audit

What it does

Performs a multi-level code review on recent changes, involving domain-specific and security-aware reviewers, and outputs structured findings. After the review, a fix-gate asks the user whether to apply findings; on approval, it runs below to plan and dispatch fixes.

How it works

• Initiates a multi-phase review with a standalone Reviewer; follows Layer 3 (Orchestrator) and Layer 9 (Security).
• Step 1 — Resolve scope: uses provided target or git diff HEAD/git diff --staged as read-only input.
• Step 2 — Gather context: runs parallel Surface mapping (2a), Semantic indexing (2b), and Convention scan (2c) by Searchers; each has a Reviewer verdict. Step 2d aggregates coverage via a standalone Reviewer.
• Step 3 — Review: runs in parallel sub-phases 3a (L1+L2 syntax/naming), 3b (L3 integration/security), 3c (L4+L5 perf/a11y/UX); each ends with a Reviewer aggregation verdict.
• Step 4 — Findings synthesis: parallel sub-steps 4a (Critical findings), 4b (Important findings), 4c (Suggestions/memory), with a Reviewer verifying each. Step 4d (Memory feedback) curates anti-patterns after the audit file is written.
• Step 5 — Severity reconciliation: Reviewer consolidates severity labels from Step 3.
• Step 6 — Fix gate: uses AskUserQuestion to decide applying fixes; on Yes, triggers /hyperflow:plan with findings as the spec, then chains to /hyperflow:dispatch.

When to use it

• Trigger with /hyperflow:audit, or phrases like "review this change", "review my PR", "audit the diff", or "code review".
• Default input targets: a file path, line range, commit SHA, branch, or PR number. Default target behavior uses git diff HEAD and git diff --staged when no target is provided.

What it can touch

• Tools: Read, Write, Edit, Bash(git:*), Glob, Grep, Agent, Skill, AskUserQuestion are declared as allowed-tools.
• The workflow involves running Searchers and Reviewers across file groups, surface mappings, semantic indices, conventions, and various domain specialists. The orchestrator and safety reviewers coordinate findings and aggregation.

Caveats

• Failure recovery follows canonical policy; if a Reviewer fails at L1/L2, escalation to L3+ Reviewer occurs rather than aborting.
• Security violations in Step 3b trigger an immediate halt, surface the finding, and skip the fix gate.
• The fix application is gated by a user decision (Yes) to apply findings via /hyperflow:plan.