ViktorsBaikers devrites-audit: read-only audit dispatch
Dispatch one fresh-context, read-only review axis for the active feature. The caller decides how to use the report; this skill never edits.
Axis
| Argument | Role | Discipline |
|---|---|---|
security |
devrites-security-auditor |
trust boundaries, OWASP, secrets, dependencies |
perf |
devrites-performance-reviewer |
measure-first hot paths, N+1, payload/bundle and stated budgets |
simplify |
devrites-simplifier-reviewer |
behavior-preserving deletion/simplification; Suggestion/Nit/FYI only |
If no axis is supplied, infer only when intent is unambiguous; otherwise the root asks the human before dispatch.
Gather and dispatch
- Resolve
.devrites/ACTIVE; requirespec.mdandtouched-files.md. - Follow the bounded fresh-context native dispatch contract in
agents.md. - Include
spec.md,decisions.mdwhen present,evidence.mdfor performance,touched-files.md, and the immutable diff. - Objective: derive expected behavior independently, apply the role's documented
discipline, and return one labeled finding per line with
file:line. - Wait for, validate, and pass the role result to the caller. The root reconciles and decides what to accept.
Use one task per axis. If several axes are requested, keep their inputs separate with
no cross-pollination; batch or serialize per
parallel-dispatch.md when readers
exceed ~3 per wave.
Fallback and scope
If an exact named read-only role is unavailable, stop for HITL. Use these role contracts:
.codex/agents/devrites-security-auditor.toml.codex/agents/devrites-performance-reviewer.toml.codex/agents/devrites-simplifier-reviewer.toml
Stay inside the active feature. Critical findings block seal; simplification never changes behavior.