Quality audit frameworks: the seven objectuve-* pillars
Objectuve runs seven sibling audit skills, each judging a different layer of the product — or, for the seventh, the description of the product itself. All seven live in .claude/skills/ and are description-triggered — an agent (or a human via Claude Code) invokes one by naming it and a verb.
| # | Pillar | Judges | Skill path | Crew owner |
|---|---|---|---|---|
| 1 | Hallmark | A single frame — one screen or component | .claude/skills/objectuve-hallmark/ | Desi |
| 2 | Throughline | The line through frames — a multi-step flow | .claude/skills/objectuve-throughline/ | Desi |
| 3 | Keystone | The load-bearing structure underneath both — server-side and cross-service contracts | .claude/skills/objectuve-keystone/ | Codi |
| 4 | Signal | Whether a failure anywhere in the other pillars is actually visible | .claude/skills/objectuve-signal/ | Dave |
| 5 | Bastion | Whether every place trust changes hands actually holds | .claude/skills/objectuve-bastion/ | Roy |
| 6 | Compass | Whether a surface still serves the user's goal, not engagement/revenue as an end in itself | .claude/skills/objectuve-compass/ | Penny |
| 7 | Atlas | Whether the map the other six read from still matches the territory | .claude/skills/objectuve-atlas/ | Dori |
| Verbs | Edits app code? | Gate list | Pre-emit rubric | |
|---|---|---|---|---|
| Hallmark | audit, sweep, redesign, study | redesign does | 70 gates, 11 categories (A–K) | P/H/E/S/R/V |
| Throughline | audit, walk, trace | No — report only | 52 gates, 8 categories (A–H) | O/M/C/R/F/X |
| Keystone | audit, map, trace | No — report only | 56 gates, 8 categories (A–H), 16 blocking | B/C/I/L/D/O |
| Signal | audit, sweep | No — report only | 44 gates, 6 categories (A–F), 15 blocking | T/A/P/E/R/S |
| Bastion | audit, sweep | No — report only | 38 gates, 5 categories (A–E), 15 blocking | B/E/S/T/I/N |
| Compass | audit, scan | No — report only | 24 gates, 4 categories (A–D), 8 blocking | A/C/T/I/O/N |
| Atlas | audit, sweep | No — report only | 44 gates, 6 categories (A–F), 14 blocking | C/L/A/I/M/S |
Locked source of truth per pillar:
| Pillar | Locked source of truth |
|---|---|
| Hallmark | DESIGN.md, design_system/css/tokens.css, design_system/tailwind-tokens.cjs, docs/brand/brand.md |
| Throughline | DESIGN.md Motion section, useModalAnimations, useToast/useHaptics tiers |
| Keystone | docs/architecture/ddd/00–06, domain_events.rb, public_record.rb, .rubocop.yml |
| Signal | CLAUDE.md Common Gotchas, docs/operations/deployment.md, health_controller.rb, featureFlags.ts, cronotab.rb |
| Bastion | CLAUDE.md Common Gotchas, clerk_jwt_verifier.rb, graphql_controller.rb, authorization.rb, public_record.rb, routes.rb |
| Compass | MISSION.md Values/Commitments, docs/brand/brand.md Anti-Social App section, docs/product/pricing-philosophy.md, useScreenTimeNudge.ts, docs/development/notification-surfaces.md |
| Atlas | CLAUDE.md, docs/reference/claude-quick-ref.md, MISSION.md, DESIGN.md, docs/operations/planning-canon.md |
Evidence-harvester parity
Not every pillar persists a .planning/ evidence bundle before scoring a finding — this table is the map of which do, which don't, and why. All evidence directories below are gitignored and regenerated on demand; none are committed to the repo.
