config-audit/commands/implement.md

---
name: config-audit:implement
description: Phase 5 - Execute action plan with backups and verification
allowed-tools: Read, Write, Edit, Bash, Agent, AskUserQuestion
model: opus
---

# Config-Audit: Implementation (Phase 5)

Execute the action plan with full backup, verification, and rollback support.

## Prerequisites

- Must have completed Phase 4 (plan)
- Action plan at `~/.claude/config-audit/sessions/{session-id}/action-plan.md`

## Arguments

- `$ARGUMENTS` may contain `--raw` to forward to the implementer-agent's instructions; in `--raw` mode the agent renders v5.0.0 verbatim severity prefiks instead of humanized `userActionLanguage` urgency phrasing.

## Implementation

### Step 1: Parse flags, load and verify

```bash
RAW_FLAG=""
if echo "$ARGUMENTS" | grep -q -- "--raw"; then RAW_FLAG="--raw"; fi
```

Find the most recent session with a plan. If none: "No action plan found. Run `/config-audit plan` first."

Use the Read tool on the action plan and count actions. Tell the user:

```
## Implementing Action Plan

Found {N} actions to execute across {M} files.
A backup will be created before any changes are made.
```

### Step 2: Get user approval

```
AskUserQuestion:
  question: "Ready to implement {N} actions? Backup created automatically — you can roll back with one command."
  options:
    - "Yes, proceed"
    - "Review plan first" (then show the plan file path)
    - "Cancel"
```

### Step 3: Create backup

Create backup silently:

```bash
mkdir -p ~/.claude/config-audit/backups/$(date +%Y%m%d_%H%M%S)/files/ 2>/dev/null
```

Copy each file to be modified. Generate `manifest.yaml` with checksums.

The manifest is what `/config-audit rollback` reads, so it MUST carry both lists:

```yaml
files:                      # pre-existing files this run will MODIFY
  - backup: files/root/CLAUDE.md
    original: /abs/path/CLAUDE.md
    sha256: <sha256 of the pre-change content>
created:                    # files this run will CREATE (no backup can exist)
  - /abs/path/.claude/rules/post-quality.md
```

Record every `create`-type action under `created:`. Rollback cannot restore a
file that never existed, but it must be able to tell the user which files it is
leaving behind — a half-restored target is only dangerous when it is silent.

Tell the user: **"Backup created. Implementing actions..."**

### Step 4: Execute actions

Group actions by dependencies. For each group, spawn implementer agents (batch of 3):

```
Agent(subagent_type: "config-audit:implementer-agent")
  model: sonnet
  prompt: |
    Execute action: {action-id}
    File: {file-path}, Type: {create|modify|delete}
    Mode: $RAW_FLAG (empty = humanized progress prose; "--raw" = v5.0.0 verbatim)
    Details: {changes}
    Verify backup exists, make change, validate syntax.
    When logging progress, use the humanized title/userActionLanguage
    fields from the action plan (the planner already rendered them) —
    do not re-derive severity prose. Append result to:
    ~/.claude/config-audit/sessions/{session-id}/implementation-log.md
    Append with Bash `>>` (heredoc) — NEVER the Write tool on this log;
    parallel agents share it and a full-file Write clobbers their entries.
```

Show progress between groups using the humanized titles already present in the action plan:

```
Action 1/N: {humanized title} — done
Action 2/N: {humanized title} — done
...
```

### Step 5: Verify results

Spawn verifier agent:

```
Agent(subagent_type: "config-audit:verifier-agent")
  model: sonnet (note: using sonnet, not haiku)
  prompt: |
    Verify all changes from implementation:
    1. Modified files exist and are syntactically valid
    2. New files created correctly
    3. No new conflicts introduced
    Report to: ~/.claude/config-audit/sessions/{session-id}/implementation-log.md
```

If verifier finds issues: one retry with implementer agent. If still failing: report and suggest rollback.

### Step 6: Present results

```markdown
### Implementation Complete

**{succeeded} succeeded** | {failed} failed | {skipped} skipped

{If score improved, run quick posture and show:}
Score impact: {old_grade} → {new_grade} (+{delta} points)

{If failed > 0:}
{failed} action(s) couldn't be completed — see log for details.

**Backup location:** `~/.claude/config-audit/backups/{timestamp}/`
**Rollback:** `/config-audit rollback {timestamp}`
**Full log:** `~/.claude/config-audit/sessions/{session-id}/implementation-log.md`
```

### Step 7: Update state

Update `state.yaml` with `current_phase: "implement"`, `next_phase: null`.

## Rollback

If the user requests rollback at any point:
1. Read `manifest.yaml` from backup
2. Restore each file and verify checksums
3. Delete newly created files
4. Update state to `rolled_back`

## Error Handling

| Error | What happens |
|-------|-------------|
| Permission denied | Skip action, log it, continue with others |
| File not found | Skip action, log it, continue |
| Invalid syntax after edit | Rollback that single file, log, continue |
| Critical failure | Offer full rollback |