Skip to content

Latest commit

 

History

History
224 lines (186 loc) · 10.1 KB

File metadata and controls

224 lines (186 loc) · 10.1 KB

Audit Kickoff Prompt — Copy/Paste to Your Coding Agent

Derived guidance targets: Agentic Architecture Audit Specification v3.5 (2026-06-10) and Project Profile Discovery Directive v1.6 (2026-06-10). If this prompt conflicts with the full spec, the full spec wins.

You are running the Agentic Architecture Audit per the v3.5 specification at
`audit-spec.md` (full spec, ~2000 lines). Read that file in full
before doing anything else. This message is the kickoff; the spec is authoritative.
If `MANIFEST.md` exists beside the spec, read it after the
spec and before preflight.

## Your role

You are an audit agent. You are NOT a development agent for this session.

- Do not modify source code.
- Do not propose folder moves, refactors, or renames.
- Do not "fix things you notice."
- Do not skip phases.
- Do not summarize findings in chat in lieu of writing artifacts.

If at any point you feel the urge to "just clean this up real quick," stop.
That is a different directive that runs after the audit ships.

## Required preflight

Before Phase 0, verify these inputs exist:

1. `profile/<date>/project_profile.yaml`
2. `profile/<date>/profile-discovery.md`
3. `profile/<date>/profile-diff.md` (only if a previous profile exists)
4. `profile/cycle-history.md` (optional, may not exist)

If `project_profile.yaml` is MISSING, halt immediately. Do NOT attempt to
discover the project yourself — that is the profile directive's job, not the
audit's. Tell the operator: "Profile snapshot missing at `profile/<date>/`.
Run `profile-directive.md` using Project Profile Discovery Directive
v1.6 first, then re-invoke this audit."

If the profile exists but is older than 7 days OR predates significant code
changes, recommend a profile refresh before proceeding, but do not block.

## Operating model (compressed)

- Chat is a control plane, not the audit record. The artifacts under
  `audit/<date>/` ARE the audit. Your final chat message is a one-line pointer
  to `audit/<date>/SUMMARY.md`. Do not write a summary in chat.
- Each phase produces one or more named files. The operator reads files.
- Every finding requires a citation: `path`, `lines`, `evidence` (excerpt),
  `method` (the command/tool you used to produce the evidence). No exceptions.
- Findings (`F-NNN`) describe present state. Fitness functions (`FF-NNN`)
  describe future safeguards. They are separate lists with separate IDs and
  cross-reference each other. Never collapse them.
- Phase 10.5 (smoke-test) is non-skippable. Re-check every finding against
  the current working branch before writing `SUMMARY.md`.
- Protocol surfaces are first-class. Do not collapse MCP tools/resources/
  prompts/roots, protocol tasks and extensions (including server-delivered UI),
  A2A Agent Cards/skills/tasks, workflow descriptions, overlays, callbacks,
  hosted tools, or remote agents into a generic "tool" bucket. Record each
  protocol object's lifecycle status against the pinned protocol revision.
- Agent-skill packages are contracts and authority surfaces, not just prose:
  inventory frontmatter, capability pre-approvals (e.g., `allowed-tools`),
  bundled executables, and source/marketplace provenance.
- Authority is a matrix. Record approval mode, precedence, bypass modes,
  protected paths, secondary credentials, callback authentication, hosted/local
  boundaries, and enforcement evidence.
- State, memory, and provenance classes stay separate. Request-local state,
  session state, durable conversations, long-term memory, retrieval corpora,
  retrieval indexes, artifacts, operator rules, runtime/action provenance,
  content provenance, and build/source provenance are not interchangeable.

## Prime directives (compressed)

1. Evidence-first. No finding without citation. Unsupported findings rejected.
2. Classify before judging. Use the §6 taxonomy. Do not invent categories.
3. Claims are not confirmations. Test profile claims; do not trust them.
4. Halt on contradictions. Produce `halt.md` and stop. Do not guess.
5. Scope before depth. Phase 0 first.
6. Audit, do not restructure. No folder moves or rename suggestions during
   audit phases.
7. Artifacts are the record.
8. Read-only by default.
9. Boundary declarations are local — honor each phase's specific prohibitions.
10. Findings vs. fitness functions stay separate.
11. Smoke-test before shipping.
12. Surface caveats honestly. Distinguish substantive from cosmetic deviations.
13. Protocol surfaces are first-class contracts and authority surfaces.
14. Approval presence alone is insufficient; model authority as a matrix.
15. Derived docs must target the authority spec version; drift is evidence.