| Pillar | Skill path | Verbs | Registry | Harvester script | Evidence path |
|---|---|---|---|---|---|
| Hallmark | .claude/skills/objectuve-hallmark/ | audit, sweep, redesign, study | scripts/hallmark-surfaces.mjs | scripts/capture-hallmark-evidence.mjs | .planning/hallmark-evidence/<surface>/ |
| Throughline | .claude/skills/objectuve-throughline/ | audit, walk, trace | scripts/flow-journeys/ (10 journey modules) | scripts/capture-flow-evidence.mjs | .planning/flow-evidence/<journey-id>/ |
| Keystone | .claude/skills/objectuve-keystone/ | audit, map, trace | scripts/arch-domains.mjs | scripts/capture-arch-evidence.mjs | .planning/arch-evidence/<domain>/ |
| Signal | .claude/skills/objectuve-signal/ | audit, sweep | scripts/signal-surfaces.mjs | scripts/capture-signal-evidence.mjs | .planning/signal-evidence/<surface>/ |
| Bastion | .claude/skills/objectuve-bastion/ | audit, sweep | scripts/bastion-surfaces.mjs | scripts/capture-bastion-evidence.mjs | .planning/bastion-evidence/<surface-id>/ |
| Compass | .claude/skills/objectuve-compass/ | audit, scan | references/compass-surfaces.md (markdown registry) | prose-only — by decision | none |
| Atlas | .claude/skills/objectuve-atlas/ | audit, sweep | scripts/doc-surfaces.mjs (24 surfaces) | scripts/capture-doc-evidence.mjs | .planning/atlas-evidence/<surface>/ |
Compass ships no harvester and writes no evidence bundle by decision, not by omission — it's deliberately the lightest pillar in the family, since its gates are policy/intent judgements (does this nudge quietly serve engagement over the user's stated goal?) that only a source read against MISSION.md/docs/brand/brand.md can settle, not a fact a harvester script can extract and cache. See objectuve-compass/SKILL.md's "What a reader checks instead" section for the exact, rerunnable scan command set this implies.
All seven share one discipline: never invent — a token, a gate, a bounded context, a domain event name, an incident, a Value/Commitment, or a canonical form. If the thing you need doesn't exist in the locked source of truth, that's a finding to report, not a value to mint.
When to reach for which one
Ask, in order:
- Is the defect visible in one still frame (a screenshot, a single click-through state)? → Hallmark.
- Is it only visible across two or more frames or points in time (order, timing, transition, interruption, repetition)? → Throughline.
- Is it invisible to a screenshot or click-through, and structural — boundaries, contracts, coupling, data integrity, server-side? → Keystone.
- Would the "bug" disappear the instant it were loudly, visibly surfaced to an engineer? If yes — the defect is that a failure or mismatch is invisible, not the underlying correctness bug — → Signal.
- Is it specifically about whether a trust boundary holds — an auth guard, an id-format boundary, a secret comparison, a token's single-use/expiry property? → Bastion.
- Does it span multiple surfaces or sessions and concern whether a mechanic quietly serves engagement/revenue instead of the user's stated goal — independent of whether any single screen, flow, or line of code is individually "correct"? → Compass.
- If the doc/skill/runbook describing the system were deleted entirely, would the finding disappear? If yes — the written artifact is the defect — → Atlas.
A single bug can produce findings in more than one framework at once and they aren't duplicates — they're different fixes for different layers. The canonical example, from the Keystone skill: a double-submit bug on a "Create goal" button. Throughline finds it at the button (no client-side debounce, gate g27). Keystone finds it at the mutation (no idempotency guard on AddGoal, gate g34). Both get filed. The same pattern recurs across every adjacent pair of pillars — see each section's "Routing rule" below.
Hallmark (the frame)
Adapted from Hallmark — the brand-picking engine (themes, macrostructures, diversification log) is deleted because Objectuve already has one locked brand. What survives is the judgement: the verbs, the slop-test gates, the universal disciplines, the 8-state component flow, and the pre-emit self-critique.
Scope: any screen or component in ionic_frontend, admin_dashboard, or marketing_landing.
