Audit template
lean
Find the bloat, dead code, and unused dependencies — without deleting anything load-bearing.
Maps to: Google Eng · OWASP · YAGNI
How this audit works
A read-only leanness audit across five dimensions: dependency transparency and supply chain, dead code and orphan files, duplication, AI slop and defensive boilerplate, and over-engineering. It builds an SBOM and a reachability map first, then gates every removal behind Chesterton's Fence and a Resurrector skeptic — so each cut is sorted into remove-now, investigate, deprecate, or protected, never a blind delete.
Use it when
Inheriting an AI-generated codebase
After months of agent-written code, you suspect duplicated utilities, restating-the-code comments, and over-defensive boilerplate but cannot prove it. The audit reports duplication density with both clone locations, flags log-and-continue catch blocks, and names which simplifications are behaviour-equivalent.
Trimming the dependency surface before a release
You want to shrink install and supply-chain risk but fear breaking a fresh install. It separates declared-but-unused dependencies from phantom used-but-undeclared ones, explains why every transitive package is present, and checks the lockfile and licenses against policy.
Deciding whether dead code is really dead
A static tool flagged unused exports and orphan files, but reflection, dynamic imports, and out-of-repo consumers make you hesitant to delete. The audit traces the reachability map, states which dynamic channels were ruled out, and labels each candidate proven-dead or only suspected-dead.
What you get
A leanness scorecard plus prioritized GitHub issues, each with a removal class, the reachability proof, and a before/after fix with a revert note.