GPT-6 Astra Migration Auditor is a read-only Codex Skill for locating migration decisions before anyone edits an integration. Its scanner points to likely model, API, sampling, reasoning, caching, and service-tier settings; the Skill then reads each location in context and turns only relevant matches into a verification plan.
What the package contains
SKILL.mddefines a seven-part audit report and a read-only boundary.migration-rules.mdrecords the OpenAI compatibility facts checked on 11 September 2026.audit_astra_migration.pyscans common source and configuration formats using the Python standard library.verification.mdseparates structural validation, offline scanner tests, the retained model-behavior run, and work that was not performed.
The scanner now recognizes an existing gpt-6-astra selection, reads multiline parameter assignments, deduplicates top_logprobs from the separate logprobs rule, and redacts common API-key, token, password, bearer-token, and URL-credential patterns before an excerpt leaves the tool.
How findings are classified
| Class | Use it when | Example |
|---|---|---|
| Blocker | Observed live code conflicts with an Astra requirement. | An Astra request serializes temperature. |
| Decision required | The code cannot answer a product or operational question. | Moving a text-only Chat Completions path would change its return contract. |
| Opportunity | An Astra feature fits an observed workload but is not needed for compatibility. | A real long-running task may benefit from steering. |
| Not observed | A searched pattern was absent from the inspected boundary. | No Fast service tier literal appeared in the scanned files. |
“Not observed” remains a search result rather than proof of absence. Model aliases, environment variables, SDK defaults, generated requests, account residency, and caller behavior can sit outside the scanned files.
Run it
- Download and inspect the ZIP.
- Extract the top-level folder into a repository's
.agents/skills/directory, or use the current Codex documentation for another Skill scope. - Invoke
$gpt-6-astra-migration-auditorexplicitly the first time and name the authorized path. - For a deterministic candidate list, run:
python3 scripts/audit_astra_migration.py /path/to/project --format markdown
The report intentionally stops before implementation. A production migration still needs owner decisions, the smallest code change, offline tests, matched runtime requests, rollback evidence, and authorized production readback.
Verification record
The current scanner passed a positive fixture covering all seven rule classes, a zero-finding control, a multiline-configuration case, credential-redaction checks, and a top_logprobs deduplication check. Those are offline scanner tests; no API request or migration was executed.
The Skill procedure also has one retained explicit GPT-6 Astra run from a read-only Codex CLI 0.153.4 session. That earlier fixture produced eight candidate locations. The Skill returned all seven report sections, reviewed the matches in context, kept unknown SDK, account, residency, cost, and performance evidence visible, and made no edit or API call. The later scanner hardening was verified offline, not by rerunning that model-behavior test.
Security and evidence limits
Redaction lowers the chance that a common credential literal appears in a report; it is not a secret-discovery or data-loss-prevention guarantee. The scanner skips typical dependency and generated directories, ignores files larger than 1 MB, and reports only lexical candidates. Unusual secret names, encoded values, runtime configuration, and unsupported file types may remain outside its protection and coverage.
Before acting on a report, inspect the original line locally, verify time-sensitive rules in current official OpenAI documentation, and test the serialized request. The package does not certify migration readiness, estimate savings, or decide whether Astra is justified for the workload.
