godpowers 3.11.0 → 3.13.0

package/CHANGELOG.md

@@ -7,6 +7,60 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.13.0] - 2026-06-16
+
+### Changed
+- The default greenfield workflow (`full-arc`, run by `/god-mode`) now runs two
+  more steps so the one-shot product ships audited and documented. A `code-audit`
+  job (`god-debt-assessor`) runs after the build and before deploy/harden, giving
+  the whole AI-generated codebase a scored audit that catches what the per-slice
+  reviews could not see across files. A `docs` job (`god-docs-writer`) runs after
+  harden and before launch, writing the project documentation and verifying every
+  claim against the code (drift detected) before the product ships. `deploy` and
+  `harden` now need `code-audit`; `launch` now needs `docs`. The plan goes from
+  11 to 13 steps. No new skill, agent, workflow, or recipe surface: both jobs
+  reuse agents that already exist.
+- `GOD-ORCHESTRATOR-RUNBOOK` documents the new audit and docs positions in the
+  greenfield arc.
+
+## [3.12.1] - 2026-06-16
+
+### Changed
+- De-duplicated the audit lanes in `god-debt-assessor`. Its Security dimension
+  now defers to `god-harden-auditor`: when `.godpowers/harden/FINDINGS.md`
+  exists, score Security from harden's verdict and cite its finding IDs instead
+  of re-running the OWASP walkthrough, recording a security finding only for
+  something harden did not cover. Its Code Quality dimension is explicitly the
+  whole-repo point-in-time read that complements, not duplicates,
+  `god-quality-reviewer`'s per-slice diff review.
+
+## [3.12.0] - 2026-06-16
+
+### Changed
+- Upgraded `god-debt-assessor` (`/god-tech-debt`) to a codeauditor-grade,
+  read-only source-code audit: nine weighted dimensions scored 0-100 with grade
+  bands and risk-capping, per-finding Severity/Confidence/Effort, adversarial
+  verification with Suspected marking, paper-construct/theater hunting,
+  root-not-leaves systemic clustering, a strengths-to-preserve section,
+  calibration to maturity, a file:line + substitution evidence gate, and a
+  self-contained "how to use this report" protocol for an acting agent. Keeps
+  Godpowers' broader operational/knowledge debt categories as extra lenses.
+  Output stays `.godpowers/tech-debt/REPORT.md`.
+
+### Added
+- Added the audit-remediation loop: a new `audit-remediate` recipe routes
+  "audit and fix until clean" intent, and a `GOD-ORCHESTRATOR-RUNBOOK` section
+  defines the bounded drive-to-zero loop (audit, select worst-first, fix with
+  `god-debugger`, verify with an independent reviewer, bound the retries with
+  `evidence.outcome`, re-audit until no Confirmed Critical/High remains). The
+  can't-fake-done gate makes "clean" an evidence-backed re-audit; un-fixable
+  findings pause as precise blockers instead of silent skips.
+
+### Notes
+- No new skill or agent (god-debt-assessor enhanced in place). Recipe surface
+  count moves 43 to 44. The audit-remediation loop is opt-in (intent/recipe or
+  an end-of-arc pass); it is not wired into the default greenfield `full-arc`.
+
 ## [3.11.0] - 2026-06-15
 
 ### Added

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/aihxp/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/aihxp/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-3.11.0-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-3.13.0-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**
@@ -30,13 +30,21 @@ Godpowers makes AI coding accountable: every serious run should leave disk
 state, artifacts, validation gates, host guarantees, and a next action. Code is
 only one output. The project memory and proof trail matter too.
 
