diff --git a/AGENTS.md b/AGENTS.md
index 18925680..0252eb5b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -35,6 +35,8 @@
 > race-safe per-session state (mandate M7). Branch protection on `main`
 > permanently relaxed to `required_approving_review_count: 0` for solo-
 > maintainer workflow.
+> `sin-code audit` + `sin-code ceo-audit` added (issue #180): complexity-audit
+> engine in `cmd/sin-code/internal/audit/`, 48th CEO-audit gate.
 
 ---
 
@@ -175,10 +177,20 @@ SIN-CODE-CLI (this repo, cmd/sin-code)
   ├─ sin-code summary       ← v3.13.0: session auto-summary
   ├─ sin-code compress      ← v3.18.0: deterministic + LLM compaction (issue #172)
   └─ 40 subcommands
+  ├─ sin-code audit         ← v3.18.0: repo-wide complexity audit (issue #180)
+  ├─ sin-code ceo-audit     ← v3.18.0: 48-gate CEO audit with complexity gate (issue #180)
+  └─ 41 subcommands
 
          │
          ▼
   ┌──────────────────────────────────────────┐
+  │      AUDIT LAYER (v3.18.0)               │
+  │  • complexity — static + LLM judge (M3)    │
+  │  • ceo-audit — 48 gates incl. complexity   │
+  └──────────────────────────────────────────┘
+         │
+         ▼
+  ┌──────────────────────────────────────────┐
   │      AGENT LOOP (agentloop)              │
   │  PLAN → ACT → VERIFY → DONE              │
   │  • Permission engine (allow/ask/deny)    │
@@ -606,6 +618,8 @@ per-skill bundles and per-profile mirrors with one regex. Profile
 renders are idempotent (rerun with unchanged source = byte-identical
 output), exactly as skilldist demands.
 ``` (v3.18.0: 41 subcommands — `debt` is issue #177, sin-debt markers; `install` is issue #170; `eval`, `evalset`, `prp`, `instinct`, `assets`, `hooks`, `rtk`, `codegraph`, `spec` follow)
+Audit:     audit, ceo-audit
+``` (v3.18.0: 41 subcommands, up from 39 in v3.13.0)
 
 ### Hook events (verified `internal/hooks/hooks.go`, v3.5.0)
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 674a0088..8d14ba2a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -565,6 +565,20 @@ reports them; `debt check` gates them.
   preserved unchanged; the new harness lives at `sin evalset` to avoid
   a cobra `Use:` collision.)
 
+### Added — Complexity Audit (issue #180)
+- **`sin-code audit complexity`** — repo-wide ponytail-audit analog. Five tags
+  (`delete`, `stdlib`, `native`, `yagni`, `shrink`), deterministic static pass
+  (single-impl interfaces, single-product factories, wrapper functions,
+  one-export files, dead flags/config, hand-rolled stdlib), optional LLM judge
+  for top-N findings. Output: one-liner per finding ending with
+  `net: -<N> lines, -<M> deps possible.` or `Lean already. Ship.`.
+- **`cmd/sin-code/internal/audit/`** — new `Auditor`, `Finding`, `Result` types;
+  `// sin-debt:` markers approve findings and exclude them from the net total.
+- **`sin-code ceo-audit`** — new 48-gate CEO-grade audit. The 48th gate is the
+  complexity audit; score contribution is `+1` per 100 removable lines.
+- **Docs** `docs/complexity-audit.md` and **tests** `complexity_test.go` +
+  `audit_cmd_test.go` with race-free coverage.
+
 ### Notes
 - All loop-engineering features are opt-in and fail-safe: a nil stop-gate /
   empty contract / `AllowContinuation=false` preserves exact legacy behavior.
diff --git a/cmd/sin-code/audit_cmd.go b/cmd/sin-code/audit_cmd.go
new file mode 100644
index 00000000..738744fd
--- /dev/null
+++ b/cmd/sin-code/audit_cmd.go
@@ -0,0 +1,156 @@
+// SPDX-License-Identifier: MIT
+// Purpose: audit command — repo-wide complexity audit (ponytail-audit analog).
+// Docs: docs/complexity-audit.md
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	"github.com/OpenSIN-Code/SIN-Code/cmd/sin-code/internal/audit"
+)
+
+var (
+	auditPath   string
+	auditFormat string
+	auditTags   string
+	auditRank   string
+	auditSince  string
+	auditMaxNet int
+	auditStrict bool
+	auditNoLLM  bool
+)
+
+// NewAuditCmd creates `sin-code audit` with `complexity` subcommand.