Verbs
| Verb | Does | Edits files? |
|---|---|---|
audit | Scores a screen/component against the 70 slop-test gates + P/H/E/S/R/V rubric. Produces a findings list. | No |
sweep | Runs scripts/capture-hallmark-evidence.mjs for a scope, verifies the artifacts landed, summarizes the evidence bundle. | No — writes evidence only |
redesign | Reworks the visual layer of a surface, staying inside the locked brand. | Yes |
study | Extracts design DNA from a reference URL/screenshot, diffs it against the locked system, produces a drift report. | No |
Gate categories (references/slop-tests.md)
A. Token integrity · B. Color discipline · C. Hierarchy & layout · D. State coverage · E. Dark mode parity · F. Motion · G. Anti-social-app philosophy · H. Honest UI · I. Microcopy & voice · J. Touch & accessibility · K. Story fixture fidelity.
Pre-emit self-critique — P/H/E/S/R/V
Polish (would this pass for a shipped screen in Linear/Stripe/Things 3?) · Hierarchy (exactly one primary action?) · Empty/edge states (loading, empty, error designed, not afterthoughts) · Spacing & system (4px grid, real tokens) · Restraint (gold scarce, one accent, no fake chrome) · Voice (action-forward microcopy, no "AI" label, no engagement bait).
Real usage
The pre-beta design remediation milestone ran a read-only Hallmark audit across all three surfaces, surfaced eight beta-blocking P0 defects plus a token-discipline and accessibility backlog, then fixed every item before shipping. See .planning/audits/hallmark-pre-beta-2026-06-07.md and the published narrative at docs/milestones/v3.11.25-hallmark-remediation.md. One of that sweep's fixes landed back in the gate list itself — gate 7's spacing scale gained 1.5 to match DESIGN.md §SPACING. The monthly Desi — Design-debt audit monthly autopilot (see multica-autopilots.md) is the recurring cadence that keeps this pillar's findings from accumulating unaudited between milestones.
Throughline (the flow)
The sequence-level quality bar. Where Hallmark judges a single frame, Throughline judges the order, timing, transitions, interruptions, and endings of a multi-step user flow — onboarding, goal creation, daily check-in, communities, public sharing, monetization, and more.
Scope: any multi-step journey with an evidence directory under .planning/flow-evidence/<journey-id>/.
Verbs
| Verb | Does | Edits files? |
|---|---|---|
audit | Scores one or more journeys against the 52 flow gates + O/M/C/R/F/X rubric, using captured evidence + a code trace. Produces a findings list. | No |
walk | Runs scripts/capture-flow-evidence.mjs for named journeys, verifies artifacts landed, summarizes run.json. | No (writes evidence, not app code) |
trace | Static code-path map of a flow — routes/guards/meta flags, mutations per step, cache writes, celebration triggers, localStorage flags. Feeds audit when no dev server is available. | No |
Gate categories (references/flow-gates.md, 52 gates, g1–g52)
A. Entry & orientation (g1–6) · B. Step transitions (g7–13, 1 blocking) · C. Loading handoffs (g14–19) · D. Interruption & recovery (g20–27, 5 blocking) · E. Feedback & celebration (g28–34, 2 blocking) · F. Momentum & friction (g35–41, 1 blocking) · G. State integrity (g42–47, 4 blocking) · H. Release & anti-social philosophy (g48–52, 1 blocking).
Pre-emit self-critique — O/M/C/R/F/X
Orientation (does the user know where they are, why, what's next?) · Momentum (does every step earn its place?) · Continuity (no jank, double-render, layout shift across transitions?) · Recovery (survives back, refresh, abandon, offline, double-tap?) · Feedback (right toast/haptic/ celebration tier, fired exactly once?) · eXit (does completion release the user with no detour?).
