feat: audit now applies fixes instead of just reporting

- CI audit step edits files directly (agents, skills, settings, etc.)
- git add -A captures all changes, not just docs/
- Check for changes covers entire repo including new files
- /audit-config command updated to apply fixes too
- PR serves as review gate for all applied improvements

Author: nicolas-codemate

.github/workflows/sync-audit.yml

@@ -50,46 +50,48 @@ jobs:
             exit 1
           fi
 
-      - name: Check for changes
-        id: changes
-        run: |
-          if git diff --quiet docs/; then
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-            echo "### Changed files:" >> /tmp/sync-summary.txt
-            git diff --stat docs/ >> /tmp/sync-summary.txt
-          fi
-
-      - name: Run audit
-        if: steps.changes.outputs.has_changes == 'true'
+      - name: Run audit and apply fixes
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
         run: |
           claude -p "$(cat <<'PROMPT'
-          You are auditing a Claude Code configuration repository.
+          You are auditing and improving a Claude Code configuration repository.
+
+          ## Phase 1: Read everything
 
-          Read these files:
           1. docs/claude-cookbook-best-practices.md (just synced - reference for latest features)
           2. settings.json
           3. CLAUDE.md
           4. All agents: agents/*.md
           5. All skills: use Glob for skills/*/SKILL.md, then read each
           6. All commands: commands/*.md
 
-          Produce a concise markdown audit report. For each actionable finding:
+          ## Phase 2: Apply improvements
+
+          For each actionable finding, APPLY the fix directly (edit files, create missing agents, remove deprecated code, update settings).
 
-          **[CATEGORY] `file`** — recommendation (impact: high/medium/low)
+          Categories to check:
+          - SETTING: missing permissions, new settings to adopt
+          - AGENT: missing model field, missing tools in frontmatter
+          - SKILL: outdated patterns, missing features
+          - COMMAND: missing allowed-tools, broken references
+          - HOOK: new hook events to leverage
+          - CLAUDE.MD: rules that could be settings/hooks instead
+          - CONFLICT: duplicates, deprecated code to remove
 
-          Categories: AGENT, SKILL, COMMAND, SETTING, HOOK, CLAUDE.MD, CONFLICT
+          ## Rules
 
-          Rules:
-          - Only flag things that would concretely improve the workflow
+          - Only fix things that would concretely improve the workflow
           - Skip anything that works fine as-is
-          - Check for conflicts with new bundled commands
-          - Check for new features agents/skills could leverage
-          - Check for CLAUDE.md rules that could be settings/hooks instead
-          - Keep the report under 100 lines
+          - Do NOT delete files without strong justification (prefer deprecation)
+          - Do NOT modify docs/ (already synced)
+          - Keep changes minimal and focused per finding
+
+          ## Phase 3: Summary
+
+          After applying all fixes, output a concise markdown report listing what you changed:
+
+          **[CATEGORY] `file`** — what was changed (impact: high/medium/low)
           PROMPT
           )" \
             --model claude-sonnet-4-6 \
@@ -98,6 +100,20 @@ jobs:
             --output-format text \
             | tee /tmp/audit-report.txt
 
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet && [ -z "$(git ls-files --others --exclude-standard)" ]; then
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+            {
+              echo "### Changed files:"
+              git diff --stat
+              git ls-files --others --exclude-standard | sed 's/^/  new: /'
+            } > /tmp/sync-summary.txt
+          fi
+
       - name: Create PR
         if: steps.changes.outputs.has_changes == 'true'
         env:
@@ -113,30 +129,29 @@ jobs:
           done
 
           git checkout -b "$BRANCH"
-          git add docs/
-          git commit -m "chore: sync best practices docs"
+          git add -A
+          git commit -m "chore: sync docs and apply audit improvements"
           git push -u origin "$BRANCH"
 
           # Build PR body
           {
-            echo "## Sync"
+            echo "## Changes"
             echo ""
             cat /tmp/sync-summary.txt
             echo ""
             echo "---"
             echo ""
-            echo "## Audit"
+            echo "## Audit Report"
             echo ""
             if [ -f /tmp/audit-report.txt ]; then
-              # Extract just the last meaningful section (skip Claude's verbose output)
               cat /tmp/audit-report.txt | tail -80
             else
               echo "No audit report generated."
             fi
           } > /tmp/pr-body.txt
 
           gh pr create \
-            --title "chore: sync best practices $(date +%Y-%m-%d)" \
+            --title "chore: sync & improve config $(date +%Y-%m-%d)" \
             --body-file /tmp/pr-body.txt \
             --assignee nicolas-codemate
 

commands/audit-config.md

@@ -125,9 +125,12 @@ Only include actionable items — no vague suggestions.
 </output>
 
 <constraints>
-- Do NOT apply any changes automatically — this is an audit, not a fix
-- Do NOT suggest changes that are purely cosmetic or subjective
+- APPLY fixes directly — edit files, create missing agents, update settings, remove deprecated code
+- Do NOT just report findings — fix them
+- Do NOT apply changes that are purely cosmetic or subjective
+- Do NOT delete files without strong justification (prefer deprecation)
+- Do NOT modify docs/ (already synced in Phase 1)
 - Focus on: new features we could use, conflicts, deterministic enforcement, context savings
 - Ignore: minor formatting, personal preferences, things that work fine as-is
-- Be critical but pragmatic — only flag things that would actually improve the workflow
+- Be critical but pragmatic — only fix things that would actually improve the workflow
 </constraints>