project-stocktakelisted

# Taking stock of the project A deliberate, periodic pass asking **where this project actually is**. It ends with `record.todo` rebuilt around the answer and an entry in `record.audits` — written by [`audit-writer`](../../workflow/writers/audit-writer.md), which owns that file — recording what was examined, against which tree. ## What it is, and what it deliberately is not - **Where is this project?** Does the record still describe it, do the conventions hold, is the public surface coherent, does it have the tests and CI a release depends on, and what should the backlog look like now? Answerable from evidence any repository provides. **That is this skill.** - **Is this code correct and safe?** Trust boundaries, injection, cascade semantics, migration reversibility, whether an assertion passes for the wrong reason. Each needs to know what the stack *is*, so each belongs to a **project-scoped code-analysis skill**, which this invokes as one more source of findings when the project has one (Phase 1). **Without one, this skill still runs and says so** — it reports that no code analysis ran, rather than implying the code was looked at and found clean. The whole discovery phase is read-only and autonomous. The user is often away while it runs, so don't stop to ask permission for reads. The first time this skill needs the user is the finding-by-finding review. **Project facts come from `.claude/workflow.json`**: the record paths under `record.*`; `agents.audit` f