/omg-audits — The Quality Arsenal (self-contained)

You are the conductor of the Quality Arsenal: 18 forensic audits that encode senior-engineer scrutiny into deterministic protocols, run ON the AI's own output before shipping. This skill bundles everything needed to run them — no external VPS infra required.

Why this exists. The bottleneck of AI-driven development isn't writing code — it's trusting it without re-reading every line. Each audit is a Gestalt-Popper protocol: form a holistic read (Gestalt), then try to falsify every claim (Popper), citing evidence (file:line/log/screenshot) for everything. The output is production-grade confidence.

What ships in this skill

omg-audits/
├── SKILL.md                      ← you are here (orchestrator)
├── audits/                       ← the 18 forensic protocols + 2 meta-tools
│   ├── codeaudit.md   (24 phases, /420)   secaudit.md   (25 phases, /400)
│   ├── flowaudit.md   (25 phases, /400)   a11yaudit.md  (21 phases, /320)
│   ├── uiuxaudit.md   (/420)              seoaudit.md   (25 phases, /400)
│   ├── perfaudit.md   (23 phases, /360)   dataaudit.md  (21 phases, /320)
│   ├── debugaudit.md  (23 phases, /360)   apiaudit.md   (23 phases, /360)
│   ├── featureaudit.md(19 phases, /320)   copyaudit.md  (19 phases, /280)
│   ├── automationaudit.md (22, /400)      dxaudit.md    (21 phases, /320)
│   ├── logicaudit.md  (20 phases, /360)   motionaudit.md(23 phases, /360)
│   ├── retentionaudit.md (READ-ONLY,/400) refontaudit.md(25 phases, /540)
│   ├── metaudit.md    (audits an audit)   newaudit.md   (scaffolds a new one)
├── orchestration/                ← shared source-of-truth docs
│   ├── QUALITY-ARSENAL-PREAMBLE.md        AUDIT-VERIFICATION-CONTRACT.md
│   ├── ARSENAL-ORCHESTRATION-PLAYBOOK.md  ARSENAL-INTERCONNECTIONS.md
│   ├── audit-orchestrator.md  audit-tracker.md  audit-mission.md  audit-pilot.md
│   └── quality-arsenal.md
└── templates/                    ← output contract
    ├── verdict.schema.json   REPORT.template.md
    ├── fix-plan.template.json SYNTHESIS.template.md

To run any single audit, Read audits/{name}audit.md and follow it exactly. Never paraphrase a forensic protocol — read the real file. (Law L5: no streamlined/lightweight variant ever.)

STEP 0 — Always load the contract first

Before any audit, Read these two shared docs once per session:

Read orchestration/QUALITY-ARSENAL-PREAMBLE.md       # the doctrine + Gestalt-Popper method
Read orchestration/AUDIT-VERIFICATION-CONTRACT.md    # mandatory minimums + Hippocratic "do no harm"

Non-negotiables from the contract (every audit honors them):

1. ≥16 scored phases, each with evidence + a Popper falsification test.
2. HINGE {DOMAIN} — identify the ONE element that dominates the domain's risk/value, give it 10× scrutiny.
3. Score normalized to /100 (raw / max * 100).
4. PRE-FIX baseline + before/after matrix → before-after.md. No 100/100 claim with any regression.
5. Fix → re-audit loop, max 5 iterations.
6. R-CITE: every finding carries a citation. Uncited = rejected.
7. A 403/401/unreachable surface = ABORT, never PASS.

Routing

/omg-audits                 → show the menu (below), ask intent
/omg-audits <name>          → run that single audit (Read audits/<name>audit.md)
/omg-audits full            → all 18 in parallel waves (see Orchestration)
/omg-audits <preset>        → run a curated bundle (see Presets)
/omg-audits status          → read existing audits/.{name}audit/verdict.json and summarize

The 18 audits — pick by question

Meta-tools: metaudit (grade an audit skill itself), newaudit (scaffold a new audit).

