Audit Sprint

Purpose

Security and quality audit of sprint implementation as the Paranoid Cypherpunk Auditor. Final gate before sprint completion. Runs AFTER senior lead approval.

Invocation

/audit-sprint sprint-1
/audit-sprint sprint-1 background

Agent

Launches auditing-security from skills/auditing-security/.

See: skills/auditing-security/SKILL.md for full workflow details.

Prerequisites

Sprint tasks implemented (/implement)
Senior lead approved with "All good" (/review-sprint)
Not already completed (no COMPLETED marker)

Workflow

Pre-flight: Validate sprint ID, verify senior approval
Context Loading: Read PRD, SDD, sprint plan, implementation report
Code Audit: Read actual code files for security review
Security Checklist: OWASP Top 10, secrets, auth, input validation
Decision: Approve or require changes
Output: Write audit feedback or approval
Completion: Create COMPLETED marker on approval
Analytics: Update usage metrics (THJ users only)

Arguments

Argument	Description	Required
`sprint_id`	Which sprint to audit (e.g., `sprint-1`)	Yes
`background`	Run as subagent for parallel execution	No

Outputs

Path	Description
`grimoires/loa/a2a/{sprint_id}/auditor-sprint-feedback.md`	Audit results
`grimoires/loa/a2a/{sprint_id}/COMPLETED`	Completion marker
`grimoires/loa/a2a/index.md`	Updated sprint status

Decision Outcomes

Approval ("APPROVED - LETS FUCKING GO")

When security audit passes:

Writes approval to auditor-sprint-feedback.md
Creates COMPLETED marker file
Sets sprint status to COMPLETED
Next step: Move to next sprint or deployment

Changes Required ("CHANGES_REQUIRED")

When security issues found:

Writes detailed findings to auditor-sprint-feedback.md
Includes severity (CRITICAL/HIGH/MEDIUM/LOW)
Sets sprint status to AUDIT_CHANGES_REQUIRED
Next step: /implement sprint-N (to fix issues)

Security Checklist

The auditor reviews:

Secrets: No hardcoded credentials, proper env vars
Auth/Authz: Proper access control, no privilege escalation
Input Validation: No injection vulnerabilities
Data Privacy: No PII leaks, proper encryption
API Security: Rate limiting, CORS, validation
Error Handling: No info disclosure, proper logging
Code Quality: No obvious bugs, tested error paths

Error Handling

Error	Cause	Resolution
"Invalid sprint ID"	Wrong format	Use `sprint-N` format
"Sprint directory not found"	No A2A dir	Run `/implement` first
"No implementation report found"	Missing reviewer.md	Run `/implement` first
"Sprint has not been reviewed"	Missing engineer-feedback.md	Run `/review-sprint` first
"Sprint has not been approved"	No "All good"	Get senior approval first
"Sprint is already COMPLETED"	COMPLETED marker exists	No audit needed

Feedback Loop

/audit-sprint sprint-N
      ↓
[Security audit]
      ↓
CHANGES_REQUIRED          APPROVED
      ↓                       ↓
/implement sprint-N    [COMPLETED marker]
      ↓                       ↓
/audit-sprint sprint-N   Next sprint

Sprint Ledger Integration

When a Sprint Ledger exists (grimoires/loa/ledger.json):

ID Resolution: Resolves sprint-1 (local) to global ID (e.g., 3)
Directory Mapping: Uses a2a/sprint-3/ instead of a2a/sprint-1/
Status Update: Sets sprint status to completed in ledger on approval
Consistent Paths: All file operations use resolved global ID

Example Resolution

# In cycle-002, sprint-1 maps to global sprint-3
/audit-sprint sprint-1
# → Resolving sprint-1 to global sprint-3
# → Reading: grimoires/loa/a2a/sprint-3/engineer-feedback.md
# → Writing: grimoires/loa/a2a/sprint-3/auditor-sprint-feedback.md
# → Creating: grimoires/loa/a2a/sprint-3/COMPLETED
# → Updating ledger: sprint-3 status = completed

Legacy Mode

Without a ledger, sprint IDs are used directly (sprint-1 → a2a/sprint-1/).

beads_rust Integration

When beads_rust is installed, the agent records security audit results:

Session Start: br sync --import-only to import latest state
Record Audit: br comments add <task-id> "SECURITY AUDIT: [verdict] - [summary]"
Mark Status: br label add <task-id> security-approved or security-blocked
Session End: br sync --flush-only before commit

Protocol Reference: See .claude/protocols/beads-integration.md

audit-sprint

details