SuperAPI AI Directory

audit-verify

Security & auditing

View repository

Updated 10-23 23:07

About this skill

Your objective is to implement $audit verify [--full].

Before proceeding, verify that .cocoplus/ exists. If not, output: "CocoPlus not initialized in this directory. Run $pod init to begin." Then stop.

Contract

Read .cocoplus/audit/, lifecycle audit records, and contract proof artifacts. Validate append-only ordering, required fields, timestamp presence, actor/source provenance, and hash-chain continuity when hashes are present.

With --full, also re-check CocoContract proof artifacts and report whether archived falsifiability checks remain reproducible from committed inputs.

Output:

  • Verified artifact count
  • Broken or missing links
  • Contract proof status
  • Highest-severity finding
  • Recommended next command

Exit Criteria

  • Missing audit artifacts produce an explicit "no audit artifacts found" result.
  • Hash or ordering failures are reported as deterministic audit failures.
  • Contract proof drift is distinguished from missing proof.
  • The command never repairs audit history silently.

Anti-Rationalization

Shortcut / Temptation Why It Fails
Treat the skill as complete because the file exists Skill contracts must describe observable behavior and verification, not just command names.
Skip artifact and safety checks for a small command Small commands still mutate state or guide execution; preserve the same gates.