메뉴
用户触发 /ezfl:audit 或要求审计实施产出时必须使用本 skill。执行 Constitution 合规检查（注入点 D）+ 5 项 scorer 脚本，结果写入 .harness/metrics/<timestamp>-metrics.json。
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | audit |
| description | 用户触发 /ezfl:audit 或要求审计实施产出时必须使用本 skill。执行 Constitution 合规检查（注入点 D）+ 5 项 scorer 脚本，结果写入 .harness/metrics/<timestamp>-metrics.json。 |
启动时必须先输出：[easy-flow] 进入阶段: audit — 使用 easy-flow:audit skill。
审计 skill。两步审计流程：Constitution Compliance Audit + Scorer 评分。
Metrics 存储约定（贯穿 audit / reflect / scorer）：
.harness/metrics/（当前工作目录的 .harness/——若在 worktree 内即 worktree 的 metrics，ship 阶段会合回主仓）<timestamp>-metrics.json，每次 audit 写一个新文件，不覆盖历史<timestamp> 推荐格式：YYYYMMDD-HHMMSS（UTC，例如 20260525-074800）change_id 字段（v0.3.7 起）：用于 reflect 按 change 维度归因；同一 worktree 内若先后跑过 A→B 两个 change 的 audit，可按 change_id 区分.harness/metrics/ 是唯一存储位置（不再拷贝到 archive）。reflect 通过 glob 聚合全局趋势；单 change 追溯通过 JSON 内的 change_id 字段从顶层过滤。禁止把顶层 metrics 视为冗余而清理——会破坏 reflect 全局视图.harness/metrics/*-metrics.json glob 聚合所有历史（worktree 的 metrics 在 ship 阶段合回主仓后才进入 reflect 视野）ls -t .harness/metrics/*-metrics.json | head -1 取最近一次结果State 写入约定：
.harness/changes/<change_id>/state.yaml（worktree 路径下即 worktree 内的同名目录）audit.* 段（constitution_valid / overall_score / scorer_results / blocked）
读取 .harness/workflow.yaml: active_changes，筛选 phase=audit 的 entry：change_idask_followup_question 让用户选择脚本驻留 plugin 内部，由 .harness/.cache/.plugin_root（SessionStart 写入）定位；若缺失或脚本不可执行，提示用户重启会话以触发重新写入。
PLUGIN_ROOT="$(cat .harness/.cache/.plugin_root)"
bash "$PLUGIN_ROOT/hooks/constitution-validity.sh" # 0=有效 / 1=无效 / 2=不存在
判定后续：
constitution_required 配置决定告警或阻断5 个 scorer 脚本同样驻留 plugin 内（$PLUGIN_ROOT/scorers/），每个输出 0-100 分 + 理由：
PLUGIN_ROOT="$(cat .harness/.cache/.plugin_root)"
for s in audit-violation-rate constitution-violation-count test-coverage-scorer complexity-scorer doc-sync-scorer; do
bash "$PLUGIN_ROOT/scorers/$s.sh"
done
每个脚本 stdout 输出一行 JSON：{"scorer":"<name>","score":<0-100>,"reason":"<text>"}。
聚合写入约定：
mkdir -p .harness/metrics.harness/metrics/<timestamp>-metrics.json（<timestamp> 用 date -u +%Y%m%d-%H%M%S）change_id 取自 hooks/change-locate.sh 单匹配结果(与 SKILL.md "State 写入约定"节共享解析逻辑);若解析失败(如 trivial 路径无 entry)则填 "",reflect 按"未归因"分桶overall_score 加权聚合(见下方"Overall Score 加权聚合")audit 嵌套段供 audit-violation-rate.sh 下次复用）：{
"timestamp": "20260525-074800",
"change_id": "refactor-sdk-api-0701c0",
"mode": "solo",
"audit": {
"violations": 0,
"total_checks": 12
},
"overall_score": 90,
"scorers": [
{"scorer":"audit-violation-rate","score":100,"reason":"无已知违规"},
{"scorer":"constitution-violation-count","score":100,"reason":"..."},
{"scorer":"test-coverage","score":85,"reason":"行覆盖 85% (source=istanbul:coverage/coverage-summary.json)"},
{"scorer":"complexity","score":78,"reason":"..."},
{"scorer":"doc-sync","score":92,"reason":"..."}
]
}
audit.violations= Step 1 中累计的 Critical+Important 违规条数；audit.total_checks= 该次 audit 共核对的 Core Principle + 子检查项总数（无明确分母时填 1）。audit-violation-rate.sh读取最新一次 metrics 计算违规率。
不要写到
.harness/metrics.json（单文件形式）—— 那会破坏 scorer/reflect 的"按时间戳叠加历史"语义。
5 个 scorer 的 score 通过加权平均聚合为 overall_score,用于 thresholds.solo.warn_below / thresholds.team.block_below 的阈值判定,同时写入 metrics JSON 顶层与 state.yaml: audit.overall_score。
公式:
overall_score = round( Σ(score_i × w_i) / Σ(w_i) )
其中 w_i 取自 .harness/harness.toml: [scorer.weights] 中对应 scorer 名的值;未配置 / 缺失 / 整个 [scorer.weights] 段不存在 → 全部默认 1.0(等权平均,与本特性引入前的行为完全一致)。
特殊语义:
w_i = 0 → 该 scorer 完全排除出 overall_score(其 score 仍写入 scorers[] 供溯源,但不参与计算)Σ(w_i) = 0(理论极端:所有权重为 0)→ overall_score 取 0,reason 提示"所有 scorer 权重为 0"降权常见用法:test-coverage 在未接入标准覆盖率报告(lcov/cobertura/Istanbul JSON)时启发式估算不准,可降到 0.3 减少其对 overall_score 的影响。详见 scorers/README.md。
thresholds.solo.warn_below）仅告警thresholds.team.block_below）阻塞，需 override| Policy | 文件 | 作用 |
|---|---|---|
| Constitution Audit | ./policies/constitution-audit.md | 详细审计规则 |
Scans project-level agent directories before subagent dispatch, recommends based on phase keywords, lets user choose, and persists results to disk for anti-corruption
Must use this skill when user triggers /ezfl:audit or requests auditing of implementation outputs. Executes Constitution compliance check (injection point D) + 5 scorer scripts, results written to .harness/metrics/<timestamp>-metrics.json.
Must use this skill when user triggers /ezfl:build or requests implementation / execution of tasks.md. Selects implementer subagent, which executes /opsx:apply in its own session — main agent is forbidden from directly writing implementation code.
Must use this skill when user triggers /ezfl:constitution or /openspec:constitution, or requests creation / amendment / viewing of the project constitution. Manages CREATE / AMEND / SHOW modes for openspec/memory/constitution.md.
Must use this skill when user triggers /ezfl:design or requests entering the design phase. Only responsible for design discussion, Reframe, Premise Challenge, and producing pre_design.md.
Must use this skill when user triggers /ezfl:lock, or requests engineering review / locking plan / review architecture / tech review, or describes a non-trivial change (>3 files, new components, cross-module changes) and is clearly in the pre-coding phase. Reviews plans/proposals from an engineering-manager perspective with adversarial rigor (architecture, data flow, edge cases, test coverage, performance), aiming to find holes rather than go through the motions. **Do NOT** use for: simple bug fixes / single-file changes / pure documentation or configuration changes / requesting 'review of already written code' (that's code review, not plan review).