audit

# Audit ## Standalone Codex host branch Claude frontmatter, TLDR, agent teams, dynamic workflows, `codex-verifier`, and `codex-run.ts` do not apply in standalone Codex. Keep source inspection read-only. Map with `rg --files`, `rg -n`, direct import/caller searches, focused file reads, and the repo's own diagnostics; never claim TLDR ran. Use Context7 only when the user configured that MCP. Otherwise inspect pinned manifests and lockfiles, consult official package documentation through native browsing when available, and label currency or API claims unverified when neither source is reachable. This package does not auto-run unpinned registry MCP packages. For fan-out, create each new reader with `spawn_agent`, continue a live reader with `send_message`, trigger another turn for an idle existing reader with `followup_task`, wait with `wait_agent`, and stop its current turn with `interrupt_agent` only when necessary. Only read-only reviewers may overlap. Writers share the working tree unless the live host explicitly offers isolation, so the main session writes the final report after readers finish; any implementer and test-writer phases must be serialized with non-overlapping ownership. One skill, eight whole-repo audit modes. Seven of them share a skeleton: read the surface **in full** (never sample), hunt with explicit categories, and ship a prioritized, executable report or plan set. Six families of question: - **Codebase** — one merged audit, two lenses on the same read...