audit-pass
Installation
SKILL.md
Purpose
One bounded, ordered pass over a target repository's Claude Code instruction surface, coordinated across three scopes and resumable mid-run. It adds no criteria of its own — every check is delegated to the plugin that owns it. What it contributes is what invoking those skills by hand yields none of: a three-scope inventory before any check runs, a run-time-derived exclusion set, stable finding identity, suppression memory, incremental persistence and resume, and one human gate for the pass. All of it is specified in reference/run-contract.md.
Read-only contract, and where mutation can reach
Bare invocation reads and reports. --fix is the only mutation path, and it is bounded by scope:
| Scope | Posture under --fix |
|---|---|
| Managed policy | Never remediated. Read-only in every mode. A finding here reports "conflicts with org policy at <path>" and proposes no edit to either side — seeking a policy exception is an organizational decision, not a linting one. |
| User | Routed as a recommendation, never edited in place. A user-scope tree is commonly managed by a dotfiles manager, so an in-place edit is drift the operator's own sync path will fight. |
| Project | The only editable scope, per-finding confirmed. |