# Audit Output Contract

Audience: AI coding agents first.

## Required sections

1. **Decision** — single recommended prevention architecture.
2. **Evidence base** — refs scanned, exact commit count/range, commands, dirty-tree state, limitations.
3. **Current controls** — instructions, agent hooks, Git hooks, local gates, CI, branch protection, slopgate/linter/test configuration. Every claim MUST cite `path:line` or captured command evidence.
4. **Confirmed defect families** — stable ID, invariant, recurrence, severity, representative introducing/fixing SHAs, hotspot files, escaped gate.
5. **Detector matrix** — defect family → instruction/hook/pre-commit/merge detector → red/green fixture → owner.
6. **Blind spots** — reasoning requirement, deterministic blocker, evidence checklist, owner, expiry.
7. **Bypasses** — fail-open paths, ignored configs, local machine paths, mutable baselines, suppressions, non-required CI jobs.
8. **Rollout** — close bypasses first; highest-loss repeat families next; reasoning scan last.
9. **Success metrics** — recurrence by family, detector precision, suppression growth, gate latency, required-check coverage.
10. **Validation** — commands and exact outcomes; distinguish audit changes from pre-existing failures.

## Evidence record

Use one JSON object per confirmed chain:

```json
{
  "id": "SLOP-001",
  "invariant": "mutation requires resource ownership",
  "introducedBy": "sha-or-unknown",
  "fixedBy": "sha",
  "provenance": "agent-explicit|bot-explicit|human-explicit|unknown",
  "files": ["path"],
  "escapedGate": "missing authorization contract test",
  "detector": "rule-or-test-path",
  "redFixture": "path",
  "greenFixture": "path",
  "layer": "merge",
  "owner": "team-or-path",
  "blindSpot": false
}
```

## Classification rules

- Counts from keyword matching are candidate evidence only.
- Confirm recurrence from diffs/tests, not commit wording alone.
- Categories may overlap; never sum overlapping counts as unique defects.
- Separate code defect, weak test, and weak gate root causes.
- Attribute agent provenance only from explicit metadata or linked execution records.
- Prefer stable invariants over tool-specific rule names.
- Re-open every cited control/bypass before final output. Unsupported attribution becomes `unverified`, never fact.