-Version 3.11.0 adds the optional one-time `.mythify/` ledger importer (`npx
-godpowers import-ledger`), the final piece of the native fusion of Mythify's
-evidence engine and quarterback into Godpowers. The fusion is now complete end
-to end: the evidence producer, enforced close-on-evidence on the build and
-harden gates, the quarterback entry router, the work report, reflections,
-memory, lessons, outcome loops, the read-only MCP tools, and now a path to bring
-existing Mythify ledgers along. The current 3.x line keeps
+Version 3.13.0 makes the default greenfield arc (`/god-mode`) miss less. The
+one-shot `full-arc` workflow now runs a whole-codebase code audit after the
+build (so it catches what the per-slice reviews missed in AI-generated code) and
+a documentation pass after harden (so the shipped product has docs verified
+against the code, not vibes). The arc goes build, code-audit, deploy, observe,
+harden, docs, launch, final-sync: per-slice review, whole-codebase audit plus
+remediation, a security gate, and verified docs before launch. This builds on
+3.12.x, which made that code audit codeauditor-grade: `god-debt-assessor`
+(`/god-tech-debt`) produces a scored, prioritized, self-contained source-code
+audit across nine weighted dimensions, and the `audit-remediate` recipe drives
+the findings to zero (audit, fix worst-first with an independent reviewer,
+re-audit, bounded by an outcome budget, with the can't-fake-done gate ensuring
+"clean" is evidence-backed). It all sits on top of the completed Mythify fusion
+(the evidence producer, enforced close-on-evidence, the quarterback, work report,
+reflections, memory, lessons, outcome loops, MCP read tools, and ledger importer). The current 3.x line keeps
 the omitted installer profile on `core`, keeps first-run, demo, and
 surface-control entry points, preserves `--profile=full` for compatibility,
 keeps locate and lifecycle views under `/god-status`, ships the optional
@@ -321,14 +329,14 @@ dependency to the main `godpowers` package:
 
 ```bash
 npx godpowers mcp-info --project=.
-npx -y -p godpowers@3.11.0 -p @godpowers/mcp@3.11.0 godpowers-mcp serve --project=.
+npx -y -p godpowers@3.13.0 -p @godpowers/mcp@3.13.0 godpowers-mcp serve --project=.
 ```
 
 The companion exposes `status`, `next`, `gate_check`, `lint_artifact`, and
 `trace_requirement`. Host registration is opt-in:
 
 ```bash
-npx -y -p godpowers@3.11.0 -p @godpowers/mcp@3.11.0 godpowers-mcp setup --host=codex --project=. --write
+npx -y -p godpowers@3.13.0 -p @godpowers/mcp@3.13.0 godpowers-mcp setup --host=codex --project=. --write
 ```
 
 See [MCP Companion](docs/mcp.md) for package boundaries and setup details.

package/RELEASE.md

@@ -1,41 +1,41 @@
-# Godpowers 3.11.0 Release
+# Godpowers 3.13.0 Release
 
 > Status: Prepared
-> Date: 2026-06-15
+> Date: 2026-06-16
 
-[DECISION] Godpowers 3.11.0 adds the optional one-time `.mythify/` ledger importer, the final item in the fusion design. With it, the native fusion of Mythify's evidence engine and quarterback into Godpowers (Phases 0-3 plus the optional importer) is complete.
-[DECISION] The importer is optional, one-time, and additive: it appends imported records to the Godpowers ledger and does not roll up into `state.json` or emit gate events. No existing command behavior changes.
-[DECISION] This release keeps `core` as the omitted installer profile, keeps `--profile=full` as the complete compatibility surface, and keeps the 3.1.0-3.10.0 evidence, close-gate, quarterback, work-report, reflections, memory, lessons, outcome, and MCP surface.
+[DECISION] Godpowers 3.13.0 is a minor release that hardens the default greenfield arc. The one-shot `full-arc` workflow run by `/god-mode` now audits the whole codebase after the build and writes verified documentation after harden, so a long-running idea-to-production run ships audited and documented without a separate manual pass.
+[DECISION] No new skill, agent, workflow, or recipe surface is added: both new steps reuse existing agents (`god-debt-assessor`, `god-docs-writer`). Surface counts are unchanged from 3.12.1.
+[DECISION] This release keeps `core` as the omitted installer profile, keeps `--profile=full` as the complete compatibility surface, and keeps the full 3.1.0-3.12.1 surface (fusion + codeauditor-grade audit + remediation loop).
 
