> ## Documentation Index > Fetch the complete documentation index at: https://docs.monolex.ai/llms.txt > Use this file to discover all available pages before exploring further. # Audit & Correctness > Contract, coupling, structural-risk, deep-semantic, and 14 possibility-band audits in monogram 0.98.11. Monogram's audit layer asks whether code is connected, contract-complete, and worth deeper review. It does not turn ranked candidates into automatic verdicts. Every meaningful finding should return to line-numbered source and the owning call/boundary path before a change is made. *Documents the public OpenCLIs release `monogram 0.98.11`.* For the complete 50-tool list, see [Monogram Reference](/ai-clis/monogram/reference#complete-50-tool-mcp-inventory). ## Proof discipline ```text theme={null} candidate/worklist row -> context -> chain or investigate -> owning boundary -> edit/test -> rerun the same audit ``` * `ORPHAN_*`, `uncalled`, semantic rows, and possibility bands are observed evidence, not deletion or bug orders. * Search and audit ranks help choose where to look; they do not establish cause. * Deep commands are trustworthy only after `monogram semantic status` confirms a current semantic companion. * `--score-debug` explains ranking evidence; it does not increase the certainty of a structural finding. * Broad JSON outputs may be summary-first. Narrow with the emitted `next_hint`, `--pattern`, `--category`, `--file`, or `--lang` before requesting sites. ## Contract audits ### Public requirement preflight ```bash theme={null} monogram spec-audit instruction.md --against . monogram sequence start "" --from instruction.md monogram sequence deepen current monogram sequence define current monogram sequence finish current ``` `spec-audit` extracts public edge bands and source probes before implementation search. `sequence` keeps the contract investigation stateful and joins the selected bands, IAW-SOP gates, structural forks, and embedded fix-shape knowledge. `sequence define` writes `connection-points.md`; follow its binding ORDER chain and review it as a proof plan, not generated truth. After the final Edit/Write and test, `sequence finish` re-presents the saved task contract and Book section, writes the close witness, and sets the session phase to `finished`. Make no source mutation after that close; if a gate is unproved, prove it and run `finish` again. ### Format-language contract gate ```bash theme={null} monogram format-trace json-schema src/schema.ts monogram format-trace openapi api.yaml monogram format-trace hcl infrastructure/ monogram format-trace cargo-toml Cargo.toml ``` Use `format-trace` first when a task is owned by a reference graph, schema scope, branch semantics, generated runtime behavior, normalization, or round trip. Public planes are `json-schema`, `openapi`, `openapi-yaml`, `hcl`, and `cargo-toml`. JSON Schema output can identify `$defs`/`$ref` edges, cycles, converter re-entry, lost root context, runtime binding risks, and required positive/negative probes. Do not close work while `completion_gate` is `BLOCKED` or a required coverage row remains unproved. ## Boundary and structural audits ### `monogram coupling` Joins client/caller keys to definitions across language, process, and protocol boundaries. ```bash theme={null} monogram coupling --summary monogram coupling --domain http monogram coupling --domain sql monogram coupling --domain pubsub monogram coupling --domain event monogram coupling --domain css-token monogram coupling --domain export-import monogram coupling --domain ffi --pattern Session --all monogram coupling --domain tauri-ipc --category orphan --verify-callers ``` | Domain | Connected surfaces | | --------------- | ---------------------------------------------------------- | | `http` | Client requests and server route definitions | | `sql` | Queries and table definitions | | `pubsub` | Emit/publish/fire and on/subscribe/bind | | `event` | Control-plane or WebSocket message types and handler cases | | `tauri-ipc` | Frontend `invoke` calls and Rust Tauri commands | | `ffi` | C/Zig/Rust/Swift/Kotlin boundary symbols | | `css-token` | CSS custom-property consumers and CSS/JS definitions | | `export-import` | Imports and exports | | Verdict | Evidence boundary | | --------------- | ------------------------------------------------------------------------------------ | | `OK_Bound` | A definition and call were both observed; hidden unless `--all` | | `ORPHAN_Call` | A caller exists without a matched