Audit Agents

Skill: Agent Protocol Auditor (Project-Agnostic)

🛑 SCOPE CONFINEMENT (Priority 0)

• All file enumeration, inspection, and patch operations MUST be strictly confined to the caller's current working directory ([PROJECT_ROOT]).
• You are STRICTLY FORBIDDEN from traversing outside [PROJECT_ROOT] or referencing parent directories. Use generic placeholders like [PROJECT_ROOT]/AGENTS.md.
• Absent-File Policy: If optional architectural files (DESIGN.md, docs/architecture.md, docs/data_model.md) do NOT exist in [PROJECT_ROOT], SKIP them gracefully with an explicit note. DO NOT HALT. DO NOT HALLUCINATE their contents. DO NOT scaffold or create them unless explicitly instructed.
• OpenCode Isolation: You are STRICTLY FORBIDDEN from creating .opencode/ scaffolding inside third-party projects. Only inspect .opencode/ if [PROJECT_ROOT]/.opencode/ ALREADY exists OR if the user passes with_opencode: true.

Target Audit Criteria

The AGENTS.md file MUST explicitly contain the following operational constraints, ideally within a Task Management & OpenCode Rules section:

• Mandatory First-Read Rule: MUST explicitly command the agent to read AGENTS.md first before any execution. Inside it, it must route the agent to read DESIGN.md, docs/architecture.md, docs/data_model.md, and docs/conventions.md first.
• Core File Locations: MUST explicitly list paths for AGENTS.md, DESIGN.md (if present, else note absent per Absent-File Policy), docs/conventions.md, and the 5 Kanban directories (tasks/backlog, tasks/in-progress, tasks/qa, tasks/completed, tasks/archive). Only require .opencode/skills/ when the project already contains .opencode/ or with_opencode: true is set.
• conventions.md Compliance: The project MUST have a docs/conventions.md file containing the Universal DateTime Standard (UTC at rest, Epoch/ISO-8601 with Offset at API boundaries, Clock injection, Dual-Representation for future events, TZ=UTC Infrastructure), SOLID Programming Guidelines (SRP, OCP, LSP, ISP, DIP, Pragmatic Guardrails), Universal Financial Ledger Standard (snapshot-on-write, $ifNull precedence, discrepancy alerting, deep config merging), and Defensive Shell Protocol (DSP) (set -euo pipefail, banned error masking, sidecar isolation).
• Decentralized Task Management: Agents MUST strictly use decentralized, individual task files in the Kanban directories (tasks/backlog, tasks/in-progress, tasks/qa, tasks/completed, tasks/archive) as their single source of truth.
• No Monolithic State: Agents are strictly forbidden from creating TODO.md or STATE.md.
• Zero-Autonomous-Commit: Agents MUST be strictly forbidden from executing Git commands autonomously; they may only run Git commands when explicitly instructed by the Orchestrator. Exception: git mv is permitted for moving task files between Kanban directories (backlog, in-progress, qa, completed, archive).
• Mandatory End-Of-Task Sequence: MUST explicitly mandate a 5-step completion process: 1) Update CHANGELOG.md. 2) Write manual reasoning in the task file. 3) Call the custom_context_stage_and_inject_diff MCP tool, then git mv the task to tasks/qa/ (NO COMMITS ALLOWED). 4) Synchronize the task file's **File:** metadata to the new path and re-run lint + stage at the new path. 5) Notify the Manager.
• UI/UX Enforcement: Any UI/UX changes MUST enforce the guidelines defined in the project's DESIGN.md.
• Task-Generator Skill Loading: AGENTS.md MUST explicitly instruct the Hands to load the task-generator skill before creating new task files.
• Project Skill Loading: AGENTS.md MUST explicitly instruct the Hands to load every available skill matching the project's tech stack before task implementation.
• Complex Debugging: Agents MUST be instructed not to guess blindly on complex bugs, but instead utilize the debug-instrumentation skill.
• MCP Report Generation: AGENTS.md MUST instruct agents to generate context reports (custom_context_read_source_files) and tree reports (custom_context_create_tree_report — "create a tree of the project") via the MCP server and hand the file path to the Manager instead of reading context-reports/ files inline.
• Explicit Staging Contract (F5): Verify that the active task's Execution Log & Reasoning or summary_phase passed a modified_files list to stage_and_inject_diff — blind git add -A . staging is banned because it sweeps parallel-session files into unrelated commits.
• Gatekeeper Validation (Halt Protocol): Agents MUST be instructed to evaluate tasks against project rules and HALT with a warning if the Orchestrator provides non-compliant instructions.
• Context Bootstrapping: AGENTS.md MUST explicitly instruct the Hands: "At the start of every task, you MUST call search_memory or list_namespaces to load any hidden project quirks relevant to your domain before implementing."
• Buffer Isolation: The shared validation phase MUST include a buffer-flush directive requiring Hands to treat every task as contextually independent, preventing cross-task context leakage.
• Defensive Shell Protocol (DSP): AGENTS.md MUST include a guardrail forbidding bash scripts without set -euo pipefail and banning 2>/dev/null on data commands. docs/conventions.md MUST contain a ## Defensive Shell Protocol (DSP) section.
• Universal Financial Ledger Standard: AGENTS.md MUST include a guardrail requiring snapshot-on-write for financial mutations and $ifNull precedence for monetary aggregations. docs/conventions.md MUST contain a ## Universal Financial Ledger Standard section.
• Lite Mode Protocol: AGENTS.md MUST document the <lite_mode_protocol> — when eligible (single-file, no security/financial impact, obvious simplicity), the full 9-step production line can be bypassed with a [LITE] justification in the task's ## Execution Log & Reasoning section. Escalation to Full Mode is mandatory if hidden complexity is discovered.
• Deprecated-Section Purge Rule: Scans AGENTS.md and all task files across tasks/ (excluding archive and completed history) for deprecated sections: ## Manager Decisions, ## Admin Decision, Manager Decision, Admin Decision. When detected, the auditor MUST purge the entire deprecated section from the target file, document the purge in the audit findings/changelog, and MUST NOT flag their absence as a missing requirement or recreate them.
• Plugin Runtime-State gitignore: If the project uses OpenCode plugins that write per-project state, .gitignore MUST cover plugin runtime-state paths (e.g. worktree checkouts, session/state JSON, goal-state dirs) while MUST NOT ignore deliberate config overrides checked in on purpose (e.g. a project-level plugin config pinning team-shared settings). Audit .gitignore read-only first; patch only paths belonging to plugins actually detected in the project's opencode.json/tui.json plugin arrays — never speculative entries.