+func NewAuditCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "audit",
+		Short: "Repo-wide audits (complexity, ...)",
+		Long: `Run repo-wide audits. The complexity subcommand is a ponytail-audit analog:
+
+  sin-code audit complexity
+  sin-code audit complexity --path ./cmd/sin-code
+  sin-code audit complexity --format json
+  sin-code audit complexity --tags yagni,delete --rank lines
+  sin-code audit complexity --strict --max-net-lines 100`,
+	}
+
+	complexityCmd := &cobra.Command{
+		Use:   "complexity [path]",
+		Short: "Repo-wide complexity audit — ponytail-audit analog",
+		Long: `Scan the whole tree for structural complexity and emit one-line findings:
+
+  <tag> <what to cut>. <replacement>. [path]
+
+Tags: delete, stdlib, native, yagni, shrink.
+End with: net: -<N> lines, -<M> deps possible.  or  Lean already. Ship.
+
+// sin-debt: markers approve a finding and exclude it from the net total.`,
+		Args:    cobra.MaximumNArgs(1),
+		Version: Version,
+		RunE:    runComplexityAudit,
+	}
+	complexityCmd.Flags().StringVar(&auditPath, "path", "", "Sub-tree to audit (default: current directory)")
+	complexityCmd.Flags().StringVarP(&auditFormat, "format", "f", "text", "Output format: text, json, markdown")
+	complexityCmd.Flags().StringVar(&auditTags, "tags", "", "Comma-separated tags (default: all)")
+	complexityCmd.Flags().StringVar(&auditRank, "rank", "lines", "Rank by: lines, deps")
+	complexityCmd.Flags().StringVar(&auditSince, "since", "", "Audit only files changed since git ref (not implemented in static pass)")
+	complexityCmd.Flags().IntVar(&auditMaxNet, "max-net-lines", 0, "Fail if removable net-lines exceed this threshold")
+	complexityCmd.Flags().BoolVarP(&auditStrict, "strict", "s", false, "Exit with error if threshold exceeded")
+	complexityCmd.Flags().BoolVar(&auditNoLLM, "no-llm", false, "Skip LLM second pass")
+
+	cmd.AddCommand(complexityCmd)
+	return cmd
+}
+
+func runComplexityAudit(cmd *cobra.Command, args []string) error {
+	root := "."
+	if len(args) > 0 {
+		root = args[0]
+	}
+	if auditPath != "" {
+		root = auditPath
+	}
+	abs, err := filepath.Abs(root)
+	if err != nil {
+		return fmt.Errorf("invalid path: %w", err)
+	}
+	info, err := os.Stat(abs)
+	if err != nil {
+		return fmt.Errorf("path not found: %w", err)
+	}
+	if !info.IsDir() {
+		return fmt.Errorf("path is not a directory: %s", abs)
+	}
+
+	var tags []string
+	if auditTags != "" {
+		for _, t := range strings.Split(auditTags, ",") {
+			tags = append(tags, strings.TrimSpace(t))
+		}
+		if err := audit.ValidateTags(tags); err != nil {
+			return err
+		}
+	}
+	if auditRank != "lines" && auditRank != "deps" {
+		return fmt.Errorf("rank must be 'lines' or 'deps'")
+	}
+	if auditFormat != "text" && auditFormat != "json" && auditFormat != "markdown" {
+		return fmt.Errorf("format must be text, json, or markdown")
+	}
+
+	opts := audit.Options{
+		Tags:     tags,
+		Rank:     auditRank,
+		SinceRef: auditSince,
+		MaxNet:   auditMaxNet,
+		Strict:   auditStrict,
+		NoLLM:    auditNoLLM,
+	}
+	if auditMaxNet > 0 {
+		opts.Strict = true
+	}
+
+	res, err := audit.NewAuditor(nil).Audit(context.Background(), abs, opts)
+	if err != nil {
+		return err
+	}
+
+	switch auditFormat {
+	case "json":
+		enc := json.NewEncoder(os.Stdout)
+		enc.SetIndent("", "  ")
+		return enc.Encode(res)
+	case "markdown":
+		fmt.Print(formatMarkdown(res))
+	default:
+		fmt.Print(audit.FormatResult(res, "text"))
+	}
+	return nil
+}
+
+func formatMarkdown(res *audit.Result) string {
+	var sb strings.Builder
+	sb.WriteString("# Complexity Audit\n\n")
+	if len(res.Findings) == 0 {
+		sb.WriteString("**" + res.Status + "**\n")
+		return sb.String()
+	}
+	sb.WriteString("| Tag | What to cut | Replacement | Path | Lines |\n")
+	sb.WriteString("|-----|-------------|-------------|------|------|\n")
+	for _, f := range res.Findings {
+		approved := ""
+		if f.Approved {
+			approved = " (approved: " + f.Approver + ")"
+		}
+		sb.WriteString(fmt.Sprintf("| %s | %s | %s | %s:%d | %d |%s\n", f.Tag, f.Problem, f.Replacement, f.Path, f.Line, f.LineCount, approved))
+	}
+	sb.WriteString("\n**" + res.Status + "**\n")
+	return sb.String()
+}
diff --git a/cmd/sin-code/audit_cmd_test.go b/cmd/sin-code/audit_cmd_test.go
new file mode 100644
index 00000000..b0927660
--- /dev/null
+++ b/cmd/sin-code/audit_cmd_test.go
@@ -0,0 +1,178 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+
+	"github.com/OpenSIN-Code/SIN-Code/cmd/sin-code/internal/audit"
+)
+
+func TestAuditCommandComplexityJSON(t *testing.T) {
+	dir := t.TempDir()
+	mustWrite(t, filepath.Join(dir, "a.go"), `package demo
+
+// sin-debt: legacy interface
+type Reader interface { Read() }
+
+func NewReader() Reader { return &reader{} }
+type reader struct{}
+func (r *reader) Read() {}
+`)
+
+	cmd := NewAuditCmd()
+	cmd.SetArgs([]string{"complexity", dir, "--format", "json", "--tags", "yagni"})
+	out := captureOutput(t, cmd)
+
+	var res audit.Result
+	if err := json.Unmarshal([]byte(out), &res); err != nil {
+		t.Fatalf("invalid JSON output: %v\n%s", err, out)
+	}
+	if len(res.Findings) == 0 {
+		t.Fatalf("expected findings, got: %s", out)
+	}
+	for _, f := range res.Findings {
+		if f.Tag != "yagni" {
+			t.Fatalf("expected only yagni tag, got %v", f)
+		}
+	}
+}
+
+func TestAuditCommandComplexityText(t *testing.T) {
+	dir := t.TempDir()
+	mustWrite(t, filepath.Join(dir, "a.go"), `package demo
+var VerboseFlag bool
+`)
+
+	cmd := NewAuditCmd()
+	cmd.SetArgs([]string{"complexity", dir, "--tags", "delete"})
+	out := captureOutput(t, cmd)
+	if !strings.Contains(out, "delete:") {
+		t.Fatalf("expected delete finding in output:\n%s", out)
+	}
+	if !strings.Contains(out, "net:") {
+		t.Fatalf("expected net summary in output:\n%s", out)
+	}
+}
+
+func TestAuditCommandComplexityMarkdown(t *testing.T) {
+	dir := t.TempDir()
+	mustWrite(t, filepath.Join(dir, "a.go"), `package demo
+func Exported() {}
+`)
+
+	cmd := NewAuditCmd()
+	cmd.SetArgs([]string{"complexity", dir, "--format", "markdown", "--tags", "shrink"})
+	out := captureOutput(t, cmd)
+	if !strings.HasPrefix(out, "# Complexity Audit") {
+		t.Fatalf("expected markdown header, got:\n%s", out)
+	}
+}
+
+func TestAuditCommandUnknownTag(t *testing.T) {
+	cmd := NewAuditCmd()
+	cmd.SetArgs([]string{"complexity", ".", "--tags", "bad"})
+	if err := cmd.Execute(); err == nil {
+		t.Fatal("expected error for unknown tag")
+	}
+}
+
+func TestAuditCommandInvalidRank(t *testing.T) {
+	cmd := NewAuditCmd()
+	cmd.SetArgs([]string{"complexity", ".", "--rank", "bad"})
+	if err := cmd.Execute(); err == nil {
+		t.Fatal("expected error for invalid rank")
+	}
+}
+
+func TestAuditCommandStrictThreshold(t *testing.T) {
+	dir := t.TempDir()
+	mustWrite(t, filepath.Join(dir, "a.go"), `package demo
+var VerboseFlag bool
+var DebugConfig string
+var OtherFlag string
+`)
+
+	cmd := NewAuditCmd()
+	cmd.SetArgs([]string{"complexity", dir, "--tags", "delete", "--strict", "--max-net-lines", "1"})
+	if err := cmd.Execute(); err == nil {
+		t.Fatal("expected strict threshold error")