Real usage
Throughline shipped via PR #1343 (feat(throughline): user-flow audit framework + evidence tooling + pilot) and ran a two-flow pilot before a full 10-flow sweep (the ten journeys registered under scripts/flow-journeys/). The full-sweep audit re-verified both pilot blockers were fixed on master (a legendary-celebration stacking bug and a goal-create double-submit) and surfaced two new blockers in flows the pilot never touched — a stale-cache Enneagram result screen (g42) and a dead-end route on an ally-invite terminal screen (g38). See .planning/audits/throughline-fullsweep-2026-07-08.md and the earlier .planning/audits/throughline-pilot-2026-07-08.md. The monthly Desi — Throughline trace sweep monthly autopilot (see multica-autopilots.md) is the recurring cadence for this pillar.
Keystone (the structure)
The structure-level quality bar for the server side and every cross-service seam it publishes a contract through. A screen can look perfect and a flow can feel seamless while the interaction underneath silently double-charges a card or leaks another context's model — that's Keystone's territory.
Scope: rails_api/ (interactions, models, GraphQL types/mutations, jobs, services), agent_runner/ and its webhook contract back to Rails, the GraphQL contract as consumed by ionic_frontend/src/constants/graphql/ (18 modules) and admin_dashboard/src/graphql/ (12 modules), and cross-service seams (Stripe, RevenueCat, Agent Runner webhooks, OIDC/HMAC auth, domain events).
Verbs
| Verb | Does | Edits app code? |
|---|---|---|
audit | Scores a scope (one or more registry domains, --all, or a diff/branch) against the 56 arch gates + B/C/I/L/D/O rubric, using harvested evidence + source reads. Produces a findings list. | No |
map | Runs scripts/capture-arch-evidence.mjs for a scope, verifies artifacts landed. | No — writes evidence only |
trace | Static vertical-slice map of one capability: GraphQL mutation/query → interaction → models/validations → domain events → subscribers → jobs → webhooks → consumer query shape. | No |
Audit scopes:
- Domain sweep — one or more
scripts/arch-domains.mjsregistryids (e.g.audit goal_tracking). The registry currently has 14 domains (goal_tracking,social,user_identity,gamification,ai_coaching,ai_workforce,billing,feedback,critical_path,teams,content_moderation,admin,gdpr,platform). - Full sweep —
--all, every registered domain. - Diff sweep — changed files on a branch/PR mapped to domains via the registry's globs; files matching no domain glob are listed explicitly as cross-cutting/unregistered, never silently dropped.
Gate categories (references/arch-gates.md, 56 gates, g1–g56)
A. Boundary integrity (g1–7, 2 blocking) · B. Contract discipline (g8–15, 3 blocking) · C. Domain model integrity (g16–22, 2 blocking) · D. Coupling & cohesion (g23–30, 2 blocking) · E. Side effects & consistency (g31–38, 4 blocking) · F. Understandability & language (g39–44, 1 blocking) · G. Testability & coverage (g45–50, 1 blocking) · H. Operational integrity (g51–56, 1 blocking).
Pre-emit self-critique — B/C/I/L/D/O
Boundary (business logic in the interaction, not the resolver/controller/ model?) · Contract (does the API tell the truth — ids, nullability, error shape, defaults?) · Integrity (writes guarded, transactional where multi-write, idempotent where retried?) · Language (names match docs/architecture/ddd/02-ubiquitous-language.md?) · Decoupling (cross-context writes go through a domain event or documented seam?) · Operability (errors reach Sentry, jobs run on Sidekiq/Crono, failure stance stated?).
Known doc/code drifts it tracks rather than resolves
Keystone's references/system-vocabulary.md deliberately carries three confirmed drifts forward as tracked facts instead of silently resolving them: the bounded-context count (8 vs. 9 across docs), the coupling-point tally (4 vs. 5 vs. a separately tracked 6th), and the domain-event name regex (the docs' looser pattern vs. the code's stricter one). Every Keystone report on these topics cites the same three drifts rather than re-deciding them — this is intentional, not an oversight.
Real usage
The monthly Codi — Keystone architecture audit monthly autopilot (see multica-autopilots.md) rotates 2 of the 14 registry domains per run rather than a full 56-gate sweep every time — a whole-domain score across all 14 is too expensive to run monthly in full.
Signal (the observability)
The observability-truth layer. Where Hallmark, Throughline, and Keystone judge whether a surface is visually clean, flows well, and is structurally sound, Signal judges something orthogonal to all three: will anyone find out when it breaks? A guard can be perfectly placed, a flow can feel seamless, and an interaction can be architecturally sound while its failure path silently swallows an exception, a flag fails closed with zero operator-visible signal, or a "required" CI check quietly stops running on the PRs it's supposed to gate.
Scope: guards, limiters, and rescued exceptions across rails_api/app/interactions/, rails_api/app/jobs/, rails_api/app/controllers/webhooks/; Sidekiq jobs and Crono crons (rails_api/config/cronotab.rb); feature flags and env vars (ionic_frontend/src/lib/featureFlags.ts, backend ENV.fetch/credentials reads), checked for frontend/backend/PostHog parity; product/analytics events (PostHog capture() call sites); CI workflows in .github/workflows/ (required-check integrity: branch filters, concurrency groups, continue-on-error terminal re-raise, secret-output suppression, jq/?? footguns); health/readiness endpoints (GET /health, GET /up).
Verbs
| Verb | Does | Edits app code? |
|---|---|---|
audit | Scores a scope (a PR/diff, a feature area, or a single file) against the 44 signal gates + T/A/P/E/R/S rubric, using harvested evidence + source reads. Produces a findings list. | No |
sweep | Runs scripts/capture-signal-evidence.mjs for a scope, verifies artifacts landed, summarizes the evidence bundle. | No — writes evidence only |
Audit scopes are registry ids from scripts/signal-surfaces.mjs, --all for a full sweep, or a diff/branch sweep mapped to surfaces via the registry's globs.
Gate categories (references/signal-gates.md, 44 gates, 15 blocking)
A. Failure visibility — g1–g8 (4 blocking) · B. Fail-open/fail-closed declaration — g9–g16 (2 blocking) · C. Flag/config parity — g17–g23 (2 blocking) · D. Event/ analytics trustworthiness — g24–g30 (2 blocking) · E. CI/deploy gate integrity — g31–g38 (4 blocking) · F. Health-check fidelity — g39–g44 (3 blocking).
Pre-emit self-critique — T/A/P/E/R/S
Traceable (does a production failure reach a human, not just a rescued-and-swallowed exception?) · Actionable (does the signal say what broke and where — a file:line/event name/metric, not a generic message?) · Parity (does a flag/config match on every side that reads it?) · Explicit (is the fail-open/fail-closed stance stated and does it match the risk?) · Reproducible (can the finding be reproduced from a citation, not asserted from memory?) · Scoped (does the finding stay inside signal's territory — invisibility — rather than re-litigating the underlying correctness bug?).
Locked evidence, one notable exception
Signal's primary locked evidence is CLAUDE.md's Common Gotchas section (10+ real production incidents matching this exact failure shape) and docs/operations/deployment.md. One incident — the Crono at:-on-sub-day-period outage — is not in CLAUDE.md; it lives only in cronotab.rb's header comment and the regression spec rails_api/spec/config/cronotab_spec.rb. Cite those two files for it, never CLAUDE.md.
Real usage
The monthly Dave — Signal instrumentation audit monthly autopilot (see multica-autopilots.md) runs the recurring sweep; Signal's gate H-lineage (operational integrity) started life as Keystone gates 51–56, which still exist there for structural operability while Signal owns the broader instrumentation-truth sweep across all pillars.
Bastion (the trust boundary)
The trust-boundary quality bar. Where Keystone judges whether the structure underneath a screen is sound and Signal judges whether a failure is honestly visible, Bastion judges the narrower, sharper question: at every point trust changes hands, does the code actually verify what it's trusting? A mutation can be architecturally clean, fully observable, and still let a non-admin call an admin-only action, or accept a client-supplied integer id where a public_id was required, or replay a single-use token twice.
Scope: every place a trust boundary is crossed in rails_api/ — GraphQL mutations/resolvers, app/controllers/graphql_controller.rb's three current_user resolution paths (Clerk, Fallback, MagicLink), webhook/ integration receivers, token-issuing/verifying services (ClerkJwtVerifier, StepUpTokenVerifier, Gdpr::ExportDownloadToken, VerifyMagicCode/ MagicCode), config/initializers/rack_attack.rb + AdminIdentityResolver, and secret-bearing env vars.
Verbs
| Verb | Does | Edits app code? |
|---|---|---|
audit | Scores a scope (one or more registry surfaces, --all, or a diff/branch) against the 38 bastion gates + B/E/S/T/I/N rubric, using harvested evidence + source reads. Produces a findings list. | No |
sweep | Runs scripts/bastion-surfaces.mjs against a scope, confirms every registry surface still resolves to a real file/route, summarizes counts. | No — writes/prints evidence only |
Gate categories (references/bastion-gates.md, 38 gates, 15 blocking)
A. Boundary enforcement — g1–8 (3 blocking) · B. Identity correctness — g9–16 (4 blocking) · C. Secret handling — g17–23 (3 blocking) · D. Injection/validation — g24–30 (2 blocking) · E. Session/token lifecycle — g31–38 (3 blocking).
Pre-emit self-critique — B/E/S/T/I/N
Boundary-crossed-safely · Evidence-backed (real file:line, never an invented citation) · Scoped-to-real-risk (money, auth, PII — not a theoretical worst case) · Testable (a concrete repro, not just an assertion) · Identity-correct (server-resolved identity vs. client-supplied identifiers) · No-new-surface (prefer one of the three existing verified token shapes over a fourth ad hoc one).
Real usage
Bastion runs two ways: a real-time, diff-scoped pass on every security-sensitive PR (see Roy's "Security-sensitive diffs" section in multica-agent-crew.md), and a full, unrotated 38-gate sweep every month via the Roy — Bastion security audit monthly autopilot (see multica-autopilots.md). Unlike Keystone's domain rotation, Bastion's gates are scoped to specific call sites and surfaces rather than entire architectural domains, so a full sweep is cheap enough to run every time without rotation. One confirmed inconsistency worth citing rather than re-discovering: Gdpr::ExecuteExport achieves admin-equivalent gating via a hand-rolled role check instead of authorize_admin_role! — a should-fix, not a blocking finding, since the guard itself is correct, just inconsistent with the shared concern.
Compass (the business model)
The business-model/anti-pattern integrity layer. Where Hallmark, Throughline, Keystone, and Signal judge a surface's frame, flow, structure, and observability, Compass judges something orthogonal to all four: does this surface still serve the user's stated goal, or has it quietly started serving engagement/retention/ revenue as an end in itself? A screen can pass every Hallmark token check, a flow can pass every Throughline transition gate, an interaction can be architecturally clean per Keystone, and a failure can be fully observable per Signal — while the underlying feature is a guilt-framed streak nudge, a soft paywall on a feature that should be free, or a "come back" notification with no real event behind it. Compass is the one pillar whose job is fundamentally preventative — Objectuve has not shipped a confirmed dark-pattern incident, so this skill exists to keep it that way rather than to clean up after one.
Scope: notification/nudge/celebration surfaces (the 12 documented in docs/development/notification-surfaces.md, plus session-length nudges and lifecycle reminder crons); monetization/upgrade surfaces (SupporterUpgradeModal.vue, Teams billing/upgrade views); streak/gamification surfaces (streak display, streak-freeze/grace mechanics, badge/XP/rank copy); feed/list surfaces; and copy review against brand.md's "Out of Brand" list.