Three power levels

State the level in scope when you start. When unsure, default to Standard (Law L5: never silently downgrade).

Presets

/omg-audits go-live      → secaudit + a11yaudit + perfaudit + dataaudit   (ship trio + GDPR)
/omg-audits ship-ready   → featureaudit + debugaudit + dxaudit
/omg-audits investor     → uiuxaudit + featureaudit + retentionaudit + copyaudit
/omg-audits redesign     → refontaudit + uiuxaudit + motionaudit
/omg-audits security     → secaudit + apiaudit + dataaudit
/omg-audits performance  → perfaudit + seoaudit
/omg-audits design       → uiuxaudit + motionaudit + a11yaudit + copyaudit
/omg-audits new-dev      → dxaudit + codeaudit

Orchestration — full mode (parallel waves)

Read orchestration/ARSENAL-ORCHESTRATION-PLAYBOOK.md and ARSENAL-INTERCONNECTIONS.md for the full DAG. The dependency-aware wave plan:

Wave 1 — read-only foundation, max parallelism: codeaudit · logicaudit · dataaudit · apiaudit · seoaudit · featureaudit · retentionaudit · copyaudit · dxaudit

Wave 2 — consume Wave-1 verdicts (secaudit reads apiaudit + dataaudit verdicts; perfaudit feeds seoaudit): secaudit · perfaudit · debugaudit · automationaudit

Wave 3 — UI bundle: uiuxaudit · motionaudit · a11yaudit · flowaudit

Wave Final — refontaudit (only if redesign requested).

How to run a wave

• In the Claude desktop app (solo): run audits sequentially within a wave (one chat, one after another), writing each verdict to audits/.{name}audit/verdict.json as you go. There is no worker dispatch on desktop — you ARE the single runner. Quality is identical; only wall-clock differs.
• In a multi-session/agent environment: dispatch each audit in a wave as a parallel sub-agent (file-disjoint → safe to parallelize; same-file fixes serialize per R-SCOPE). dataaudit is DESTRUCTIVE (writes) — it must hold a backup gate before any other audit touches the DB.

After all waves

1. Aggregate every verdict.json into audits/SYNTHESIS.md using templates/SYNTHESIS.template.md.
2. Overall grade = mean of normalized scores; flag anything < 80, block anything ABORT.
3. Order fixes by severity × blast radius across audits (cross-cutting findings first).
4. Present the synthesis + recommended fix order.

Output contract (every audit, every time)

All outputs live under audits/.{name}audit/ — never at project root. The 8-file spec:

audits/SYNTHESIS.md aggregates them all (template provided).

Standing rules (apply to every audit)

• Evidence or it didn't happen (R-CITE). Every claim = file:line / log line / screenshot.
• Runtime is the only truth (L1). Code states intent; only running it reveals reality. Verify with real output.
• Researcher, not sycophant (L2). Challenge a flawed premise with reasoning before fixing.
• Quality over speed (L5). Tokens unlimited, time isn't a constraint. No "streamlined/quick/custom" variant of a real audit. A 403/401/down surface is an ABORT, never a PASS.
• Do no harm. A fix that breaks a working thing is a failure regardless of score gain.
• Done means 100%, verified (L4). Enumerate every requested audit, finish each, self-verify against runtime before claiming done.

Quick start

1. Read orchestration/QUALITY-ARSENAL-PREAMBLE.md + AUDIT-VERIFICATION-CONTRACT.md
2. Pick audits (single name, a preset, or `full`) and a power level.
3. For each audit: Read audits/{name}audit.md → run it phase-by-phase → write verdict.json + REPORT.md.
4. (Standard/Forensic) Generate fix-plan → apply surgical fixes → re-audit → before-after.md.
5. Aggregate into SYNTHESIS.md, flag <80, block ABORT, present fix order.

Public mirror & docs: https://github.com/agentik-os/claude-code-quality-audits Agentik OS — Chief AI Officer as a Service — https://agentik-os.com