definition; runtime-risk candidate | | `ORPHAN_Define` | A definition has no matched caller; dead-surface candidate, unless public or dynamic | | `AMBIGUOUS` | Multiple definitions own the same key | `--verify-callers` adds an inbound call-edge count to orphan definitions. Zero is stronger evidence for dead surface; one or more suggests internal or dynamic use. Neither result replaces source review. `monogram bridges` provides the resolved semantic view of frontend Tauri invokes and backend commands. ### `monogram trace` versus `monogram investigate` ```bash theme={null} monogram trace handle_request monogram investigate handle_request --file server ``` `trace` returns a bounded definition/caller/callee view and suggests a coupling boundary. `investigate` runs that boundary in the same report and identifies the highest fan-in edit anchor. Prefer `investigate` when a review must demonstrate the structural and cross-boundary path together. ### `monogram important` Classifies CSS `!important` rules into redundant, needed, vendor/runtime override, and conflicting families. ```bash theme={null} monogram important src/styles monogram important --category REDUNDANT --file prompt.css monogram important report src/styles monogram important migrate src/styles ``` `report` aggregates hotspots and conflict pairs; `migrate` produces refactor plans. Monogram is report-only: there is no `--apply`. Selector text cannot prove DOM overlap, so each proposed removal needs source/DOM review. ### `monogram errors` Categorizes Rust and TypeScript build errors and joins each error to its containing symbol and impact radius. ```bash theme={null} monogram errors monogram errors --from build.log cargo check 2>&1 | monogram errors --stdin monogram errors --from build.log --category TYPE_MISMATCH --json ``` Without `--from` or `--stdin`, `errors` runs the relevant compiler (`cargo check` or `tsc`) and may write ordinary build artifacts even though it does not edit source. Categories include merge conflict, missing resource, unresolved import, syntax, type, trait-bound, borrow-check, and frontend distribution failures. ### `monogram metrics`, `monogram uncalled`, and `monogram unused-imports` ```bash theme={null} monogram metrics --summary monogram metrics --over -n 20 monogram uncalled --lang rs --file src monogram uncalled --dead monogram unused-imports --file src ``` * `metrics` reports length, parameters, fan-in/out, depth, recursion, and coupling hotspots. * `uncalled` reports functions with no inbound indexed call edge. `--dead` adds internally unreachable evidence from the deep graph. * `unused-imports` reports names that appear only on their own import line; JSX, re-export, type, and code uses count as used. These are review candidates. Dynamic dispatch, public APIs, reflection, generated calls, and tests can sit outside the observed edge set. ## Deep semantic plane Build and verify the companion first: ```bash theme={null} monogram index . --deep monogram stats --deep monogram semantic status ``` The semantic plane is observed-only (`ranking_ready=false` in semantic reports). It complements the core trigram/call index; it does not replace reading source. | Command | Evidence | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `monogram semantic` | Status, resolution audit, dead code, references, schema bands/metrics, contract drift, environment/command surface, mutations, exceptions, resolved calls, complexity, Tauri reach, emit anchors, and compiler facts | | `monogram inspect` | Per-symbol FunctionIR, effects, body shape, callers/callees, reachability, lifecycle, roles, and meaning tags | | `monogram effect` | Functions carrying a named effect such as await, unsafe, allocation/deallocation, mutation, or exception/result behavior | | `monogram hubs` | Resolved graph centrality by fan-in/fan-out | | `monogram lifecycle` | Lifecycle order or the global teardown closure | | `monogram unsafe-reach` | Functions transitively reaching an unsafe operation | | `monogram modules` | Import/export/module graph, including dead exports and orphan modules | | `monogram injection` | Candidate dataflow from known sources to sinks | | `monogram bridges` | Resolved cross-language Tauri IPC connections | | `monogram types` | Type declarations, members, and inherited behavior evidence | | `monogram provenance` | Writers and writer callees for a value's raw-source versus transformed-view fork | Example flow: ```bash theme={null} monogram inspect SessionActor monogram effect uses_await