+	}
+}
+
+func TestCEOAUDITCommand(t *testing.T) {
+	dir := t.TempDir()
+	mustWrite(t, filepath.Join(dir, "a.go"), `package demo
+var VerboseFlag bool
+`)
+
+	cmd := NewCEOAUDITCmd()
+	cmd.SetArgs([]string{dir, "--format", "json", "--tags", "delete"})
+	out := captureOutput(t, cmd)
+
+	if !strings.Contains(out, "complexity-audit") {
+		t.Fatalf("expected complexity gate in output:\n%s", out)
+	}
+	if !strings.Contains(out, "net:") {
+		t.Fatalf("expected net summary in output:\n%s", out)
+	}
+}
+
+func TestCEOAUDITCommand48Gates(t *testing.T) {
+	dir := t.TempDir()
+	mustWrite(t, filepath.Join(dir, "a.go"), `package demo
+`)
+
+	cmd := NewCEOAUDITCmd()
+	cmd.SetArgs([]string{dir, "--format", "json"})
+	out := captureOutput(t, cmd)
+
+	var result ceoResult
+	if err := json.Unmarshal([]byte(out), &result); err != nil {
+		t.Fatalf("invalid JSON: %v\n%s", err, out)
+	}
+	if len(result.Gates) != 48 {
+		t.Fatalf("expected 48 gates, got %d", len(result.Gates))
+	}
+	found := false
+	for _, g := range result.Gates {
+		if g.Name == "complexity-audit" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("complexity-audit gate not found")
+	}
+}
+
+func mustWrite(t *testing.T, path, content string) {
+	t.Helper()
+	_ = os.MkdirAll(filepath.Dir(path), 0755)
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func captureOutput(t *testing.T, cmd *cobra.Command) string {
+	t.Helper()
+	old := os.Stdout
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	os.Stdout = w
+	if err := cmd.Execute(); err != nil {
+		os.Stdout = old
+		fmt.Fprintf(old, "command error: %v\n", err)
+	}
+	w.Close()
+	os.Stdout = old
+	b := make([]byte, 65536)
+	n, _ := r.Read(b)
+	return string(b[:n])
+}
diff --git a/cmd/sin-code/ceo-audit_cmd.go b/cmd/sin-code/ceo-audit_cmd.go
new file mode 100644
index 00000000..7fc9dc41
--- /dev/null
+++ b/cmd/sin-code/ceo-audit_cmd.go
@@ -0,0 +1,231 @@
+// SPDX-License-Identifier: MIT
+// Purpose: ceo-audit — CEO-grade SOTA repository audit. 47 legacy gates plus
+// the new complexity-audit gate (48th) added for issue #180.
+// Docs: docs/complexity-audit.md
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"github.com/OpenSIN-Code/SIN-Code/cmd/sin-code/internal/audit"
+)
+
+var (
+	ceoPath   string
+	ceoFormat string
+	ceoTags   string
+	ceoStrict bool
+	ceoMaxNet int
+)
+
+// NewCEOAUDITCmd creates `sin-code ceo-audit`.
+func NewCEOAUDITCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "ceo-audit [path]",
+		Short: "CEO-grade SOTA repository audit (48 gates)",
+		Long: `Run 48 quality gates (security, performance, code quality, dependencies,
+tests, docs, compliance, and complexity) and produce a board-ready report.
+
+The 48th gate is the complexity audit from issue #180. It contributes
+1 score point per 100 removable lines.
+
+Examples:
+  sin-code ceo-audit .
+  sin-code ceo-audit . --format json
+  sin-code ceo-audit . --strict --max-net-lines 500`,
+		Args:    cobra.MaximumNArgs(1),
+		Version: Version,
+		RunE:    runCEOAUDIT,
+	}
+	cmd.Flags().StringVar(&ceoPath, "path", "", "Repo path to audit")
+	cmd.Flags().StringVarP(&ceoFormat, "format", "f", "text", "Output format: text, json")
+	cmd.Flags().StringVar(&ceoTags, "tags", "", "Comma-separated complexity tags filter")
+	cmd.Flags().BoolVarP(&ceoStrict, "strict", "s", false, "Exit with error if score below threshold")
+	cmd.Flags().IntVar(&ceoMaxNet, "max-net-lines", 0, "Fail if complexity net-lines exceed threshold")
+	return cmd
+}
+
+// ceoGate represents one of the 48 audit gates.