Core Document Templates

1. architecture.md Template

# Architecture Overview

This document serves as a critical, living template designed to equip agents with a rapid and comprehensive understanding of the codebase's architecture, enabling efficient navigation and effective contribution from day one. Update this document as the codebase evolves.

## 1. Project Structure

[Project Root]/
├── backend/ # Contains all server-side code and APIs
│ ├── src/ # Main source code for backend services
│ │ ├── api/ # API endpoints and controllers
│ │ ├── client/ # Business logic and service implementations
│ │ ├── models/ # Database models/schemas
│ │ └── utils/ # Backend utility functions
│ ├── config/ # Backend configuration files
│ ├── tests/ # Backend unit and integration tests
│ └── Dockerfile # Dockerfile for backend deployment
├── frontend/ # Contains all client-side code for user interfaces
│ ├── src/ # Main source code for frontend applications
│ │ ├── components/ # Reusable UI components
│ │ ├── pages/ # Application pages/views
│ │ ├── assets/ # Images, fonts, and other static assets
│ │ ├── services/ # Frontend services for API interaction
│ │ └── store/ # State management (e.g., Redux, Vuex, Context API)
│ ├── public/ # Publicly accessible assets (e.g., index.html)
│ ├── tests/ # Frontend unit and E2E tests
│ └── package.json # Frontend dependencies and scripts
├── common/ # Shared code, types, and utilities used by both frontend and backend
│ ├── types/ # Shared TypeScript/interface definitions
│ └── utils/ # General utility functions
├── docs/ # Project documentation (e.g., API docs, setup guides)
├── scripts/ # Automation scripts (e.g., deployment, data seeding)
├── .github/ # GitHub Actions or other CI/CD configurations
├── .gitignore # Specifies intentionally untracked files to ignore
├── README.md # Project overview and quick start guide
└── ARCHITECTURE.md # This document

## 2. High-Level System Diagram

[User] <--> [Frontend Application] <--> [Backend Service 1] <--> [Database 1]
|
+--> [Backend Service 2] <--> [External API]

## 3. Core Components

### 3.1. Frontend

Name: [Web App, Mobile App]
Description: [Purpose, core interfaces, and roles]
Technologies: [e.g., React, Next.js, Jetpack Compose, Swift/Kotlin]
Deployment: [e.g., Vercel, Netlify, Play Store, App Store]

### 3.2. Backend Services

#### 3.2.1. Service Name 1

Name: [e.g., API Service]
Description: [Core business roles]
Technologies: [e.g., Spring Boot, Node.js Express, Go]
Deployment: [e.g., AWS ECS, Kubernetes]

## 4. Data Stores

### 4.1. Data Store 1

Name: [e.g., SQL Database]
Type: [e.g., PostgreSQL, MongoDB]
Purpose: [e.g., Account records]

## 5. External Integrations / APIs

- Service Name: [e.g., Stripe, SendGrid]
- Purpose: [e.g., Payments]
- Method: [e.g., REST, SDK]

## 6. Deployment & Infrastructure

- Provider: [e.g., AWS, GCP]
- CI/CD: [e.g., GitHub Actions]

## 7. Security Considerations

- Authentication: OAuth2/JWT
- Encryption: TLS + AES-256

## 8. Development & Testing Environment

Testing Frameworks: [e.g., Pytest, JUnit, Jest]

## 9. Future Considerations / Roadmap

[Planned changes or architectural debt]

2. DESIGN.md Template (Google Spec)

# Design System Specification

---

name: custom-ui-system
colors:
primary: "#1D4ED8"
secondary: "#4B5563"
background: "#F3F4F6"
surface: "#FFFFFF"
text: "#111827"

---

## 1. Visual Theme & Atmosphere

[Rich prose outlining overall design mood, light/dark values, and whitespace philosophy]

## 2. Color Palette & Roles

- Primary foundation
- Interactive / CTAs
- Text hierarchy
- State colors (Success, error, warn)

## 3. Typography Rules

- Hierarchy (headline, body, label)
- letterSpacing, lineHeight, fontWeights

## 4. Component Stylings

- Buttons
- Cards
- Navigation
- Input fields

## 5. Layout Principles

- Spacing scales
- Breakpoints

3. docs/conventions.md Template

Generate a docs/conventions.md file containing the Universal DateTime Standard and SOLID Programming Guidelines:

# Conventions

This document defines syntax rules, naming conventions, file boundaries, and automation patterns for this project.

## Universal DateTime Standard

All projects in this ecosystem MUST follow these datetime rules:

1. **UTC at Rest** — All databases and caches store datetimes in UTC with `TIMESTAMP WITH TIME ZONE`. Banned: naive or local-time storage.
2. **ISO-8601 with Offset / Epoch ms at API Boundaries** — APIs transmit datetimes as Unix Epoch milliseconds (int64) or ISO-8601 with offset (e.g., `2026-07-23T14:30:00+00:00`). Banned: timezone-naive strings.
3. **Clock Injection** — All current-time access must go through an injectable `Clock` abstraction. Banned: direct `new Date()`, `datetime.now()`, `time.Now()` in business logic.
4. **Dual-Representation for Future Events** — Calendar events expose both `event_start_local` (with timezone) and `event_start_epoch_ms` (absolute).
5. **`TZ=UTC` Infrastructure** — All environments run with `TZ=UTC`. Timezone display is a client-layer responsibility only.

## SOLID Programming Guidelines

Enforce these SOLID principles and pragmatic guardrails in every implementation:

1. **SRP** — One reason to change per module. Split merged concerns.
2. **OCP** — Open for extension, closed for modification. Use composition over inheritance.
3. **LSP** — Subtypes must be substitutable. Ban `NotImplementedError` overrides.
4. **ISP** — Small role-specific interfaces. Ban monolithic god-interfaces.
5. **DIP** — Depend on abstractions, not concretions. Core layer must not import adapters.