monogram lifecycle teardown monogram types SessionState monogram context SessionActor --code 80 monogram chain SessionActor --callers --depth 1 ``` ## The 14 possibility-band commands These MCP/CLI commands are explicit review surfaces. Some are false-positive-leaning candidates; others are complete Tier-0 worklists. Presence never means “confirmed bug.” | Command | Candidate or worklist | Required proof after a row | | ----------------------------- | ------------------------------------------------- | ------------------------------------------------------- | | `monogram blocking-in-async` | Known blocking call inside Rust/Python async code | Read the site and prove its execution path | | `monogram lock-across-await` | Rust/C# guard spans an await | Prove acquire-await-release ordering and callers | | `monogram select-sites` | Complete `tokio::select!` site list | Inspect branch cancellation safety | | `monogram worklist` | Named Tier-0 band such as `banned-libc` | Review every concrete row in source | | `monogram panic-reach` | Tauri command transitively reaches panic/abort | Trace the complete path to the unchecked edge | | `monogram unsafe-send` | Hand-written Rust `unsafe impl Send/Sync` | Prove aliasing and thread ownership | | `monogram async-void` | C# `async void` | Separate event-handler cases and prove caller behavior | | `monogram rescue-exception` | Ruby `rescue Exception` | Decide whether `StandardError` is the intended boundary | | `monogram throwing-dtor` | C++ destructor may throw | Inspect unwind and teardown error behavior | | `monogram floating-promise` | TS/JS async call has no await/then/catch | Prove completion and error ownership | | `monogram mutable-defaults` | Python collection-literal parameter default | Prove cross-call shared state | | `monogram contract-pair` | Only one Java/Python equality/hash method exists | Inspect inherited methods; implement both or neither | | `monogram is-literal` | Python value compared with `is` | Confirm identity is not intended | | `monogram bitwise-precedence` | C bitwise/comparison precedence pattern | Confirm intended grouping and parenthesize explicitly | ```bash theme={null} monogram blocking-in-async --lang rust -n 20 monogram lock-across-await --lang rust -n 20 monogram select-sites -n 20 monogram worklist banned-libc monogram panic-reach -n 20 monogram unsafe-send -n 20 monogram async-void -n 20 monogram rescue-exception -n 20 monogram throwing-dtor -n 20 monogram floating-promise -n 20 monogram mutable-defaults -n 20 monogram contract-pair java-eq monogram is-literal -n 20 monogram bitwise-precedence -n 20 ``` The stable proof path is: ```bash theme={null} monogram semantic status monogram [options] monogram context --code 80 --file monogram investigate --file ``` ## Book attachments Navigation commands can attach curated vulnerability/fix knowledge with `--bands`: ```bash theme={null} monogram search "deserialize request" --bands monogram symbols parse_request --bands monogram chain parse_request --callers --bands ``` Text output prints an executable `monograph read` only when the standalone Monograph companion is available. JSON preserves all matching Book IDs. The attached Book entry explains a known pattern; the source and call/boundary evidence decide whether it applies here. ## Mutation and execution boundaries | Operation | Effect | | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `monogram sequence start` | Creates the session under `MONOGRAM_HOME` when set, otherwise repo-locally; persists the task/spec/scope/current pointer and auto-runs `define` | | `monogram sequence deepen` / `define` | Advances the bounded problem-definition state or writes `connection-points.md` | | `monogram sequence finish` | Re-presents the final contract review, writes `finish.json`, and updates the session phase; it does not edit product source | | `monogram sequence resume` | Changes the repo-local current-session pointer | | `monogram sequence status` / `list` | Read session state only | | `monogram errors` without input/log | Runs a compiler and can update build artifacts | | `monogram index` / `reindex` / `prune` / `scope apply` | Mutates Monogram's own databases or scope configuration, not source files | | `monogram boot init` | Writes `.monogram/boot.toml` | | All other audit queries on this page | Read indexed/source evidence and print reports | For database selection, fail-closed deep state, and cleanup previews, continue to [Scope & Index Management](/ai-clis/monogram/scope).