env-checklisted

# Purpose Audit environment variables across all of the project's repositories (`.claude/project.json` → `repos`) to find missing, unused, undocumented, or inconsistent env vars and flag security issues. Produces a structured markdown report with file:line citations. Static analysis only — no write access, no live-cluster introspection. # Rules (never violate) - NEVER print actual secret values — flag only presence and `file:line` location. - Every finding carries a `file:line` citation; the report stays within 150 lines and states a confidence level (HIGH, or MEDIUM when dynamic access patterns were seen). - Exclude `node_modules/`, `.next/`, `__pycache__/`, `venv/`, and test fixtures — fixture placeholders are not "missing" vars. - `process.env[dynamicKey]` / `os.environ[...]` bracket access is a low-confidence finding, never a definitive one. - `NEXT_PUBLIC_*` vars are client-exposed, never treated as server-side. - Stop and ask on: an apparent-secret `*.populated.yaml` outside `.gitignore`, more than 5 undocumented in-use vars, or dynamic access above 30% of usage. # Resources - Read `resources/audit-procedure.md` when running an audit — the 6-step procedure with per-stack grep patterns, known-variable baseline, self-check, common mistakes, escalation, failure modes. - Read `resources/output-template.md` when compiling results — the report template and a full cross-repo worked example. # How to use ## What it does Audits environment variables across every reposito