github-audit

# GitHub Audit Comprehensive GitHub repo audit → auto-fix → quality gate → (confirmed) deploy → record. Tracks decisions in `.planning/github-audit-history.md` for cross-run consistency. > `allowed-tools` above PRE-APPROVES safe/common tools (it does NOT restrict — every > tool stays callable). `git push`, `gh pr merge`, and any deploy command are > deliberately NOT pre-approved, and Phase 4 is gated by an explicit confirmation. ## Run mode (from `$ARGUMENTS`) `$0` selects scope (default = full): - **`audit-only`** → Phases 0, 1, 5 only. Report findings; make NO changes, NO deploy. - **`fix`** → Phases 0–3 + 5. Fix + quality gate; STOP before deploy. - **`deploy`** or empty → all phases (Phase 4 still requires the confirmation gate). ## Execution rules - Auto-fix only safe/small items that match a Saved Policy; otherwise STOP and discuss via `AskUserQuestion`. - Quality gate: zero tolerance — fix ALL errors/warnings/failures (a known flaky test must pass in isolation to count as green). - Deploy: sequential gates; each step must succeed before the next; **never** without the Phase 4 confirmation. - Prefer a platform MCP/API over scraping CLI output when one is available (e.g. a hosting or backend MCP for deployment/env status). --- ## Phase 0 — Initialize 1. Read `.planning/github-audit-history.md` (Saved Policies + last audits). If it has an `IN_PROGRESS` block, ask the user to **resume** or **start fresh**. 2. `git remote -v`, `git branch --show-current`. Derive `own...