| name | rest-audit |
| description | Audit the project against the R.E.S.T. framework (TRAE) — Reliability, Efficiency, Security, Traceability. Reads ledger entries, hook state, and artifact presence across long-session + policy-gateway + context-engine + traces. Single PASS/WARN/FAIL table. Cross-cut meta-surface. |
| when_to_use | Periodic checkup, before releases, or when investigating a session regression that may span multiple plugins (a missed gate, a leaked secret, a token blowout). Do NOT use for structural drift — that's `/entropy-scan`; this skill reports outcomes (R/E/S/T axes), not file-level mismatches. |
| disable-model-invocation | true |
| allowed-tools | ["Read","Grep","Glob","Bash"] |
| logical | report shows PASS / WARN / FAIL for each of the 4 R.E.S.T. axes with worst-axis as overall verdict |
/rest-audit — R.E.S.T. Framework Audit
Outcome-oriented audit surface. Unlike /entropy-scan (structural — drift/registration/invariants), this one reports against the four production-readiness outcomes from TRAE's R.E.S.T. framework: Reliability · Efficiency · Security · Traceability.
Every axis pulls from at least two existing plugins so a failure has a concrete remediation path.
Process
For each axis, collect signals → classify PASS / WARN / FAIL → report one actionable next step.
Reliability (targets: fault recovery, idempotency, graceful degradation)
| Check | PASS | WARN | FAIL |
|---|
claude-progress.txt exists AND has ≥1 entry | yes | 0 entries | missing |
init.sh exists AND executable | yes | non-exec | missing |
Ledger has ≥0 safe-mode-enter events in last 7 days | 0–1 | 2–3 | ≥4 (runaway) |
/postmortem coverage: ratio of safe-mode-exit ledger events followed by a memory entry within 24h | ≥0.8 | 0.5–0.8 | <0.5 |
consecutive-failure-guard present in hooks.json | present | — | missing |
Sources: .claude/lineage/ledger.jsonl, claude-progress.txt, init.sh, plugins/context-engine/hooks/hooks.json.
Efficiency (targets: resource control, per-category budgets, low-latency)
| Check | PASS | WARN | FAIL |
|---|
| CLAUDE.md size (root) | <150 lines | 150–300 | >300 |
/token-pipeline nudge surfaced last session | yes (hook log or user run) | no data | — |
| Memory topic count | <30 | 30–60 | >60 |
| Features.json pending/done ratio (if present) | <1.0 | 1.0–3.0 | >3.0 (backlog blowout) |
| Traces hook wiring present | present | — | missing |
Sources: CLAUDE.md, .claude/memory/MEMORY.md, .claude/features.json, plugins/traces/hooks/hooks.json.
Security (targets: least privilege, I/O filtering, injection defense)
| Check | PASS | WARN | FAIL |
|---|
policy-gateway plugin present | yes | — | missing |
block-destructive.sh + scan-secrets.sh both PreToolUse | both | one | neither |
rules.d/secrets.txt exists AND non-empty | yes | empty | missing |
Ledger policy-block events in last 30 days (sign the plugin is armed AND being used) | ≥1 | 0 but plugin present | plugin missing |
Sensitive files not in working tree (grep matches via /policy-audit pass 2) | 0 matches | 1–2 | ≥3 |
Sources: .claude-plugin/marketplace.json, plugins/policy-gateway/, ledger.
Traceability (targets: end-to-end trace, explainability, auditability)
| Check | PASS | WARN | FAIL |
|---|
traces/hooks/hooks.json registers ≥3 collectors | ≥3 | 1–2 | 0 |
| Ledger entries in last 7 days | ≥5 | 1–4 | 0 |
Handoff-equivalent coverage: claude-progress.txt entries vs session count (sessions count = .claude/traces/session-*.jsonl file count or similar) | ≥0.7 | 0.3–0.7 | <0.3 |
/lineage-audit runs clean (invoke it as part of rest-audit; propagate failures) | clean | warnings | fails |
Sources: plugins/traces/hooks/hooks.json, .claude/lineage/ledger.jsonl, .claude/traces/ (if present), call /lineage-audit.
Output
R.E.S.T. AUDIT — <UTC>
=============================================
Reliability [PASS/WARN/FAIL]
<check> [status] <detail>
Next: <one concrete action>
Efficiency [PASS/WARN/FAIL]
<check> [status] <detail>
Next: <one concrete action>
Security [PASS/WARN/FAIL]
<check> [status] <detail>
Next: <one concrete action> (e.g. "Run /policy-audit for deep dive")
Traceability [PASS/WARN/FAIL]
<check> [status] <detail>
Next: <one concrete action> (e.g. "Run /lineage-audit")
Overall: PASS / WARN / FAIL
Axis status = worst individual check.
Overall = worst axis.
Examples
Example 1: healthy project
Input: ledger has 12 entries in the last 7 days (no safe-mode runaway), CLAUDE.md is 142 lines, block-destructive.sh + scan-secrets.sh both registered, 4 traces collectors registered, /lineage-audit runs clean.
Output:
R.E.S.T. AUDIT — 2026-05-19T10:00Z
=============================================
Reliability PASS
claude-progress.txt: 14 entries [PASS]
safe-mode events last 7d: 0 [PASS]
Next: none
Efficiency PASS
CLAUDE.md size: 142 lines [PASS]
Memory topics: 18 [PASS]
Next: none
Security PASS
policy-gateway present [PASS]
block-destructive + scan-secrets [PASS both]
policy-block events last 30d: 3 [PASS]
Next: none
Traceability PASS
traces collectors: 4 [PASS]
/lineage-audit: clean [PASS]
Next: none
Overall: PASS
Example 2: Security WARN driven by no recent policy-block
Input: policy-gateway present and armed, but no policy-block ledger entries in 30 days (plugin armed but unexercised); everything else green.
Output:
R.E.S.T. AUDIT — 2026-05-19T10:00Z
=============================================
Reliability PASS
Efficiency PASS
Security WARN
policy-gateway present [PASS]
block-destructive + scan-secrets [PASS both]
policy-block events last 30d: 0 [WARN — armed, never fired]
Next: Run /policy-audit to confirm scanners are reaching the working tree (a 0-count could mean clean repo OR misconfigured matchers).
Traceability PASS
Overall: WARN
Integration
Reads from everywhere — this is the meta-surface:
.claude/lineage/ledger.jsonl — safe-mode, policy-block, progress-log, SEPL eventsclaude-progress.txt — long-session coverage.claude/spec.md, .claude/features.json — living spec / testable reqs.claude/memory/MEMORY.md — memory bloat signalCLAUDE.md — efficiency signalplugins/*/hooks/hooks.json — wiring-presence signalsplugins/policy-gateway/rules.d/*.txt — armed-rules signal
Delegates to:
/policy-audit for Security deep dive/lineage-audit for Traceability deep dive/token-pipeline for Efficiency remediation planning/postmortem for Reliability remediation (after safe-mode exits)
Invoked by:
/entropy-scan includes this skill as a sub-check/evolve reads the FAIL list to seed proposals (e.g. if Security axis fails, propose adding a rule to rules.d/secrets.txt)
Known Failure Modes
- Ledger missing → axes that depend on it report WARN (not FAIL) and suggest running the producing skills at least once.
/lineage-audit not installed → Traceability axis still runs (skips only the sub-call).- Some signals unknowable without Claude Code instrumentation (e.g.
/postmortem memory check requires reading memory index) — degrade to best-effort.
Do NOT
- Do not fix anything. This skill is diagnostic only; remediation belongs to the delegated skills.
- Do not write anything except the report. No ledger writes (the audit itself is not a protocol operator).
