Audit and clean repositories with systematic health checks

Audits repository health across five independent, read-only lanes, then applies only authorized repairs and finishes through the repository's own protected workflow rather than inventing a parallel one. Before any mutation, it runs a policy gate: read root and nested AGENTS.md, contributor guidance, and release instructions; inspect the current branch, worktree, staged files, remotes, default branch, and branch protection; discover the repo's own validation/sync/merge/release commands; and preserve unrelated user work out of scope. If the repository names a mandatory maintainer skill or guarded command, it delegates to that instead of improvising - e.g. in agentic-awesome-skills it defers to antigravity-maintainer-batch-release and npm run merge:batch since main is pull-request-only, and it will not resurrect retired gates (certified-v1 baseline, benchmark, tuning-gold, transaction-fault, race, or a frozen OS/runtime matrix) as routine merge checks. The audit itself covers five lanes in parallel: Git/artifact hygiene (untracked caches/build output, tracked large or binary files, accidental secrets, stale branches, submodules, symlinks - without deleting or rewriting history); dependencies and packaging (lockfile/manifest agreement, outdated/vulnerable/duplicate/EOL packages, runtime imports misplaced in dev dependencies, clean-install behavior - treating scanner output as evidence to verify, not permission to act); CI and release health (failing or stale workflow runs, unjustifiably broad runtime matrices, unpinned actions, required checks and branch protection, documented-vs-implemented release commands); documentation and metadata drift (README, changelog, badges, contribution instructions vs current CI policy); and code-quality signals (dead code, debug logging, unsafe defaults, suppressed errors, credential exposure). For FAF projects, it also inspects .faf/.faf-dna/sync/score/MCP contracts via the project's installed FAF commands.

Use it when asked to maintain, clean, audit, harden, or prepare a repository for release. Defer to a more specific security, database, deployment, or release skill when that is the dominant task instead. It never authorizes destructive cleanup, branch-policy changes, direct protected-branch pushes, merges, deployments, or releases beyond what was explicitly requested - it will never delete data, rewrite history, rotate credentials, change branch protection, or upgrade across breaking versions without explicit authorization. A request to "push to main" is read as describing the desired final state, not permission to bypass branch protection.

git status --short --branch
git diff --stat
git diff --cached --stat
git remote -v
git log -5 --oneline

Input is the repository itself, its policy docs, and its CI/release configuration. For each finding, output is a prioritized decision record: evidence and affected paths, severity and user impact, whether it's safe to fix now, needs approval, or belongs to another workflow, and the exact validation that proves the repair - with duplicate symptoms of the same root cause merged, and optional modernization kept separate from release blockers. Repairs are the smallest coherent change set, with tests updated alongside behavior changes and the targeted failing check rerun after each repair group; the final step runs the repo's required pre-PR suite, inspects the diff for unrelated files or secrets, and opens a pull request through the repo-native merge path when the target branch is protected.

Reads the repository's own governance surface - AGENTS.md, contributor docs, CI workflow definitions, branch protection rules, and (for FAF projects) .faf/.faf-dna contracts - and defers to whatever native validation, sync, merge, or release tooling the repository already has (e.g. npm run merge:batch in agentic-awesome-skills) rather than substituting a generic Git workflow.

Maintainers preparing a repository for release or general upkeep who want a systematic, evidence-based health audit with repairs applied only where authorized and always shipped through the repository's own protected merge/release path.