Skip to content

Audit skill#118

Merged
gewenyu99 merged 11 commits into
mainfrom
audit
May 5, 2026
Merged

Audit skill#118
gewenyu99 merged 11 commits into
mainfrom
audit

Conversation

@gewenyu99
Copy link
Copy Markdown
Collaborator

lol what a massive skill

lots of handholding for progressively selecting appropriate items from the best-practices skill, creating todos, and doing them so we get progressive progress updates.

This is more of a "get it to work" edition of the skill. :kek: it is very needing of various optimizations.

@github-actions
Copy link
Copy Markdown

🧙 Wizard CI

Run the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands:

Test all apps:

  • /wizard-ci all

Test all apps in a directory:

  • /wizard-ci android
  • /wizard-ci angular
  • /wizard-ci astro
  • /wizard-ci django
  • /wizard-ci fastapi
  • /wizard-ci flask
  • /wizard-ci javascript-node
  • /wizard-ci javascript-web
  • /wizard-ci laravel
  • /wizard-ci next-js
  • /wizard-ci nuxt
  • /wizard-ci python
  • /wizard-ci rails
  • /wizard-ci react-native
  • /wizard-ci react-router
  • /wizard-ci stripe
  • /wizard-ci sveltekit
  • /wizard-ci swift
  • /wizard-ci tanstack-router
  • /wizard-ci tanstack-start
  • /wizard-ci vue

Test an individual app:

  • /wizard-ci android/Jetchat
  • /wizard-ci angular/angular-saas
  • /wizard-ci astro/astro-hybrid-marketing
Show more apps
  • /wizard-ci astro/astro-ssr-docs
  • /wizard-ci astro/astro-static-marketing
  • /wizard-ci astro/astro-view-transitions-marketing
  • /wizard-ci django/django3-saas
  • /wizard-ci fastapi/fastapi3-ai-saas
  • /wizard-ci flask/flask3-social-media
  • /wizard-ci javascript-node/express-todo
  • /wizard-ci javascript-node/fastify-blog
  • /wizard-ci javascript-node/hono-links
  • /wizard-ci javascript-node/koa-notes
  • /wizard-ci javascript-node/native-http-contacts
  • /wizard-ci javascript-web/saas-dashboard
  • /wizard-ci laravel/laravel12-saas
  • /wizard-ci next-js/15-app-router-saas
  • /wizard-ci next-js/15-app-router-todo
  • /wizard-ci next-js/15-pages-router-saas
  • /wizard-ci next-js/15-pages-router-todo
  • /wizard-ci nuxt/movies-nuxt-3-6
  • /wizard-ci nuxt/movies-nuxt-4
  • /wizard-ci python/meeting-summarizer
  • /wizard-ci rails/fizzy
  • /wizard-ci react-native/expo-react-native-hacker-news
  • /wizard-ci react-native/react-native-saas
  • /wizard-ci react-router/react-router-v7-project
  • /wizard-ci react-router/rrv7-starter
  • /wizard-ci react-router/saas-template
  • /wizard-ci react-router/shopper
  • /wizard-ci stripe/stripe-next-js-saas-starter
  • /wizard-ci stripe/stripe-saas-demo
  • /wizard-ci sveltekit/CMSaasStarter
  • /wizard-ci swift/hackers-ios
  • /wizard-ci tanstack-router/tanstack-router-code-based-saas
  • /wizard-ci tanstack-router/tanstack-router-file-based-saas
  • /wizard-ci tanstack-start/tanstack-start-saas
  • /wizard-ci vue/movies

Results will be posted here when complete.


