@tacoda/keystone-audit
AFull dual-flywheel audit — Learning (capture from review) + Pruning (remove dead rules). Periodic charter hygiene.
Install
agr install @tacoda/keystone-audit --target claudeWrites 1 file into .claude/skills/, pinned to git-e3a0d357.
- .claude/skills/keystone-audit/SKILL.md
Document
kind: skill id: keystone:audit description: Full dual-flywheel audit — Learning (capture from review) + Pruning (remove dead rules). Periodic charter hygiene. triggers:
- keystone audit
- keystone:audit
- /keystone:audit
- run audit
- audit the charter
- dual flywheel audit model: opus tools:
- Read
- Grep
- Glob
- Bash
- Task
keystone:audit — periodic dual-flywheel review
The Pruning flywheel's main entry point, paired with one Learning sweep. Walks the corpus + guides looking for stale, dead, or unused content; proposes archive moves with a one-line reason per item.
Canonical playbook: .charter/actions/audit.md. Read it for
the 12-category Pruning checklist (stale rules, dead idioms,
placeholders, failing sensors, empty shells, uncited policies,
unresolved gaps, drifted state, strict-cascade violations, required-item
gaps, risk fingerprint, traffic topology).
Run
Open .charter/actions/audit.md and execute every section.
Output is one report with Learn / Prune sections, each listing concrete
proposed charter edits. Pruning diffs land in
.charter/corpus/state/charter-debt.md.
When to trigger
- Monthly cadence (recommended).
- After any major refactor or stack change.
- When the dashboard's debt count starts to feel wrong.
Asymmetry
Guides churn often; corpus rarely. Audit reflects that — guide proposals are routine, corpus proposals are rare and load-bearing.
Trustgrade A
- passBody integrity
Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.
- passType matchnot applicable to this artifact type
Whether the artifact is really the kind of thing its metadata claims it is.
- passFreshness
How long since the source repository was last pushed to.
- passPrompt injection
Scans the artifact's own text for instructions aimed at your agent rather than at you.
- passLicense
Whether the source repository declares an SPDX license permissive enough to redistribute.
How the grade is calculated
Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:
- Aevery check passed
- Bone warning
- Ctwo warnings
- Dprompt injection or body integrity failed, or three warnings
- Fone of those failed, and something else is wrong
These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.
Versions
git-e3a0d35713fd2026-07-31