| name | auditing-devforgeai |
| description | Audit DevForgeAI through Prompts 0–8 and maintain a provenance-preserving audit bundle. Use when Codex must perform, resume, refresh, or synthesize an enterprise review of DevForgeAI skills, hooks, commands, agents, process gates, Claude↔Codex parity, or Codex-native behavior; regenerate scope after framework components change; archive a prior audit before updating it; or produce the self-contained audit workflow HTML and remediation roadmap. |
Audit DevForgeAI
Use the bundled prompt suite as the audit contract and the bundle manager as the state boundary.
Prepare the run
Resolve the repository root, then run:
python3 <skill-dir>/scripts/audit_bundle.py prepare \
--project-root <repo-root> \
--audit-root <repo-root>/tmp/Audit
Read <audit-root>/current/run.json and inventory.json. Treat the inventory and its delta_from_previous as the current scope; do not reuse old component counts or assume that a previously absent skill, hook, command, agent, rule, config, or CI file is still absent.
prepare archives an existing canonical run, imports legacy audit documents once, records hashes, initializes all nine report files, embeds the prompt suite/templates, and renders the HTML workflow document.
Execute Prompts 0–7
Read references/audit-protocol.md completely before the first phase. For each phase:
- Read its complete prompt from
current/internal/DevForgeAI_Audit_Prompt_Suite.md.
- Inspect every relevant current component from
inventory.json, including additions and changes since the prior run.
- Write only grounded findings to the assigned file under
current/reports/ using the bundled scorecard and finding schemas.
- Record exact paths, lines, commands, outputs, and confidence. Mark a dependency on unseen evidence
Plausible and name the missing artifact.
- Re-render after material inventory or report changes:
python3 <skill-dir>/scripts/audit_bundle.py render --audit-root <repo-root>/tmp/Audit
Do not use model APIs. Use local files, CLI validation, hooks, git/CI configuration, and the active Claude Code/Codex terminal surfaces.
Execute Prompt 8
Synthesize only the completed Prompt 0–7 reports. De-duplicate findings, state conflict resolutions, set one final score per Appendix C dimension, rank concrete cross-provider remediation, and list exact residual artifacts. Do not re-audit raw artifacts during synthesis except to resolve a documented conflict.
Validate and import completed content
Before finalization, run devforgeai-validate audit-content-validate against
the managed Prompt 0–8 report directory and exact audited snapshot. HALT on a
missing CLI, exit 127, malformed JSON, template marker, placeholder, incomplete
Appendix B record, duplicate ID, phase-map error, snapshot mismatch, or Prompt
8 input-hash mismatch.
When durable remediation intake is requested, use
audit-import-completed followed by audit-findings-build. Never edit archive
bytes or remediation state directly. Corrections create provenance in a new
managed import; the original hash remains immutable.
Validate and finalize
Run:
python3 <skill-dir>/scripts/audit_bundle.py validate --audit-root <repo-root>/tmp/Audit
python3 <skill-dir>/scripts/audit_bundle.py finalize --audit-root <repo-root>/tmp/Audit
Do not report completion when validation fails. Return the final report paths, archive lineage, inventory delta, and validation result.
Bundled resources
assets/DevForgeAI_Audit_Prompt_Suite.md: immutable per-skill prompt contract copied into each run.assets/templates/: Appendix B/C-derived finding, scorecard, phase-report, and synthesis templates.assets/DevForgeAI-Audit-Workflow.html: self-contained workflow illustration with the prompt suite and templates embedded as internal assets.references/audit-protocol.md: phase-to-artifact contract, adaptive discovery rules, and provenance semantics.scripts/audit_bundle.py: deterministic inventory, archive, render, validate, and finalize operations.
