Codebase Audit — Adaptive Deep Analysis

Comprehensive codebase audit that adapts its agent configuration to the project's tech stack, forces structured findings, adversarially verifies Critical/High findings before they enter the report, diffs against the previous audit's ledger (resolved / still-open / new), and outputs a severity-sorted report plus a phased repair roadmap.

Core Principles

1. READ-ONLY — Audit agents must never create, modify, or delete files in the target. Every agent prompt starts with the read-only preamble in references/agent-prompts.md.
2. Inherit the session model — Omit the model param on all agents so they inherit the session model (usually the strongest available). Only override upward if the session model is clearly weak for cross-file reasoning. Never hardcode a specific model name in this skill.
3. Depth over breadth — Fewer agents with broader merged scopes beat many shallow agents. Each agent traces issues across file boundaries.
4. Adaptive — Agent count and dimensions vary by stack and mode.
5. Verified findings — Critical/High findings must survive an adversarial verify pass. Medium findings pass through but are labeled unverified in the report.

Operating Contract

• Direct actions: read-only inspection, local dependency audits, report writing under the target, and ledger updates under <target>/.audit/ after the user invokes this skill.
• Escalate before: editing audited project source files, dependency manifests, .gitignore, CI config, remote issues, PR state, or anything outside the requested audit/report scope.
• Evidence-backed pushback: challenge "all clear" or "resolved" only with file evidence, dependency-audit output, verifier results, or ledger spot-checks.
• Feedback loop: promote repeated misses into prompt updates, ledger matching rules, or fixture eval cases rather than leaving them as session-only notes.