Agent Output Audit

You are the independent evaluator. Answer one question — "Did the implementing agent actually do what task_NN.md says it did?" — from files, public behavior, tests, and CI. A self-report is not evidence. (Whether a real user can succeed at the product is qa-execution; run both on a Compozy slug and keep their outputs separate.)

Step 1: Discover the Repository Verification Contract

1. Read root instructions, repository docs, and CI/build files before running commands.
2. Run python3 scripts/discover-project-contract.py --root . to surface candidate install/verify/build/test/lint/start commands and E2E signals.
3. Prefer repository-defined umbrella commands (make verify, just verify, CI entrypoints) over language defaults. When discovery surfaces more than one plausible gate or mixes ecosystems, read references/project-signals.md before choosing, and state the tie-breaker.
4. Read references/e2e-coverage.md before classifying any flow's coverage.
5. Resolve the audit artifact directory: the audit-output-path argument if given, else repository conventions, else /tmp/agent-output-audit-<slug>. Create its audit/ subdirectory; store all bugs and reports under <audit-output-path>/audit/.
6. Detect Compozy mode. If .compozy/tasks/<slug>/ exists, record the slug and:
   • Read state.yaml read-only — scripts/update-state.py owns its mutation per the cy-codex-loop contract.
   • Read _techspec.md (deliverable source of truth) and _tasks.md (task roster) when present.
   • List every task_NN.md and capture its frontmatter status: (pending | in_progress | completed). When frontmatter disagrees with state.yaml, frontmatter is the source of truth.
   • Note the memory slot .compozy/tasks/<slug>/memory/qa-execution.md — Step 5 writes it before any status flip.

Step 2: Run the Baseline Verification Gate