oc-code-auditor

原文涵盖的主题

• Code Auditor
• /oc-audit — Command Reference
• Tri-Agent Architecture
• Why Three Agents?
• Phase 1: Auditor Agent
• Category Sweeps
• 1a. Security Sweep
• 1b. Performance Sweep

On first invocation, read references/orchestrator.md and follow its welcome protocol. Tri-agent code quality system: Auditor finds problems → Fixer proposes remediations → Verifier confirms the fixes actually solve the findings (not just cosmetic reshuffles). The Auditor-only mode (/oc-audit) runs a one-pass sweep and produces a findings report. The full harness (/oc-audit fix-all) chains all three agents for find → fix → verify. -- 1. Auditor bias: A single agent that finds AND fixes tends to minimize findings it can't easily fix, and over-report findings it already knows the fix for. Separating Auditor from Fixer keeps the audit honest. 2. Fix theater: When asked to "fix this code," LLMs commonly restructure the code cosmetically without actually solving the underlying problem. A separate Verifier that re-reads the original finding and the diff catches this — it asks "does this diff actually prevent the vulnerability / fix the bug / solve the performance issue?" without being influenced by the Fixer's explanation. 3. Scope creep: A fixer will "improve" adjacent code while fixing a finding, introducing unreviewed changes. The Verifier flags scope creep: "This diff changes 40 lines

这里只展示节选，请以完整原文和当前要求为准。