 ## What's in this release
 
-- [DECISION] New `lib/evidence-import.js` and `npx godpowers import-ledger [--from <path>]`.
-- [DECISION] It copies an existing Mythify `.mythify/` ledger into `.godpowers/ledger/`: verifications (rebinding plan/step_id/step_title/step_status to arc/substep/substep_status), reflections, memory (merged by key), lessons (lessons/*.json to lessons.jsonl), and outcomes (goal.json + iterations.jsonl per slug).
-- [DECISION] Records are appended; the import does not roll up into `state.json` or emit gate events.
-- [DECISION] 120 slash commands, 40 specialist agents, 13 executable workflows, 43 intent recipes, and the 3.1.0-3.10.0 evidence, close-gate, quarterback, work-report, reflections, memory, lessons, outcome, and eight-tool MCP surface remain available.
+- [DECISION] `full-arc` gains a `code-audit` job (`god-debt-assessor`, `mode: post-build-audit`) that runs after `build` and before `deploy`/`harden`. It gives the whole AI-generated codebase a scored, prioritized audit that catches issues the per-slice `god-spec-reviewer` + `god-quality-reviewer` reviews cannot see across files.
+- [DECISION] `full-arc` gains a `docs` job (`god-docs-writer`, `mode: product-docs-verify`) that runs after `harden` and before `launch`. It writes the project documentation and verifies every claim against the code (drift detected) before the product ships.
+- [DECISION] Dependencies were rewired: `deploy` and `harden` now `need` `code-audit`; `launch` now `needs` `docs`. The greenfield arc is build, code-audit, deploy, observe, harden, docs, launch, final-sync. The `full-arc` plan goes from 11 to 13 steps.
+- [DECISION] `GOD-ORCHESTRATOR-RUNBOOK` documents the audit and docs positions in the greenfield arc.
+- [DECISION] 120 slash commands, 40 specialist agents, 13 executable workflows, 44 intent recipes, and the full fusion + audit surface remain available.
 
 ## Changes
 
-- [DECISION] `package.json`, `package-lock.json`, and `packages/mcp/package.json` now publish the 3.11.0 minor version.
-- [DECISION] CHANGELOG, RELEASE notes, README, roadmap, reference, architecture, and the SECURITY supported-version series now describe the 3.11.0 importer and the completed fusion.
+- [DECISION] `package.json`, `package-lock.json`, and `packages/mcp/package.json` now publish the 3.13.0 version.
+- [DECISION] `workflows/full-arc.yaml` adds the `code-audit` and `docs` jobs and rewires `deploy`/`harden`/`launch` dependencies. No lib change.
+- [DECISION] CHANGELOG, RELEASE notes, README, roadmap, reference, architecture, and the MCP docs now reflect 3.13.0. SECURITY supported-version table adds the `3.13.x` row and moves `3.12.x` to security fixes only.
 
 ## Validation
 
-- [DECISION] `npm run lint` passed with 29 static checks.
-- [DECISION] `node scripts/test-evidence-import.js` passed with 4 importer tests, including the plan/step to arc/substep rebind.
-- [DECISION] `node scripts/test-cli-dispatch.js` passed with 48 CLI dispatch tests, including the new `import-ledger` tests.
-- [DECISION] `npm run release:check` passed `coverage:lib` above the 90 percent line floor for `lib/**/*.js` (evidence-import.js at 97 percent lines).
+- [DECISION] `npm run lint` passed with 29 static checks (agent contract + size + refs intact).
+- [DECISION] `node tests/integration/full-arc.test.js`, `node scripts/test-workflow-runner.js`, and `node scripts/test-agent-refs.js` passed: `full-arc` plans to 13 steps with a valid DAG and both `god-debt-assessor` and `god-docs-writer` are real agents.
+- [DECISION] `npm run release:check` passed `coverage:lib` above the 90 percent line floor for `lib/**/*.js`.
 - [DECISION] `npm run release:check` passed `npm audit --omit=dev` with 0 vulnerabilities.
-- [DECISION] `npm run release:check` passed public surface docs for version 3.11.0 with 120 skills, 40 agents, 13 workflows, and 43 recipes.
+- [DECISION] `npm run release:check` passed public surface docs for version 3.13.0 with 120 skills, 40 agents, 13 workflows, and 44 recipes.
 - [DECISION] `npm run release:check` passed root and `@godpowers/mcp` package contents.
 
 ## Upgrade
 
-- [DECISION] Use `npm install -g godpowers@3.11.0` or `npx godpowers@3.11.0`.
-- [DECISION] No migration is required. The importer is optional and additive; no other behavior changed.
+- [DECISION] Use `npm install -g godpowers@3.13.0` or `npx godpowers@3.13.0`.
+- [DECISION] No migration is required. Existing projects are unaffected; the change only adds steps to the greenfield one-shot arc, which now takes longer in exchange for an audited and documented product.
 
