feat: jc audit — cross-resource health checks (security/compliance/hygiene/identity)

[jklaassenjc]

Summary

A composable check registry that audits the whole org in one pass. 11 checks across 4 categories, each emitting severity-tagged findings with structured resource_ref and remediation hints. The same primitive backs jc-security-audit and jc-compliance-check skills, which now interpret structured JSON instead of scripting raw queries.

What's included

• internal/audit/ (new package)
  • audit.go — Severity, Category, Finding, CheckResult, AuditCheck types + registry + Run loop + sort/filter helpers
  • data.go — parallel Fetcher interface + shared Data bundle (best-effort: sub-fetch failures become warnings, only all-fail returns an error)
  • checks.go — all 11 checks in one file for catalog discoverability
  • audit_test.go — registry, runner, per-check, fetch semantics
• internal/cmd/audit.go — parent audit command now runs health checks on bare invoke; audit verify (KLA-411 MCP signed-log) remains as sibling subcommand. Includes clientFetcher adapter mapping v1/v2 to the Fetcher interface, and renderers for human/json/ndjson/table/csv.
• Skills — jc-security-audit + jc-compliance-check rewritten to invoke jc audit --category X --output json and layer interpretation on top of structured findings instead of bash-scripted queries.
• Schema + showcase site — adds jc audit + jc doctor to the manifest (both were missing from the hand-curated catalog), new "Diagnostics" sidebar category, duration flag-type added to the whitelist (jc doctor's --probe-timeout 5s).
• docs/AUDIT.md — per-check reference: what it checks, why, severity scaling, roadmap notes.

The 11 checks

Category	Check	Severity
security	admins-without-mfa	CRITICAL
security	users-without-mfa	HIGH
security	suspended-not-locked	MEDIUM
security	iplists-empty	LOW
compliance	mfa-adoption-rate	scales (<50% CRITICAL → <95% MEDIUM → silent above)
compliance	admin-mfa-coverage	CRITICAL if <100%
compliance	password-age	MEDIUM
compliance	fde-coverage	scales (<50% CRITICAL → <90% HIGH → MEDIUM)
hygiene	stale-devices	MEDIUM
hygiene	auth-policies-disabled	LOW
identity	recently-created-admins	INFO

Deferred (N+1 fetch patterns): empty-groups, suspended-users-with-ssh-keys, policies-without-scope. Documented in docs/AUDIT.md roadmap section.

CLI surface

jc audit                              # everything, human-readable
jc audit --category security          # security only
jc audit --severity high              # high/critical only
jc audit --output json                # for skills + CI
jc audit --exit-code --threshold high # CI gate: exit 1 on threshold

Test plan

• go test ./... — full sweep green (incl. new audit package + schema)
• go vet ./... clean
• make verify-site clean
• Smoke against real org: surfaced 2 admins-without-mfa, 2 users-without-mfa, 5 stale devices, low FDE, disabled auth policy
• Exit code wired: --threshold critical --severity critical exits 1; --threshold critical --category hygiene (no criticals there) exits 0
• All output formats render: human/json/ndjson/table verified live
• audit verify (existing KLA-411 subcommand) still resolves correctly

Closes KLA-443

🤖 Generated with Claude Code

---

Note

Medium Risk
Read-only org-wide API listing and security/compliance interpretation can mis-rank risk or fail CI gates if sub-fetches degrade; exit-code behavior was tightened to treat check errors as failures.

Overview
jc audit is now the primary entry point for org-wide health checks (security, compliance, hygiene, identity), not only MCP signed-log tooling. A bare jc audit runs a registered battery of checks after a single parallel JumpCloud list fetch; jc audit verify is unchanged for MCP manifest verification.

The new internal/audit package defines severities, categories, structured findings (resource_ref, remediation_hint), a check registry (11 checks in v1), and a runner with category/severity filters plus helpers for CI exit policy. The CLI wires v1/v2 clientFetcher, renders human/json/ndjson/table/csv/yaml, and --exit-code --threshold fails on threshold findings or check errors so partial API failures cannot pass a gate.

jc-security-audit and jc-compliance-check skills now call jc audit with JSON output instead of hand-rolled list queries. README, docs/AUDIT.md, schema, and the site manifest add a Diagnostics category documenting jc audit and jc doctor.

^{Reviewed by Cursor Bugbot for commit 5a3c381. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 5277379. Configure here.}