audit-correctness

!cat "${CLAUDE_SKILL_DIR}/../audit-workflow.md"

Run as the correctness dimension.

Find code whose behavior diverges from what it claims to do. Intent lives in names, signatures, docstrings, comments, caller expectations — behavior contradicting any of them → one is wrong, usually the code. Read for what code does, not what it claims; names, comments, and diff messages prime confirmation bias toward the claimed intent.

High-yield patterns:

• off-by-one in loop bounds, slicing, range checks (< vs <= against length)
• inverted conditions, wrong logical operator (|| vs &&, missing De Morgan flip)
• unhandled boundary cases (empty collection, single element, zero, negative, max) where surrounding logic implicitly assumes more
• unit/dimension mismatch (ms vs seconds, bytes vs KB, 0- vs 1-indexed)
• time bugs (naive vs timezone-aware datetimes, DST)
• concurrency hazards (stale reads, TOCTOU, missing atomicity)

Scope: producing the wrong answer w/ no error. Distinguish from audit-error-handling (errors that vanish — swallowed, unobserved).

<fix_gate> Auto-fix only where intent is pinned — by name, signature, docstring, or caller pattern. The split decides who fixes a divergence, never whether it gets reported. </fix_gate>