Read-only integrity audits

Find broken local links, incomplete declared provenance, and source/index drift. Stable finding IDs; no automatic repair.

gno audit reports unresolved local wiki/Markdown links, missing declared capture/record provenance, and source/index byte drift. Collections can opt in to link and path-layout rules of their own. It does not repair.

gno audit
gno audit links --collection notes --path projects
gno audit provenance --json
gno audit freshness --max-age-days 90 --json --output audit.json

Reports written with --output are private to the current user. On Windows, this requires built-in Windows PowerShell to establish and verify filesystem permissions; the write fails if those checks are unavailable.

Three deterministic categories

• Links finds unresolved or ambiguous local wiki and Markdown targets plus isolated documents under your explicit orphan roots and ignored prefixes. Links resolve across the collections of a vault: a link to a sibling collection is not unresolved, a note linked only from another collection is not an orphan, and an ambiguous vault link lists the tied candidates (a collection-scoped audit counts candidates outside its scope without naming them). A link to a file that exists in the vault but is not indexed (an image, a PDF, a script a Markdown link names by path, a note in an excluded or unindexed folder) is an informational outside-index finding that does not fail the audit, so only genuinely missing targets are reported as unresolved. Links are read only from Markdown notes and never from code spans or code blocks. External URLs are not local graph edges; a collection can opt in to have them reported (see Opt-in collection rules).
• Provenance checks only capture and logical-record contracts that a document explicitly declares. It does not invent citations or judge whether prose is true.
• Freshness distinguishes missing/unreadable sources, source bytes that differ from the indexed revision, indexing errors, and optional age review signals. Age alone is never labelled false.

Opt-in collection rules

An audit block on a collection adds three checks to gno audit links: which other collections its notes may link into, a report of external URLs written in its notes, and globs every document path must match.

collections:
  - name: published
    path: /Users/you/notes/published
    audit:
      linkCollections: [reference]
      externalUrls: report
      paths: ["20??/**/*.md"]

• links.collection-policy: a link that resolves into a collection linkCollections does not name. Links inside the collection are always allowed.
• links.external-url: with externalUrls: report (default ignore), every external URL in a document's indexed text, with its line and column.
• links.path-layout: a document whose path, relative to the collection root, matches none of the paths globs (up to 64).

These findings are warnings. They only report: indexing, search, editing, and link resolution are never blocked. Collections without an audit block get the same report as before. The external URL report is unrelated to egress policy, which governs where content may travel. Field details and validation are in Collection audit rules.

Complete findings, honest gaps

Human output and JSON use one report. Finding IDs are stable for the same rule, subject, location, and evidence. --max-findings (1 to 100000, or all to export every finding) bounds returned detail while exact totals remain visible. The report says separately when the bounded audit snapshot was cut (totals then cover the snapshot, not the whole index) and when finding evidence was shortened. Exit 0 is clean, 4 is complete with findings, and 5 means evidence was partial, unavailable, inconclusive, cancelled, or kept changing after one bounded retry.

The read-only MCP tool gno_audit returns the same report with collection, path, tag, age, and orphan-policy inputs, and applies the same collection rules from config with no extra inputs. Both surfaces run offline. They do not write notes, config, index rows, graph edges, daemon state, findings, baselines, or suppressions.

Bounds

gno audit reports; it does not repair. There is no contradiction judge, citation generator, maintenance scheduler, hidden overnight job, or preview/apply mutation. Review the evidence and choose any follow-up yourself. gno egress-audit is unrelated: it manages content-free receipts for transport-policy decisions.