Audit Workbench by WinMedia · v0.2.7 macOS Candidate
Know what your AI coder should work on next—and whether the result made your repository better.
AI coding assistants execute tasks quickly, but they don't establish which repository problem deserves attention first or whether a later change actually improved the codebase. Audit Workbench finds the highest-priority move, challenges AI-proposed evidence against actual code, and verifies progress against saved baselines.
Release review
Seeking reviewers
Audit Workbench is ready for release review. We are seeking reviewers who can try it on a repository they know and provide feedback.
Express interest in reviewingThe Problem
AI assistants execute, but they don't prioritize or verify.
Autonomous coding assistants are productive at generating implementations, but they operate without repository perspective.
Misaligned Priorities
Coding agents will eagerly write complex features on top of broken test harnesses, missing CI configurations, or untracked build artifacts without noticing foundational problems.
Hallucinated Findings
LLM-based code reviews frequently invent problems, cite nonexistent files, or recommend refactors that contradict existing architectural mechanisms already present in the codebase.
Unverified Progress
After an agent makes a dozens of edits across a repository, developers struggle to determine whether the original defect was actually resolved or if new regressions were introduced.
The Core Workflow
Fix First. Unlock Next. Verify Progress.
Three disciplined stages designed to keep AI coding work grounded in repository truth.
Fix First
Identifies the single highest-priority supported defect or risk blocking the repository. Includes an actionable remediation plan and explicit verification criteria.
Unlock Next
Discovers a distinct high-leverage opportunity that creates architectural or developer workflow advantage once the primary fix is complete.
Verify Progress
Saves an immutable audit baseline before coding begins. Re-run after agent changes to objectively prove whether findings are resolved, still present, or require verification.
Under The Hood
Evidence-bound architecture, not ungrounded LLM prompts.
AWB combines deterministic static analysis with adversarial evidence challenge to eliminate hallucinations.
Deterministic Foundation
Fast Mode: 100% Local Discovery
Inspects repositories using deterministic rules across six core families.
- Test Harness: Detects absent test runners, missing test suites, or broken test scripts.
- Git Hygiene: Audits tracked runtime artifacts, build outputs, and loose worktree state.
- Dependency Hygiene: Flags outdated lockfiles, vulnerable packages, and phantom scripts.
- CI Configuration: Checks workflow definitions, missing automated gates, and step coverage.
- Secret Containment: Ensures private keys, environment files, and credentials are quarantined.
- Lint & Build Posture: Validates compile boundaries, syntax configurations, and formatting rules.
Adversarial Validation
Deep Mode: Semantic Evidence Challenge
Augments deterministic findings with semantic proposals that must survive evidence verification.
- File Existence Check: Every cited file path must exist in the target repository.
- Content & Line Range Check: Exact cited line ranges are inspected against actual file content.
- Contradictory Search: Searches for equivalent existing mechanisms that would invalidate the proposal.
- Actionability Preconditions: Rejects recommendations whose prerequisites are unsatisfied.
- Safe Degradation: If semantic augmentation fails or is rejected, deterministic recommendations are preserved.
User Interface
A clean visual workbench that runs on loopback.
Start the visual workbench with 'awb ui' or integrate the CLI directly into automation.
1. Repository Selection & Goal Alignment
Select any readable local Git repository. Choose your current development priority (Release Readiness, Testing, CI, or Faster Dev) and pick Fast (deterministic) or Deep (hybrid) mode.
2. Lead Recommendations with Source Citations
Inspect Fix First and Unlock Next cards with direct clickable citations into local repository source code, action steps, and verification criteria.
3. Progress Comparison Against Baselines
Save an exact run as a baseline with one click. After your AI coding assistant finishes changes, compare against the baseline to see what was resolved or newly detected.
4. Structured Feedback & Export
Rate recommendations directly in the UI (useful, changed direction, incorrect, etc.). Export completed briefs to JSON or clean Markdown for inclusion in pull requests or agent prompts.
$ awb ui→ Audit Workbench running at http://127.0.0.1:58736 (Local loopback only)
Internal Case Study
Surfaced a live production webhook vulnerability.
Early evidence from WinMedia's internal dogfooding and release qualification.
“During internal release qualification, Audit Workbench inspected WinMedia's own commerce surface and flagged a critical PayPal webhook signature-verification flaw. The finding was manually confirmed, verified by human operators, and immediately repaired before any customer transactions occurred.”
Context & Non-Claim: This internal validation demonstrates Audit Workbench's ability to detect serious security configuration defects in real repositories. However, AWB does not claim this establishes general or exhaustive security-detection performance.
Early Access Pricing
Simple, transparent per-developer pricing.
Audit all your authorized repositories with zero per-audit fees or arbitrary limits.
