Lean Audit

Overview

Run a read-only whole-repo simplicity audit. Report validated cuts; do not edit, delete, commit, open a PR, or post comments.

When to use

Use for audits of over-engineering, bloat, or simplification. Do not use for diff-only review, correctness, security, performance, generic test coverage, or style; route those concerns to review or debugging.

Process

1. Establish root. Read applicable instructions and inspect git status without changing it. Record root, exclusions (.git, generated output, vendored code, node_modules, and build caches), and every inspected first-party area. If the user explicitly includes an excluded path, state that override. If a required area or repository-wide search is unavailable, report Audit incomplete: <specific limitation> and do not make a lean verdict.
2. Inventory source, structure, entrypoints, manifests, dependencies, configuration, commands, and tests. Use rg and direct reads. Before judging a candidate, use FFF multi-pattern grep (fallback: rg) to search callers, registrations, and dynamic-reference variants, then inspect relevant configuration, tests, and extension requirements.
3. Report only validated cuts with one of these tags: delete, stdlib, native, yagni, or shrink. Omit ambiguous candidates. Preserve explicit requirements, repository conventions, compatibility boundaries, required validation, and behavior-protecting tests. Route out-of-scope concerns to review/debugging.
4. Rank the largest credible cut first. Report savings only when supported; never imply that a change was applied.

Output

# Lean audit
Scope: <repository root>; exclusions: <paths>; inspected: <first-party areas>

1. delete: <path:line> <cut>. <replacement>. evidence: <paths/searches>

net: -<N> lines, -<M> dependencies possible.

Every finding needs an exact repository-relative path:line, evidence, and a replacement. For shrink, show the shorter equivalent form. After complete coverage with no validated cut, keep the header and scope, then output Lean already. Ship. and omit findings and net. If coverage is incomplete, output the limitation instead. End with the Next: block from using-devkit (Next: none after a complete report).

Quick reference

Example

src/format.js:18 — stdlib: replace the hand-written extension parser with node:path.extname; evidence: callers and tests cover the same input boundary.

Common mistakes

• Calling a style preference bloat without behavior or reuse evidence.
• Calling code dead after checking only one direct occurrence.
• Removing a factory or validation despite an explicit extension contract.