last-call

The audit you run right before a private repository goes public. An agent skill that sweeps for personal and machine leaks, finds documentation that has drifted from the shipped code, names what shipped with no documentation at all, and reports a commit history whose subjects and bodies expose how the author works.

User: /last-call

Agent: [inventory] 84 tracked files, 41 commits, no remote, no tags.
       History rewrite is free.

       [sweep + consistency + coverage, in parallel]

       4 documents cite a gitignored directory — one of them calls it
       the schema of record.
       A flag that posts to a webhook appears in no document and in
       no help page.
       SECURITY.md says the tool "reads only the file passed on the
       command line". Config discovery walks parent directories.
       README says the export format is unstable. It was frozen 30
       commits ago and has a passing compatibility test.

       Fixes applied, gate green, one commit.

       History: 9 slop subjects, 7 commits with no body, 3 bodies that
       narrate your terminal. Four options — which?

The audit is the program. The agent is the runtime. The history rewrite is the operator's decision, always.

Why this and not a linter

A linter reads logic. This reads strings and history.

A correct, well-tested program can leak a home directory, cite a file nobody outside can open, describe a smaller security surface than it has, and carry thirty commit messages written for an audience of one. Nothing fails. Every test passes. It all becomes permanent the moment the repo is cloned.

Quick start

Clone into your agent's skill directory:

git clone https://github.com/TGPSKI/last-call.git ~/.agents/skills/last-call

Or symlink an existing checkout:

ln -s ~/git/TGPSKI/last-call ~/.agents/skills/last-call

Then, in the repo you are about to publish:

Run last-call before I make this public.

The scripts run standalone too, against any git repo:

scripts/inventory.sh      ~/git/myproj   # surface, and what a rewrite costs
scripts/sweep.sh          ~/git/myproj   # mechanical leak sweep
scripts/history-audit.sh  ~/git/myproj   # slop, bodyless, exposing commits

They need git, grep and a POSIX shell. They report; they never change anything.

The seven phases

Phase	Asks	Reads
1. Inventory	What ships, and what does a rewrite cost?	git ls-files, remotes, tags
2. Leak sweep	What must not ship?	every tracked file
3. Consistency	Where do the docs contradict the code?	source first, docs second
4. Coverage	What shipped with no documentation?	the user-facing surface
5. Prose	Which lines change no decision?	every document
6. Fix and gate	Does it still work?	the repo's own gate
7. History	What does the log expose?	every commit message

Phases 2–5 are independent and run in parallel. Phase 6 blocks on them. Phase 7 blocks on the operator.

What it finds that you will not

• Documents citing gitignored paths. A tracked file naming _private/handoff.md as normative leaks the private working process and sends every reader to a file that does not exist for them. The highest- value class, and no generic grep finds it.
• Undocumented outbound writes. A subprocess call, an HTTP request, a push to a local daemon — appearing in no README, no help text, and no security policy. A coverage gap and a security-surface gap at once.
• Security-doc drift. It is written early, describing a small program, and the program's read surface only grows. "Opens exactly the file given on the command line" stops being true and nothing fails.
• Stale claims. A sentence true when written that has become misleading — usually a claim about the absence of work, against a history that shows the work happening.
• Pinned hashes in prose. They rot with nothing failing. State the version; name the command that prints the live value.
• Convention fiction. A contribution rule no commit has ever followed. Usually a wrong rule, not a hundred wrong commits.

What's here

File	Role
SKILL.md	The seven-phase workflow the agent follows
scripts/inventory.sh	Publication surface, artifacts, rewrite cost, cited-but-ignored paths
scripts/sweep.sh	Identity, credentials, endpoints, work markers, artifacts
scripts/history-audit.sh	Slop subjects, bodyless commits, exposing bodies
references/LEAKS.md	The seven leak classes, and which ones grep cannot find
references/CONSISTENCY.md	Code-vs-docs method; the security-surface checklist
references/HISTORY.md	Rewrite mechanics: root squash, non-interactive reword, verification
references/PROSE.md	words-are-cheap as a checklist
examples/worked-audit.md	A composite run, by phase — classes real, figures invented

Rules the workflow holds

• The history rewrite needs approval in the current session. Not implied by "audit the repo", not implied by the repo being private. Every other phase is reversible from the working tree; this one is why the backup branch exists.
• A real quote is surfaced, never stripped silently. Load-bearing evidence and a personal leak look identical to a grep. Paraphrasing turns observed evidence into authored assertion — a real cost, and the operator's call.
• Nothing found is deleted. Stale branches, orphaned refs and leftover tags are reported. Removing them is the operator's decision.
• The tree is the invariant. After any rewrite, git diff --stat <backup> <branch> must be empty. Messages change; code does not.
• A clean grep is not a clean repo. Greps find known shapes. The three classes that matter most are found by reading.

Related

directed-workflows encodes Inspect-Decide-Generate for configuration. abductive-triage encodes Observe-Discriminate-Narrow for diagnosis. This encodes Sweep-Reconcile-Gate for publication, and shares their premise: expert reasoning as structured markdown an agent executes.

License

GNU General Public License v3.0.

Author

Tyler Pate (@TGPSKI), 2026.