← Browse

@tacoda/keystone-audit

A

Full dual-flywheel audit — Learning (capture from review) + Pruning (remove dead rules). Periodic charter hygiene.

skillclaude

Install

agr install @tacoda/keystone-audit --target claude

Writes 1 file into .claude/skills/, pinned to git-e3a0d357.

  • .claude/skills/keystone-audit/SKILL.md

Document


kind: skill id: keystone:audit description: Full dual-flywheel audit — Learning (capture from review) + Pruning (remove dead rules). Periodic charter hygiene. triggers:

  • keystone audit
  • keystone:audit
  • /keystone:audit
  • run audit
  • audit the charter
  • dual flywheel audit model: opus tools:
  • Read
  • Grep
  • Glob
  • Bash
  • Task

keystone:audit — periodic dual-flywheel review

The Pruning flywheel's main entry point, paired with one Learning sweep. Walks the corpus + guides looking for stale, dead, or unused content; proposes archive moves with a one-line reason per item.

Canonical playbook: .charter/actions/audit.md. Read it for the 12-category Pruning checklist (stale rules, dead idioms, placeholders, failing sensors, empty shells, uncited policies, unresolved gaps, drifted state, strict-cascade violations, required-item gaps, risk fingerprint, traffic topology).

Run

Open .charter/actions/audit.md and execute every section. Output is one report with Learn / Prune sections, each listing concrete proposed charter edits. Pruning diffs land in .charter/corpus/state/charter-debt.md.

When to trigger

  • Monthly cadence (recommended).
  • After any major refactor or stack change.
  • When the dashboard's debt count starts to feel wrong.

Asymmetry

Guides churn often; corpus rarely. Audit reflects that — guide proposals are routine, corpus proposals are rare and load-bearing.

Trustgrade A

  • passBody integrity

    Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.

  • passType matchnot applicable to this artifact type

    Whether the artifact is really the kind of thing its metadata claims it is.

  • passFreshness

    How long since the source repository was last pushed to.

  • passPrompt injection

    Scans the artifact's own text for instructions aimed at your agent rather than at you.

  • passLicense

    Whether the source repository declares an SPDX license permissive enough to redistribute.

How the grade is calculated

Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:

  • Aevery check passed
  • Bone warning
  • Ctwo warnings
  • Dprompt injection or body integrity failed, or three warnings
  • Fone of those failed, and something else is wrong

These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.

Versions

  • git-e3a0d35713fd2026-07-31