 ## Notes
 
-- [DECISION] The publish targets are npm `godpowers@3.11.0`, npm `@godpowers/mcp@3.11.0`, and GitHub release `https://github.com/aihxp/godpowers/releases/tag/v3.11.0`.
-- [DECISION] The tag-triggered GitHub publish workflow remains the preferred npm path because it publishes with provenance.
-- [DECISION] This is the final planned release of the fusion design. Every phase (0-3) and the optional importer are implemented and shipped to main across 3.1.0-3.11.0.
+- [DECISION] The publish targets are npm `godpowers@3.13.0`, npm `@godpowers/mcp@3.13.0`, and GitHub release `https://github.com/aihxp/godpowers/releases/tag/v3.13.0`.
+- [DECISION] The tag-triggered GitHub publish workflow remains the preferred npm path because it publishes with provenance. This release has not been tagged or published to npm yet.

package/agents/god-debt-assessor.md

@@ -3,7 +3,8 @@ name: god-debt-assessor
 description: |
   Assess and prioritize technical debt in an existing codebase. Categorizes
   by type (code, design, dependency, security, test, doc), estimates cost
-  to fix, ranks by priority. Outputs prioritized remediation plan.
+  to fix, ranks by priority. Outputs a scored, prioritized, self-contained
+  remediation plan.
 
   Spawned by: /god-tech-debt, brownfield-arc workflow
 tools: Read, Bash, Grep, Glob, WebSearch
@@ -22,122 +23,201 @@ handoff:
 
 # God Debt Assessor
 
-Tech debt is real. Classify it, prioritize it, plan remediation.
+Tech debt is real. Classify it, prioritize it, plan remediation. This is a
+**read-only** code audit: read the code, score it, and write a self-contained
+report. Do not edit source. Remediation is a separate, gated step (god-debugger
+and the orchestrator audit-remediation loop) that consumes this report.
 
 ## When to use
 
 - Before /god-upgrade or /god-refactor on legacy code
 - Quarterly health check on a brownfield project
 - After /god-archaeology surfaced concerns
+- As the end-of-arc audit before a remediation loop drives findings to zero
 - Before promising a feature that might require debt paydown first
 
-## Categories
-
-| Category | Examples |
-|----------|----------|
-| **Code debt** | TODO/FIXME comments, dead code, copy-paste, complex functions |
-| **Design debt** | Wrong abstractions, missing abstractions, architectural drift |
-| **Dependency debt** | Outdated packages, deprecated libraries, security CVEs |
-| **Test debt** | Missing tests, flaky tests, slow tests, low coverage |
-| **Doc debt** | Stale docs, missing API docs, drift from code |
-| **Security debt** | Known vulnerabilities, weak auth, missing validation |
-| **Operational debt** | Manual deploys, missing runbooks, paper SLOs |
-| **Knowledge debt** | Tribal knowledge with no docs, single point of failure people |
+## Operating principles (non-negotiable)
+
+1. **Evidence over assertion.** No claim without a concrete `file:line`. Apply
+   the substitution test to every finding: if the same sentence would read true
+   for a different repo, it is filler. "Error handling is weak" fails;
+   "`api/users.ts:88` returns 200 on a validation failure so callers cannot
+   detect bad input" passes.
+2. **Verify against reality.** Read the code, not the names, comments, or docs.
+   When a doc or comment claims one thing and the code does another, that gap is
+   itself a finding.
+3. **Refuse theater. Hunt paper constructs.** The most dangerous defects look
+   robust but carry no weight: a try/catch that swallows the error, a validator
+   defined but never called, middleware registered but not applied to the routes
+   it should guard, a test that asserts nothing, a health check that returns 200
+   without checking a dependency, a rate limiter that does not limit. Flag
+   anything that exists for appearance but does not do its job.
+4. **Find the root, not the leaves.** If one mistake appears in twelve places,
+   that is one systemic finding, not twelve. Cluster instances; name the cause.
+5. **Verify adversarially.** For every candidate finding, try to refute it
+   before keeping it (is there a guard, a test, a deliberate trade-off?). If you
+   cannot confirm by reading, mark it Suspected so the acting agent re-checks.
+6. **Calibrate to the project.** Grade against the project's evident ambition
+   and maturity, not an absolute ideal. State your calibration.
+7. **Name the strengths.** Record what the codebase does well, with evidence,
+   so remediation does not refactor those away.
+
+## Dimensions (score each 0-100, weighted)
+
+The debt categories map onto nine scored dimensions. Score each against its
+findings, with a one-line justification. No number without a reason.
+
+| Dimension | Weight | Covers (debt categories) |
+|---|---|---|
+| Security | 20% | security debt: authn/authz, injection, secrets, crypto, exposure, paper trust boundaries, LLM/tool surfaces |
+| Architecture and Design | 15% | design debt: boundaries, coupling, cohesion, abstraction fit, drift |
+| Code Quality and Maintainability | 15% | code debt: complexity, size, duplication, naming, dead code, magic values, TODO/FIXME/HACK markers, type-safety escape hatches |
+| Testing and Verification | 15% | test debt: critical-path coverage, assertion quality, determinism, tests that never run |
+| Error Handling and Resilience | 10% | swallowed errors, lost context, I/O timeouts/retries, transactional integrity, resource cleanup |
+| Performance and Efficiency | 8% | algorithmic hot paths, N+1, caching, blocking work, memory (mark Suspected without a profiler) |
+| Dependencies and Supply Chain | 7% | dependency debt: CVEs, staleness, deprecated APIs, bloat, pinning, licensing |
+| Documentation and Drift | 5% | doc debt: README/API accuracy, phantom/missing docs, stale comments |
+| Observability and Operability | 5% | operational debt: logging, metrics/tracing, paper health checks, config/secrets, deployability |
+
+Carry Godpowers' extra lenses where they apply: **operational debt** (manual
+deploys, missing runbooks, paper SLOs) folds into Observability; **knowledge
+debt** (tribal knowledge, single-points-of-failure people) is reported as a
+systemic note.
+
+### Lane discipline (do not re-derive what another auditor owns)
+
+This audit is the **point-in-time, whole-repo** read. Two dimensions overlap
+other auditors; defer to them rather than duplicate their work:
+
+- **Security** is owned by `god-harden-auditor` (the gating OWASP walkthrough at
+  `.godpowers/harden/FINDINGS.md`). When that file exists, score the Security
+  dimension from its verdict and **cite its finding IDs** (for example
+  "Security 72 - see harden CRITICAL-001/002") instead of re-running the
+  walkthrough. Record a Security finding here only for something harden did not
+  cover, and tag it for harden to re-check. If FINDINGS.md is absent, do a
+  lightweight security read and say so plainly - it is not a substitute for
+  `/god-harden`.
+- **Code Quality** at the *diff* level is owned by `god-quality-reviewer` during
+  build. This dimension is the *whole-codebase* health read: report systemic
+  quality debt, not a line-by-line review of recent changes, and point to the
+  reviewer for per-slice concerns.
+
+Bands: 90-100 A, 80-89 B, 70-79 C, 60-69 D, 0-59 F. Risk does not average away:
+one Confirmed Critical caps its dimension at 69 and the overall at 79 until
+resolved.
 
