weekly-maintenance

name	weekly-maintenance
version	2.6.0
description	Execute comprehensive weekly maintenance routine (1-2 hours, Friday recommended). Includes health checks, quality review, dependency governance, activity insights, and planning.
trigger	manual
depends-on	["code-quality"]
references	[]
disable-model-invocation	true
user-invocable	true
allowed-tools	Read, Glob, Grep, Bash, Edit, Write

---

weekly-maintenance

Execute comprehensive weekly maintenance routine (1-2 hours, Friday recommended):

1. Codebase Health Check

Run the project's quality/health tools (from CLAUDE.md Commands section):

# Use project-specific commands, e.g.:
# just health, npm run lint, cargo clippy, etc.

Report on:

• Complexity trends (should be stable or decreasing)
• Duplication percentage (target: <5%)
• High-churn files that may need attention
• Dead code: unused exports, orphaned functions (run monthly or when codebase > 5K LOC)

2. Code Quality Agent Review

Use the code-quality skill to analyze the entire codebase:

• Flag any functions with CCN >10
• Identify duplication patterns
• Check for pattern consistency violations

3. Documentation Review

Check key documentation for accuracy:

• @CLAUDE.md accuracy (commands, paths, patterns still correct?)
• @docs/progress.md completeness
• Any drift between docs and implementation
• Documentation efficiency: Key context files (CLAUDE.md, progress.md, BACKLOG_INDEX.md) are loaded every session — keep them lean. Archive stale content, deduplicate, condense verbose sections.
• Metrics freshness: If docs/progress.md → ## Sprint History has ≥2 data rows but ## Metrics table still shows "—" values, sprint-end is not computing metrics — flag as a measurement gap. The feedback loop is broken: data collected but not surfaced.

4. Dependency Review

Check for outdated dependencies using the project's package manager:

# npm outdated, pip list --outdated, cargo outdated, etc.

Dependency Health Check

Run dependency auditing tools:

# npm audit / pip-audit / cargo audit / bundler-audit

Flag and report:

• Recently added packages (added since last maintenance) — verify they exist in the registry and are well-established
• Young packages (< 7 days old) — flag as supply chain risk
• Known vulnerabilities — categorize by severity
• Lockfile sync — verify lockfile matches dependency manifest

Read `docs/reference/SECRETS_INVENTORY.md` and check: - **Overdue rotations:** Scan the `Next Due` column for dates in the past. Flag by severity: ≤7 days (warning), 8-30 days (high priority), >30 days (critical — rotate immediately). - **Missing rotation methods:** Any secrets without a documented `Rotation Method` should be flagged. - **Critical secrets without automation:** Secrets classified as `critical` that rely on `manual` rotation are high-risk. If `docs/reference/SECRETS_INVENTORY.md` does not exist but the project uses environment variables or credentials, note this as a gap: "No secrets inventory — consider creating one from the template in the framework scaffold." Check the health of project ground rules: Review the health of architecture decision records: