OwnAudit

The lift-out home for Own.NET's audit pipeline. The audit itself is canonical in Own.NET/audit/ — an orchestrator that runs ready-made analyzers over a legacy .NET 4.7.2 / WPF / DevExpress app, normalizes everything to SARIF, scores by cross-tool agreement, and renders a health report ranked by "where it hurts most." Don't reimplement it here.

This repo holds:

• the separate-repo boundary — Own.NET's Plan.md §7 lift-out destination;
• Run-Audit.ps1 — reproduce the STS health report through audit/;
• validated artifacts/ — a real run over STS (380 findings);
• a thin .NET skeleton (src/) reserved for audit/'s C# on lift-out + the deferred ClrMD duplicate-detector.

Run the audit over STS

pwsh ./Run-Audit.ps1
# -> artifacts/health-report.md (+ .html, .json)

It drives the canonical pipeline — OwnSharp (build-free) → SARIF → aggregate/normalize.py → score → report. Normalization runs from this repo; scoring and reporting still run from a worktree of Own.NET main, so dotnet + python on PATH and that worktree are both required. PYTHONUTF8=1 is set to dodge the cp1251 console crash on the Russian-locale Windows target.

Where things live

concern	home	status
SARIF normalization + category taxonomy	aggregate/ (this repo, docs)	canonical
scoring + reporters	Own.NET/audit/aggregate	canonical, port pending
runtime LeakHarness / DuplicateDetector / storm profiler	Own.NET/audit/runtime	canonical
boundary + STS runner + artifacts + lift-out home	OwnAudit/ (this repo)	active
fix arm — wire mass appliers + safety wrapper + OWN fixer	OwnAudit/ (docs/fix-arm.md)	design
LeakFixMine — mine real leak-fixes, SZZ-prove them, score OwnAudit vs baselines	leakmine/ (docs/leakfix-mine.md)	active
agent-run triage — ingest 007's Zero Trust audit trail as evidence	OwnAudit/ (docs/agent-run-triage.md)	design
architecture review — drift gate & report pipeline over Own.Arch facts	OwnAudit/ (docs/architecture-review.md)	design
sketch-based evidence layer — compact cross-run finding summaries	OwnAudit/ (docs/sketch-based-evidence.md)	design
agentic coding discipline — task contracts, diff gates, judge-run	OwnAudit/ (docs/agentic-coding-discipline-proposal.md)	design

See PLAN.md, the Fix arm design, and LeakFixMine.