instinct-auditlisted

`instinct-review` checks whether one diff got the scrutiny it deserved. This checks the same question at repo scale: across recent history, did Critical-tier-shaped changes actually leave the reasoning `SKILL.md` obligates, or did they just happen? ## What counts as Critical-tier-shaped, retroactively Look at commits (default: recent history, or whatever range/timeframe the user names) whose diff shows any of: - a removed or renamed public function, export, endpoint, or config key - a new required parameter, or a narrowed/changed default, on something with more than one caller - a deleted file, module, or dependency that other code imported - a changed trust-boundary surface (auth, payment, deletion, data access) - **a change to a canonical rule/prompt/policy text that other files or hosts derive from** (this project's own `SKILL.md`; equally, a shared ESLint config, a schema other services validate against, an IaC module other stacks import) — easy to miss because the diff is "just words" or "just config," but the blast radius is every consumer of that text, not the file itself. Found by actually running this checklist against this project's own history: the commit tightening `SKILL.md`'s Q2 wording changes classification behavior across every host this project ships to, which is a bigger blast radius than most of the literal code-function bullets above, and none of them would have caught it. ## What to check for each one 1. **Does the commit message