 ## Process
 
-### 1. Inventory
-
-Walk the codebase looking for indicators per category:
-- Code: grep TODO/FIXME/HACK; cyclomatic complexity; duplicate code; long functions
-- Design: god classes; circular dependencies; mixed concerns
-- Dependency: `npm audit` / equivalent; date of last update; deprecation warnings
-- Test: coverage report; tests marked .skip; flaky test history; CI duration
-- Doc: comments referencing old code; README age; broken links
-- Security: SAST findings; missing input validation; hardcoded secrets
-- Operational: manual steps in deploy; runbooks not updated; alerts without runbooks
-- Knowledge: single contributors to critical code; no comments on complex algorithms
-
-### 2. Estimate cost to fix
-
-Per debt item, classify:
-- **S (small)**: <1 day, no behavior change
-- **M (medium)**: 1-3 days, possibly small behavior change
-- **L (large)**: 1-2 weeks, requires planning
-- **XL**: weeks-months, requires migration
-
-### 3. Estimate impact of NOT fixing
-
-Per item:
-- **HIGH**: blocks a planned feature, security risk, customer pain
-- **MEDIUM**: slows team, occasional bugs, maintenance burden
-- **LOW**: cosmetic, no observable impact
-
-### 4. Prioritize
-
-Priority = Impact × (1 / Cost). High-impact + small cost = top of list.
-
-| Priority | Definition |
-|----------|-----------|
-| **P0** | High impact + S/M cost. Do this sprint. |
-| **P1** | High impact + L cost OR Medium impact + S cost. Do this quarter. |
-| **P2** | Medium impact + M cost. Do when convenient. |
-| **P3** | Low impact OR XL cost without clear benefit. Backlog or ignore. |
+### 1. Orient and map
+Detect languages/frameworks/build system from manifests; measure size and decide
+exhaustive vs sampled (declare which). Locate entry points. Read the README to
+learn intended behavior and maturity. Trace two or three primary flows end to
+end. Record exclusions (vendored, generated, build output) and the commit/branch.
+
+### 2. Inventory across every dimension
+Use search to find candidates, then **read the cited code to confirm** before
+recording. A search hit is a lead, not a finding. Per dimension's indicators:
+- Code: grep TODO/FIXME/HACK; complexity; duplication; long functions; dead code
+- Design: god files; circular deps; mixed concerns; structure-vs-docs drift
+- Security: read `.godpowers/harden/FINDINGS.md` first and cite it; only if it
+  is absent, do a lightweight read for untrusted input into queries/shell/paths/
+  HTML, secrets, weak crypto, and declared-but-unenforced guards
+- Test: critical-path coverage; assertion-free or over-mocked tests; `.skip`
+- Dependency: `npm audit` / equivalent; staleness; deprecations; pinning
+- Error handling: empty catches; lost cause; missing timeouts; partial commits
+- Performance: nested loops on large inputs; N+1; sync I/O on hot paths
+- Docs: setup steps vs scripts; documented endpoints that do not exist
+- Observability: structured logging; real vs paper health checks; config/secrets
+
+### 3. Verify adversarially and cluster
+Try to refute each candidate. Assign **Severity** (Critical/High/Medium/Low),
+**Confidence** (Confirmed/Likely/Suspected), and **Effort** (S under 1 day /
+M 1-3 days / L 1-2 weeks / XL weeks). Cluster repeated instances into one
+systemic finding, keeping the member IDs.
+
+### 4. Score and prioritize
+Score each dimension 0-100 with its justification; the overall is the weighted
+average with risk-capping. Bucket findings: **Quick wins** (High/Critical,
+Confirmed, S), **Plan now** (High/Critical, M or L), **Verify first** (any
+Suspected), **Backlog** (Low). Map to P0-P3: P0 = High impact + S/M; P1 = High
+impact + L or Medium + S; P2 = Medium + M; P3 = Low or XL without clear benefit.
 
