Agent Config Audit

Authorized Scope

Apply this engine only within the user's requested task and existing explicit authorization. Loading or delegating to it grants no additional authority. Preserve report-only restrictions and the caller's target, host, provider, and cost limits. Existing approval satisfies a gate only for the same actions and scope; obtain approval before expanding them. Forward these limits to delegates.

Contract

Inputs:

• Workspace root
• Scope: full, dedup, stale, instructions, cursor, settings, or fix
• Optional list of repos/config files to include

Outputs: