# agent-audit takes a single file path and derives the counterpart by scope detection

**Partially superseded by ADR-0025 (2026-09-15).** `agent-audit` merged with `skill-audit` into
`factory-audit`. Read `agent-audit` below as `factory-audit`'s agent flow. The single-file
invocation contract this ADR sets survives — `factory-audit` dispatches at Step 0 on the target
path, so the caller still names one file and the script still derives the rest — but the set of
paths that contract accepts is **narrower**. The agent flow is taken by an `*.agent.md` file, or by
a `.md` file whose *immediate* parent directory is named `agents/`, at any scope:
`.claude/agents/x.md` is accepted, `.apm/agents/sub/x.md` is refused. "A path under `.apm/agents/`"
is not the rule — ADR-0025 rejects that phrasing as both wider than the script and circular. An
agent `.md` outside an `agents/` directory was audited before the merge and now stops at exit 2,
the never-ran tier, because a single auto-detecting entry point classifies on the path alone and
detection never guesses.
ADR-0020 recorded the merge as reopening this ADR; that is the clause it reopened.

`agent-audit` validates agent definition file pairs (Claude Code `.md` + Copilot `.agent.md`). The skill accepts a path to either file and derives the counterpart using scope detection rather than requiring the caller to name both files or supply a root directory.

## Considered options

**Directory input (rejected)** — analogous to `skill-audit <skill-dir>`. Rejected because agents have no per-agent directory. At plugin scope both files are flat in `agents/`; at project scope they are in completely different directories (`.claude/agents/` and `.github/agents/`). No single directory contains both files across all scopes.

**`<name> <root>` signature (rejected)** — mirrors `new-agent.sh <name> <root>`. Rejected because it requires the caller to supply two pieces of information when one (the file path) is sufficient. The file path already implies the agent name (filename stem) and the root (found by walking up). Forcing the caller to re-supply what the script can infer is the kind of convention knowledge the script exists to encapsulate.

## Consequences

- The unit of validation is the pair. A missing counterpart is always a FAIL — an orphan file is incomplete by definition.
- Scope detection walks up from the input file: first directory containing `plugin.json` → plugin scope; first directory containing `.git` without `plugin.json` → project scope; path under `~` with neither → user scope.
- At user scope the derivation crosses filesystem locations (`~/.claude/agents/` ↔ `~/.copilot/agents/`); the script must handle the home directory case explicitly.
- The invocation signature is the public contract. Changing it is a breaking change to any caller — treat it as such.

**Update (ADR-0016):** the plugin-scope clause above is superseded. Plugin scope is no longer
detected via `plugin.json`, and there is no counterpart to derive — a directory containing
`apm.yml` produces a single `.apm/agents/<name>.agent.md` file, and `agent-audit` validates it
directly with no pair-consistency check. Project scope and user scope keep the pair-derivation
mechanism described above unchanged. See ADR-0016.