---
name: bt6-pr-audit-review
description: Findings-first BT6 pull-request audit with authority, exact SHA, research integrity, verification, decision, and residual risk.
---

# BT6 Pull Request Audit

Repository: `<canonical repository>`
Tracker: `<canonical tracker>`
PR: `<#number or URL>`
Title: `<title>`
Head SHA: `<sha>`
Base: `<remote/branch at sha>`
Reviewer: `<name/tool>`
Reviewed: `<YYYY-MM-DD HH:MM timezone>`

## Authority and Scope

| Field | Value | Evidence |
| --- | --- | --- |
| Canonical target | `<repository>` | `<config/remote/API>` |
| Tracker actor | `<actor>` | `<connector/API/CLI>` |
| Profile | `<path/derived defaults>` | `<hash/status>` |
| Review posting authorized | `<no/yes exact scope>` | `<operator request>` |

## Findings

| Severity | File / Artifact | Finding | Evidence | Required Change |
| --- | --- | --- | --- | --- |
| `<blocking/high/medium/low>` | `<path:line or artifact>` | `<finding>` | `<test/source/citation/contract>` | `<change>` |

If none: **No blocking findings at the exact head SHA above.**

## Research and Data Integrity

| Dimension | Result | Evidence / Unknown |
| --- | --- | --- |
| Source/license/provenance | `<pass/fail/n-a>` | `<details>` |
| Citation/timestamp/locator | `<pass/fail/n-a>` | `<details>` |
| Parsing/normalization/indexing | `<pass/fail/n-a>` | `<details>` |
| Corpus/schema migration | `<pass/fail/n-a>` | `<details>` |
| Reproducibility/generated claims | `<pass/fail/n-a>` | `<details>` |

## Verification

| Check | Result | Exact Evidence |
| --- | --- | --- |
| `<CI or local command>` | `<pass/fail/not run>` | `<URL/output/commit>` |

Unverified areas:

- `<area and why>`

## Public / External Input Assessment

- Risk: `<low/medium/high>`
- Assessment: `<bt6-public-input-threat-assessment reference>`
- Security routing: `<none | discovery phrase/result>`

## External Provider Assessment

Required for remote-provider changes: `<not applicable | assessment reference>`

- Service real: `<yes/no/unclear>`
- Independently verified: `<yes/partial/no>`
- Trustworthy for sensitive workloads: `<yes/conditional/no/unproven>`
- Integration complete: `<yes/no>`
- Claim-to-code traceability complete: `<yes/no>`

## Decision

Decision: `<approve | request changes | comment | hold>`

Reason:

- `<short evidence-based reason>`

## Residual Risk and Expiration

- Residual risk: `<risk or none>`
- Audit expires when: `<head/base/check/profile/evidence change>`

## Suggested Tracker Review

```markdown
Reviewed PR #<number> at `<sha>`.

<findings or no-blocking-findings statement>

Verification:
- <checks>

Decision: <decision>
```