audit-resilience — The "80% Problem" Non-Functional Audit

Degree of freedom: MIXED — Phases 1 and 4 [HIGH freedom]; Phase 0/2 surface greps [LOW freedom — run exactly].

Agents nail the happy path (CRUD, passing tests) and silently skip what decides whether code survives real traffic: a webhook with no idempotency key double-charges; a fetch with no timeout hangs the request; a retry storm with no backoff takes down the dependency; PII lands in plaintext logs. This audit finds those gaps before production does.

Read-only. This skill inventories resilience gaps and hands each to the right fix skill. It does not change code.

How to reason

1. Observe — quote the call/mutation and whether timeout, retry+jitter, or idempotency key exists
2. Interpret — hang, retry storm, double-write, or silent catch?
3. Classify — Implemented / Partial / Missing (per matrix row)
4. Severity — payment/webhook without idempotency, or no timeout on a live path = Critical