auditor:diff-audit

auditor-skill — Differential Audit (Mode 4)

Arguments: $ARGUMENTS

1. Compute the changed set: git diff --name-only <base>..<head> (default main..HEAD). In a checkout you did not clone yourself, every git call carries the OUTPUT-RULES.md Rule 11c flags.
2. Run Phase 0.5 Context Reconstruction on changed functions + their direct callers/callees (1-hop).
3. Risk-classify changed files (auth / crypto / value-transfer / validation-removal = HIGH). Git-blame removed security code (in a checkout you did not clone: GIT_NO_LAZY_FETCH=1 git --no-pager -c core.fsmonitor=false -c log.showSignature=false blame --no-textconv --no-ext-diff <rev> -- <path>, Rule 11c) — code deleted in a “fix” / “CVE” commit is a CRITICAL regression.
4. Run only the checklist items + known-vectors matching the changed files’ language/domain, through the Rule 5b gate.
5. Dependency lane. If the changed set touches a manifest or lockfile (Cargo.toml, Cargo.lock, package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock, pyproject.toml, uv.lock, poetry.lock, requirements*.txt, go.mod, go.sum), run checklist 11 §11.11 on the dependency delta. Baseline: this run’s <base>..<head>; a re-audit passes the last audited ref as <base>. Enumerate every changed entry, artifact-diff what the §11.11 coverage budget names — fetched from the registry, never installed or built — and verdict SC-059..062, stating how many changed packages were left without an artifact diff. A one-line lockfile bump can bring in a whole new release, so the changed lines alone are not the reviewed code.
6. Emit audit_<n>/PR-REPORT.md — changed-surface verdicts + findings only, plus a Dependency delta section when step 5 ran. Reuses the methodology corpus; skips whole-repo discovery. Output hygiene and any outside-service disclosure follow OUTPUT-RULES.md Rule 11d / 11b.