Read-only integrity audits

Find broken local links, incomplete declared provenance, and source/index drift. Stable finding IDs; no automatic repair.

gno audit reports unresolved local wiki/Markdown links, missing declared capture/record provenance, and source/index byte drift. It does not repair.

gno audit
gno audit links --collection notes --path projects
gno audit provenance --json
gno audit freshness --max-age-days 90 --json --output audit.json

Three deterministic categories

• Links finds unresolved or ambiguous local wiki and Markdown targets plus isolated documents under your explicit orphan roots and ignored prefixes. External URLs are not local graph edges.
• Provenance checks only capture and logical-record contracts that a document explicitly declares. It does not invent citations or judge whether prose is true.
• Freshness distinguishes missing/unreadable sources, source bytes that differ from the indexed revision, indexing errors, and optional age review signals. Age alone is never labelled false.

Complete findings, honest gaps

Human output and JSON use one report. Finding IDs are stable for the same rule, subject, location, and evidence. --max-findingsbounds returned detail while exact totals remain visible. Exit 0 is clean, 4 is complete with findings, and 5 means evidence was partial, unavailable, inconclusive, cancelled, or kept changing after one bounded retry.

The read-only MCP tool gno_audit returns the same report with collection, path, tag, age, and orphan-policy inputs. Both surfaces run offline. They do not write notes, config, index rows, graph edges, daemon state, findings, baselines, or suppressions.

Bounds

Audit v1 reports; it does not repair. There is no contradiction judge, citation generator, maintenance scheduler, hidden overnight job, or preview/apply mutation. Review the evidence and choose any follow-up yourself. gno egress-audit is unrelated: it manages content-free receipts for transport-policy decisions.