AND Sweep

Sweep audits GitHub workflow state for drift that can make delivery unsafe. Every finding is classified before mutation:

• Detect: the default; report authoritative drift without changing it.
• Normalize: when the user explicitly asks to fix or normalize, apply reported, unambiguous low-risk representation fixes without a second confirmation.
• Repair: changes to meaning or authority require explicit approval for the exact mutation, or route to the owning workflow skill.

Workflow Contract

Use and-workflow-contract with work-records.md for Locate Work and ordinary Read Work Record, then read sweep-checks.md for Audit Invariants; use the kernel's Record Receipt representation only when an approved repair reaches that operation. Add delivery-units.md for Read Delivery Unit only when the selected scope contains package, ownership, blocker, receipt, implementation, or Finish evidence. Read deployment-handoff.md only when that evidence includes reviewed implementation or Finish.

Use Locate Work, Read Work Record or Read Delivery Unit, and Audit Invariants, then apply the direct Sweep checklist. Those authorities own exact state, relationship, ownership, receipt, lifecycle, Wayfinding, and representation checks; Sweep owns finding classification and repair control.

If repository setup or the contract is unavailable, stop and route to setup-and or ask the user to install the missing skill.

Scope

Default to open work in the current repository. Respect a specific work ID, ready slate, stage, PRD, map, ownership condition, or other bounded subset supplied by the user. Use an explicit limit or pagination.