This is the **first** TodoWrite of the run. Open the four-item list with these `content` strings verbatim, with the first task `in_progress` and the others `pending`:

```
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious: if we need serious predictability, would it work better to track this progress with a custom tool that directly manipulates both files and state? the TodoWrite hack is great for free-form work the agent chooses but it looks like you want to constrain it closely here (which is fine)

I'm confident this will work as is but I'm wondering if there's a more ergonomic and scalable version that makes the determinism you're specifiying in these docs a side effect of the tool calls. wdyt?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah we don't need this. This is to make the already slow boot up feel faster so I don't stare at a blank table for like, longer than 2-3 minutes. I cannot for the life of me get this agent to putout a status update without first trying to make like 10 tool calls.

We can likely bypass this all together if we tried splitting this entire skill into subagent tasks.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh that's interesting, parallelize it with specific return value expectations, yeah


## Action

1. `Glob` for the project's dependency manifests by name: `package.json`, `requirements.txt`, `pyproject.toml`, `Gemfile`, `composer.json`, `build.gradle`, `Podfile`. One Glob is enough. **Do not read any code**.
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

note to self: I want to check if this procedure should also be a tool (feel free to argue against while I think it through @gewenyu99)

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it should be. It should in fact be static and something we can reuse.


## TodoWrite

This is the **first** TodoWrite of the run. Call `TodoWrite` with `todos` set to the **array** below (not a string — pass the literal array value):
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lol

this is a very specific form of cyberpunk

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a story behind every weird prompt.

The audit runs as a 4-step chain. Each step file ends with a pointer to the next. Follow them in the order they are written. You must resolve them in order before any source-tree exploration.

**Start by reading `references/1-seed.md`.** Do not Glob, ls, or find the skill directory. Do not preload future steps. Do not re-read a step file once you've moved past it. Do not re-read SKILL.md.
The audit ledger is already seeded with the 9 pending checks. Use `mcp__wizard-tools__audit_resolve_checks` to patch each one as you finish it.
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is it still 9?

do we want some templating here or is that overkill?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still 9. Templating would be good. I'm gonna bring back the template. Had it at some point before pulling back to a smaller subset

Comment on lines 491 to +529
const localReferences = fs.readdirSync(sourceReferencesDir, { withFileTypes: true })
.filter(entry => entry.isFile() && entry.name.endsWith('.md'));

const refsConfig = skill._references || {};

// Build continuation map when opted in via config
const continuationMap = new Map();
if (refsConfig.continuations) {
const sequentialPattern = /^(\d+)-(.+)\.md$/;
const sequential = localReferences
.filter(entry => sequentialPattern.test(entry.name))
.sort((a, b) => {
const aNum = parseInt(a.name.match(sequentialPattern)[1], 10);
const bNum = parseInt(b.name.match(sequentialPattern)[1], 10);
return aNum - bNum;
});

for (let i = 0; i < sequential.length - 1; i++) {
continuationMap.set(sequential[i].name, sequential[i + 1].name);
}
}

for (const reference of localReferences) {
const sourcePath = path.join(sourceReferencesDir, reference.name);
const content = fs.readFileSync(sourcePath, 'utf8');
let content = fs.readFileSync(sourcePath, 'utf8');
const headingMatch = content.match(/^#\s+(.+)$/m);

// Inject preamble after the first heading if configured
if (refsConfig.preamble && headingMatch) {
const headingEnd = content.indexOf(headingMatch[0]) + headingMatch[0].length;
content = content.slice(0, headingEnd) + '\n\n' + refsConfig.preamble + content.slice(headingEnd);
}

// Auto-append continuation for sequential references
const nextFile = continuationMap.get(reference.name);
if (nextFile) {
content = content.replace(/\n+---\n+\*\*Upon completion, continue with:\*\*\s*\[.*?\]\(.*?\)\s*$/, '');
content += `\n\n---\n\n**Upon completion, continue with:** [${nextFile}](${nextFile})`;
}
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My biggest suggestion: I think we should explicitly encode preamble and sequential | next_step patterns into frontmatter for each reference file

  • relying on file naming convention is kind of clunky
  • what happens if we need to eventually support a variety of files in /references, each with different preambles and sequences
  • more composable if we do it on a per-file basis

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

agree

Comment thread .posthog-audit-checks.json Outdated
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

did you mean to check this in here?

This could go into an /assets directory within the audit skill directory

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

l o l no definitely not

- Move continuation chaining from filename-numbering convention to per-file
  `next_step` frontmatter on each reference. `5-report.md` declares
  `next_step: null` to mark the terminal step.
- Group-level `preamble` stays in config.yaml and is only injected when a
  file has a next step (terminal files don't need the "read only this" framing).
- Remove the accidentally committed `.posthog-audit-checks.json` runtime
  ledger and gitignore both it and `posthog-audit-report.md`.

Generated-By: PostHog Code
Task-Id: 108de9ba-4744-4815-b2d4-491b07fb0572
@gewenyu99 gewenyu99 merged commit 5eb0851 into main May 5, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants