Architecture Audit

VerifiedSafe

Audit your Swift codebase for architectural violations like factory bypass and scope non-compliance. Ideal before merging PRs that touch Core Data.

Sby Skills Guide Bot
DevelopmentIntermediate
7/22/2026
Claude CodeCursorCodex
#architecture-audit#core-data#static-analysis#code-review#adr-compliance

Recommended for

Automated summary

This skill runs a grep-based architecture audit over a Swift/Core Data codebase to catch factory bypass, raw assigns, fetch requests missing a householdKey predicate, and context saves inside view files.

Strengths

  • Ships ready-to-run grep commands with an explicit expected result for each check
  • Encodes concrete architecture decisions (ADR 013 and 014) and lists exempt files such as tests, previews, seeders and the factory itself
  • Accounts for legitimate false positives, including #Preview blocks and PreviewProvider extensions inside production files
  • States an explicit non-goal for the Views layer, preventing bogus violation reports

Limitations

  • Grep patterns and paths are hardcoded for one specific project (WeeklyList, Recipe and other entities under forager/), so reuse elsewhere requires rewriting them
  • Purely textual analysis: it cannot see indirect object creation and exclusion globs may cause misses or false positives
  • The householdKey predicate check needs manual inspection of each fetch site rather than being fully automated
When to use it

Run it before a PR or milestone that touches the service/model layer, or whenever a new Core Data object creation site is being introduced.

When not to use it

Not useful on projects that don't use Core Data or the factory/householdKey conventions from these ADRs, or for auditing the Views layer, which is explicitly out of scope.

Security analysis

Safe
Quality score90/100

The skill only performs read-only grep searches over Swift source files to detect architectural violations. It does not execute arbitrary code, delete files, exfiltrate data, access secrets, or disable safety mechanisms.

No concerns found

How this analysis is made

Examples

Pre-PR gate
Run the architecture audit before I open the PR for the meal-planning milestone that adds new Core Data creation sites.
Factory bypass check
I'm about to create Recipe objects directly inside a view model — check the codebase for factory bypass violations of ADR 014.
Scope compliance spot check
Audit my new fetch requests in the Services and Repositories layers to confirm every HouseholdScoped fetch has a householdKey predicate.

name: architecture-audit description: Check codebase for architectural violations (factory bypass, raw assign, scope compliance, service layer). TRIGGER when the user discusses creating Core Data objects in production code, adding new entity creation sites, or before PR creation on milestones that touch the service/model layer. user_invocable: true

Architecture Audit

Run this audit before any milestone that creates Core Data objects, during code review, and as a quality gate.

Checks

1. Factory Bypass Detection (ADR 014)

Search for direct creation of HouseholdScoped entities outside exempt files:

# Search for direct Entity(context:) for HouseholdScoped types
grep -rn 'WeeklyList(context:\|Recipe(context:\|PlannedMeal(context:\|MealPlan(context:\|Category(context:\|IngredientTemplate(context:' \
  --include='*.swift' \
  --exclude-dir=foragerTests \
  --exclude-dir=foragerUITests \
  --exclude='*Preview*' \
  --exclude='DefaultSeeder.swift' \
  --exclude='SampleDataSeeder.swift' \
  --exclude='ManagedObjectFactory.swift' \
  --exclude='HouseholdService.swift'

Expected: Zero matches in non-exempt production files. Exempt files: Tests, previews, seeders, HouseholdService (migration), ManagedObjectFactory itself. Note: Repository files may have fallback paths with direct creation — these are acceptable IF they also have factory-first branches.

2. Raw Assign Detection

Search for viewContext.assign( or context.assign( outside ManagedObjectFactory.swift:

grep -rn 'viewContext\.assign(\|context\.assign(' --include='*.swift' --exclude='ManagedObjectFactory.swift'

Expected: Zero matches.

