Deep Code Audit

Perform a non-mutating, coverage-aware audit. Report demonstrated risks and worthwhile improvements without turning preferences, scanner output, authorship guesses, or missing evidence into facts.

Preserve the audit boundary

• Follow the user request and every applicable AGENTS.md before doing anything else.
• Treat activation as permission to inspect and report, not permission to edit application, test, configuration, documentation, or other user-authored repository files. Do not save an audit report unless the user explicitly requests one. Implement fixes only under a separate implementation request.
• Record git status --short before running checks and again before handoff. Also record the reviewed revision, requested comparison base, and the staged, unstaged, and untracked scope so the final comparison is meaningful.
• Do not run rewriting formatters, installations, upgrades, migrations, deployments, destructive commands, credentialed services, or unrelated external systems.
• Run repository-discovered, non-deploying tests, builds, linters, type checks, help commands, and already-configured scanners when they are safe. Build artifacts and caches are acceptable; unexpected tracked-file changes are not. Stop the responsible command and preserve the evidence after an unexpected mutation. Report every observed mutation, including expected artifact or cache paths, or state that none occurred.
• Never expose credentials or sensitive values. Redact values while preserving the file, line, category, and evidence needed to act.

Select the audit mode and freeze repository truth