Audit Resolution

Read the runtime invocation contract first. Use the bundled Python CLI after resolving AUDIT_PLUGIN_ROOT and AUDIT_PROJECT_DIR as described there. A separately configured audit_* MCP server is an optional equivalent with an explicit absolute root.

Purpose: fix one unblocked audit ticket, record implementation evidence, and hand off to independent verification.

If the user authorized a fix group or batch, inspect related_tickets from next --for resolution --json and the full acceptance criteria of each ticket. Resolve compatible shared-file/root-cause problems through one coherent source change, then record resolution evidence on each addressed ticket. Do not treat same-file suggestions as automatic authorization for extra work.

For incorrect generated or computed results, trace the responsible producer and affected consumers. Repair the producer or state owner when it is editable within the ticket's authorized scope, rather than hiding that defect behind a rejection, filter, or approval gate. If the producer is external or outside that scope, implement the ticket's required consumer-side behavior (such as normalization or rejection) and identify it as a mitigation, not a producer fix. Preserve controls independently required by the accepted ticket or product contract.

For a BUG ticket, investigate reported symptom → reachable failing path → violated contract/invariant → responsible owner → minimal correct fix before changing code. Inspect relevant callers, affected consumers and evidence that might disprove the suspected cause. A source-provable defect need not be reproduced in an unavailable runtime; state what was inspected and what could not be observed. Name a scoped workaround as a mitigation, not a verified root-cause repair. Preserve the ticket's original acceptance criteria and record only evidence actually obtained, following the shared proof guide below. Do not introduce tests, diagnostic infrastructure or extra scope implicitly.

Use the shared resolution proof guide to separate proposed checks, observed results, and verdicts, including whether corrected source is active in the relevant running instance. Keep the existing acceptance gates and user-authorized validation scope; do not generate tests or restart services implicitly.

First move from empty context

python3 "${AUDIT_PLUGIN_ROOT}/scripts/audit.py" --root "${AUDIT_PROJECT_DIR}" doctor
python3 "${AUDIT_PLUGIN_ROOT}/scripts/audit.py" --root "${AUDIT_PROJECT_DIR}" next --for resolution --json

If the workspace is absent or no ticket is returned, report it without initializing or inventing tickets. A BLOCKED ticket requires an explicit resume after its blocker is removed; it is not selected automatically. Before changing implementation, confirm Decision: FIX and that every dependency is PASS, even for a ticket explicitly named by the user.

Default flow

python3 "${AUDIT_PLUGIN_ROOT}/scripts/audit.py" --root "${AUDIT_PROJECT_DIR}" next --for resolution --json
python3 "${AUDIT_PLUGIN_ROOT}/scripts/audit.py" --root "${AUDIT_PROJECT_DIR}" show 001
# inspect current code, implement the smallest correct fix
python3 "${AUDIT_PLUGIN_ROOT}/scripts/audit.py" --root "${AUDIT_PROJECT_DIR}" resolve 001   --fix-commit abc123   --evidence "Implemented null-user validation in src/parser.py"   --test "manual reproducer: pass"   --changed src/parser.py   --as audit-resolution   --json

Allowed actions

• read the ticket and related code;
• modify implementation code for the selected ticket;
• record changed files, fix commit, command/result evidence, and resolution notes;
• set READY_FOR_VERIFICATION through python3 "${AUDIT_PLUGIN_ROOT}/scripts/audit.py" --root "${AUDIT_PROJECT_DIR}" resolve.

Forbidden actions

• never set PASS;
• never verify your own fix;
• do not bypass dependencies;
• do not process all tickets unless the user explicitly asks for batch/all.

Stop condition

Stop after the selected ticket reaches READY_FOR_VERIFICATION and summarize what verification should check. Report command failures from their actual exit/result. If metadata was written but an opted-in Git commit failed, report both facts; do not repeat the resolution as though nothing changed.