mixocreative/cia

### 程式碼完整性稽核 · a skill for Claude Code and OpenAI Codex
Your tests are green. Your system is still broken.
cia finds the bugs that live between two correct functions — and proves what it checked.
測試全綠，系統照壞。cia 專抓藏在「兩個各自正確的函式之間」的 bug，而且每一條結論都附證據。
Quick start · Wiring audit · What it catches · Where it fits · How it is measured · FAQ · Install
bash
claude plugin marketplace add mixocreative/cia && claude plugin install cia@mixocreative
You shipped. Every test passed. Then a setting in the admin panel turned out to change nothing, a nightly job stopped three weeks ago without a word, and the "0 problems" health check had never looked at anything. Each function was correct on its own. The bug was in the wire between them.
Ask your agent to run /cia. It maps your codebase, follows every value from where it is written to every place it is read, follows every switch from the screen to the line that should obey it, runs your app for real, and hands back a report where nothing counts as "passed" unless this run produced the evidence.
> 程式上線了，測試也全過了。結果後台某個開關其實什麼都沒控制、某個排程三週前就默默停了、健康檢查回報「0 個問題」其實從來沒檢查過任何東西。每個函式單獨看都沒錯，錯的是它們之間的那條線。
> 對你的 AI Agent 輸入 /cia：它會先畫出整個系統的地圖，追蹤每個值從寫入到每一個讀取點、每個開關從畫面到真正該執行的那一行程式碼，實際把 App 跑起來走一遍，最後交出一份報告 —— 沒有這次執行產生的證據，就不算通過。
## Quick start｜快速開始
1. Install｜安裝 — one command in Claude Code (other options under Install):
bash
claude plugin marketplace add mixocreative/cia && claude plugin install cia@mixocreative
2. Ask your agent｜直接對 Agent 下指令 — copy any of these:
text
/cia pre-launch audit, Screen tier
text
Before we ship: trace every admin setting to the line of code that obeys it,
and show me the ones nothing reads.
text
Our tests say green. Prove they actually ran the database and browser tests,
and list everything that was NOT verified.
text
上線前幫我用 /cia 稽核：哪些後台開關其實沒有程式在讀？哪些排程停了不會有人知道？
3. What comes back｜你會拿到什麼 — a numbered report that opens with five plain-language lines for the owner (what is safe, what is not, what to do first), then one line per step, every sweep naming the files it read:
text
Tier: Screen — elapsed 3h10m (budget 2–4 h)
1. Fast lint + scope tests ............ ✅ tests green
2. Integrity sweeps S1–S24 ............ ❌ findings, each with path:line + a quoted line
3. Full suite on HEAD ........... ✅ / (or ⏭ with the one command you must run)
4. Runtime walk ....................... routes / assets / error-log delta / closed-loop clicks
5. Fixes applied (one commit + test each) | Escalated to you, with the patch attached
9. Evidence ledger .................... PASS / FAIL / UNVERIFIED / UNPROVEN — every PASS cites an artefact
## Feature list vs wiring audit｜功能清單 vs 串接稽核
A feature comparison asks: "Do we have retries?" A wiring audit asks: "What happens if the job is accepted, the worker dies, the input changes underneath, the result write fails, and someone opens the dashboard on Monday?" That is where in-house systems break — and cia writes that question for your system first, then answers it with evidence.
> 功能比較問的是：「我們有重試機制嗎？」串接稽核問的是：「如果工作被接受了、Worker 掛了、輸入資料被改了、結果寫入失敗，而有人星期一才打開儀表板，會發生什麼事？」 自己寫的系統就是在這裡出事。cia 會先針對你的系統寫出這個問題，再用證據回答。
Three layers, every run｜每次檢查三層: function logic · relationship wiring (called, persisted, retry-safe, partial failure handled) · lifecycle rules (late, twice, out of order). Findings are counted per layer.