**Pragmatic Guardrails:** No abstraction for <3 trivial operations. Only extract interfaces with 2+ implementations. Apply YAGNI strictly. Prefer simpler designs unless a measurable requirement forces complexity.

## Universal Financial Ledger Standard

All financial, transactional, and countable data operations MUST enforce these mandates:

1. **Snapshot-on-Write for Mutable Totals:** Whenever a financial amount, inventory count, or balance is mutated, persist a read-only snapshot of the preceding state in the same transaction (sidecar table, audit log, or WAL). Banned: mutating without preserving the prior value.
2. **Mandatory `$ifNull` Precedence:** All aggregation queries on monetary fields MUST use explicit null-handling (`COALESCE`, `ISNULL`, `$ifNull`). Banned: passing nullable columns into mathematical operators.
3. **Observability Alerting on Discrepancies:** If a computed total diverges from its line-item sum by more than 0.01, emit a high-severity alert and prevent finalization.
4. **Deep Config Merging for Financial Settings:** Financial configuration updates MUST deeply merge nested properties. Banned: shallow object spread on financial config objects.

## Defensive Shell Protocol (DSP)

When writing or reviewing bash scripts, cron jobs, or container orchestration commands:

1. **Mandatory Strict Mode:** All scripts MUST start with `set -euo pipefail`.
2. **Banned Error Masking:** `2>/dev/null` is STRICTLY FORBIDDEN on data-generation, backup, archive, or database commands.
3. **No Post-Redirect Status Checks:** Never use `command > file; if [ $? -eq 0 ]` — the shell creates the file before running the command, masking failures.
4. **Sidecar Isolation for Hostless Backups:** Never rely on host file staging for Docker volume backups. Always use ephemeral containers (`docker run --rm -v volume:/data:ro alpine tar...`) with read-only mounts.

Use this skill in two modes:

• Phase 0 (Generation): When AGENTS.md does not exist yet — generate it from the template below.
• Audit Mode (Existing): When AGENTS.md already exists — audit and patch it against the Target Audit Criteria.

Mode 1: Phase 0 — Generate AGENTS.md & docs/conventions.md

Use this when a project has no AGENTS.md yet (new project onboarding).

Workflow

1. Read the project's existing context (package configs, README, tech stack files) to determine the project name, description, and relevant tech stack skills.
2. Generate AGENTS.md at the project root using the template below.
3. Fill in the [bracketed] placeholders with the actual project details.
4. Generate docs/conventions.md using the conventions template above, if the project does not already have one.
5. Confirm both files were created.

AGENTS.md Template

# [Project Name] — Project Context Hub

## Project Overview

[Brief description of the project, its purpose, and tech stack]

## Setup & Dev Commands

- Build: [build command, e.g., npm run build]
- Test: [test command, e.g., npm test]
- Lint: [lint command, e.g., npm run lint]
- Dev: [dev server command, e.g., npm run dev]

## Actionable Guardrails (Do's & Don'ts)

- **Don't** [common anti-pattern to avoid]
  -> **Do** [preferred alternative]
- **Don't** [another anti-pattern]
  -> **Do** [preferred alternative]
- **Don't** read `context-reports/` markdown files yourself.
  -> **Do** generate them using the MCP server — context reports via `custom_context_read_source_files`, tree reports via `custom_context_create_tree_report` ("create a tree of the project") — and hand the file path to the Manager.
- **Don't** execute Git commands like `git add`, `git commit`, or `git mv` autonomously or try to guess when to stage code.
  -> **Do** execute Git commands ONLY when explicitly instructed by an Orchestrator task block. Otherwise, rely on the `custom_context_stage_and_inject_diff` MCP tool.
  -> **Exception:** `git mv` is permitted autonomously for moving task files between Kanban directories.
- **Don't** guess blindly when facing complex bugs, deadlocks, or silent timeouts.
  -> **Do** utilize the `debug-instrumentation` skill to inject strategic logs and trace the runtime execution path.
- **Don't** write bash scripts without strict mode or mask errors with `2>/dev/null` on data commands.
  -> **Do** follow the Defensive Shell Protocol: `set -euo pipefail`, ban error masking, sidecar isolation for Docker backups. See `docs/conventions.md`.
- **Don't** perform financial mutations without snapshotting the prior state or allow nulls in monetary aggregations.
  -> **Do** follow the Universal Financial Ledger Standard: snapshot-on-write, `$ifNull` precedence, discrepancy alerting, deep config merging. See `docs/conventions.md`.
- **Don't** carry over assumptions, partial results, or architectural hypotheses from a previous task.
  -> **Do** flush context and treat every task as contextually independent (Buffer Isolation directive in validation-phase).
- **Don't** execute raw, informal, or non-English (Farsi) prompts directly.
  -> **Do** load the `prompt-refactor` skill to translate and expand the intent into an elite English spec first. (Note: If you receive a standard XML task block, skip this and execute normally).
- **Don't** attempt to resolve cross-disciplinary ambiguity within a single persona.
  -> **Do** trigger the Multi-Agent Brainstorming Loop if the Manager explicitly requests brainstorming or a task exhibits cross-disciplinary ambiguity. Interpret the `<brainstorming_session>` results in backlog tasks as non-functional guidelines that govern execution.

## Documentation Sync Rules

When modifying this repository, you must keep these files synchronized:

1. Active task file in `tasks/` (single source of truth for current work items)
2. `CHANGELOG.md` (Keep a Changelog format)
3. `DESIGN.md` (UI/UX design system, if modified)
4. `docs/conventions.md` (syntax rules, datetime standard, SOLID guidelines)
5. Relevant `SKILL.md` files (if structural patterns were altered)

## 🛑 GATEKEEPER VALIDATION (HALT PROTOCOL)

You (the Hands) are the final gatekeeper. Before executing any implementation task, you MUST evaluate the Orchestrator's instructions against this file and any referenced specs (`DESIGN.md`, `architecture.md`, etc.). If the instructions violate project rules, ignore them. HALT immediately and output a `⚠️ RULE VIOLATION WARNING` back to the Manager explaining exactly what the Orchestrator got wrong, forcing it to self-correct.

## 🛑 CORE FILE LOCATIONS

You MUST strictly adhere to these exact paths. Do not create duplicates elsewhere:

- **Global Rules:** `AGENTS.md` (Root)
- **UI/UX Specs:** `DESIGN.md` (Root)
- **Agent Skills:** `.opencode/skills/<skill-name>/SKILL.md` (Local workspace — optional; only include if project utilizes OpenCode)
- **Active Tasks:** `tasks/backlog/<task-number>-<name>.md` (backlog), `tasks/in-progress/`, `tasks/qa/`, `tasks/completed/`, `tasks/archive/`

## 🛑 SKILL LOADING RULES

You MUST follow these skill loading rules in every session:

- **Task-Generator Skill:** Before creating any new task file, you MUST load the `task-generator` skill using the `skill` tool to ensure the correct template format with `<!-- BEGIN_GIT_DIFF -->` / `<!-- END_GIT_DIFF -->` markers.
- **Project Skills:** Before implementing any task, you MUST load every available skill matching the project's tech stack (e.g., `android-kotlin`, `spring-boot`, `react-vite`). If a relevant skill exists, it MUST be loaded — this enforces framework-specific conventions and architectural rules.

## 🛑 CONTEXT BOOTSTRAPPING

At the start of every task, you MUST call `search_memory` or `list_namespaces` to load any hidden project quirks relevant to your domain before implementing.

## 🛑 MANDATORY END-OF-TASK SEQUENCE

When finishing a task, you MUST execute these exact steps in order:

