dhpk-session-usage-auditlisted

# dhpk Session Usage Audit Audit session evidence from the machine and user running this skill. The collector is deterministic; model analysis may rank and explain findings, but it cannot promote an observation to a GitHub issue without independent verification and human confirmation. ## When NOT to Use - Do not use for a single known GitHub issue; use the existing issue-analysis workflow. - Do not use for source-code review or a direct bug fix. - Do not use as a remote fleet collector; this skill is local-machine only. - Do not use for a broad repository health score; use the repository-health workflow. ## Workflow 1. Resolve the date scope. No date means the current local day; `--date` is a single day; `--from/--to` is an inclusive range. Preserve source timestamps in UTC and use the machine timezone only for filtering. 2. Run the bundled collector with the requested `--agent` filters. It scans only the allowlist described in [source-adapters.md](references/source-adapters.md) and reports unsupported or skipped sources instead of guessing. Claude and native/project Codex JSONL plus known Orca NDJSON traces are parsed; private SQLite and aggregate usage stores remain explicitly omitted. 3. Read the JSON report. Separate installed agents, observed agents, strong dhpk evidence, weak text-only evidence, malformed records, and partial scans. Raw transcripts must never be copied into the report or prompt. 4. Use [finding-taxonomy.md](references/findin