Warden Sweep

Run a full-repository Warden sweep: scan files, verify findings, create a tracking issue, open draft PRs for validated issues, and organize the final report.

Requires: warden, gh, git, jq, uv.

Run commands from the repository root. Use the host's skill-root path for bundled scripts and references.

Output goes to .warden/sweeps/<run-id>/.

References

Load only the reference for the current phase:

| Need | Read | |------|------| | Script arguments, outputs, and side effects | references/script-interfaces.md | | Phase 1 scan workflow | references/scan-phase.md | | Phase 2 verification workflow | references/verify-phase.md | | Phase 3 tracking issue workflow | references/issue-phase.md | | Phase 4 patch and draft PR workflow | references/patch-phase.md | | Phase 5 organize and final report workflow | references/organize-phase.md | | Resume behavior and artifact layout | references/resume-and-artifacts.md | | Verification task prompt template | references/verify-prompt.md | | Patch task prompt template | references/patch-prompt.md |

Workflow

Track progress across phases:

• [ ] Phase 1: Scan repository files with Warden.
• [ ] Phase 2: Verify findings before patching.
• [ ] Phase 3: Create a tracking issue.
• [ ] Phase 4: Patch verified findings and open draft PRs.
• [ ] Phase 5: Organize results and produce the final report.

Phase Order

1. Read references/script-interfaces.md once before running scripts.
2. Run Phase 1 from references/scan-phase.md. Save runId and sweepDir.
3. Run Phase 2 from references/verify-phase.md. Verify every finding before patching.
4. Run Phase 3 from references/issue-phase.md. Continue if issue creation fails.
5. Run Phase 4 from references/patch-phase.md. Patch sequentially, one finding at a time.
6. Run Phase 5 from references/organize-phase.md.
7. For interrupted or partial runs, read references/resume-and-artifacts.md and continue from the first incomplete phase.

Non-Negotiable Rules

• Verify findings before creating fixes.
• Use draft PRs for generated patches.
• Branch every patch from the repository default branch.
• Patch findings sequentially; do not run patch workers in parallel.
• Skip existing entries in sweep artifacts instead of duplicating work.
• Record failures in sweep data and continue to the next finding when possible.
• Clean up each worktree after patch success or failure.

Final Response

After organizing, report:

## Sweep Complete

| Metric | Count |
|--------|-------|
| Files scanned | {filesScanned} |
| Findings verified | {verified} |
| PRs created | {prsCreated} |
| Security findings | {securityFindings} |

Full report: `{summaryPath}`