audit-config

/audit-config — Configuration & Documentation Health Check (cowork variant)

Scan all CLAUDE.md files, plugin manifests, and knowledge files for drift, broken references, and staleness.

Cowork variant of aria-knowledge's /audit-config. Output schema (4-tier findings table) is byte-identical per item #17g + #17m. Three input-discovery + scope divergences:

• Field enumeration via CONFIG.md, not bin/config.sh (#17b + #17e + ADR-013). Cowork has no bin/ directory; the canonical schema list is the human-readable CONFIG.md cowork ships at repo root.
• Tracked-artifact staleness check (Step 5a) SKIPPED per ADR-005 (#17f). aria-knowledge stats CODEMAP.md / STITCH.md per project; cowork excludes /codemap + /stitch so no tracked artifacts to check.
• Cadence invocation differs (#17n). aria-knowledge runs cadence checks at SessionStart via hook. Cowork has no hook layer — cadence checks fire at the first aria-cowork skill invocation per session (entry-points: /aria-setup, /extract, etc., which check the log and prompt if cadence exceeded).

Step 3a.1 version-stamp ripple + Step 3a.2 adoption-state cascade run with cowork-scoped surfaces + cowork-relevant phrases per #17c + #17d.

Plugin attribution in audit-log entries uses aria-cowork@{INSTALLED_VERSION}. Schema-identical 4-tier output means a knowledge folder's logs/config-audit-log.md accepts entries from both plugins without format drift.

Runtime Gate (per ADR-094)

Canonical resolution: This is the Claude Cowork variant — namespaced-only. When both plugin-claude-code and plugin-claude-cowork are loaded in the same session (most common in Claude Desktop), bare /audit-config resolves to aria-knowledge's variant — Code is the canonical owner of all 24 dual-port skills per ADR-094 §Part 1. To reach this skill, use the namespaced form: /aria-cowork:audit-config. Do NOT match bare /audit-config — that belongs to aria-knowledge.

Before Step 0: Check whether the Bash tool is available in this session. If Bash IS available (you are running in Claude Code or another runtime with shell access), surface the following notification and wait for explicit user confirmation:

⚠️ Runtime mismatch — you invoked aria-cowork's /audit-config from a runtime with shell access.

This variant uses CONFIG.md-driven field enumeration and skips CODEMAP.md / STITCH.md checks per ADR-005 — but you appear to be in Claude Code, where the canonical aria-knowledge variant uses bin/config.sh + Agent sub-audits + tracked-artifact staleness. For the Code-native variant, use /audit-config (the aria-knowledge canonical).

Use /audit-config instead? (y / n)

Wait for an explicit reply:

• y / yes — Use the Skill tool to invoke audit-config (the bare-slash canonical, which routes to aria-knowledge when both ports are loaded) with the same arguments the user provided to this invocation. Do not proceed with this skill's steps; the aria-knowledge variant takes over and runs to completion. This is the default-yes path — auto-redirect is the helpful action.
• n / no — Proceed with this (aria-cowork) variant anyway despite the runtime mismatch. The user has explicitly opted in.
• No response / any other reply — Treat as "do not proceed" and exit cleanly without running either variant.

This gate applies even when mode = auto per ADR-094 §Part 3. Auto mode's "implicit-yes on all gates" rule is suspended for the runtime-mismatch check — auto trusts that the user invoked the correct variant, and this gate enforces that precondition. All other auto-mode gates remain bypassed. The friction cost is now low: on y, the auto-redirect runs the correct variant with the original args.

If Bash is NOT available (normal Cowork runtime), proceed to Step 0.

Step 0: Resolve Config

Read <knowledge_folder>/aria-config.md and extract knowledge_folder and audit_cadence_config. If the file doesn't exist, stop: "aria-cowork is not configured. Run /aria-setup to get started."

Use {knowledge_folder} as the base path for all knowledge file operations in subsequent steps.

Step 1: Read the Audit Log and Determine Mode

Read {knowledge_folder}/logs/config-audit-log.md.

Note the "Last Audit" date and calculate days since.

Determine how this skill was invoked:

• User-requested (user said /audit-config, "audit configs", "check setup", etc.): Always run the full audit, regardless of how recently the last audit was. Skip directly to Step 2.
• Cadence check at skill-invocation (cowork has no SessionStart hook per #17n — the cadence check fires when the user invokes any aria-cowork skill that runs the cadence check at startup, typically /aria-setup or /extract):
• If cadence exceeded: Prompt the user — "It's been N days since the last config & docs audit. Want me to check for drift?" If they agree, proceed to Step 2. If not, stop.
• If within cadence: Report the last audit date and stop. "Last config & docs audit was N day(s) ago (YYYY-MM-DD). Next check due in M days."

Cowork divergence vs aria-knowledge: aria-knowledge's SessionStart hook fires the cadence check automatically at every session start, before any user input. Cowork's check is invocation-driven instead — fires when the user invokes the next skill that has the cadence check baked in. The user-experienced cadence is approximately the same (~14 days default); the trigger mechanism differs.

Step 2: Scan Configuration Files

Use agents in parallel to scan these areas:

2a: Settings Files

Find all .claude/settings.local.json files in the current working directory. For each:

• Validate JSON structure
• Check all Bash(...) permission paths exist on disk
• Check all mcp__* references against currently available MCP tools
• Flag stale or redundant permissions
• Check for ghost configs in unexpected locations (e.g., node_modules/)

2b: Plugin Manifests

For each plugin referenced in settings files:

• Compare manifest version against any version claims in CLAUDE.md files
• Verify plugin paths referenced in settings files

2c: Plugin Configs

Check .claude/*.local.md files:

• Verify referenced IDs and paths are properly formatted
• Note configuration settings

Step 3: Scan CLAUDE.md Files

Find all CLAUDE.md files recursively in the current working directory.

Expand via Glob first, then issue Read calls for all found CLAUDE.md files in a single parallel tool-use block. Validation checks run in the main thread after reads complete.

For each file, check:

• File references — do referenced files/paths actually exist?
• Cross-references — do pointers to other CLAUDE.md files resolve?
• Version claims — do stated versions match actual manifests/package.json?
• Version-stamp ripple — when a version appears in one CLAUDE.md, does the same version appear consistently across sibling CLAUDE.md files and memory files that reference the same project? Mismatched versions across surfaces (e.g., root says v2.14.2, sub-project says v2.14.3) signal a post-release update that didn't propagate. See Step 3a for the detection pattern.
• Adoption-state phrases — does language like "NOT YET BUILT", "(placeholder)", "spec drafted, not yet built", "currently disabled", "still has older prototype", "pipeline built but not yet adopted" contradict the actual state of a referenced artifact (plugin.json exists with non-zero version, config flag is enabled, build output is present)? See Step 3a.
• Team roster — is it consistent across CLAUDE.md files?
• Stale content — are there line numbers, dates, or status claims that look outdated?
• Missing references — are there significant docs/files in the project that aren't referenced?

Step 3a: Release-State Cascade Patterns

Two specific cascade shapes are common enough to warrant dedicated detection. Both follow the same structural pattern: one s