audit

name	audit
description	Use after a slice's phases are implemented, when the task is now evidence, conformance, and reconciliation against the design — disposition every finding on a reconciliation review ledger (the RV kind) before closure.

Audit

You are running the reconciliation loop: does the work match its design and governance, and is every gap consciously dispositioned before reconciliation?

The audit stage runs on a review ledger — the RV kind (RV-NNN, ADR-007). The shared ledger mechanics (open + prime, raise, dispose + resolve, the severity and disposition vocab, synthesis, the close-gate, the parent-tree caveat) live in .doctrine/review-ledger.md — read it; this skill does not repeat the verbs. What follows is the audit lens: the facet, the modes, the scope, the evidence the reconciliation loop demands, and the audit-specific harvest and closure tail.

Findings are append-only to the ledger and field-owned, "no undispositioned findings before close" is enforced by the binary (the close-gate teeth), and the audit prose becomes the review's ## Synthesis.

Dispatched slice — review the candidate surface, not the raw evidence. When the slice was driven by /dispatch, review/* and phase/* are immutable evidence refs (R2); audit/repair runs against the candidate interaction branch published by doctrine dispatch candidate create (see doctrine dispatch candidate status). Record which surface you reviewed in the ledger ## Brief (F-2), and link the admitting RV via doctrine dispatch candidate admit --review RV-NNN.

Inputs:

• the slice's implemented phases and their verification evidence
• design.md (canonical), slice-nnn.md, plan.toml
• relevant ADRs and tech specs (see /canon)

Tool preference

If your harness supports MCP tools and doctrine's MCP server is connected (you see review_new, review_raise, review_dispose, review_verify, review_prime, review_list, review_show, review_status in your tool list), prefer these MCP tools over the CLI — they return machine-parseable JSON text in the MCP content block and eliminate shell overhead. Every review verb has an MCP equivalent.

Audit lens

Subject is always the slice — target-ladder rung 1. An audit targets its slice (the --target) and never degrades to prose; the closure-grade trigger is satisfied by definition (it gates the slice's audit→reconcile→done). Do not re-derive the subject — open the RV against the slice.

Facet is reconciliation. That is the lifecycle aspect this stage interrogates. Posture, if any, rides --raiser, never a new facet (review-ledger.md §2).

Audit mode — pick one:

• conformance — post-implementation audit tied to a slice (the usual case).
• discovery — backfill or existing-code investigation.

Self-audit (the usual case). When you are both reviewer and author, drive both roles with --as <role> — the raiser raises/verifies/withdraws, the responder disposes. This is cooperative role assertion, not a security boundary (ADR-007; review-ledger.md §4).

Disposition convention (audit-specific). Audit's permitted dispositions are: aligned (observation correct, no change needed), fix-now (code fix within audit scope — never a spec or governance edit), tolerated (explicit accepted drift with rationale), and verified with a reconciliation-brief link for spec/governance changes delegated to /reconcile. Audit must never use design-wrong or follow-up for spec/governance items — those belong to the reconcile write surface. Every finding stays verified (the observation is confirmed); the remediation is reconcile's job and is recorded separately — do not mutate a finding to fixed/remediated.

Process

1. Open the ledger for the slice (replaces authoring audit.md): open a reconciliation-facet RV targeting the slice, then fill the ledger's ## Brief with the lines of attack (what this audit probes and the invariants it holds the slice to). Verbs and flags: review-ledger.md §1–§2. Loose notes are insufficient for closure-grade work — findings belong in the ledger.

   The old domain_map/prime seeding is gone (RFC-004 / SL-147): the hand-authored area map was a dead authoring tax. The mechanical drift signal now comes from slice conformance (step 2), computed from recorded source-deltas — no curation.

2. Gather evidence (the audit's divergent work):

   • prepare subject: do NOT change the main repository branch; use a worktree instead, if necessary.

   • Run doctrine slice conformance <id> and read the algebra — the mechanical path-conformance delta between what design.md declared (design-target selectors) and what git actually touched (recorded source-deltas). It reports three cells:

     • undeclared (highest signal) — paths edited but not in any design-target selector. Each is a finding candidate: scope creep, a missed design update, or an undocumented touch.
     • undelivered — design-target selectors that matched no actual edit. Declared-but-not-delivered: dropped work or a stale design.
     • conformant — count of paths that matched (each with its selector).

     Conformance is necessary, not sufficient: it says where to look, never whether it passes. Treat undeclared/undelivered as leads to disposition, not auto-findings. If it reports unavailable (empty registry) or incomplete (a completed phase carries no row — the F-2 backstop), that gap is itself a finding: the registry was not recorded as phases landed; bootstrap with doctrine slice record-delta <id> PHASE-NN --start <oid> --end <oid> or note the partial coverage — never read a partial registry as clean.

   • run the tests/checks the design and plan require, plus doctrine check gate;

   • inspect observed behaviour against design.md and the phase VT- criteria;

   • note where behaviour and design diverge — each divergence is a finding.

3. Raise + dispose every finding on the ledger per review-ledger.md §3–§4. Hold the audit line on the anti-escape pressure: do not pick follow-up for spec/governance findings — those go to the reconciliation brief with verified; for code findings, do not pick follow-up merely because the fix is large; do not normalise tolerated without a real rationale; and do not downgrade a true blocker to dodge the close-gate. If the right route is ambiguous after reading design.md and governance, stop and /consult.

4. Synthesize. Write the audit's reasoning as the review's ## Synthesis (append it to review-NNN.md) — the closure story, the standing risks, the tradeoffs consciously accepted (the prose the old audit.md carried).

5. Write the reconciliation brief. Append a dedicated ## Reconciliation Brief section to review-NNN.md — separate from ## Synthesis. This is the structured handoff from audit to /reconcile, mapping every spec/governance finding to its target and the intended write surface (D3):

   ## Reconciliation Brief
   
   ### Per-slice (direct edit)
   - design.md §3: the eviction model changed from edge-at-a-time to per-SCC —
     update prose to match implementation.
   
   ### Governance/spec (REV)
   - ADR-006 §D5: branch-point staleness description is wrong → REV modify
   - REQ-077: cordage scale target verified at 50k nodes → REV status active
   

   Build the brief from every non-aligned, non-tolerated finding that touches design or governance. Group by write surface (per-slice direct edit vs. governance/spec REV). Each entry cites the finding id and describes the exact change needed.

   Brief-surface guardrails (D3). /reconcile writes exactly two surfaces — per-slice artefacts (design.md, slice-NNN.md) by direct edit, and governance/spec by REV. Name a surface the writer skill will actually touch, or the brief stalls at reconcile:

   • Plan criteria are off-surface. plan.toml EN-/EX-/VT- (and PHASE-NN) ids are immutable-append (boot rule) — never a reconcile direct-edit surface. A divergence that would require changing a plan criterion is a design/plan escalation, not a "Per-slice (direct edit)" brief item. Do not write a brief item that edits plan.toml.
   • Conformance findings name the registry verb, not the prose. A "spurious undelivered / scope-creep" conformance finding is fixed by the selector registry (doctrine slice selector rm/add), which is what slice conformance reads (slice-NNN.toml). design.md §6 is only the human mirror — a prose-only brief item leaves conformance red. Name the slice selector verb as the load-bearing change; cite the §6 edit as its mirror.

6. Harvest (audit tail). Harvest durable risks, decisions, and gotchas from the disposable runtime phase sheets into notes.md; promote reusable facts via /record-memory; capture durable follow-up work the audit surfaced — risks, issues, chores — as backlog items with backlog new (the work / knowledge / decision boundary: using-doctrine.md).

7. Hand off to reconcile. Once the reconciliation brief is written, the ledger is resolved, and every finding is terminal, hand off to /reconcile. Do NOT hand off directly to /close — reconcile is the sole writer of reconciled truth; close only confirms the outcome. Record the lifecycle move: doctrine slice status <id> reconcile (bare number) — the binary refuses it while a blocker is unresolved (D-C9b).

Outcomes

• Audit evidence is a structured RV ledger (review-NNN.toml + the review's ## Synthesis + ## Reconciliation Brief), not a hand-made audit.md.
• Every finding ends terminal with an explicit disposition (or is withdrawn).
• No unresolved blocker remains — the close-gate would refuse it.
• The reconciliation brief maps every spec/governance finding to its target and write surface.
• /reconcile receives a complete, actionable brief — not raw findings.