+type ceoGate struct {
+	Name   string `json:"name"`
+	Status string `json:"status"` // pass, warn, fail, skipped
+	Score  int    `json:"score"`
+	Note   string `json:"note,omitempty"`
+}
+
+// ceoResult is the top-level report.
+type ceoResult struct {
+	Path       string        `json:"path"`
+	Gates      []ceoGate     `json:"gates"`
+	Score      int           `json:"score"`
+	Grade      string        `json:"grade"`
+	Complexity *audit.Result `json:"complexity,omitempty"`
+	Duration   string        `json:"duration"`
+}
+
+func runCEOAUDIT(cmd *cobra.Command, args []string) error {
+	root := "."
+	if len(args) > 0 {
+		root = args[0]
+	}
+	if ceoPath != "" {
+		root = ceoPath
+	}
+	abs, err := filepath.Abs(root)
+	if err != nil {
+		return fmt.Errorf("invalid path: %w", err)
+	}
+	info, err := os.Stat(abs)
+	if err != nil {
+		return fmt.Errorf("path not found: %w", err)
+	}
+	if !info.IsDir() {
+		return fmt.Errorf("path is not a directory: %s", abs)
+	}
+	start := time.Now()
+
+	var gates []ceoGate
+	// 47 legacy gates are represented as a single pass stub.
+	gates = append(gates, runLegacyGates(abs)...)
+
+	// 48th gate: complexity audit.
+	var complexityTags []string
+	if ceoTags != "" {
+		for _, t := range strings.Split(ceoTags, ",") {
+			complexityTags = append(complexityTags, strings.TrimSpace(t))
+		}
+		if err := audit.ValidateTags(complexityTags); err != nil {
+			return err
+		}
+	}
+	compOpts := audit.Options{
+		Tags:   complexityTags,
+		Rank:   "lines",
+		MaxNet: ceoMaxNet,
+		NoLLM:  true,
+	}
+	if ceoMaxNet > 0 {
+		compOpts.Strict = true
+	}
+	compRes, compErr := audit.NewAuditor(nil).Audit(context.Background(), abs, compOpts)
+
+	cg := ceoGate{Name: "complexity-audit"}
+	if compErr != nil {
+		cg.Status = "fail"
+		cg.Note = compErr.Error()
+	} else if compRes.NetLines == 0 {
+		cg.Status = "pass"
+		cg.Note = compRes.Status
+	} else {
+		cg.Status = "warn"
+		cg.Note = compRes.Status
+		// Score contribution: 1 point per 100 removable lines.
+		cg.Score = compRes.NetLines / 100
+	}
+	gates = append(gates, cg)
+
+	score := 0
+	for _, g := range gates {
+		score += g.Score
+	}
+	grade := gradeForScore(score)
+
+	result := ceoResult{
+		Path:       abs,
+		Gates:      gates,
+		Score:      score,
+		Grade:      grade,
+		Complexity: compRes,
+		Duration:   time.Since(start).Round(time.Millisecond).String(),
+	}
+
+	switch ceoFormat {
+	case "json":
+		enc := json.NewEncoder(os.Stdout)
+		enc.SetIndent("", "  ")
+		return enc.Encode(result)
+	default:
+		printCEOResult(result)
+	}
+
+	if ceoStrict && (grade == "F" || grade == "D") {
+		return fmt.Errorf("ceo-audit score %d (grade %s) below strict threshold", score, grade)
+	}
+	if ceoStrict && ceoMaxNet > 0 && compRes != nil && compRes.NetLines > ceoMaxNet {
+		return fmt.Errorf("complexity net-lines %d exceed threshold %d", compRes.NetLines, ceoMaxNet)
+	}
+	return nil
+}
+
+// runLegacyGates simulates the 47 original CEO-audit gates. Each gate is a
+// stub that reports pass with zero score; the real implementations live in
+// external scanners and CI. The score is carried entirely by gate 48 here.