14-Day Free Trial
$0
No credit card required
- ✓ Full local visual workbench
- ✓ Unlimited Fast deterministic audits
- ✓ Optional Codex Deep mode support
- ✓ Baseline saving & progress comparison
- ✓ Markdown and JSON export
Monthly
$19 / month
Billed monthly · Cancel anytime
- ✓ All authorized repositories
- ✓ Unlimited Fast audits & comparisons
- ✓ Deep mode provider preflight
- ✓ 7-day offline grace period
- ✓ 30-day initial purchase refund policy
Annual
$190 / year
Two months free · Single payment
- ✓ Everything in Monthly
- ✓ 2 months free equivalent
- ✓ Simplified annual expense invoicing
- ✓ Priority bug & detector feedback review
- ✓ 30-day initial purchase refund policy
Monthly and annual subscriptions are available. The free trial remains available. Cancellation stops renewal; offline access expires after the paid period plus seven days. Contact support@winmedia.com to cancel or request a refund.
* Customer provides their own Codex/LLM credentials for Deep mode and bears external inference costs. WinMedia charges no per-audit or compute markup.
Quick Start
Download Audit Workbench 0.2.7 for a fresh local installation.
Scoped macOS candidate. Preserve your existing installation, trial, history and case records.
Before installing, verify with shasum -a 256 audit-workbench-0.2.7.tgz. Expected SHA-256: 46bda42aa0cfa621fb7ba255e270ae56a69a4fdb63a8096c4c01290f3781ecfc. Stop if it differs.
Step 1: Install in a new, unused prefix (Node.js 20+)
npm install --prefix "$HOME/.local/share/awb-0.2.7" --omit=dev --ignore-scripts --no-audit --no-fund ./audit-workbench-0.2.7.tgzThis command downloads dependencies. Choose another unused prefix if the example already exists. Keep your old prefix and .awb storage; do not use sudo.
Step 2: New users may start a trial; existing users skip this step
node "$HOME/.local/share/awb-0.2.7/node_modules/audit-workbench/dist/cli/index.js" license trialAn upgrade does not restart or extend your trial.
Step 3: Launch the installed workbench directly
node "$HOME/.local/share/awb-0.2.7/node_modules/audit-workbench/dist/cli/index.js" ui --codex-model gpt-6-sol --codex-reasoning-effort mediumUse the actual Codex executable on PATH. Fast mode and opening the UI make no model call. For a separately authorized Deep audit, select relevant paths or line ranges, review every included excerpt and its size, then approve that exact context. Credential screening cannot guarantee secret-free selected source. Global Codex settings are not changed.
Requirements
Qualification scope and prerequisites.
The candidate is qualified for the documented macOS scope; broader compatibility remains untested.
Tested local environment
- • macOS 15.7.4 on Apple Silicon arm64; Node.js 20.19.4
- • Node.js 20+, Git and npm are installation prerequisites
- • Desktop and approximately 390px interactions passed by direct user report; real mobile hardware was not tested
- • Intel Macs, Linux, Windows and other runtime versions remain untested
Deep Mode Requirements (Optional)
- • codex-cli 0.155.1 and the exact shipped capability catalog; unknown versions fail closed
- • One existing file-backed Codex ChatGPT login was tested with gpt-6-sol / medium; keyring-only login and other accounts/models are untested
- • Earlier payload passed one live Deep audit. The merged build is offline verified; provider/input-boundary bytes match, but no renewed live or direct browser qualification was performed
- • Effective settings come from CLI runtime-header evidence; no independent server attestation
- • Fast mode operates without an external model CLI
Boundaries
Explicit Non-Promises & Limitations
We state clearly what Audit Workbench does NOT claim to do.
Audit Workbench is a developer prioritization and progress verification tool. Do not claim or rely on it for:
- Exhaustive security scanning: AWB checks specific deterministic hygiene families and surfaces targeted issues, but it is not an all-encompassing SAST or DAST scanner.
- Guaranteed vulnerability detection: The absence of surfaced findings does not certify code as secure.
- Compliance certification: AWB does not provide SOC2, ISO, PCI, or regulatory compliance certificates.
- Automatic code correctness: AWB advises on what deserves work next; developers remain responsible for code correctness and review.
- Production verification: AWB audits repository source code and configuration, not runtime production infrastructure.
- Autonomous remediation: AWB recommends remedies with verification plans, but never mutates your repository without human authorization.
- Universal language coverage: Deterministic coverage focuses on modern full-stack web and systems stacks (TypeScript, JavaScript, Python, Rust, Go, shell).
Privacy & Security
Privacy and Data Processing Disclosure
Your repository code remains your private intellectual property.
Fast Mode & Local History
Deterministic repository analysis runs 100% locally on your machine. Audits, baselines, and reports are stored in your local ~/.awb directory. No repository code or AST data is ever sent to WinMedia.
Deep Mode & Licensing
Deep mode sends reviewed selected context through the qualified local Codex CLI using your existing login. Credential screening cannot guarantee secret-free selected source; review remains required. Global Codex settings are preserved. Licensing tokens contain only your email, expiration date, and plan type—never repository paths or telemetry.
Support & Guarantee
30-Day Money-Back Guarantee
We stand behind Audit Workbench's ability to clarify your developer workflow.
If Audit Workbench does not function materially as described on your supported configuration, contact support@winmedia.com within 30 days of your initial purchase for a full, courteous refund.
For installation assistance, bug reports, or recommendation feedback, reach out to our engineering support team at support@winmedia.com.