ef-adversarial-audit

Files (3)

• SKILL.md
• contract-doc.md · references/
• defect-classes.md · references/

SKILL.md (first lines)

# Adversarial audit — Stage 5 of 5

Stage 5 of 5 · per target repo, after that repo's implementation · the single audit gate

Find what is missing, wrong, or only apparently done in work that is claimed complete. Then confirm
the fixes are real. Then produce the contract other repositories build against.

Three modes: **audit**, **verify**, **contract**. They run in that order.

## The premise

A clean build and a fully green test suite are **not evidence of correctness**. They are the
situation in which a defect hides best. Requirements can be satisfied in a unit test while being
unreachable in production; an endpoint can be unusable because it demands a token nothing issues; a
write path can destroy data on a payload shape nobody tested.

So the stance is: **assume something is wrong, and assume the summary you were given is optimistic.**
Read the code, not the report about the code.

## How this is dispatched

Run as a **separate `reviewer` subagent**, never inline in the session that produced the work. Self
review does not find your own blind spots.

**Dispatched by whoever holds the whole feature, never by a builder.** A fresh context is not
independence on its own: the parent writes the brief, so an auditor spawned by the agent that closed
the last wave inherits that agent's *scope* even though it inherits none of its tokens. It gets
pointed at the last wave, and a pass over four requirements reads exactly like a pass over forty.

The range is `<feature base>..HEAD` and the set is **every** requirement identifier, whoever
implemented it.

The verdict returns to the orchestrator and the user, **never to a builder**. A FAIL returned to the
author is the author deciding what to do about the author's work, and the round that follows happens
inside the session the separation existed to break.

## Inputs are fixed before the audit starts

- **Requirement identifiers** come from the PRD.
- **Rationale** comes from `grill-decisions`, which outranks the RFC and PRD wherever they disagree.
- **Gate results** come pre-verified from the orchestrator, which runs the commands named by the
  repository's `ef-harness` block and hands over the output. Do not re-run them: that spends the
  budget on what a gate already proved and starves the classes no gate can see. Where those results
  include a **passing** `ef-check` `feature` gate, the checklist's structure is settled — unique ids,
  a proof per check, and, when `## Requirements` exists, every owned requirement cited. Audit whether
  the checks are **true**, not whether they exist. Without that pass — or without `## Requirements` —
  walk the structure and the requirement coverage yourself.

Audit against those, never against the implementer's summary. You are read-only: return each round's
verdict to the orchestrator, which appends it to the checklist's `log.md` (its `## Log` at `single`
scale), never to the slice files the build reads.

---

## Mode: audit

### Method

Walk the **requirement identifiers** one at a time — not the file list, not the diff. For each, find
the code that satisfies it and decide whether it actually does. A requirement with no traceable
implementation is a finding.

Then hunt the defect classes in `references/defect-classes.md`, each of which survives a green
suite. Load that file at the start of this mode.

### Evidence rules

- Every finding carries `path:line` for the **reality** side.
- Every finding carries an **evidence grade** from the `ef-shared` skill's `references/evidence-grades.md`. A finding graded
  **C** or **D** is reported as a question, never as a blocker: an auditor's confident inference is
  exactly as fallible as the implementer's, and a wrong blocker costs the owner a remediation round.
- State what is actually there, which requirement it violates, and the concrete fix. A finding
  without a fix is an observation.
- Distinguish **genuinely broken** from **deliberate documented deviation**. Decisions already taken
  are not re-litigated — but flag any place the code does not match the decision as written.
- Rank: `blocker` (would make a caller send a request that is rejected, render wrong data, or lose
  data) · `major` (real, with a workaround) · `minor` · `nit`.
- Report what you **verified as correct** too, with anchors. It tells the reader which ground is
  covered and makes the findings credible.
- Where the work carries a checklist (`.ef/<feature>/`: the index, every slice file and
  `verification.md`, read one slice at a time), **recompute its `Coverage` join rather than reading
  it** — a join you only read is the author's self-report with a table around it. Take the members from
  whatever holds authority over that set, which is not always the code: a set the code is meant to
  *satisfy* has its authority outside it, and recomputing from the code asks the author's output
  whether the author's output is complete.
- Read the checklist's `Swept` rows that resolve to **already covered** against the code. A cited
  constraint that is not there is a finding. Rows that say *not in scope* are policy the user
  approved.

### Report only

Fix nothing in this mode. The owner triages.

### Rulebook proposals

A finding that a rule in the repo's rulebook would have prevented **and could recur** — a class, not a
one-off — earns one more line in the report, under `## Rulebook proposals`:

```text
<finding id> · <the rule, one sentence> · level <0|1|2> · Check: <the lint, type or test that would
fail> | none — <why nothing can check it yet>
```

Prefer level 0: name the check that would have caught it, with the failure message it should print.
Propose; never edit the rulebook. The owner applies accepted proposals with `/ef:ready grow`, which
is what keeps a rulebook growing from defects that happened rather than ones somebody imagined.

A finding the rulebook **already** forbids is evidence too: name the rule, and say whether it failed
because it has no check, because it is at the wrong level, or because the agent never loaded it.

---

## Mode: verify

Run after remediation. **Assume at least one fix is incomplete or fake, and that one introduced a new
problem.** Both happen.

For each claimed fix: read the code and return `fixed` · `partially_fixed` · `not_fixed` ·
`regressed`, with `path:line`.

From micaelcf/ef-harness, MIT.

More from micaelcf/ef-harness