 ### 5. Output
 
-Write `.godpowers/tech-debt/REPORT.md`:
+Write `.godpowers/tech-debt/REPORT.md`, self-contained for an acting agent with
+no memory of the audit:
 
 ```markdown
-# Tech Debt Assessment
-
-Date: [ISO 8601]
-Scope: [path or "entire codebase"]
-
-## Summary
-
-| Category | P0 | P1 | P2 | P3 | Total |
-|----------|----|----|----|----|-------|
-| Code | 3 | 5 | 12 | 8 | 28 |
-| Design | 1 | 2 | 4 | 1 | 8 |
-| Dependency | 0 | 1 | 3 | 7 | 11 |
-| ... | | | | | |
-
-Estimated debt: [N] person-weeks total
-P0+P1 paydown: [N] weeks (recommended next 1-2 sprints)
-
-## P0 - Do this sprint
-
-| ID | Category | Description | Cost | Impact | Recommendation |
-|----|----------|-------------|------|--------|----------------|
-| D-001 | Security | SQL injection in /api/search | S | HIGH | Fix immediately; route to /god-hotfix |
-| D-002 | Test | Auth module has 0% coverage | M | HIGH | Add tests via /god-add-tests before any auth changes |
-| D-003 | Operational | Deploy script has manual step | S | MEDIUM | Automate; route to /god-deploy revisit |
-
-## P1 - Do this quarter
-
-[Same structure]
-
-## P2 - When convenient
-
-[Same structure]
-
-## P3 - Backlog or ignore
-
-[Same structure; explanation if "ignore"]
-
-## Recommended next steps
-
-1. [Specific action with command, e.g., /god-hotfix for D-001]
-2. [Specific action]
+# Code Audit and Tech Debt Assessment
+
+Date: [ISO 8601] | Scope: [path or "entire codebase"] | State: [commit/branch]
+Read-only audit. Self-contained: every finding cites file:line and how to verify.
+
+## Snapshot
+Languages, size, frameworks, entry points, evident maturity, coverage
+(exhaustive or sampled, say what was sampled), exclusions.
+
+## Overall score
+NN/100 - Grade X (label). Two-to-four sentence verdict. One-line calibration.
+
+| Dimension | Score | Grade | Weight | Verdict |
+|---|---|---|---|---|
+| Security | NN | X | 20% | one-line specific verdict |
+| ... | | | | |
+| Overall | NN | X | 100% | weighted |
+
+## What to fix first
+Ordered union of Quick wins + Plan now, Critical before High.
+`[ID] title - severity, effort - one-line why`
+
+## Strengths (preserve these)
+What the codebase does well, each with evidence. Do not refactor these away.
+
+## Systemic patterns (root causes)
+One entry per recurring cause: what it is, member IDs, the one root fix.
+
+## Findings
+Sorted by severity then dimension. Each finding:
+
+### [SEC-001] <title>
+- Severity: <C/H/M/L> | Confidence: <Confirmed/Likely/Suspected> | Effort: <S/M/L/XL> | Dimension: <name>
+- Location: `file:line` (+ others)
+- Evidence: <what the code does now, precisely>
+- Impact: <concrete consequence>
+- Recommendation: <specific change and where; not a platitude>
+- Verify the fix: <test to add / behavior to check / command to run>
+- Related: <systemic pattern or finding IDs, or "none">
+
+## Remediation plan
+Quick wins / Plan now (suggested order) / Verify first / Backlog, by ID. Map to
+P0-P3. For each P0/P1, name the Godpowers command (for example /god-hotfix,
+/god-debug, /god-add-tests, /god-update-deps).
+
+## Scope and limitations
+What was and was not examined; sampling; assumptions that would change conclusions.
+
+## How to use this report (for the acting agent)
+1. Triage by severity and confidence. Confirmed Critical/High are safe to act on
+   now, in "What to fix first" order. Re-verify any Suspected finding first.
+2. Fix root causes (systemic patterns) before individual leaves.
+3. Preserve the strengths; do not refactor them away.
+4. One finding, one change, verified: run its "Verify the fix" after each fix;
+   keep changes atomic and traceable to the finding ID.
+5. Do not widen scope silently. Re-run the audit to confirm findings are
+   resolved, not relocated, and that no strength regressed.
 ```
 
