An audit that tells you what it could not check.
Diligent is a portable Agent Skill for auditing U.S. government websites and digital services. Every step leaves a durable artifact, and the final status is computed, not asserted.
npx skills@latest add Simple-Cortex/diligent
0.1.0 contracts and gate 0 automated website checks 7 rule packs in research lifecycle
Version 0.1.0 is a contracts-and-gate release. It ships zero automated website checks. It defines the workflow, the artifacts, the authority registry, the rule packs, and a deterministic gate. It does not find or clear accessibility issues by itself.
Six words a check can say. None of them is “probably fine”.
Every result has one of six states. A skipped test is not_tested, never a pass. The overall outcome is computed from the recorded results.
| State | Meaning |
|---|---|
| pass | An observation was recorded and it meets the rule. |
| fail | A recorded observation shows the rule is not met. |
| needs_review | The question is routed to a named person. It stays open until they answer. |
| not_tested | The check did not run. A skipped test lands here. |
| blocked | The check could not run, for example a timeout or a collector failure. |
| error | The check ran and failed to produce a usable result. |
| Outcome | Meaning |
|---|---|
| fail | A confirmed mandatory failure. The gate exits 1. |
| incomplete | Required work is untested or applicability is unknown. The gate exits 2. It never becomes a pass. |
| pass_for_declared_scope | No failure in the declared scope and nothing required was left untested. The gate exits 0. |
| not_applicable | The audited obligations do not apply to the declared scope. |
The gate exits 3 for an invalid configuration or an execution failure.
How it works
Each phase writes its artifact before the next may start. Artifacts live under .diligent/<audit-id>/.
- initRUN.json
- discoverPROJECT-CONTEXT.json
- scopeAPPLICABILITY.json
- inventoryINVENTORY.json
- planAUDIT-PLAN.json
- collectEVIDENCE.jsonl
- assessRESULTS.jsonl
- proposeREPAIRS.json
- verifyVERIFICATION.json
- reportREPORT.md
- gateexit code 0, 1, 2, or 3
What it will not do
No certification
It never certifies, authorizes, or approves anything. A result is not a statement of legal compliance.
No live submissions or payments
Submissions, payments, notifications, and changes to real records are outside the workflow. It uses synthetic fixtures.
A skipped test is never a pass
A timeout or a collector failure is blocked or error, never conformance.
Page content cannot instruct the auditor
Page, repository, document, and issue text is untrusted data. It cannot skip a rule or mark itself passed.
Who it is for
Accessibility and compliance leads
You need the audit to say what it covered and what it did not. Diligent reports counts with denominators, lists unsupported criteria, and routes judgment calls to named roles.
Developers and product teams
You need to know where to fix something and what must not change. Findings carry a location, a reproduction, an acceptance test, and the protected constraints.
Program, privacy, and security owners
You need the right questions at the right time. Evidence requests name the exact artifact, the owner role, and the obligation it would settle.
Updates
0.1.0, 2026-10-17
First release. A contracts-and-gate release: it ships no automated website checks.
- Router skill and ten phase skills, with an artifact chain and a JSON Schema for each artifact.
- Authority registry and seven research-lifecycle rule packs, plus two profiles.
- Deterministic gate that exits 0, 1, 2, or 3. A skipped test is never a pass.
Install
npx skills@latest add Simple-Cortex/diligent
Requires Node 20 or later for the command line helpers. The skill also has a manual fallback for hosts without scripts. Source on GitHub.
Also from the same maker: Considered, the design-reasoning skill.