Audit play

Before you run it1 local tool

Everything here is checked on your machine when rote inspects the play. This page never learns what you have installed or which credentials you hold.

• ○
  python3local tool

  Requires >=3.9. Run rote play inspect to check your host; unverified versions remain unknown.

Inputs11, all optional

rote asks for these before running and shows the defaults it will use.

• Project pathproject_path

  Which project to audit. The word all audits every project this machine records, which is what a bare run with no parameters does. A path narrows to one project, selecting its policy files and its transcript directory. A path inside the rote run workspace is the play's own scratch directory rather than a project, so it falls back to all with a warning.

  optionalstringdefault allexample /Users/you/code/my-projectcustom value allowed
• Window hourswindow_hours

  How far back to look, in hours, filtered per event on the record timestamp. 0 means the whole recorded history. Shorter than a weekend produces mostly false idleness.

  optionalstringdefault 72example 168custom value allowed
• Harnessharness

  Which agent harness wrote the transcripts and config. claude reads ~/.claude/projects, ~/.claude.json and the settings files. codex reads ~/.codex/sessions rollouts and ~/.codex/config.toml, where policy is an approval mode rather than a rule list, so the three rule-shaped finding classes read not applicable. Any other value is a hard fault rather than a silent empty report.

  optionalstringdefault claudeexample codex

  2 choices

  • claude
  • codex
• Denial patternsdenial_patterns

  Case insensitive regex that marks an errored tool result as a denial rather than an execution failure. Exposed because the harness wording is not a stable contract, and misreading it turns a control that worked into a control that was bypassed. The default carries the Claude Code phrasings and Codex's Sandbox(Denied marker.

  optionalstringdefault has been denied|Permission denied|permission was denied|was denied by|tool use was rejected|Sandbox\(Deniedexample has been denied|rejected by policycustom value allowed
• Include subagentsinclude_subagents

  Whether to read subagent transcripts under each session's subagents directory alongside the session transcripts. They hold real tool calls, so excluding them makes every unused finding a floor.

  optionalstringdefault trueexample false

  2 choices

  • true
  • false
• Policy scopespolicy_scopes

  Comma separated settings scopes to union. Each scope reads its settings.json and settings.local.json.

  optionalstringdefault user,projectexample projectcustom value allowed
• Reportreport

  findings prints the top items per class and omits the per-file array from traces.json; all prints every row in the least privilege profile and writes the per-file array. Neither setting changes a count.

  optionalstringdefault findingsexample all

  2 choices

  • findings
  • all
• Sincesince

  Path to the shadow-diff.json an earlier run wrote. Given one, the report adds what moved since that run — grants newly dead, grants newly used, rules added or removed, servers newly idle or newly active, and blocks that started or stopped. Two runs taken over different windows, scopes or harnesses are reported as not comparable rather than subtracted. Empty means no comparison.

  optionalstringexample /tmp/last-audit/shadow-diff.jsoncustom value allowed
• Sessionsession

  Audit one run instead of the machine. Takes a transcript file path or a session id; executed evidence then comes from that transcript and the subagents it spawned, and nothing else. The window still applies inside it. A machine-wide audit answers what a policy has authorised over months; this answers what one piece of work actually needed. A session that cannot be found is a hard fault rather than a silent fallback to everything.

  optionalstringexample a1cafe13-0abf-4a91-b65f-00ff1db6f676custom value allowed
• Compare tocompare_to

  Path to the shadow-diff.json an earlier run wrote. Given one, the report says whether every count reproduces and, where a count moved, names the condition that moved underneath it — window bounds, transcript files enumerated, rules read, servers advertised, harness, scope, scan time. A count that moved while a condition moved was measuring something else, not failing to reproduce. Empty means no check.

  optionalstringexample /tmp/last-audit/shadow-diff.jsoncustom value allowed
• Out dirout_dir

  Where the six artifacts are written, five JSON files and one markdown profile. Empty means the run workspace working directory. traces.json records the command, file path or URL each call was made with, truncated, with credential-shaped spans masked; treat it as you would your shell history.

  optionalstringexample /tmp/shadow-diffcustom value allowed

What it changes