chore(#221): retrofit 7 audit skills onto _lib-audit-history.sh#239
Merged
Conversation
Mechanical retrofit completing the follow-up filed alongside #218. Each of the 7 remaining audit skills now persists a structured JSON+MD pair via audit_run_persist + renders trend via audit_render_trend on every run. Same shape as the threat-model and security-review pilots from #222. Skills retrofitted: - /compliance-check — GDPR/ePrivacy - /accessibility-audit — WCAG 2.1 AA - /performance-audit — bundle / images / caching - /seo-audit — meta / sitemap / OG / structured data - /monitoring-audit — logs / errors / health / alerts / runbooks - /docs-audit — Diataxis quadrants + README quality + staleness - /analytics-audit — SDK / event taxonomy / funnels / dashboards Each gains: - A "Persist the run + render trend" section before its existing "## Rules" section, with subsections for project/score/verdict resolution, payload+body construction, persist call, trend render, and opt-in commit marker - Two new Rules entries: "Always persist via the lib" + "Severity vocabulary in the JSON is lowercase" - Per-dim severity-vocabulary mapping documented (e.g. "Documentation readiness: PARTIAL" → conditional, "Incident readiness: NOT READY" → fail, etc.) 7 new canonical templates at templates/audits/<dim>.md, each demonstrating the dimension's findings shape (POUR groupings for accessibility, Diataxis quadrants for docs, regulatory exposure for compliance, etc.) per the convention shipped in #222. After this PR, all 9 audit skills (this 7 + threat-model + security-review) consume the shared lib uniformly. /launch-check already consumed the lib via its #222 refactor with backward-compat read-merge for adopters' existing history. Closes #221 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
atlas-apex
commented
May 15, 2026
atlas-apex
left a comment
Collaborator
Author
There was a problem hiding this comment.
Code Review: PR #239
Commit: aedd800c9c4835c87b7430b1dfadc67a1d8daeaa
Summary
Mechanical retrofit completing #221 — brings the remaining 7 audit skills (/compliance-check, /accessibility-audit, /performance-audit, /seo-audit, /monitoring-audit, /docs-audit, /analytics-audit) onto the shared _lib-audit-history.sh API shipped in #222. After this, all 9 audit skills consume the lib uniformly. +600/−0 across 14 files (7 SKILL.md modified, 7 templates added).
Checklist Results
- Architecture & Design: Pass — uses lib as-shipped; no lib changes (verified diff has no hits on
_lib-audit-history.sh). - Code Quality: Pass — high structural symmetry across all 7 retrofits.
- Testing: Pass — manual smoke-test plan documented in PR body; mechanical edits + new templates don't warrant unit tests.
- Security: N/A — no auth/crypto/secrets paths touched.
- Performance: N/A — documentation/skill edits only.
- PR Description & Glossary: Pass — Summary, Why, Testing, Glossary all present; 6 well-defined glossary entries (Retrofit, Per-dim canonical template, Legacy verdict vocabulary, Headline score, POUR groupings, Diataxis quadrants).
- Technical Decisions (AgDR):N/A — load-bearing decisions captured in AgDR-0019 (already on dev). This PR is mechanical application.
Verification of reviewer asks
- Structural symmetry across the 7 retrofits — Confirmed. Each modified SKILL.md inserts
## Persist the run + render trendbefore## Rules, with the same three subsections (### Resolve project name + score + verdict,### Persist + render,### Opt-in commit). Each callsaudit_run_persist+audit_render_trendwith the dimension's own slug. - Score formula consistency — Confirmed.
score = max(0, 100 - 25*critical - 10*high - 3*medium - 1*low)appears verbatim in all 7 retrofits. Verdict mapping (critical/high → fail,medium → conditional,low/none → pass) is consistent. - Legacy-vocabulary mappings — Confirmed per skill: accessibility "WCAG 2.1 AA estimate" (FAIL/PARTIAL/PASS), compliance "GDPR readiness" (NOT READY/PARTIAL/READY), docs "Documentation readiness" (PARTIAL/MISSING/COMPLETE), monitoring "Incident readiness" (NOT READY/READY), performance "Performance readiness" (NEEDS WORK/GOOD), SEO "SEO readiness" (GOOD/NEEDS WORK). All map cleanly to the three-state.
- Dimension-specific templates — Confirmed via spot-checks: accessibility groups by POUR (Perceivable/Operable/Understandable/Robust) with WCAG criterion numbers; docs groups by Diataxis quadrants (Tutorials/How-to/Reference/Explanation) plus README quality + Staleness sections; compliance has dedicated "Regulatory exposure" section citing GDPR Art. 6/7/17 and ePrivacy. Templates are not generic boilerplate.
- 2 new Rules entries per skill — Confirmed. All 7 retrofits add identical entries 5 + 6: "Always persist via the lib" and "Severity vocabulary in the JSON is lowercase."
- No lib changes — Confirmed.
_lib-audit-history.shdoes not appear in the diff. - PR body + commit format — Pass. Title
chore(#221): retrofit 7 audit skills onto _lib-audit-history.shmatches the validator regex; body includesCloses #221. CI green (lychee, markdownlint, ticket-ID check).
Issues Found
None blocking.
Suggestions (non-blocking)
- The compliance-check retrofit's Rule #6 has slightly more explanatory text than the other 6 (mentions
stats.by_severity). Minor inconsistency — feel free to leave or harmonise. - Per-skill
audit_run_persistexample calls all use placeholder"fail"+ numeric scores (60/55/35). Consistent with the pilots; no action needed.
