work-unit-auditlisted

# Work-unit audit Task review proves each task was done correctly. Work-unit audit answers the question no task review asks: does the *combined* result achieve the work unit's intended outcome as a complete, coherent, sufficiently verified system? Individually accepted tasks can still leave missing cross-task behavior, an incomplete product outcome, conflicting configuration, duplicate mechanisms, code and docs that disagree, unnecessary combined complexity, integrated regressions, or task-level evidence that never proved the final combined state. Work-unit audit is **enabled by default**. Unless a human explicitly records `work_unit_audit: disabled` in `.agenticloop/project.md`, work-unit closeout cannot publish `AGENT_CLOSEOUT_STATUS: complete` without a current certificate. ## 1. Preconditions Do not start an audit until all of the following hold: - every covered task is `accepted` or `closed` under the configured backend; - the covered artifacts are integrated or composed into one exact candidate; - the candidate is frozen: a commit SHA or another immutable revision reference; - final integrated verification evidence exists for that exact candidate; - an Auditor model is configured at `adapters.<host>.roleSettings.auditor`. If auditing is enabled and no Auditor model is configured, that is a blocking setup condition. Report it and stop. Never substitute the Maintainer model. Integration rehearsal and audit are different steps. Engineer-owned integration rehearsal