distributed-system-auditlisted

# Distributed System Audit A separate skill from [`codebase-audit`](../codebase-audit/SKILL.md). That one walks the code in one repo; this one walks the **system**: many processes, many trust boundaries, protocols between them, and the failure modes that don't exist when everything runs in one process. The biggest mistake auditors make on distributed systems is treating them as N independent code audits. The interesting findings live *between* the components, in the assumptions they make about each other. ## When to invoke - Auditing a client/server product (native agents + control plane) - Auditing a microservices or service-mesh setup - Auditing an IoT or fleet-management backend - Auditing a multi-tenant SaaS with worker / job-runner architecture - Acquisition due-diligence on a distributed product - Handing over operations of a multi-component system - After an incident that crossed component boundaries Pairs with [`codebase-audit`](../codebase-audit/SKILL.md) for the per-component code-level work, [`kubernetes-security`](../kubernetes-security/SKILL.md) if the control plane is K8s, [`message-bus-security`](../message-bus-security/SKILL.md) for the messaging layer, [`agent-client-security`](../agent-client-security/SKILL.md) for the client-side. ## Step 0 — Map first, judge later The first deliverable of a distributed-system audit is **an architecture diagram you produced**, not the findings. Until you can draw every component and every channel between them, you do