IMPLEMENTAUDIT
On this page
  1. Repository changes with an evidence trail
  2. Proportional discipline
  3. The contract lives on disk
  4. What it is not
  5. v0.3.3.3 countermeasures
  6. What it does not authorize
  7. Not automatic proof
  8. Allowed vs separate
  9. Not ungated autonomy
  10. Stop or hand off
  11. Reader promise
  12. Source surfaces
Overview

What it is

IMPLEMENTAUDIT is a Claude Code and Codex skill for making repository changes with a durable evidence trail.

Repository changes with an evidence trail

IMPLEMENTAUDIT helps Claude Code or Codex make repository changes that leave evidence behind.
It makes the agent plan, inspect real files, run before/after checks, stop on failures, and close with an audit.
Formal name: implementation with audit gates (audit-governed implementation).

It is reusable meta-engineering packaged as IMPLEMENTAUDIT.skill: a method for sustained planning, design, implementation, improvement, review, recovery, integration, and closure, not only a one-off code audit.
A skill or agent-tooling repository can itself be the audit object, so the same owner/source and evidence gates can govern skills-about-skills.

This repository demonstrates that self-application here; it does not prove effectiveness across every agent, host, repository, or external ecosystem.
In this project, .skill names the release asset and import layout, not a universal host standard.

The key move is simple: the conversation carries only a short instruction, while the real contract lives in a durable work record on disk.
For phased or larger work, that record is organized inside a run folder.

Proportional discipline

Small reversible work can stay compact.
Deeper planning, durable run state, independent review, package checks, or external readback activate only when scope, risk, dependencies, or the claimed evidence surface warrant them.

Process volume is not engineering value.
The method asks which consumer and consequence a control protects, and keeps, cheapens, merges, conditions, retires, or reclassifies the control on evidence.

The contract lives on disk

Work recordThe request, scope, checks, failures, and closure state are bound before mutation.
Run folderPhased or larger work uses .IMPLEMENTAUDIT/runs/<task-slug>-<id>/ as the inspectable home for the run.
STATE.mdRecords status, phase cursor, decisions, failure rows, and closure state.
Phase checklistPhase specs define bounded work, acceptance criteria, evidence, and rollback or defer paths.
Evidence surfacesBefore/after checks, failure log, final audit ledger, and transcript markers preserve review evidence.

What it is not

Not this

  • a framework, server, or build runner
  • proof that a host loaded the skill
  • a permission to commit, push, tag, release, publish, or claim provenance
  • a promise that optional sidecars exist in every consuming repo

It does this

  • keeps work bounded by a work record, and by a run folder for phased work
  • forces before/after checks before claiming success
  • records failure handling instead of hiding retries
  • requires final audit completion or an honest handoff

v0.3.3.3 countermeasures

The corrective release collects native capabilities under public identity v0.3.3.3 while the plugin/runtime version remains 0.3.3.
The first publication preceded the final R29 correction and remains superseded history. The final same-identity candidate is locally qualified; in-place replacement and independent public download/temporary-install readback remain pending.

R30 / #157 helper reachabilityA shipped helper must be instruction-reachable, same-run dispatchable, packaged, and negatively tested before another control can depend on it.
#144 scoped Graphify terrainThe bounded catalogue is deterministic llm: false, selects the smallest qualified graph, and fails closed to live files. It is partial adoption, not Luna or semantic qualification.
R31 / #158 issue work ordersMaterial findings become cold-executor-ready work orders with multi-draft reconciliation. The owner accepted seven PASS and one PARTIAL work order; the partial omitted an explicit R29 invocation.
R34 / #163 engineering valueControls need a named consumer and consequence. Materially ambiguous mechanisms may use informationally independent hypothesis lanes, distinct from adversarial review; deterministic and known-candidate work stays cheap.
R35 / #164 evaluator integrityIt preserves the original witness after evaluator mutation and catches candidate deltas that control the validation policy used to judge them. Path-only and product-only changes remain ordinary.
R32 / #160 optional convergenceAfter a second independently verified same-family rejection, R32 uses R34 only if family classification remains materially ambiguous. Verifying a rejection independently is not forming hypotheses independently.
R33 / #161 package semanticsFootprint repairs preserve owner-backed behaviour and required runtime, checker, installed, generated, and public consumers; smaller bytes alone do not close a package failure.
R29 / #155 public projectionProjection activates only when a material public or release effect, a declared README or public-doc success carrier, and an intended current, complete, or release-final claim all hold. Material representation-dependent claims also need rendered-consumer evidence and governed-detail preservation; ordinary prose stays cheap.

The controls compose without widening their evidence: reachability exposes bounded helpers, convergence responds only to repeated same-family rejection, semantic preservation protects package consumers, and public projection checks the resulting claims.
R36 / #167 is packaged and instruction-reachable in this candidate within its portable governed-writer boundary. It does not claim exclusion against arbitrary non-cooperating same-principal mutation; that stronger guarantee belongs to the target system or security substrate. R28 / #117 remains open and nonblocking; /dashboard/ is excluded.

What it does not authorize

IMPLEMENTAUDIT can plan, inspect, edit, check, stop, and audit within the authorized request.
It does not grant extra authority.

Authorization means a direct owner or user instruction for that action; a plan, CI reference, release note, or deployment pointer is not authorization by itself.

These remain separate gates:

  • commit
  • push
  • tag
  • release
  • publish
  • provenance
  • destructive filesystem mutation
  • host installs, global skills, plugins, sidecars, or backups.

Not automatic proof

  • A run folder is audit substrate, not product deliverable proof.
  • A copied package is not host-load proof.
  • Graphify terrain is orientation, not correctness proof.
  • ActiveGraph may assist fork/diff checkpoints or mirror run-root events; it is not lifecycle authority or correctness proof.
  • A checksum manifest is integrity evidence, not a signature, attestation, SBOM, or provenance chain.

Allowed vs separate

Inside a normal runRead files, patch authorized scope, run checks, and write run evidence.
Separate owner gateCommit, push, tag, release, publish, or claim provenance.
Inside a normal runUse installed helpers from the skill payload.
Separate owner gateInstall host tools, refresh global skills, mutate plugin state, or configure sidecars.
Inside a normal runCite local checksum or package validation as integrity evidence.
Separate owner gateCall that provenance, signature proof, SBOM proof, or host-load proof.

Not ungated autonomy

Natural-language repo-build requests are allowed only through governed casual-build intake.
The skill must synthesize a bounded work record before mutation and reject unsafe, unbounded, or non-repo requests.

Stop or hand off

Stop or hand off for:

  • unsafe scope
  • missing authorization
  • disputed owner/source
  • impossible criteria
  • external dependency
  • irreproducibility
  • missing required access
  • no bounded countermeasure

Reader promise

A reader should be able to tell which actions happened, which were only recommended, and which require separate approval.
If the page cannot show that boundary, it should use weaker language.

Source surfaces

README.md, AGENTS.md, skills/implementaudit/SKILL.md, and skills/implementaudit/references/routing.md.