source-command-audit-deep-analysis

name	source-command-audit-deep-analysis
description	Global read-only analysis across code, security, dependencies, and likely defects.

source-command-audit-deep-analysis

Use this skill when the user asks to run the migrated source command deep-analysis.

Command Template

🔬 Deep Analysis (global)

A full-project sweep (focus: $ARGUMENTS if given, else the whole repo): deterministic scanners plus specialist judgment into one factual report.

1. Deterministic pass — aggregate every scanner:

   node contextkit/tools/scripts/deep-analysis.mjs --write
   

   Merges tech-debt, dependency/supply-chain, and contract findings into contextkit/memory/deep-analysis-findings.json.

2. Judgment pass — what regex can't see. Delegate in parallel (Agent tool):

   • security + infra-security → vulnerabilities, secrets, infra exposure.
   • code-reviewer → constitution / SRP / structure smells.
   • architect → cross-cutting design risks (→ candidate ADRs).
   • qa-orchestrator → coverage gaps on qa.criticalPaths.
   • Bug pass: read the highest-risk modules for likely defects (off-by-one, unhandled rejections, missing error handling, race conditions, boundary bugs) — classify each by bugType + severity S1-S4.

3. Report — one consolidated report: counts by scan + severity, the top issues (🔴 / 🟡 / 🟢), and what's healthy. This is the deliverable; keep it factual.

4. Suggest ADRs — for any finding implying an architectural decision (a pattern to adopt, a boundary to enforce, a dependency to drop), first scan existing decisions with node contextkit/tools/scripts/adr-digest.mjs --json [ADR-0027] so you extend/reference an existing ADR instead of duplicating it; then draft a new one with /new-adr (Context / Decision / Consequences) only if none fits.

5. End with the natural next step — usually an explicitly scoped /dev-start on the worst accepted item. The analysis itself creates no task, workflow, or source edit.

This is the command the security-mode boot trigger reminds you to run on a cadence (config securityMode.everyNSessions). It's active, not reactive.