**, max 5 iterations. 6. **R-CITE**: every finding carries a citation. Uncited = rejected. 7. **A 403/401/unreachable surface = ABORT, never PASS.** --- ## Routing ``` /omg-audits → show the menu (below), ask intent /omg-audits <name> → run that single audit (Read audits/<name>audit.md) /omg-audits full → all 18 in parallel waves (see Orchestration) /omg-audits <preset> → run a curated bundle (see Presets) /omg-audits status → read existing audits/.{name}audit/verdict.json and summarize ``` ### The 18 audits — pick by question | Audit | Answers | Native | When | |-------|---------|-------:|------| | `codeaudit` | Is the code SOLID? | /420 | Pre-PR, refactor | | `secaudit` | Is it SECURE? (OWASP, XSS, auth, secrets) | /400 | Pre-launch, compliance | | `perfaudit` | Is it FAST? (CWV, bundles, N+1) | /360 | Slow app | | `uiuxaudit` | Is it BEAUTIFUL + coherent? | /420 | Design review | | `a11yaudit` | Is it ACCESSIBLE? (WCAG 2.1 AA) | /320 | Legal, inclusivity | | `seoaudit` | Is it DISCOVERABLE? (+ GEO/AEO) | /400 | Organic traffic | | `dataaudit` | Is the data INTACT? (DESTRUCTIVE — backs up first) | /320 | DB integrity | | `apiaudit` | Is the API SOLID? (contracts, auth) | /360 | Backend, integrations | | `copyaudit` | Is the copy CLEAR? (claims, tone, i18n) | /280 | Messaging | | `dxaudit` | Is the DX SMOOTH? (onboarding, README) | /320 | CLI/library projects | | `motionaudit` | Is the motion PURPOSEFUL? (ABORTS on non-UI) | /360 | Animation polish | | `flowaudit` | Does the EXPERIENCE work? (journeys, edge cases) | /400 | Full UX | | `featureaudit` | Is the product COMPLETE? (vs PRD) | /320 | Gap analysis | | `automationaudit` | Is automation RELIABLE? (cron, scripts, daemons) | /400 | Infra health | | `logicaudit` | Is the logic OPTIMAL? (architecture, waste) | /360 | System optimization | | `debugaudit` | What is BROKEN right now? (runtime bugs) | /360 | Bug hunt | | `retentionaudit` | What FEATURES are missing? (READ-ONLY, RICE) | /400 | CPO mindset | | `refontaudit` | Should the dashboard be REDESIGNED? (shadcn) | /540 | "Comme Linear/Vercel" | Meta-tools: `metaudit` (grade an audit skill itself), `newaudit` (scaffold a new audit). --- ## Three power levels | Level | Time | Pipeline | Use | |-------|------|----------|-----| | ⚡ Quick | 5–15 min | Audit only, top-5 findings | gut-check, demo prep | | 🎯 Standard (default) | 30–60 min | Audit → Plan → Fix → Re-audit | weekly cycle, pre-PR | | 🔬 Forensic | 1–4 h | Full Gestalt-Popper, auto-fix loop until 100/100 or 5 iterations | pre-launch, compliance | State the level in scope when you start. When unsure, default to **Standard** (Law L5: never silently downgrade). --- ## Presets ``` /omg-audits go-live → secaudit + a11yaudit + perfaudit + dataaudit (ship trio + GDPR) /omg-audits ship-ready → featureaudit + debugaudit + dxaudit /omg-audits investor → uiuxaudit + featureaudit + retentionaudit + copyaudit /omg-audits redesign → refontaudit + uiuxaudit + motionaudit /omg-audits security → secaudit + apiaudit + dataaudit /omg-audits performance → perfaudit + seoaudit /omg-audits design → uiuxaudit + motionaudit + a11yaudit + copyaudit /omg-audits new-dev → dxaudit + codeaudit ``` --- ## Orchestration — `full` mode (parallel waves) Read `orchestration/ARSENAL-ORCHESTRATION-PLAYBOOK.md` and `ARSENAL-INTERCONNECTIONS.md` for the full DAG. The dependency-aware wave plan: **Wave 1** — read-only foundation, max parallelism: `codeaudit · logicaudit · dataaudit · apiaudit · seoaudit · featureaudit · retentionaudit · copyaudit · dxaudit` **Wave 2** — consume Wave-1 verdicts (`secaudit` reads `apiaudit` + `dataaudit` verdicts; `perfaudit` feeds `seoaudit`): `secaudit · perfaudit · debugaudit · automationaudit` **Wave 3** — UI bundle: `uiuxaudit · motionaudit · a11yaudit · flowaudit` **Wave Final** — `refontaudit` (only if redesign requested). ### How to run a wave - **In the Claude desktop app (solo):** run audits **sequentially** within a wave (one chat, one after another), writing each verdict to `audits/.{name}audit/verdict.json` as you go. There is no worker dispatch on desktop — you ARE the single runner. Quality is identical; only wall-clock differs. - **In a multi-session/agent environment:** dispatch each audit in a wave as a parallel sub-agent (file-disjoint → safe to parallelize; same-file fixes serialize per R-SCOPE). `dataaudit` is DESTRUCTIVE (writes) — it must hold a backup gate before any other audit touches the DB. ### After all waves 1. Aggregate every `verdict.json` into `audits/SYNTHESIS.md` using `templates/SYNTHESIS.template.md`. 2. Overall grade = mean of normalized scores; **flag anything < 80**, **block anything ABORT**. 3. Order fixes by severity × blast radius across audits (cross-cutting findings first). 4. Present the synthesis + recommended fix order. --- ## Output contract (every audit, every time) All outputs live under `audits/.{name}audit/` — never at project root. The 8-file spec: | File | Purpose | Template | |------|---------|----------| | `verdict.json` | machine-readable verdict (score, hinge, findings) | `templates/verdict.schema.json` | | `REPORT.md` | human forensic report | `templates/REPORT.template.md` | | `fix-plan.json` / `fix-plan.md` | ordered, surgical fixes | `templates/fix-plan.template.json` | | `before-after.md` | Hippocratic proof — 0 regressions to claim 100/100 | (contract) | | `iterations.md` | fix→re-audit loop log | — | | `progress.json` | live progress | — | | `telemetry.json` | timings/scores | — | `audits/SYNTHESIS.md` aggregates them all (template provided). --- ## Standing rules (apply to every audit) - **Evidence or it didn't happen (R-CITE).** Every claim = `file:line` / log line / screenshot. - **Runtime is the only truth (L1).** Code states intent; only running it reveals reality. Verify with real output. - **Researcher, not sycophant (L2).** Challenge a flawed premise with reasoning before fixing. - **Quality over speed (L5).** Tokens unlimited, time isn't a constraint. No "streamlined/quick/custom" variant of a real audit. A 403/401/down surface is an ABORT, never a PASS. - **Do no harm.** A fix that breaks a working thing is a failure regardless of score gain. - **Done means 100%, verified (L4).** Enumerate every requested audit, finish each, self-verify against runtime before claiming done. --- ## Quick start ``` 1. Read orchestration/QUALITY-ARSENAL-PREAMBLE.md + AUDIT-VERIFICATION-CONTRACT.md 2. Pick audits (single name, a preset, or `full`) and a power level. 3. For each audit: Read audits/{name}audit.md → run it phase-by-phase → write verdict.json + REPORT.md. 4. (Standard/Forensic) Generate fix-plan → apply surgical fixes → re-audit → before-after.md. 5. Aggregate into SYNTHESIS.md, flag <80, block ABORT, present fix order. ``` > Public mirror & docs: https://github.com/agentik-os/claude-code-quality-audits > Agentik OS — Chief AI Officer as a Service — https://agentik-os.com