Verdict
APPROVED (submitting as comment because Rex cannot self-approve via gh).
Mechanical retrofit is on-pattern with #222, structurally symmetric across all 7 dimensions, with dimension-specific templates that demonstrate care (POUR / Diataxis / regulatory-exposure groupings rather than copy-paste boilerplate). Glossary is high-quality and explains the retrofit + legacy-vocabulary mapping concepts cleanly. Ready to merge subject to CEO approval.
Reviewed by Rex (Code Reviewer Agent)
Reviewed commit: aedd800c9c4835c87b7430b1dfadc67a1d8daeaa
me2resh
added a commit
that referenced
this pull request
Jun 5, 2026
Mechanical retrofit completing the follow-up filed alongside #218. Each of the 7 remaining audit skills now persists a structured JSON+MD pair via audit_run_persist + renders trend via audit_render_trend on every run. Same shape as the threat-model and security-review pilots from #222. Skills retrofitted: - /compliance-check — GDPR/ePrivacy - /accessibility-audit — WCAG 2.1 AA - /performance-audit — bundle / images / caching - /seo-audit — meta / sitemap / OG / structured data - /monitoring-audit — logs / errors / health / alerts / runbooks - /docs-audit — Diataxis quadrants + README quality + staleness - /analytics-audit — SDK / event taxonomy / funnels / dashboards Each gains: - A "Persist the run + render trend" section before its existing "## Rules" section, with subsections for project/score/verdict resolution, payload+body construction, persist call, trend render, and opt-in commit marker - Two new Rules entries: "Always persist via the lib" + "Severity vocabulary in the JSON is lowercase" - Per-dim severity-vocabulary mapping documented (e.g. "Documentation readiness: PARTIAL" → conditional, "Incident readiness: NOT READY" → fail, etc.) 7 new canonical templates at templates/audits/<dim>.md, each demonstrating the dimension's findings shape (POUR groupings for accessibility, Diataxis quadrants for docs, regulatory exposure for compliance, etc.) per the convention shipped in #222. After this PR, all 9 audit skills (this 7 + threat-model + security-review) consume the shared lib uniformly. /launch-check already consumed the lib via its #222 refactor with backward-compat read-merge for adopters' existing history. Closes #221 Co-authored-by: me2resh <ahmed.abdelaliem@gmail.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
_lib-audit-history.sh(the shared persistence + trend lib shipped in feat(#218): audit-skill artefact persistence + canonical structure #222)/compliance-check,/accessibility-audit,/performance-audit,/seo-audit,/monitoring-audit,/docs-audit,/analytics-audit) now writes a structured JSON+MD pair per run AND appends a trend section, mirroring the threat-model and security-review pilots from feat(#218): audit-skill artefact persistence + canonical structure #222templates/audits/<dim>.md, each shaped for its dimension (POUR groupings for accessibility, Diataxis quadrants for docs, regulatory exposure for compliance, etc.)pass/conditional/fail) so trend renderer comparisons stay coherent across dimensionsWhy this matters
Before this PR, only
/launch-check(since #183),/threat-modeland/security-review(since #222) wrote structured artefacts. The other 7 audits dumped findings to stdout and disappeared. Comparing two compliance reviews from a quarter apart was an exercise in reading two free-form essays.After this PR, every audit run (
/threat-model,/security-review, AND the 7 in this PR) lands inprojects/<name>/audits/<dimension>/<ts>.md+runs/<ts>.jsonwith frontmatter that the trend renderer can compare across runs. Any audit dimension answering "is the project's posture improving or regressing" is now aaudit_render_trend "<project>" "<dim>" 5away — no per-skill custom code.The retrofits were mechanical because the shared lib was designed for it: each skill assembles a
findings[]array (lowercase severity), composes its dimension-specific MD body, and callsaudit_run_persist+audit_render_trend. ~70 lines of additional SKILL.md content per skill, all following the same pattern.Testing
## Persist the run + render trendsection before the existing## Rulessection, with subsections for project/score/verdict resolution + payload+body construction + persist call + trend render + opt-in commit markertemplates/audits/<dim>.mdexists and has dimension-specific structure (verified vials templates/audits/— 9 templates total, including the 2 from feat(#218): audit-skill artefact persistence + canonical structure #222)audit_run_persistANDaudit_render_trendmentions (2 hits each)/threat-modelretrofit from feat(#218): audit-skill artefact persistence + canonical structure #222 to confirm structural symmetry (they should look near-identical except for dimension name + finding examples)projects/<name>/audits/<dimension>/, confirm trend renders on a second invocationGlossary
_lib-audit-history.shAPI. Same pattern across all 7 dimensions.templates/audits/<dim>.mdcapturing the dimension-specific shape of the audit's body (POUR groupings, Diataxis quadrants, regulatory exposure tables, etc.). The skill itself embeds equivalent shape inline; the template is a copy-paste starting point.GDPR readiness: READY/PARTIAL/NOT READY,Incident readiness: READY/NOT READY,Documentation readiness: COMPLETE/PARTIAL/MISSING, etc.). Each retrofit documents the per-skill mapping to the generic three-state (pass/conditional/fail) so trend rendering across mixed-dimension data stays coherent.score = max(0, 100 - 25*critical - 10*high - 3*medium - 1*low)— single 0-100 number per run plotted on the trend chart's Y-axis. Same formula across all 9 audits for cross-dimension comparability.🤖 Generated with Claude Code