Verbs
Compass is deliberately the lightest pillar — it ships no dedicated evidence-harvester script the way Signal/Throughline do; scan runs its checks directly via grep/read against the surfaces in references/compass-surfaces.md rather than persisting a .planning/ evidence bundle first.
| Verb | Does | Edits app code? |
|---|---|---|
audit | Scores a scope (a PR/diff, a feature area, or a single file) against the 24 compass gates + A/C/T/I/O/N rubric, using direct source reads. Produces a findings list. | No |
scan | Lightweight grep pass over the surfaces registry for known anti-pattern strings (guilt-copy phrases, countdown/scarcity copy, Date.now()-based dismissal keys, non-dismissible modal props). | No — read-only |
Gate categories (references/compass-gates.md, 24 gates, 8 blocking)
A. Engagement-hook check — g1–g6 (2 blocking) · B. FOMO/urgency check — g7–g12 (2 blocking) · C. Monetization pressure — g13–g18 (2 blocking) · D. Session-length intent — g19–g24 (2 blocking).
Pre-emit self-critique — A/C/T/I/O/N
Action-forward (points the user toward a real action on their own goal, not re-engagement for its own sake) · Consented (opt-in and dismissible, never a forced interstitial) · Transparent (states the real mechanic, no hidden terms or implied urgency) · Impermanent (stays dismissed, doesn't re-fire on a wear-down schedule) · Optional (declining costs nothing functional) · Necessary (serves the user's stated goal, or the product would be better without it).
A confirmed documentation drift this pillar cites rather than resolves
MISSION.md and docs/product/pricing-philosophy.md currently disagree with each other on Supporter-annual and Teams pricing figures — a real, confirmed drift, not something Compass silently resolves one way.
Real usage
The monthly Penny — Compass business-model audit monthly autopilot (see multica-autopilots.md) is the recurring cadence. Compass's category D (session-length intent) is adjacent to Signal's event/analytics-trustworthiness category but judges intent/policy, not firing correctness — Signal owns whether an event fires exactly once and honestly, Compass owns whether the team is reading the number the right direction.
Atlas (the documentation truth)
The documentation-truth layer — the seventh pillar, and the only one whose territory is the other six's own evidence bases. Where Hallmark, Throughline, Keystone, Signal, Bastion, and Compass judge the system, Atlas judges the description of the system: does the map still match the territory? Code can be beautifully structured, observably instrumented, and correctly guarded while the document telling the next engineer — or the next agent — how it works describes a version that stopped existing three milestones ago. Atlas is the only pillar whose failures are self-concealing: a drifted doc reads exactly like a current one, which is why this skill leans hard on a mechanical harvester rather than judgement alone.
Scope: any written artifact that asserts something about this system, for humans or for agents — agent-facing (CLAUDE.md, .claude/skills/**, .claude/agents/**, .planning/*.md, the highest blast radius since it's acted on, not merely read) and human-facing (docs/**, root *.md, the six per-app READMEs). Out of scope: the live Multica workspace skills and agent prompts themselves (this repo's docs/guides/ copies are mirrors — Atlas audits the mirror's honesty about being a mirror, not the upstream config), and route drift (already gated by .github/workflows/route-drift.yml + docs_site/scripts/check-route-drift.mjs — cite that gate, don't re-derive it).
Verbs
| Verb | Does | Edits docs? |
|---|---|---|
audit | Scores a scope (a PR/diff, a doc surface, or a single file) against the 44 atlas gates + C/L/A/I/M/S rubric, using harvested evidence + source reads. Produces a findings list. | No |
sweep | Runs scripts/capture-doc-evidence.mjs for a scope, verifies artifacts landed, summarizes the evidence bundle. | No — writes evidence only |
Audit scopes are registry ids from scripts/doc-surfaces.mjs (24 surfaces, --all completes in ~7s across all 304 docs), or a diff/branch sweep.
Gate categories (references/atlas-gates.md, 44 gates, 14 blocking)
A. Code-claim liveness — g1–g8 (3 blocking) · B. Currency — g9–g16 (2 blocking) · C. Agent-context integrity — g17–g24 (2 blocking) · D. Single-source & contradiction — g25–g30 (2 blocking) · E. Navigability & coverage — g31–g37 (2 blocking) · F. Intent honesty — g38–g44 (3 blocking).
