---
name: audit-setup
description: Generates scanner, verifier and the /audit skill tailored to the current project, including roadmap reconciliation with roadkeep. Run once per repository.
---
Generate an audit workflow for THIS project. Do not ask
anything you can discover by reading files.

## 1. Discover (read-only, be economical)
- Stack and languages: package.json, pom.xml, *.csproj,
  requirements.txt, go.mod.
- Verification commands: test/lint/build scripts,
  tsconfig, eslintrc, checkstyle.
- Partitions: first/second-level folders containing code,
  ignoring node_modules, dist, target, .git. Group into
  4 to 8 partitions of similar size.
- Conventions: CLAUDE.md, README.
- Roadmap: if roadkeep.toml exists, note which files it
  owns (ROADMAP.md, IMPROVEMENTS.md, ...) and the exact
  roadkeep commands available (`roadkeep --help`). Never
  edit those files directly; always go through roadkeep.

## 2. Generate the files (overwrite if they exist)
`.claude/agents/scanner.md`
  tools: Read, Grep, Glob · model: sonnet · effort: high
  Body: fixed output format
  `path:line | issue | why it matters | how to reproduce`,
  + an 8-12 item checklist SPECIFIC to the detected stack
  (e.g. for AEM: Sling models without @Optional, unclosed
  resource resolvers; for GraphQL: N+1 resolvers, fields
  without null-check; etc.). Never fix anything.

`.claude/agents/verifier.md`
  tools: Read, Grep, Glob, Bash · model: opus · effort: xhigh
  Body, two modes selected by the prompt:
  - FINDINGS mode: classify each finding as CONFIRMED /
    FALSE POSITIVE / UNVERIFIABLE using the project's real
    verification commands discovered in step 1.
  - ROADMAP mode: for each existing open task, check the
    code and classify as STILL VALID / ALREADY DONE /
    OUTDATED / NEEDS REWORDING (unclear, too broad, or
    duplicates a new finding). Output one line per task:
    `task-id | status | evidence (path:line or command)
    | suggested new text if NEEDS REWORDING`.
  Never modify any file in either mode.

`.claude/skills/audit/SKILL.md`
  Script:
  (1) run the discovered lint/test/build commands;
  (2) one `scanner` per partition, in parallel;
  (3) deduplicate findings;
  (4) `verifier` in FINDINGS mode with the full list;
  (5) if roadkeep is configured: read the open tasks
      via roadkeep, then run `verifier` in ROADMAP mode
      with the task list AND the CONFIRMED findings, so
      it can spot overlaps;
  (6) reconcile: mark ALREADY DONE tasks as done,
      remove OUTDATED, rewrite NEEDS REWORDING, and add
      CONFIRMED findings not already covered — all via
      roadkeep commands, then run `roadkeep lint`.
      Without roadkeep, write the same to docs/AUDIT.md;
  (7) report counts only: findings confirmed/false,
      tasks kept/closed/removed/rewritten/added.

## 3. Finish
Show the partition list, the generated checklist and the
roadkeep commands the audit will use, in 20 lines or
less, then stop. Do not run the audit.