3. ADR 013 Scope Compliance (services + repositories only)

Search for HouseholdScoped fetch requests missing householdKey predicate in the service + repository layers:

# Look for fetch requests on HouseholdScoped entities in Services/ and Repositories/ ONLY
grep -rn 'NSFetchRequest<WeeklyList>\|NSFetchRequest<Recipe>\|NSFetchRequest<MealPlan>\|NSFetchRequest<PlannedMeal>\|NSFetchRequest<Category>\|NSFetchRequest<IngredientTemplate>\|NSFetchRequest<GroceryListItem>\|NSFetchRequest<Ingredient>\|NSFetchRequest<Store>' \
  Services/ forager/Repositories/ \
  --include='*.swift'

Then verify each fetch includes a householdKey predicate (grep the same file within ~10 lines after the declaration for the string householdKey).

Non-goal — view-layer @FetchRequest: this check intentionally does NOT scan forager/Views/. The view-layer in-memory-filter pattern is emergent (first appeared f263730 on 2026-01-18; spread by copy-paste across 24 views; not formalized by any ADR) and is deferred to a future change named decide-view-layer-scope-architecture which will evaluate alternatives, pilot one, migrate all ~43 sites, and only then write a definitive ADR. Do NOT extend this check to forager/Views/ before that future change lands — the bare @FetchRequest on a HouseholdScoped entity is NOT a violation of ADR 013 today. See the auto-memory entry project_scope_safety_three_layers.md for context.

4. Service Layer Compliance

Search for context.save() in production view files (views should use services). Previews are exempt — #Preview { } blocks and PreviewProvider extensions are a legitimate standalone environment that may call context.save() to stage preview data.

# Production view saves: exclude dedicated preview files via glob
grep -rn 'context\.save()\|viewContext\.save()' forager/Views/ \
  --include='*.swift' \
  --exclude='*Preview*'

Manual follow-up: matches inside #Preview { ... } macro blocks or PreviewProvider extension bodies (in files NOT named *Preview*) are also legitimate. Discount them when reporting violations. For each reported match, open the file and confirm it is outside any #Preview { } block and outside any PreviewProvider extension before flagging it.

Expected: Zero production matches (all production saves through service layer).

How to Run

Use the Grep tool to execute each check. Report violations with file:line references.

When to Run

  • Before starting any milestone that creates Core Data objects
  • During code review / PR creation
  • After completing service or view layer changes
  • As a quality gate before marking milestone complete

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/architecture-audit-mrwak9j9/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/architecture-audit-mrwak9j9' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/architecture-audit-mrwak9j9/download' --output '.skill-downloads/architecture-audit-mrwak9j9/SKILL.md.part' && mv '.skill-downloads/architecture-audit-mrwak9j9/SKILL.md.part' '.skill-downloads/architecture-audit-mrwak9j9/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/architecture-audit-mrwak9j9/SKILL.md' && test -s '.skill-downloads/architecture-audit-mrwak9j9/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/architecture-audit' && cp -R '.skill-downloads/architecture-audit-mrwak9j9' '.claude/skills/architecture-audit'

Cursor
test -f '.skill-downloads/architecture-audit-mrwak9j9/SKILL.md' && test -s '.skill-downloads/architecture-audit-mrwak9j9/SKILL.md' && mkdir -p '.cursor/skills' && test ! -e '.cursor/skills/architecture-audit' && cp -R '.skill-downloads/architecture-audit-mrwak9j9' '.cursor/skills/architecture-audit'

Codex
test -f '.skill-downloads/architecture-audit-mrwak9j9/SKILL.md' && test -s '.skill-downloads/architecture-audit-mrwak9j9/SKILL.md' && mkdir -p '.agents/skills' && test ! -e '.agents/skills/architecture-audit' && cp -R '.skill-downloads/architecture-audit-mrwak9j9' '.agents/skills/architecture-audit'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/architecture-audit-mrwak9j9'

openskills read 'architecture-audit-mrwak9j9'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/architecture-audit-mrwak9j9/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills