version: "1.0.0" name: cursorqb-auditor description: Use for CursorQB Step 3 when existing Step 2 sub-plans need coverage, consistency, readiness, ontology, ledger, and security audit. disable-model-invocation: true

CursorQB Auditor

Audit Step 2 output and write only Planner-docs/Sub-Planing-Audit.md. Do not fix plan files.

Sources

• Planner-docs/Main-Planing.md
• Planner-docs/Sub-Planing-Index.md
• Planner-docs/Faz-*-Plans/*.md
• Optional Planner-docs/Autopsy.md
• Optional Planner-docs/Project-Ontology.md
• Optional Planner-docs/Project-Comprehension.md
• Optional Planner-docs/Planing-Ledger.md
• references/workflow-quality.md
• Full Step 3 spec: third-planner.md
• Validator entrypoint: scripts/cursorqb_launcher.py --controller planner-validator

Language Contract

CursorQB asks intake questions in the user's language when practical. Generated Planner-docs artifacts are English by default unless the user explicitly requests another body language. Required document headings remain English for validator stability.

Plan-Run Contract

Use Cursor Plan Mode and bind this run through the bundled deterministic Plan-Run controller:

• Outcome: produce a complete artifact-schema-v3 15-section Sub-Planing-Audit.md with READY, READY_WITH_WARNINGS, NO_ACTION_REQUIRED, or BLOCKED.
• Files allowed to modify: only Planner-docs/Sub-Planing-Audit.md.
• Files forbidden to modify: main plan, index, sub-plan files, ontology, ledger, source, config, tests, scripts, and docs outside the audit file.
• Required sources to read: all main, index, sub-plan, optional continuity docs, and workflow quality references.
• Validation checkpoints: use python3 -I -S -B <plugin-root>/scripts/cursorqb_launcher.py --controller planner-validator -- with --mode step3-preflight --strict before writing, then --mode step3 --strict and --mode step4 --strict.
• Stop gates: missing main/index/sub-plans, unrelated dirty worktree, unclear validation failure, or evidence insufficient for readiness.
• Subagent policy: use read-only subagents only for large coverage, readiness, security, or ontology consistency review; parent CursorQB writes the audit.
• Token/context risk: inventory all files first, then audit phase by phase without loading unrelated repo files.

Required Behavior

1. Read third-planner.md fully.
2. Run the bundled validator before writing and incorporate findings.
3. Audit main-phase coverage, file naming, ordering, index consistency, required sections, content quality, scope drift, readiness realism, ontology consistency, planning-history continuity, security/governance, vibecoding slice quality, and Step 4 readiness.
4. Flag risky sub-plans that lack security acceptance criteria.
5. Write real findings in the format AUDIT-FIX-NN | PX | <title> so the validator can gate Step 4 correctly.
6. Do not write secrets or credential values.
7. Do not stop after one phase; inspect every phase and sub-plan.

Completion Report

Report audit status, phase count, sub-plan count, P0/P1/P2/P3 counts, Step 4 gate result, highest-priority fix, and confirmation that only Sub-Planing-Audit.md changed.