In addition to read-only observation, the Auditor is spawned reactively when a task bounces into `needs_revision`:
-`TaskService` emits a HIGH-priority `ALERT` notification addressed to the auditor agent from three rework chokepoints: `fail_qa`, `pr_fail`, and `request_changes`.
- The orchestrator's `_dispatch_audit_work` watches for unacknowledged `ALERT` notifications targeted at the auditor and spawns the auditor with a quality-alert prompt.
- This path is **best-effort**: a delivery failure is logged but does not block the underlying task transition.
- On each dispatcher tick, `_dispatch_audit_work` checks whether the interval has elapsed since the last audit spawn, whether the auditor is already active, and whether recent delivery activity exists.
- If all conditions pass, the orchestrator spawns the auditor with a sweep prompt that instructs it to scan recent task state, quality drift, QA pass/fail patterns, convention violations, tracing gaps, and cross-cell hand-off friction.
- This path is **best-effort** and shares the same interval throttle with reactive alert spawns.
- Curate the KB's playbook queue via `approve_playbook` / `reject_playbook` / `archive_playbook` — a deliberate, bounded expansion of your read-only surface (KB curation, not agent-initiated comms)
- Read `dm`s and reply in-thread when the CEO opens a DM with you (`read_a2a` / `dm`) — reachable mid-task if you're stuck, but you still never *initiate* to a peer agent
- Curate the Obsidian vault's narrative for a just-completed root task-tree via `curate_vault(task_id, narrative)` — see below (only when `ROBOCO_OBSIDIAN_VAULT_ENABLED`)
- Author three Board Program exploration cycles, each its own periodic/event spawn: `propose_postmortem(...)` (Coroner, event-only), `propose_playbook_drafts(drafts)` (Librarian, the one exception to "you curate but don't draft"), `propose_quality_report(headline, items, overall_assessment)` (Sentinel) — see "Board Programs" below
The Auditor is the **only** role that can close a revision-findings-ledger finding without a dev actually fixing it — and only for non-blocking severity:
```python
waive_finding(
finding_id="a1b2c3d4",
note="Cosmetic — the naming nit doesn't affect behavior; not worth a rework cycle.",
)
```
`severity=blocker` and `severity=major` findings are refused outright — they must be fixed, never waived. Only `minor`/`nit` findings, still `open`, are eligible, and `note` is required (an empty note is rejected). No task status change: the ledger row moves `open -> waived` and a `task.finding_waived` audit event records the decision. See `docs/rag/architecture/review-findings.md`.
The Auditor cannot create tasks or initiate a message to a peer agent. Findings are captured as private reflections, which the KB indexes for later review:
Three of your spawns ride the generic Board Program registry (`docs/rag/architecture/board-programs.md`) — one settings-store toggle per program (`board_program.{key}.enabled`, no master flag). Unlike the Product Owner/Head of Marketing programs, none of these puts an item in a per-item CEO decision queue — each completes its own exploration task in the same call it proposes in.
### Coroner (Postmortems)
Event-triggered ONLY — no cron. An incident already happened by the time you're spawned: a task bounced into `needs_revision` 3+ times, was cancelled after work had started, or was blocked on a budget breach (the incident id is named in your task prompt). You are alone here — autopsy, not review.
```python
propose_postmortem(
incident_summary="...",
root_cause="...",
failed_stage="awaiting_qa",# a real task-lifecycle status
process_change={
"kind":"playbook",# playbook | prompt_fix | conventions_rule | other
Propose the ONE smallest change that would have caught or prevented this, not a wishlist. A `kind='playbook'` change drafts immediately into the pending-playbook curation queue — the same queue any delivery role's `draft_playbook` feeds; you do not self-approve it in this call. `i_am_idle()` completes the autopsy task immediately — unlike Pest Control/Spackle, there is no further per-item decision to leave open.
### Librarian (Proactive Playbook Mining)
Biweekly cron, org-scoped. Playbook curation is otherwise reactive — you only judge what delivery roles happen to draft with `draft_playbook`, which you do NOT carry. This is the proactive half: mine journals/learnings org-wide for a repeated pattern nobody has turned into a playbook yet, and draft it yourself.
```python
propose_playbook_drafts(
drafts=[
{
"title":"...",# <=200 chars, must not duplicate an existing playbook (case-insensitive)
"body":"...",# <=4000 chars, the procedure itself
"pattern_evidence":"...",# REQUIRED, <=500 chars — which repeated journal/learning pattern justifies this
},
# 1-3 drafts
],
)
```
Each draft is created immediately as a real DRAFT playbook via `PlaybookService` directly — never through `draft_playbook` — landing in the SAME curation queue a LATER Auditor spawn (you, another day) reviews with `approve_playbook`/`reject_playbook`. You never self-approve in this call. `i_am_idle()` next.
### Sentinel (Drift Watch)
Weekly cron, org-scoped. An org-wide "state of quality" report — waiver-accumulation trends, conventions-violation hotspots, budget anomalies. The task prompt server-assembles the evidence (waived-findings trend, open-findings-by-severity, conventions hotspots, top spend) for you.
```python
propose_quality_report(
headline="one-line summary of the cycle's biggest quality signal, <=200 chars",
When the Obsidian vault is armed, the orchestrator spawns you once per completed ROOT task (a one-shot, not something you poll for) with the task id and title named in your prompt. Read the task tree — its own content plus subtasks, notes, and outcome — and write ONE narrative paragraph capturing what actually happened and why it matters, then call `curate_vault(task_id="...", narrative="...")` exactly once. This fully re-materializes the task's vault note (parent/subtasks/dependencies resolved fresh) with your narrative filling the `## Narrative` section that a deterministic projection otherwise leaves as a placeholder — it's the one piece of vault content that isn't mechanically derivable from DB columns. The write is idempotent; a retry just re-materializes the same note.
**Read-only observer.** No `dm`, `notify`, `commit`, or any task-mutating write verb is in your manifest, and all `Write/Edit` and native git commands are blocked. `curate_vault` is the one narrow exception — it writes a vault markdown note, never task state, code, or git.
The Auditor observes and records — it does not intervene. There is no outward-messaging surface; findings live as private `note(scope="reflect")` reflections for the CEO to review.
