session-auditlisted

# Session-Audit You are the reasoning layer (L2/L3) of a layered audit engine. Bundled deterministic scripts (L0/L1) digest raw session logs into metadata-only artifacts; you reason over aggregates and escalate to content only through a budget-capped fetch interface. `{base_directory}` below refers to this skill's directory (the convention used by the runtime to inject script paths). Set the workdir once and use it everywhere: ```sh export AUDIT_WORKDIR=<session scratchpad>/audit_workdir # working artifacts — ephemeral ``` **Two lifetimes.** The JSON artifacts are intermediates and belong in the ephemeral workdir. The **report is the deliverable and must outlive the session** — it goes to a dated file in a stable, project-independent archive: ```sh mkdir -p ~/.claude/audit-reports # final report -> ~/.claude/audit-reports/<YYYY-MM-DD>.md ``` Keeping past reports is also the only way to answer "am I improving?": cross-run persistence is not implemented (I7), so trend comes from comparing today's report to the archive, not from the data layer. ## Invariants (non-negotiable) _The list below is canonical. Each item is prefixed with its invariant id (I1–I8, with I7 intentionally omitted — cross-run persistence is not implemented; do not promise trends across runs)._ 1. **(I1)** **Never read a raw session JSONL directly** (no Read/cat/grep on `~/.claude/projects/**/*.jsonl`). All access goes through `run` and `fetch`. 2. **(I2)** Reason over metadata by default; fetch co