+ID prefixes by dimension: SEC, ARC, QUAL, TEST, ERR, PERF, DEP, DOC, OBS. Keep
+IDs stable so a remediation loop can track each finding to closure.
+
 ## Have-Nots
 
 Debt assessment FAILS if:
-- All items in one priority bucket (no real prioritization)
-- Cost estimates without rationale
-- Impact estimates without specific consequences ("makes code messy" is not impact)
-- Recommendations without specific commands or workflows
-- "Comprehensive coverage" claim without grep evidence
-- Misses obvious categories (security debt with known CVEs)
+- A dimension score has no justification tied to specific findings
+- Any finding lacks a `file:line`, or a Severity/Confidence/Effort
+- A recommendation is a platitude ("improve error handling", "add more tests")
+- Repeated issues are left loose instead of clustered into a systemic pattern
+- The Strengths section is missing
+- "Comprehensive coverage" is claimed without grep evidence or a stated sample
+- A Critical finding does not cap its dimension and the overall score
+- Obvious categories are missed (security debt with known CVEs)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "godpowers",
-  "version": "3.11.0",
+  "version": "3.13.0",
   "description": "AI-powered development system: 120 slash commands and 40 specialist agents that take a project from raw idea to hardened production. Runs inside Claude Code, Codex, Cursor, Windsurf, Gemini, and 10+ other AI coding tools.",
   "bin": {
     "godpowers": "./bin/install.js"

package/references/orchestration/GOD-ORCHESTRATOR-RUNBOOK.md

@@ -367,6 +367,46 @@ after tests pass. If a git remote exists and the user passed an explicit push
 flag or the project intent says pushing is allowed, push after the green commit
 and then continue the project run. Pushing is not a terminal state.
 
