Self-Audit

A self-audit is a deliberate post-execution pass where you become the adversary of your own work. The deliverable is finished — the RFC executed, the fix series written, the document drafted — and before it merges or ships, you re-enter it with one assumption: it contains defects, and your job is to find them. Not to confirm correctness, not to summarize what was done — to find what's wrong.

This works because the author's blind spots are systematic, not random. The same few places hide defects every time, so an audit that walks those places deliberately finds real bugs that the writing pass — and often the test suite — missed. A clean audit is a valid outcome — but on substantial branches (thousands of lines) it is rare, so it must arrive as a report carrying its evidence: the scope walked, the checks actually performed, and what remains uncertain (see Fixing and reporting). Never manufacture a finding to avoid reporting clean.

Establish the scope first

Audit a defined body of work, not "the repo":

Code on a branch: diff against the merge base (git merge-base <base> HEAD), list the commits, count the lines. State the scope in the report ("whole branch, 8 commits / ~6.5k lines"). Include everything the branch touched: source, tests, docs, config, CI. scripts/audit_scope.py scope --base main produces exactly this — commits, per-kind file and line counts, and the scope statement to open the report with (path relative to this skill's directory; from a repository root it is skills/self-audit/scripts/audit_scope.py).
Non-code work: enumerate the artifacts produced (documents, configs, diagrams, plans) and audit that set.
Re-read the spec first. Before reading the diff, re-read whatever the work claims to implement — the RFC, the task description, the ticket. The audit's first axis is deliverable-vs-spec, and you can't check fidelity from memory.

The sweep

Ten passes, in references/passes.md — load it before auditing anything. They run in order, and the order matters: the cheap structural passes narrow what the expensive verification passes have to cover.