EXTENSIONS

Cloudflare security and configuration audit workflow.

AWS cost audit workflow — identifies infrastructure waste by combining

Observe a Claude Enterprise account via the Compliance API. Covers the

Rank a restic fleet by what has actually been proven restorable. A workflow-scope report that joins every @sntxrr/restic/repository step in a run — freshness, structural check, read-data verification, canary dump and restore drill — into one ranked findings list, where a rung that has never run is itself a finding. Read-only: it reads what the steps already wrote and never touches a repository.

Content-bound Rust security review decisions with exact reuse and conservative incremental-review planning.

Microsoft Purview compliance-portal RBAC — role groups, their constituent management roles, membership, and the eDiscovery Administrator list, over Security & Compliance PowerShell. Exists because eDiscovery permission is invisible from Entra: Global Administrator maps to OrganizationManagement, which carries Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so a tenant admin can run a search yet be unable to export a single item. auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators, who can open every case in the tenant. Carries its own credential surface because the compliance endpoint rejects Azure CLI tokens regardless of user.

Audit a scanned Backblaze B2 account for hidden-version retention gaps, over-scoped or orphaned application keys, and public buckets. Two reports: a method-scope audit of one b2-account scan, and a workflow-scope companion that joins those findings to @sntxrr/b2/files byte totals so each gap is ranked by what fixing it recovers. Read-only — both analyse resources already written and never call B2.

Inventory a Backblaze B2 account — one read-only scan method emits a resource per bucket and per application key, plus a summary, via the B2 Native API v4.

Workflow-scope report that renders a change-audit timeline from CloudWatch

GitHub models for swamp.

Pages through the Coder audit log API and writes events as versioned data. Supports incremental collection with configurable limits and query filters.

Deterministic run reconstruction and invariant-violation audit of a @swamp/software-factory work item — stale SHAs across the artifact lineage, impossible states, unresolved critical/high blockers, and retained resources — rendered statically from recorded run data with no LLM involved, every flag traceable to the record it came from. Optional retained-worktree and external issue-tracker (Linear) correlation joins are pluggable, not required.

Fleet-wide VPC inventory across `profiles × regions`. A single read-only

Fleet audit for AWS Security Hub control EC2.2 ("VPC default security groups

Read-only fleet IAM lens for an integration's roles across many accounts. A

Lists RDS DB clusters in the configured AWS region and emits two

Workflow-scope report that renders an operator worklist for AWS Security Hub

Read-only operational audit of a CloudFormation StackSet and all of its stack

Generic AWS workflow-safety primitive. Fails closed before any AWS work

Workflow-scope report that audits S3 buckets against standard security

Dry-run execution driver that captures method requests without executing them. Useful for debugging, auditing, and validating workflows.

Coalesces a CloudFormation StackSet lens (@jentz/aws-stackset-audit) and an

Customer.io App API — snapshot segments and transactional messages, and run an idempotent per-brand readiness audit (segments + transactional messages) for a shared workspace.

Fleet node verification framework. A catalog of tagged checks (category × cadence × scope) contributed by domains — host-OS/apt hygiene & fitness over scripts/host-probe.sh, plus a proxmox provider for PVE-scoped checks — run by the syscheck workflow and scored into a per-node pass/warn/fail verdict. Domains (proxmox, future @stateless/docker, …) plug in via a CheckProvider contract. Sits above the domains; results belong in @stateless/inventory.