1. **Update Changelog:** You MUST insert a formal entry into CHANGELOG.md logging your modifications.
2. **Write your Summary:** Manually write your architectural reasoning, local TODO checks, and execution notes into the active `tasks/XX-task.md` file under "Execution Log & Reasoning".
3. **Call MCP Tool & QA Transition:** Call the `custom_context_stage_and_inject_diff` MCP tool. After injection, you MUST move the task file to `tasks/qa/` via `git mv` before notifying the Manager (implementation tasks only — discovery tasks stay in place). DO NOT execute any `git commit` commands. Closure to `tasks/completed/` happens ONLY after the Manager explicitly says "Approved for closure" or "Close task".
4. **Kanban Metadata Synchronization (mandatory after ANY authorized `git mv`):** After the move, update the task file's `**File:**` metadata header to the new path. If the move happened AFTER staging, re-run `lint_task_file` and call `custom_context_stage_and_inject_diff` AGAIN with the NEW task path and the full `modified_files` array before notifying the Manager — the re-stage keeps the injected diff and staging state in sync with the final path. Never notify the Manager with a stale `**File:**` header.
5. **Notify Manager:** Output exactly: "Task ready. Manager, please copy the contents of `tasks/XX-task.md` and send it back to the Orchestrator Brain for review."

Mode 2: Audit & Patch Existing AGENTS.md and docs/conventions.md

🛑 STRICT EXECUTION RULES (Priority 1)

1. Primary Source of Truth: You MUST read AGENTS.md at the project root using local file read tools.
2. Read-Only First: Evaluate the contents of both AGENTS.md and docs/conventions.md against the Target Audit Criteria before attempting any file modifications.
3. Immutable Formatting: If patching is required, maintain the exact Markdown list structure, headers, and spacing of the existing file.

Target Audit Criteria

The AGENTS.md file MUST explicitly contain the following operational constraints, ideally within a Task Management & OpenCode Rules section:

• Core File Locations: MUST explicitly list paths for AGENTS.md, DESIGN.md (if present, else note absent per Absent-File Policy), docs/conventions.md, and the 5 Kanban directories (tasks/backlog, tasks/in-progress, tasks/qa, tasks/completed, tasks/archive). Only require .opencode/skills/ when the project already contains .opencode/ or with_opencode: true is set.

Additionally, the docs/conventions.md file MUST exist and contain:

• Universal DateTime Standard: UTC at rest, Epoch/ISO-8601 with Offset at API boundaries, Clock injection, Dual-Representation for future events, TZ=UTC Infrastructure.
• SOLID Programming Guidelines: SRP, OCP, LSP, ISP, DIP, and Pragmatic Guardrails (No abstraction for <3 trivial ops, 3-Implementation Rule, YAGNI, Occam's Razor).
• Decentralized Task Management: Agents MUST strictly use decentralized, individual task files in the tasks/ directory as their single source of truth.
• No Monolithic State: Agents are strictly forbidden from creating TODO.md or STATE.md.
• Zero-Autonomous-Commit: Agents MUST be strictly forbidden from executing Git commands autonomously; they may only run Git commands when explicitly instructed by the Orchestrator. Exception: git mv is permitted for moving task files between Kanban directories (backlog, in-progress, qa, completed, archive).
• Mandatory End-Of-Task Sequence: MUST explicitly mandate a 5-step completion process: 1) Update CHANGELOG.md. 2) Write manual reasoning in the task file. 3) Call the custom_context_stage_and_inject_diff MCP tool, then git mv the task to tasks/qa/ (NO COMMITS ALLOWED). 4) Synchronize the task file's **File:** metadata to the new path and re-run lint + stage at the new path. 5) Notify the Manager.
• UI/UX Enforcement: Any UI/UX changes MUST enforce the guidelines defined in the project's DESIGN.md.
• Task-Generator Skill Loading: AGENTS.md MUST explicitly instruct the Hands to load the task-generator skill before creating new task files.
• Project Skill Loading: AGENTS.md MUST explicitly instruct the Hands to load every available skill matching the project's tech stack before task implementation.
• Complex Debugging: Agents MUST be instructed not to guess blindly on complex bugs, but instead utilize the debug-instrumentation skill.
• MCP Report Generation: AGENTS.md MUST instruct agents to generate context reports (custom_context_read_source_files) and tree reports (custom_context_create_tree_report — "create a tree of the project") via the MCP server and hand the file path to the Manager instead of reading context-reports/ files inline.
• Explicit Staging Contract (F5): Verify that the active task's Execution Log & Reasoning or summary_phase passed a modified_files list to stage_and_inject_diff — blind git add -A . staging is banned because it sweeps parallel-session files into unrelated commits.
• Gatekeeper Validation (Halt Protocol): Agents MUST be instructed to evaluate tasks against project rules and HALT with a warning if the Orchestrator provides non-compliant instructions.
• Bilingual Prompt Refactoring & Brainstorming Protocol: Agents MUST be instructed not to execute raw, informal, or non-English prompts directly. The prompt-refactor skill must be loaded, or the Phase 1.5 Multi-Agent Brainstorming Protocol triggered, to translate and expand intent first. Standard XML task blocks are exempt.
• Context Bootstrapping: AGENTS.md MUST explicitly instruct the Hands: "At the start of every task, you MUST call search_memory or list_namespaces to load any hidden project quirks relevant to your domain before implementing."
• Buffer Isolation: The shared validation phase MUST include a buffer-flush directive requiring Hands to treat every task as contextually independent, preventing cross-task context leakage.
• Defensive Shell Protocol (DSP): AGENTS.md MUST include a guardrail forbidding bash scripts without set -euo pipefail and banning 2>/dev/null on data commands. docs/conventions.md MUST contain a ## Defensive Shell Protocol (DSP) section.
• Universal Financial Ledger Standard: AGENTS.md MUST include a guardrail requiring snapshot-on-write for financial mutations and $ifNull precedence for monetary aggregations. docs/conventions.md MUST contain a ## Universal Financial Ledger Standard section.
• Lite Mode Protocol: AGENTS.md MUST document the <lite_mode_protocol> — when eligible (single-file, no security/financial impact, obvious simplicity), the full 9-step production line can be bypassed with a [LITE] justification in the task's ## Execution Log & Reasoning section. Escalation to Full Mode is mandatory if hidden complexity is discovered.
• Deprecated-Section Purge Rule: Scans AGENTS.md and all task files across tasks/ (excluding archive and completed history) for deprecated sections: ## Manager Decisions, ## Admin Decision, Manager Decision, Admin Decision. When detected, the auditor MUST purge the entire deprecated section from the target file, document the purge in the audit findings/changelog, and MUST NOT flag their absence as a missing requirement or recreate them.
• Plugin Runtime-State gitignore: If the project uses OpenCode plugins that write per-project state, .gitignore MUST cover plugin runtime-state paths (e.g. worktree checkouts, session/state JSON, goal-state dirs) while MUST NOT ignore deliberate config overrides checked in on purpose (e.g. a project-level plugin config pinning team-shared settings). Audit .gitignore read-only first; patch only paths belonging to plugins actually detected in the project's opencode.json/tui.json plugin arrays — never speculative entries.

Resolution Protocol

1. Evaluation: Compare the active AGENTS.md text against the Target Audit Criteria. Also check if docs/conventions.md exists and contains both the DateTime Standard and SOLID Guidelines.
   • Absent-File Policy (Mandatory): For DESIGN.md, docs/architecture.md, and docs/data_model.md — if any of these files do NOT exist in [PROJECT_ROOT], audit them as OPTIONAL — SKIPPED GRACEFULLY with an explicit note. DO NOT flag as fatal errors, non-compliance violations, or missing-file failures. DO NOT hallucinate or scaffold them.
2. Patching: If any constraints are missing, ambiguous, or incorrect in AGENTS.md, use the apply_patch tool to inject the exact missing rules. If docs/conventions.md is missing or incomplete, generate or patch it using the conventions template from Mode 1.
3. Halt on Success: If both files already comply 100%, DO NOT execute any write operations.

Deprecated Sections Resolution

• Deprecated Sections Purge: If any file contains deprecated sections (## Manager Decisions, ## Admin Decision, Manager Decision, Admin Decision), strip those sections cleanly. Do NOT add them back. Record the removal in the audit report under a dedicated "Deprecated Sections Purged" note.

Summary Phase

Upon completion, output a strict, formatted summary for the Manager:

Agent Audit Summary

Audit Status: [PASSED | FIXED] AGENTS.md Violations: [List of missing/incorrect rules, or "None"] conventions.md Status: [COMPLIANT | MISSING | INCOMPLETE] conventions.md Actions: [Description of the patch applied, or "Already compliant"] Actions Taken: [Description of the patches applied, or "Both files already compliant"]