The audit asks the coding-agent runtime you already use to inspect routes, onboarding, gates, pricing, empty and error states, value paths, retention loops, and service handoffs. It writes one local file, ux-assumptions.md, in the frozen v1 format. Every draft has a falsifiable question, measurable signal, numeric threshold, real file/line provenance, and Verdict: untested.

Code can reveal the bet. Customer evidence is needed to answer it.

Choose the agent explicitly

V0 supports Claude Code and Codex CLI directly:

npx sightspool audit --agent claude
npx sightspool audit --agent codex

--agent auto is the default, but it selects only when exactly one supported runtime is present. If both are installed, the command stops and asks you to choose rather than quietly picking a provider.

Scope the read to an app or package while keeping the register at the repository root:

npx sightspool audit apps/web --agent codex

Cursor, Copilot, Windsurf, Replit, and other agents

Export the complete host-neutral prompt:

npx sightspool audit --agent prompt

Copy the output into Cursor or another terminal-capable coding agent. For a temporary prompt file outside the repository:

npx sightspool audit --agent prompt > /tmp/sightspool-audit-prompt.md

Then ask the agent to follow that file in the target repository. The exported prompt contains the same protocol, format, quality examples, safe re-run rules, privacy boundary, and report contract used by the Claude and Codex adapters; it does not depend on Claude-specific slash commands.

Machine-readable output

npx sightspool audit --agent codex --json

--json emits the stable v1 result envelope on stdout. Human/runtime progress uses stderr. The envelope always includes:

{
  "schemaVersion": 1,
  "command": "audit",
  "ok": true,
  "status": "completed",
  "agent": "codex",
  "targetPath": "/absolute/repository/root",
  "scope": ".",
  "registerPath": "/absolute/repository/root/ux-assumptions.md",
  "entryCount": 8,
  "addedCount": 8,
  "topRisks": [
    { "id": "A-001", "title": "New signups reach first value", "severity": "high" }
  ],
  "providerDisclosure": "...",
  "nextStep": "https://www.sightspool.com/for-coding-agents"
}

Possible status values are completed, unchanged, prompt_ready, and error. Errors are non-zero and add error: { code, message, hint? }. prompt_ready also adds the exported prompt string. Fields are additive within schema v1; existing fields do not change meaning.

Privacy and write boundary

The CLI sends no repository content, telemetry, account data, or audit result to Sightspool.
The selected coding-agent runtime may process repository context under that provider's terms and configured account.
Direct adapters run the agent read-only and disable remote MCP servers in the Claude adapter. The CLI validates the candidate and performs the only repository write.
The only repository file created or updated is ux-assumptions.md at the repository root.
Re-runs preserve existing ids, client edits, observed values, and verdicts. New assumptions are appended above the historical maximum id. An unsafe or unrecognized existing register causes a non-zero stop, not an overwrite.
No Sightspool account, MCP connection, SDK install, or analytics setup is required.

There is no covert CLI telemetry. Package-registry aggregate download counts and explicit, user-approved import events are the only intended adoption signals.

Claude Code plugin

The existing Claude Code marketplace command remains available and now reads the same host-neutral protocol bundled with the npm CLI:

/plugin marketplace add sightspool/claude-plugins
/plugin install ux-assumptions@sightspool
/audit-assumptions

Development

npm test
npm run smoke:pack

The pack smoke test installs the generated tarball into a clean temporary project and executes its binary. Publishing and the post-publication npx sightspool@<version> smoke test remain separate, approval-gated release steps documented in RELEASING.md.

Optional next step: the coding-agent guide.