/audit-issues

Inputs

• Optional

  discovery_context

  (JSON) injected by the orchestrator.
• Optional output path (from the orchestrator): write the JSON there instead of printing it.
• Flags:

  --json

  (emit JSON only, no markdown summary).

Steps

1. Discovery: if

   discovery_context

   was NOT injected, follow

   references/discovery.md

   and build it. If injected, use it as-is (do not re-run discovery).
2. Filter: read

   references/detection/04-issues.md

   . Drop any checklist item whose

   applies_to

   shares no archetype with

   discovery_context.archetypes

   → emit it with

   status: "skipped"

   .
3. Detect (two-stage, spec §5a.2 / §9a.4): a. For each applicable item, run its

   signals

   (ripgrep) to get candidate

   file:line

   . Prefer external-tool output if available. Do NOT read the whole repo. b. Read only candidate snippets; apply each item's

   confirm

   rule. Assign severity honoring any severity floors. Consult

   references/detection/examples/04-issues.md

   only when a candidate is ambiguous.
4. Emit: produce one

   AuditResult

   JSON object conforming to

   references/schema.json

   with

   audit: "issues"

   ,

   iso_characteristic: "Maintainability"

   , the checklist (with statuses), and findings. Leave

   score

   as

   0

   — the engine computes it.
   • If an output path was given: write ONLY the JSON object to it (UTF-8), then reply with one line:

     <audit key>: <n> findings -> <path>

     .
   • With

     --json

     or as a subagent without an output path: output ONLY the JSON.
   • Standalone: also print a short markdown summary (counts + top findings).