Agent teams

---
name: audit-program
description: Turn the auditor-approved risks in outputs/risk-register.md into the audit planning pack: planning-memo.md, risk-control-matrix.md and audit-program.md (risk → expected control → test step → targeted sample, plus the PBC list), rendered and checked by build_pack.py from the planner's judgments in outputs/audit-plan.json. Loaded by the planner teammate at Phase 3.
---

# audit-program

Produce the pack a human auditor will sign off. You judge which control
each approved risk relies on, how to test it and what to sample; Python
draws every sample, fills every figure and checks every trace. Write your
judgments to `outputs/audit-plan.json`, then let `build_pack.py` render
`planning-memo.md`, `risk-control-matrix.md` and `audit-program.md`.

#!/usr/bin/env python3
"""Validate outputs/audit-plan.json and render the audit planning pack.

Usage: build_pack.py [PLAN_JSON] [--gate]
       [--rules outputs/rules.json] [--analytics outputs/analytics.json]
       [--ratings outputs/risk-ratings.json] [--register outputs/risk-register.md]
       [--comments outputs/auditor-comments.md] [--full outputs/analytics-full]
       [--out-dir outputs]

--gate only checks the auditor gate: every risk in the register has a
decision and the register is a revision that applied them. It prints the
approved scope and exits 0, or names what is missing and exits 1.

Build the audit-program skill described in CLAUDE.md. First look at outputs/risk-register.md, outputs/auditor-comments.md, outputs/risk-ratings.json and the column names of every file in outputs/analytics-full (head -3 only). Design:
- The planner writes its judgments to outputs/audit-plan.json: per approved risk, expected controls that cite rules, test steps that cite a rule or a metric, a sample recipe (file in analytics-full, filter, sort, how many), and the PBC items each test needs. Memo text uses {{$.path}} placeholders for every figure.
- build_pack.py, next to SKILL.md, computes the approved scope from auditor-comments.md and risk-ratings.json and fails if any register risk is undecided or the register is not a revision; a --gate flag runs only that check.
- It resolves every citation, draws every sample deterministically, verifies each transaction exists in spend-clean.csv and writes it to outputs/samples/<test>.csv, checks every control has a test, and checks every rule in rules.json is cited by a risk, control or test or listed as not tested with a reason.
- It renders planning-memo.md, risk-control-matrix.md and audit-program.md (ending with the PBC list) and writes pack-figures.json listing every figure it computed itself.
- Size samples by score and use indicator language throughout.

Test the builder on a fixture with two risks and confirm it fails on a missing risk, an uncited control and an unaccounted rule.

Create an agent called planner for the Phase 3 agent team in CLAUDE.md. It follows the audit-program skill: runs the gate check, writes outputs/audit-plan.json for the approved risks only, and runs build_pack.py until there are no failures. It owns only audit-plan.json; the builder writes the pack. Give it a message protocol for the team: it announces "PACK READY vN" to the challenger and the qa-reviewer by name, answers each "CHALLENGE #n" with "RESPONSE #n: accepted / declined / for the auditor", fixes each "QA vN: FAIL", rebuilds, and ends with "PLANNER DONE vN". Two challenge rounds at most. It never re-rates a risk, never changes scope, and never edits the register, the inputs, the skill or the builder.

---
name: planner
description: Agent-team member that owns the audit planning pack. Follows the audit-program skill to turn the auditor-approved risks into outputs/planning-memo.md, outputs/risk-control-matrix.md and outputs/audit-program.md, via outputs/audit-plan.json and build_pack.py. Responds to the challenger's points and the qa-reviewer's failures by revising the plan. Spawned by the lead as a teammate at Phase 3, after the auditor gate is closed.
tools: Bash, Read, Write, Edit, Glob, Grep
memory: project
---

You are the planner on a three-member agent team (planner, challenger,
qa-reviewer) that produces the audit planning pack for a procurement
audit (see CLAUDE.md, Phase 3). You own three documents and the plan
behind them. The other two review your work; you do not review theirs.

Create an agent called challenger for the Phase 3 agent team in CLAUDE.md. It reads the register, auditor-comments.md, risk-ratings.json, analytics.json, history.json, rules.json and the planner's pack, and owns only outputs/challenges.md. It waits for the planner's "PACK READY v1", then sends at most eight "CHALLENGE #n [type] R-xx" messages, each with a citation and a specific ask. Allowed types: rating and scope (for the auditor, since the decisions are approved), sample, control, test, coverage (for the planner). It records each challenge, the planner's response and a status (open, resolved, declined, for the auditor) in a table, verifies accepted changes in the rebuilt pack, runs one more round of at most four, closes every row, and ends with "CHALLENGER DONE". It never reads data/ or analytics-full/, never edits the plan or the pack, and uses indicator language only.

---
name: challenger
description: Agent-team member that challenges the audit planning pack. Reads the approved register, the analytics and history summaries and the planner's pack, and writes outputs/challenges.md: each weak spot with its evidence, the ask sent to the planner, the planner's response and a status. Spawned by the lead as a teammate at Phase 3, alongside the planner and the qa-reviewer.
tools: Read, Write, Glob, Grep
memory: project
---

You are the challenger on a three-member agent team (planner, challenger,
qa-reviewer) that produces the audit planning pack (see CLAUDE.md,
Phase 3). Your job is to find where the plan is weaker than the evidence
and make the planner answer for it. You own one file and change nothing
else.

Create the qa-reviewer agent for the Phase 3 agent team in CLAUDE.md, and the scripts it runs in scripts/checks/:
- check_quotes.py: runs the extract-rules verifier on rules.json against data/contract-rules.pdf, and checks every rule quote excerpt in risk-register.md matches rules.json.
- check_numbers.py: every figure of three or more digits or with a £ sign in planning-memo.md, risk-control-matrix.md and audit-program.md is a value in analytics.json, pack-figures.json, rules.json or outputs/samples/*.csv. Row IDs, rule and test IDs, dates, years, clause and page references are skipped.
- check_trace.py: every rule is cited by a rated risk, a control or a test, or listed as not tested with a reason; every approved in-scope risk has a control with a test and appears in the matrix and the program; every High risk is in scope or its exclusion is recorded with a reason; challenges.md exists, every row cites evidence, and none is open.
- check_samples.py: every transaction in outputs/samples/*.csv and every row ID in audit-program.md exists in spend-clean.csv and at its sheet row in the council's workbook, with the same supplier and amount.
- run_checks.py: runs all four and prints one table and a verdict.
The agent waits for "PACK READY v1", runs the checks, sends "QA vN: FAIL <check>: <items>" to the planner for each failure, re-runs on every new version, and after the planner and the challenger report done writes outputs/review.md with the results as printed, the verdict READY FOR SIGN-OFF or BLOCKED, and an auditor sign-off block. It fixes nothing and softens nothing.

Test each check on the current outputs and on a fixture with a planted bad figure and a planted missing row.

---
name: qa-reviewer
description: Agent-team member that checks the audit planning pack before sign-off. Runs scripts/checks/run_checks.py (quotes in the PDF, figures traced to the analytics, rule → risk → control → test complete, every sampled transaction present in the spend data) and writes outputs/review.md with the results, a verdict and the auditor's sign-off block. Blocks sign-off until every check passes. Spawned by the lead as a teammate at Phase 3.
tools: Bash, Read, Write, Glob, Grep
memory: project
---

You are the qa-reviewer on a three-member agent team (planner,
challenger, qa-reviewer) that produces the audit planning pack (see
CLAUDE.md, Phase 3). You decide nothing about the audit. You run the
checks, report exactly what they report, and block sign-off until they
all pass.

#!/usr/bin/env python3
"""Run every QA check on the audit planning pack and print one table.

Runs check_quotes.py, check_numbers.py, check_trace.py and check_samples.py
with the same interpreter, prints each script's FAIL lines and SUMMARY line,
then a table of check | result | summary. Exit 0 only when every check passes.
"""
import subprocess, sys
from pathlib import Path

HERE = Path(__file__).resolve().parent
CHECKS = ["check_quotes.py", "check_numbers.py", "check_trace.py", "check_samples.py"]

#!/usr/bin/env python3
"""QA check: every quote exists in its source.

1. Runs the extract-rules verifier: every verbatim_quote in outputs/rules.json
   is found in data/contract-rules.pdf on its stated page.
2. Every rule quote excerpt printed in outputs/risk-register.md
   ("- [rule:CPR-xx] clause ... : "...") is the start of that rule's quote.
Prints PASS/FAIL lines and a summary; exit 0 when clean.
"""
import json, re, subprocess, sys
from pathlib import Path

#!/usr/bin/env python3
"""QA check: every figure in the pack traces to a computed source.

Scans outputs/planning-memo.md, risk-control-matrix.md and audit-program.md
for figures (three or more digits, or a £ amount). Each must be a value in
outputs/analytics.json, outputs/pack-figures.json, outputs/rules.json or one
of outputs/samples/*.csv. Row IDs, rule/risk/test IDs, dates, years, clause
and page references are not figures and are skipped.
Prints PASS/FAIL lines and a summary; exit 0 when clean.
"""
import csv, json, re, sys
from pathlib import Path

#!/usr/bin/env python3
"""QA check: traceability of the pack.

1. Every rule in outputs/rules.json is cited by a rated risk (risk-ratings.json),
   a control or a test (audit-plan.json), or listed in rules_not_tested with a reason.
2. Every approved, in-scope risk (auditor-comments.md + risk-register.md) is
   planned with at least one control that has at least one test, and appears in
   risk-control-matrix.md and audit-program.md; nothing unapproved is planned.
3. Every risk whose matrix label is High or Extreme is in scope, or was rejected
   with a comment, or is listed under "Not in scope" in the memo with a reason.
4. outputs/challenges.md exists, every row cites evidence, and no row is open.
Prints PASS/FAIL lines and a summary; exit 0 when clean.

#!/usr/bin/env python3
"""QA check: every sampled transaction exists in the spend data.

For every row in outputs/samples/T-*.csv, and every row ID printed in the
sample tables of outputs/audit-program.md:
1. the row_id is in outputs/analytics-full/spend-clean.csv with the same
   supplier and amount;
2. the council's workbook data/spend/<source_file>, sheet "Data to publish",
   has that supplier and amount at the stated sheet row.
Prints PASS/FAIL lines and a summary; exit 0 when clean.
"""
import csv, re, sys