‹ all agents

Warden

repo-audit

LIVE

Every row is a fact traceable to a check id, with evidence naming specific paths. Re-running on an unchanged tree produces byte-identical rows. The half nothing else does: whether your codebase is legible to an agent — guidance-file coverage, module size, generated-file markers, reproducible installs.

Triggers/w audit, or the dashboard button
Modelnone — detection is code, so it needs no key and costs nothing
Categoriescommunity · workflows · dependencies · settings · structure · legibility
Tiersmust fix · should fix · optional — and not_checked, never a silent pass
AvailabilityLive — running in production on every installation

No score and no percentage, anywhere. A single number would be gamed within a week and means nothing across repo types. And a check that could not run says so — the one thing an audit tool must never do is go quiet.

Levels & categories

tier

Must fix

Something is actively wrong or unprotected.

tier

Should fix

A real gap with a clear remedy.

tier

Optional

Worth doing; not urgent.

status

Not checked

We could not evaluate it — never reported as a pass or a fail.

Sample output

Its live report on this repo — 35 checks, verbatim. Real output from a production run — not a mock-up.

repo-audit · real output

## 🏰 Warden — repository posture report

**bytesbrains/wrokin** at `410a816` — 35 checks evaluated:
**1 must fix** · 4 should fix · 10 optional · 20 already right.

### 🔴 Must fix
- **Default branch is protected** — dev is covered by ruleset(s)
  dev-protection, but no status check is required `settings/branch-protection`

### 🟡 Should fix
- **Third-party actions pinned to a commit SHA** — 4 workflows use actions
  pinned to a mutable tag `workflows/pin-actions-by-sha`
- **Workflows declare explicit token permissions** — 3 workflows run with
  default GITHUB_TOKEN permissions `workflows/explicit-permissions`

### 🔵 Optional
- **Code areas have tests next to them** — 5 of 33 code directories have no
  test file in or beside them — a path-level fact, not coverage
  `structure/untested-areas`
- **No overcrowded directories** — apps/pi-backend/src/services (94 files)
  `structure/directory-fanout`

### ⚪ Not checked
- Code / secret scanning — the same status means "off" and "you may not look",
  so this can be confirmed but not refuted `settings/scanning-enabled`

Integrate this agent

Committing this to .wrokin/config.yml is the whole setup — validate against config.schema.json first. Or drive the setup API with a token.

.wrokin/config.yml

version: 1
agents:
  repo-audit:
    enabled: true

On demand: comment /w audit on any PR or issue — Warden is deterministic, needs no model and no API key, and works the moment the app is installed.

› Install on GitHub See the whole team