+## Audit-Remediation Loop
+
+Run a bounded audit-then-remediate loop in three cases: the `full-arc`
+**`code-audit` step** (it runs `god-debt-assessor` after build and before the
+shipping tier, because AI-generated code can miss things a per-slice review and
+the security gate do not); intent like "audit and fix until clean" (the
+`audit-remediate` recipe); and any standalone `/god-tech-debt` follow-up. In
+`full-arc` the loop must drive Confirmed Critical and High findings to closure
+(or pause them as blockers) before `deploy`, `harden`, and `launch` proceed. The
+maker that fixes is never the checker that grades.
+
+1. **Audit (read-only).** Spawn `god-debt-assessor` in a fresh context. It writes
+   the scored, self-contained report to `.godpowers/tech-debt/REPORT.md` with
+   stable finding IDs (SEC-001, etc.), each carrying Severity, Confidence, Effort,
+   `file:line`, and a "Verify the fix" step.
+2. **Select.** Take the "What to fix first" list: Confirmed Critical and High,
+   worst-first, root causes (systemic patterns) before leaves. Re-verify any
+   Suspected finding against the cited code before touching it; never act on an
+   unconfirmed claim.
+3. **Drive each finding to closure** with an outcome loop so the loop is bounded
+   and self-arresting:
+   - `npx godpowers outcome start fix-<ID> --verify "<the finding's verify command>" --substep <tier.substep> --project=.`
+   - Spawn `god-debugger` (or the owning specialist) in a fresh context with only
+     that finding's evidence and touched files to draft the fix.
+   - Spawn an **independent** reviewer (`god-quality-reviewer`, or
+     `god-harden-auditor` for a SEC finding) in a fresh context to verify the fix
+     against the cited evidence and the project's tests. The maker does not grade
+     its own work.
+   - `npx godpowers outcome check fix-<ID> --project=.` runs the finding's verify
+     command and records the iteration. Repeat until the outcome succeeds or the
+     budget is exhausted.
+   - Never mark a finding resolved while `can-close` for its substep is red.
+4. **Re-audit.** Re-run `god-debt-assessor` and confirm findings are resolved,
+   not relocated, and that no Strength regressed. The loop is done when no
+   Confirmed Critical or High remains (or the agreed bucket is empty).
+5. **Pause, do not fake.** Anything that cannot be fixed within budget, or that
+   is `human-only` (scope, credentials, vendor/legal/Critical-security
+   acceptance), lands as a precise paused blocker with the finding ID, not a
+   silent skip. "Clean" is an evidence-backed re-audit, never a claim.
+
 ## Shipping Closure Protocol
 
 The shipping tier must not end by listing a broad provider checklist. God Mode

package/routing/recipes/audit-remediate.yaml

@@ -0,0 +1,30 @@
+apiVersion: godpowers/v1
+kind: Recipe
+metadata:
+  name: audit-remediate
+  category: maintaining
+  description: "Audit the codebase, then drive the findings to zero"
+
+triggers:
+  intent-keywords:
+    - "audit and fix"
+    - "fix all the audit findings"
+    - "drive the audit to clean"
+    - "remediate tech debt"
+    - "fix the codebase until clean"
+    - "pay down tech debt"
+    - "address all the findings"
+    - "code audit and fix"
+
+sequences:
+  default:
+    description: "Audit the codebase, then drive the findings to zero"
+    steps:
+      - command: "/god-tech-debt"
+        why: "Score the codebase and write the prioritized, self-contained audit report (god-debt-assessor)"
+      - command: "/god-debug"
+        why: "Fix each Confirmed Critical/High finding worst-first; an independent reviewer verifies each fix against the cited evidence"
+      - command: "/god-tech-debt"
+        why: "Re-audit to confirm findings are resolved not relocated and no strength regressed; the orchestrator loops this under an outcome budget until clean"
+
+default-sequence: default

package/skills/god-version.md

@@ -16,7 +16,7 @@ Print version and a short capability summary.
 ```
 Godpowers v2.3.1
 Install: /Users/.../.claude/  (matches package.json)
-Surface: 120 skills, 40 agents, 13 workflows, 43 recipes
+Surface: 120 skills, 40 agents, 13 workflows, 44 recipes
 Schema: intent.v1, state.v1, events.v1, workflow.v1, routing.v1, recipe.v1
 External integrations available: impeccable, agent-browser (others lazy)
 Feature awareness: planning-system migration, source-system sync-back, context refresh, dashboard status labels, repo documentation sync, repo surface sync, quick proof, request trace, release hardening, maintenance hardening

package/workflows/full-arc.yaml

@@ -62,9 +62,16 @@ jobs:
     verification:
       required: [test, lint, typecheck-or-check]
 
+  code-audit:
+    tier: 2
+    needs: build
+    uses: god-debt-assessor@^1.0.0
+    with:
+      mode: post-build-audit
+
   deploy:
     tier: 3
-    needs: build
+    needs: code-audit
     uses: god-deploy-engineer@^1.0.0
     closure:
       on-missing-external-access: create-waiting-access-bundle
@@ -84,14 +91,21 @@ jobs:
 
   harden:
     tier: 3
-    needs: build
+    needs: code-audit
     uses: god-harden-auditor@^1.0.0
     blocks-on:
       - critical-finding: pause
 
-  launch:
+  docs:
     tier: 3
     needs: harden
+    uses: god-docs-writer@^1.0.0
+    with:
+      mode: product-docs-verify
+
+  launch:
+    tier: 3
+    needs: docs
     uses: god-launch-strategist@^1.0.0
     with:
       template: HARDEN-FINDINGS.md