Category C's g17 has mechanical backing as of OBJ-2126: the harvester's chatArtifacts() detector flags an agent's own turn output leaking past a file's structural end (fence-balance breaks + first-person assistant-voice phrasing) — 29 live hits on claude_skills at time of writing; re-sweep with node scripts/capture-doc-evidence.mjs --surface claude_skills before citing that number. See references/atlas-gates.md's g17 and references/doc-vocabulary.md's "Category C — chat-artifact leakage" section for the sub-shapes and full count breakdown.
Pre-emit self-critique — C/L/A/I/M/S
Current (describes the code as it is now, not as it was when written) · Locatable (cited paths/symbols/lines/commands resolve today) · Authoritative (lives in exactly one place, others link to it) · Intent-honest (documents what exists, not what was planned or aspirational) · Machine-safe (would an agent loading this as context act correctly?) · Scoped (the defect is the documentation, not the code it describes).
Two traps this pillar exists to avoid
Asserted vs. contrastive — a line reading "Use Interaction::Base, NOT ActiveInteraction" is correct documentation that happens to contain the wrong string; that's contrastive, not a finding. Historical surfaces (rollout records, milestone narratives, PRDs) are point-in-time records — age alone is not drift there. See references/doc-vocabulary.md for the full locked inventory and the confirmed-drift list every canonical-fact claim must cite.
Sibling corruption
Several surfaces are another pillar's locked evidence: MISSION.md → Compass, DESIGN.md/brand.md → Hallmark, docs/architecture/ddd/** → Keystone, docs/operations/deployment.md → Signal, docs/architecture/authentication.md → Bastion. Drift there is always at least should-fix even when the doc looks harmless, because a sibling audit will cite it as ground truth.
Real usage
The Dori-owned Dori — Docs drift audit (objectuve-atlas) autopilot (see multica-autopilots.md) runs this pillar weekly against the high-priority doc surfaces. This very document (and its sibling reconciliation across multica-agent-crew.md, multica-autopilots.md, and multica-state.md) is itself an Atlas-class fix — a doc asserting there were three pillars when there are seven is exactly gate-D28-shaped sibling corruption: this doc is the ground-truth pillar count that the other six pillars' docs (and the crew/autopilot docs above) all need to stay consistent with.
The consistency anchor is a real, checkable back-link, not a prose claim: each of the other six pillars' SKILL.md files (.claude/skills/objectuve-<name>/SKILL.md for hallmark, throughline, keystone, signal, bastion, and compass) links back to this doc from its own ## Related skills section. grep -rl 'quality-audit-frameworks.md' .claude/skills/objectuve-{hallmark,throughline,keystone,signal,bastion,compass}/SKILL.md confirms all six.
Related references
- Multica Workspace Skills — how these
.claude/skills/audit skills (local, description-triggered) differ from always-on Multica workspace skills. - Multica Agent Crew — per-pillar crew ownership (Desi: hallmark, throughline · Codi: keystone · Dave: signal · Roy: bastion · Penny: compass · Dori: atlas) and the security-sensitive-diff review step.
- Multica Autopilots — the seven framework-tied monthly/weekly autopilots, one per pillar.
- Motion Vocabulary: Toast Dwell Tiers — the locked motion/feedback vocabulary Throughline gates cite.
- Design Context Reference — tokens, typography, and spacing Hallmark gates cite.
- DDD Overview — the bounded-context, ubiquitous-language, and domain-event docs Keystone gates cite.
- v3.11.25 — Hallmark Pre-Beta Design Remediation — the milestone that closed out a full Hallmark sweep.
Last updated: 2026-08-06 (OBJ-2126) — documented the Category C chat-artifact detector (chatArtifacts(), gate g17) added to the doc-evidence harvester, and cross-referenced it from the Atlas gate-category summary above.