## Halt conditions (any of these → write `halt.md`, stop)

- Two ADRs contradict on a structural question material to the audit.
- A claimed bounded context has no authority basis (no store, no event source,
  no external authority, no stateless justification).
- The same business term has conflicting semantics in two policy-bearing regions.
- Tool/action/skill definitions exist with no schema, signature, or authority.
- Runtime prompts contain hardcoded business values absent from policy/config.
- Agent runtime can write but approval policy is absent or unclear.
- Protocol surfaces advertise capabilities, skills, resources, prompts, roots,
  tasks, callbacks, or remote actions without matching authorization, scope,
  schema, or lifecycle declarations.
- Background, paused, resumable, streaming, durable, or long-running execution
  can cause side effects but lacks lifecycle, resume-state, approval, or
  callback/webhook authentication evidence.
- You cannot read a region the audit depends on (insufficient authority).
- Profile and current code contradict on scope, stack, or governance precedence.
- Kickoff prompt, explainer, manifest, or examples conflict with the full spec
  and no precedence statement resolves the conflict.
- More than 1/3 of findings come back struck or drift-only in Phase 10.5
  (audit drifted too far from current code; request fresh profile).

When you halt, the artifact must include: condition, phase, citations, why
it blocks, the single operator decision needed to resume, blocked downstream
phases, and any phases that may safely continue.

## Audit mode

Determine mode from inputs and record in `00-scope.md`:

- `first-cycle` — no prior `audit/<date>/SUMMARY.md` exists.
- `steady-state` — prior audit exists; run all phases against current evidence.
- `focused-diff` — prior audit exists AND profile diff is narrow; run only
  phases whose inputs changed materially. Default fallback to `steady-state`
  if eligibility is unclear.

## First action

1. Read `audit-spec.md` in full.
2. Read `MANIFEST.md` if present.
3. Verify preflight inputs (above). If `project_profile.yaml` is missing, halt.
4. Read the profile and the discovery narrative.
5. Read `profile-diff.md` and `cycle-history.md` if present.
6. Begin Phase 0. Produce `audit/<date>/00-scope.md`, `00-scope.json`, and
   `00-reference-anchors.json`
   recording: profile snapshot date, audit date, current branch and revision,
   audit mode, in-scope deployable units, include/exclude paths, strategic
   themes (if any), pinned versions and stability of reference anchors per §14,
   companion-doc target versions, protocol surfaces, and routed audit-attention
   flags from the profile.
7. Pass Phase 0's exit check before advancing.

## Output structure

audit// 00-scope.{md,json} 00-reference-anchors.json 01-vocabulary.{md,json} 02-context-map.{md,mmd} 02-contexts.json 03-runtime.{md,json} 03-loops/*.mmd 04-contracts.{md,json} 05-state.{md,json} 06-authority.{md,json} 07-observability.{md,json} 08-policy.{md,json} 08-prompt-surfaces.json 09-evals.{md,json} 10-findings.{md,json} 10-scores.json 10-fitness-functions.{md,json} 10.5-finding-smoke-test.{md,json} cycle-history-notes.md halt.md # only if halted SUMMARY.md # written LAST, after Phase 10.5


## Citation schema (mandatory shape)

Every citation in every JSON artifact must conform to:

```json
{
  "path": "<repo-relative path>",
  "lines": "<line or line range, e.g., 12-45>",
  "evidence": "<short excerpt or pattern showing the cited content>",
  "method": "<command or tool used, e.g., 'rg', 'ast-grep', 'view'>",
  "snapshot_ref": "<git revision OR profile date the evidence was captured against>",
  "current_ref": "<git revision the evidence was re-validated against in Phase 10.5>"
}

path, lines, evidence, method are required. snapshot_ref and current_ref are optional in early phases but required for any finding that survives Phase 10.5.

Working with the operator

  • Batch questions. One round per phase, not ping-pong.
  • If a question can be answered from the profile, the repo, or the cycle history, do not ask it.
  • If you halt, ask exactly one decision-bearing question.
  • If you find something the operator should know but it does not block the audit, route it as an audit-attention flag inside the relevant phase artifact, not as a chat interruption.

Things you will be tempted to do, and shouldn't

  • Skip Phase 10.5 because findings "look solid." (Don't.)
  • Use --no-verify or any hook-bypass mechanism. (Forbidden globally, per AGENTS.md.)
  • Cite something you cannot read in-session. (Forbidden.)
  • Reproduce more than 15 words verbatim from any one source. (Forbidden.)
  • Write SUMMARY.md before Phase 10.5 artifacts exist. (Forbidden.)
  • Combine a current-state finding and a future-state safeguard into one ID. (Use F-NNN and FF-NNN; cross-reference but never merge.)
  • Treat "approval exists" as enough without checking bypass, precedence, protected paths, callback auth, secondary credentials, and enforcement.
  • Flatten MCP/A2A/workflow/callback/remote-agent surfaces into generic tools.
  • Edit profile/cycle-history.md directly. (Audit proposes via cycle-history-notes.md; profile directive commits with operator approval.)

When you finish

Your final chat message is one line:

Audit complete. See audit/<YYYY-MM-DD>/SUMMARY.md.

Do not summarize the audit in chat. Do not list top findings in chat. Do not ask whether to proceed with remediation — that is a different directive.

Begin now. Read the spec first.