# Session — build repo-hygiene-audit skill (2026-05-22)

Phase 7 of repo-hygiene-remediation (trellis thread "dev-setup-and-hygiene" #272):
make the 2026-05-19/20 audit repeatable. Decisions going in: weekly cadence,
manual trigger, full skill with scripted checks.

## What was built

- New repo `pbs/repo-hygiene-audit-skill` following the repo-per-skill house
  style (a-review-skill / session-notes-skill / Claude-Code-Scaffolding-Skill).
- `repo-hygiene-audit/SKILL.md` — trigger description + 5-step workflow over the
  4 domains.
- `repo-hygiene-audit/scripts/audit.py` — pure-stdlib, read-only check engine.
- `references/check-catalog.md`, `references/findings-format.md`.

## Checks implemented

git auditability + .git ownership/dubious + group drift; `.env` perms (0660 /
devprojects target); inline compose secrets; non-git dirs with content;
uv-init stubs; docker-compose.yml→compose.yml naming; master-vs-main default;
leftover docs-audit branches; dirty trees; stray worktrees; unpushed/no-upstream;
herbygitea residue; stale review docs; missing/bloated docs.

## First-run results (39 repos, 4 domains)

high=11, medium=19, low=23, info=9 (total 62). Matched the known audit backlog:
root-owned non-git docker stacks (authelia/traefik), world-readable .env
(trellis-mcp, vault-mcp, ob1-deploy, python-uv .env.local), master defaults
(authentik, pbsii, zero-check-pipeline, docker-container, ssh-login-alerter,
hunyuan3d-sunnie, instamesh-docker), uv-init stubs (zero-check-pipeline,
wiki-context), GEMINI.md in work-index-dashboard, herbygitea residue in
workstation-ansible/CLAUDE.md + sshkm. Ruff clean.

## Open for Travis

- Remote: not chosen. Commit is local-only. Likely GitHub-destined (manual push).
- Second deliverable: canonical CLAUDE.md skeleton folded into
  Claude-Code-Scaffolding-Skill (template only; not wired into scaffold.py).
- Cadence automation deferred (`--fail-on` is the hook when ready).