audit

Run /audit with the current scope, which reviews the active feature spec, all committed feature-branch changes from the merge base, staged and unstaged changes, and untracked source files. The audit resolves the comparison base locally without fetching from the network.

Use /audit security to apply only the security lens, which checks authorization, input trust, injection, data exposure, secret handling, and unsafe configuration. A focused lens never implies the other lenses passed, and the report states what was not reviewed.

Scope controls what code is reviewed: current feature, changed files, full project, or a specific path. Lens controls what concerns are checked: quality, security, performance, or tests. They are independent controls and can be combined in either order.

No, the audit is strictly read-only for source code. It never edits files, installs dependencies, commits, or pushes. Its single write is the findings ledger at blueprint/context/findings.md, which records findings and their status.

Findings are recorded in blueprint/context/findings.md with sequential IDs, P0-P3 severities, and statuses like open, fixed, and closed. The ledger survives context clears, and only P0 and P1 findings in open or fixed status block feature completion.

Use /audit full when you need all lenses across the entire project, such as before a major release or for vibe-coded project cleanup. It excludes dependencies, generated files, build output, and vendored code, and states excluded paths before reviewing.