The audit lifecycle
Every audited phase follows this sequence:Coverage: PASS or Approval: PASS for an audited phase unless the artifact ends with Audit: PASS. The agent cannot lock the artifact unless both gates pass. There are no shortcuts.
Which phases require auditing
| Phase | Artifact |
|---|---|
| Phase 1 — AS-IS | 01-as-is.md |
| Phase 1.5 — Root Cause (debug mode) | 01.5-root-cause.md |
| Phase 2 — TO-BE plan | 02-to-be-plan.md |
| Phase 3 — Implementation summary | 03-implementation-summary.md |
| Phase 3.5 — Code review | 03.5-code-review.md |
| Phase 4 — Test summary | 04-test-summary.md |
| Phase 6 — Decisions update | 06-decisions-update.md |
| Phase 7 — State update | 07-state-update.md |
| Phase 8 — Memory impact | 08-memory-impact.md |
Coverage Gate and Approval Gate
Every audited phase ends with two mandatory gates: Coverage Gate — proves the artifact addresses everything relevant in its inputs, including any applicable addenda. The agent must demonstrate that nothing was silently skipped. Approval Gate — proves the artifact is actually ready to proceed to the next phase. For Phase 5 (manual QA), human or hybrid modes require explicit user sign-off before this gate can pass. Both gates must pass before the artifact can lock. A phase that locks without both gates is a workflow violation.Addenda
Locked artifacts must not be edited. If a later phase discovers a gap, an error, or missing information in an earlier locked phase, you use an addendum instead. Addenda live at:- List relevant addenda under
Inputsin the current phase artifact - Re-read them as part of
## Effective Inputs Re-read - Explicitly reconcile them in
## Earlier Phase Reconciliation
Requirement Completion Status
Every audited phase must include a## Requirement Completion Status section that accounts for every in-scope requirement (R#). Each requirement needs an explicit disposition:
| Disposition | Meaning | What’s required |
|---|---|---|
implemented | Code was written to satisfy this requirement | Must cite Changed Files |
verified | This requirement was validated, not just implemented | Must cite Changed Files and distinct verification evidence |
deferred | Intentionally postponed | Must cite Deferred By and rationale |
out-of-scope | Not part of this run | Must cite Scope Decision |
implemented or verified without concrete Changed Files. You cannot mark verified without separate verification evidence — citing the same code that implements the requirement is not sufficient.
Locking an artifact
AfterAudit: PASS, Coverage: PASS, and Approval: PASS, lock the artifact using the recursive-lock script:
Status: LOCKED, LockedAt, and LockHash to the artifact. Do not manually edit those fields — a manual edit will produce a LockHash mismatch that the verify script will catch.
To verify all locks in a run: