# RepoChicken demonstration audit

Report: CO-001  
Inspected snapshot: 3b2678d (before the prototype redesign)\
Scope: first-party static website; one repository  
Method: repository inspection and local container file checks  
Disclosure: demonstration, not customer results
Current service brand: RepoChicken; historical report ID CO-001 is retained.

## Executive assessment

The repository has concise root instructions and an explicitly indexed knowledge bundle. Two actionable defects and one validation gap were identified. No live coding-agent task trials were run.

1. CTX-01: internal guidance is included in the nginx document root.
2. CTX-02: the preview playbook directs the reader to stop an unidentified port owner.
3. CTX-03: the knowledge routes have no recorded behavioral validation in this snapshot.

The first two recommendations are implemented as part of the redesigned prototype. The third remains unvalidated. Historical evidence is preserved against the inspected commit.

## Scope and evidence

Inspected all 15 tracked files at 3b2678d and the local container belonging to this repository. The root AGENTS.md has 33 lines, 321 words, and 2,333 bytes. The six knowledge Markdown files total 12,126 bytes. These are file measurements, not token counts or proof of context loading.

Reproduce the historical evidence:

```bash
git show 3b2678d:AGENTS.md
git show 3b2678d:Dockerfile
git show 3b2678d:.dockerignore
git show 3b2678d:knowledge/operations/local-preview.md
git ls-tree -r --name-only 3b2678d
```

## CTX-01: internal guidance ships in the public image

- Priority: medium; resolve before publishing internal or customer-specific notes.
- Confidence: high in file exposure; no sensitive information was established.
- Evidence: Dockerfile line 3 uses COPY . /usr/share/nginx/html. The five-line .dockerignore excludes neither AGENTS.md nor knowledge/.
- Observation: both AGENTS.md and knowledge/index.md were found under /usr/share/nginx/html in the running local image.
- Consequence: repository guidance is packaged as public content. Future internal notes would inherit that boundary.
- Recommendation: use explicit COPY instructions for public assets only.
- Acceptance: public pages and report return HTTP 200; /AGENTS.md and /knowledge/index.md return HTTP 404 after rebuilding.
- Prototype disposition: implemented by allowlisting HTML, CSS, JavaScript, assets, and public reports.

## CTX-02: port conflict guidance exceeds its scope

- Priority: medium.
- Confidence: high in the written instruction defect; behavioral consequences untested.
- Evidence: knowledge/operations/local-preview.md line 41 says to stop the process using port 8080 before retrying. It does not establish ownership.
- Consequence: an agent might interrupt an unrelated local service. No interruption was observed.
- Recommendation: identify the owner, reuse the project's own container where appropriate, or explicitly choose an alternate port.
- Acceptance: the playbook includes ownership inspection and an alternate-port path, with no direction to stop unrelated processes.
- Prototype disposition: implemented; the preview port defaults to 8080 and can be explicitly overridden.

## CTX-03: discovery is documented but not behaviorally verified

- Priority: validation gap; required before making reliability or performance claims.
- Confidence: high that this tracked snapshot contains no task trial records; absence does not prove failure.
- Evidence: AGENTS.md line 8 routes to knowledge/index.md. The index links concepts. No recorded agent setup, fixed task trials, or outcomes appear in the tracked file inventory.
- Consequence: we cannot infer consistent discovery across coding agents from the presence of Markdown links.
- Recommendation: select one agent environment and run repeatable task trials on fixed snapshots.
- Proposed tasks: change the CTA recipient; preview with an occupied port; update instructions following a simulated runtime migration.
- Acceptance: record agent/model versions, configuration, task inputs, snapshot, commands, outcomes, discovery evidence where observable, and repeated runs. Control the environment and report unsuccessful trials.
- Prototype disposition: not performed. Requires an agreed agent environment, isolated execution, and a separately scoped evaluation.

## Historical correction

At 96446db, AGENTS.md contained Compose validation commands. At 3b2678d those were replaced with routing to the current operations playbook and a self-maintenance trigger. This is an observable documentation change, not evidence of improved agent success.

## Prioritized handoff

| Order | Owner role | Action | Acceptance |
| --- | --- | --- | --- |
| 1 | Site maintainer | Allowlist public image files | Public URLs return 200, internal guidance URLs return 404 |
| 2 | Repository maintainer | Bound port troubleshooting | Explicit owner check and alternate port |
| 3 | Audit operator + repository engineer | Scope controlled task trials | Recorded repeated runs with a fixed environment |

## Limitations

- No customer code or large application repository was reviewed.
- No security assurance or complete code-quality review was provided.
- No coding-agent tasks, token usage, productivity, or task-success changes were measured.
- File sizes cannot establish billed tokens or actual loaded context.
- Historical line references are tied to 3b2678d and may differ in the working tree.
- Delivery effort on this small repository does not validate the illustrative price or five-day timeline.
- First-party remediation is separate from the proposed customer audit scope.

## Delivery feasibility

Completed here: inventory, structural review, historical evidence, findings, prioritization, acceptance criteria, and a public sample report.

Requires a customer engagement: agreed repository snapshot and scope, actual agent configuration, permission to inspect material, tool/provider and retention agreement, and an engineer to validate workflow assumptions.

Requires separate evaluation: controlled agent trials and any before/after performance comparison.