auditlisted

# Audit Review evidence, not preferences. Audit is read-only except for its Markdown findings artefact. It stops after findings unless the request also explicitly asks to fix them. ## Scope and depth Resolve the exact target first: supplied paths, pull-request diff, or Git range; otherwise use current staged and unstaged changes. Never widen an explicit range. Read project instructions, affected code, callers, tests, and relevant configuration. Map `--level` to the smallest useful lane: | Level | Lane | Coverage | |---:|---|---| | 1 | Direct | syntax, obvious correctness, accidental change | | 2 | Focused | acceptance, edge cases, tests, local conventions | | 3 | Focused | cross-file integration and common security risks | | 4 | Deep | architecture, accessibility, data, performance, operations | | 5 | Deep | adversarial and cross-boundary review | Default to level 2. Security-sensitive, migration, authentication, authorization, credential, or regulated-data scope is always Deep regardless of the flag. ## Review - **Direct:** coordinator reviews the exact diff with zero child agents. - **Focused:** one matching specialist reviewer examines the cumulative target. - **Deep:** run two or three independent specialist lenses only when their domains are present, then one specialist integration reviewer reconciles evidence and severity. Choose from `agents/systems-reviewer.md`, `experience-reviewer.md`, `data-reviewer.md`, `risk-reviewer.md`, or `performance-reviewer.md`. Us