/debt-audit

---
description: Audit the four agentic-debt types (Authority Sprawl, Contract Gap, Observability Gap, Validation Gap) over the recent sprint and produce a GOVERNANCE.md update proposal.
---

Using the last two weeks of commits (`git log --since=2.weeks`) and operational metrics, audit agentic debt.

1. **Authority Sprawl** — cases where agent or tool authority scope expanded implicitly. Authority changes not reflected in GOVERNANCE.md.
2. **Contract Gap** — modules or agents added without a contract (input/output, refusal, failure modes).
3. **Observability Gap** — decision paths missing logs or traces.
4. **Validation Gap** — output paths without evaluation criteria; high-risk actions without guardrails.

## Priority criteria

Apply the following to judge priority quantitatively.

- **High** — assign High if any of the following apply.
  - Touches security or regulated paths (PII, payments, auth, regulated data).
  - Touches customer-facing surfaces (externally exposed API, customer responses).
  - Touches irreversible actions (delete, transfer, legal statement, prod deploy).
  - High-risk decision paths executed autonomously.
- **Medium** — assign Medium if any of the following apply.
  - Touches cost tracking, agent collaboration, or operational metrics.
  - Medium-risk decisions (mid-range refunds, coupons, business automation).
  - Affects internal users.
- **Low** — anything else: internal tooling, developer experience, code style.

## Output format

For each debt item, output the following.

- Origin (file:line citation).
- Corresponding OCLS phase (OWN / CONTRACT / LAYER / SHARPEN).
- Related pattern (one of the eight reopt patterns).
- GOVERNANCE.md update proposal (section name and the wording to add).
- Priority (High / Medium / Low) + a one-line rationale.

Save the final report to `docs/debt-<today>.md`. This report becomes the input to the next cycle's assessment (phase 01).

## Example item

```
### [High] Authority Sprawl — src/tools/prod-rollback.ts:18

- OCLS: OWN
- Related patterns: Module Contract, Human Approval
- Current: AgentContext implicitly grants prod-rollback authority, no approval
- GOVERNANCE.md updates:
  - Section "1. Ownership Structure" — add row `prod-rollback | DevOps Lead | Human | Pre-approval required`
  - Section "2. Judgment Contracts" — declare refusal conditions and approval targets for the rollback tool
- Rationale: rolling back a prod deploy is an irreversible action
```