# Implementation & Code Quality Audit Protocol (`tasks/audit-2.md`)

This protocol defines the standard for auditing code changes, PR branches, or
completed tasks before merging or releasing.

---

## 1. Direct Execution Protocol (When Running the Audit Yourself)

When commanded to **"Run Audit-2 on `[BRANCH / TASK / FILES]`"**:

1. **Remain Strictly Read-Only:** Do not modify code, commit changes, or push to
   remotes during the audit.
2. **Inspect Actual Code Changes:** Compare the modified files against the
   original task specification and `AGENTS.md`.
3. **Score against the 5-Point Implementation Rubric:**
   - **Criterion 1 (Spec & Scope Fidelity):** Built exactly what was requested
     without omitting core features, introducing rogue edits, or degrading
     existing UX.
   - **Criterion 2 (Zero-Trust Security & Boundary Safety):** Scope guards,
     session isolation, and error boundaries are verified. Zero privilege
     escalation risks.
   - **Criterion 3 (Modularity & Clean Architecture):** Clean separation of
     concerns without contributing to file bloat, monolithic sprawl, or circular
     imports.
   - **Criterion 4 (Quality Gates & Test Evidence):** `deno fmt`,
     `deno task lint`, `deno task check`, and `deno test --allow-all` pass with
     0 errors/warnings. Comprehensive test coverage for happy and failure paths.
   - **Criterion 5 (Runtime & Client-Side Integrity):** For UI changes, zero
     runtime JS parsing/syntax errors (validated via `ui/ui_scripts.test.ts`),
     accessible layout, and consistent styling tokens.
4. **Output the Standard Code Audit Report:**
   - **Overall Implementation Score:** [e.g. 5/5, 4/5, or Letter Grade]
   - **Verdict:** [MERGE READY / REVISION REQUIRED / BLOCKED]
   - **Successes & Verified Achievements:** Verified working features with
     evidence.
   - **Deficiencies, Regressions & Failure Risks:** Bugs, unhandled errors, UX
     regressions, or security gaps found.
   - **Actionable Remediation Suggestions:** Specific, prioritized code changes
     needed before release.

---

## 2. Dispatch Template (When Preparing a Prompt for Jules or External Agents)

When commanded to **"Prepare an Audit-2 prompt for Jules"**, fill in and provide
the following block:

```text
**Role:** Act as a Senior Security, Architecture & Quality Assurance Auditor. Do not modify production code or push commits during this audit session. Your sole deliverable is an objective Code Quality & Security Audit Report.

**The Scope:** [Specify target branch, recent commits, modified files, or task in `tasks/new/TASK_FILENAME.md` or `tasks/complete/TASK_FILENAME.md`].

**Your Task:**
Audit the actual codebase changes against the original task specification and our system guidelines (`AGENTS.md`, `docs/`) using the 5-point implementation rubric in `tasks/audit-2.md`:
1. Specification & Scope Fidelity
2. Zero-Trust Security & Boundary Safety
3. Modularity & Clean Architecture
4. Quality Gates & Test Evidence
5. Runtime & Client-Side Integrity

**Deliverable:**
Provide a structured code audit report with:
- **Overall Implementation Score:** [e.g. 5/5, 4/5, or Letter Grade]
- **Verdict:** [MERGE READY / REVISION REQUIRED / BLOCKED]
- **Successes & Verified Achievements:** Exact functionality verified and working as expected.
- **Deficiencies, Regressions & Failure Risks:** Technical bugs, unhandled errors, UX regressions, or security gaps found.
- **Actionable Remediation Suggestions:** Specific, prioritized code fixes or refactoring steps needed before final approval.
```