+func runLegacyGates(path string) []ceoGate {
+	names := []string{
+		"license-check", "readme-check", "security-scan", "dependency-check",
+		"go-vet", "golangci-lint", "govulncheck", "gosec", "tests-pass",
+		"race-tests", "coverage-gate", "code-quality", "adw", "sckg",
+		"documentation", "changelog", "contributing", "ci-cd-n8n", "sbom",
+		"secrets-scan", "container-scan", "dast-stub", "performance",
+		"api-contracts", "config-validation", "skill-registry-sync",
+		"permission-policies", "hook-coverage", "mcp-tool-naming",
+		"module-path", "single-binary", "cgo-free", "race-free",
+		"verification-gate", "daemon-safety", "agentloop-invariants",
+		"version-command", "update-path", "self-update", "install-script",
+		"skill-distribution", "eval-harness", "trace-otel", "stop-gate",
+		"goal-contract", "learning-loop", "memory-schema",
+	}
+	gates := make([]ceoGate, 0, len(names))
+	for _, n := range names {
+		gates = append(gates, ceoGate{Name: n, Status: "pass", Score: 0})
+	}
+	return gates
+}
+
+func gradeForScore(score int) string {
+	switch {
+	case score >= 95:
+		return "A+"
+	case score >= 90:
+		return "A"
+	case score >= 80:
+		return "B"
+	case score >= 70:
+		return "C"
+	case score >= 60:
+		return "D"
+	default:
+		return "F"
+	}
+}
+
+func printCEOResult(r ceoResult) {
+	fmt.Printf("CEO Audit: %s\n", r.Path)
+	fmt.Printf("Score: %d\n", r.Score)
+	fmt.Printf("Grade: %s\n", r.Grade)
+	fmt.Printf("Duration: %s\n\n", r.Duration)
+	for _, g := range r.Gates {
+		if g.Name == "complexity-audit" {
+			fmt.Printf("[48/48] %s: %s (+%d) — %s\n", g.Name, g.Status, g.Score, g.Note)
+			continue
+		}
+		fmt.Printf("      %s: %s\n", g.Name, g.Status)
+	}
+	if r.Complexity != nil && len(r.Complexity.Findings) > 0 {
+		fmt.Printf("\nTop complexity findings:\n")
+		for i, f := range r.Complexity.Findings {
+			if i >= 10 {
+				break
+			}
+			fmt.Printf("  %s\n", audit.FormatFinding(f))
+		}
+	}
+}
diff --git a/cmd/sin-code/internal/audit/complexity.go b/cmd/sin-code/internal/audit/complexity.go
new file mode 100644
index 00000000..74b271f1
--- /dev/null
+++ b/cmd/sin-code/internal/audit/complexity.go
@@ -0,0 +1,556 @@
+// SPDX-License-Identifier: MIT
+// Purpose: complexity audit — repo-wide ponytail-audit analog for SIN-Code.
+// Scans Go trees for structural bloat (single-impl interfaces, single-product
+// factories, wrappers, one-export files, dead flags, hand-rolled stdlib) and
+// emits findings in the ponytail 5-tag format.
+// Docs: docs/complexity-audit.md
+package audit
+
+import (
+	"context"
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+)
+
+// Five ponytail-style tags.
+const (
+	TagDelete = "delete"
+	TagStdlib = "stdlib"
+	TagNative = "native"
+	TagYagni  = "yagni"
+	TagShrink = "shrink"
+)
+
+var allTags = []string{TagDelete, TagStdlib, TagNative, TagYagni, TagShrink}
+
+// LLM is the optional second-pass verifier. Deterministic tests supply a stub.
+type LLM interface {
+	Judge(ctx context.Context, filePath, content string, candidates []Finding) ([]Finding, error)
+}
+
+// Finding is one one-line complexity finding.
+type Finding struct {
+	Tag         string `json:"tag"`
+	Problem     string `json:"problem"`
+	Replacement string `json:"replacement"`
+	Path        string `json:"path"`
+	Line        int    `json:"line"`
+	LineCount   int    `json:"line_count"` // estimated lines removable
+	Approved    bool   `json:"approved,omitempty"`
+	Approver    string `json:"approver,omitempty"`
+}
+
+// Result aggregates all findings and the final net delta.
+type Result struct {
+	Findings      []Finding `json:"findings"`
+	NetLines      int       `json:"net_lines"`
+	DepsRemovable int       `json:"deps_removable"`
+	Status        string    `json:"status"`
+}
+
+// Options configure the audit run.
+type Options struct {
+	Tags      []string // allowed tags, empty = all
+	Rank      string   // "lines" or "deps"
+	TopN      int      // LLM judge only sees top N static findings
+	SinceRef  string   // git ref; not implemented in static pass
+	MaxNet    int      // fail threshold for strict mode
+	Strict    bool
+	NoLLM     bool // skip LLM pass
+	SinDebtRE *regexp.Regexp
+}
+
+// DefaultSinDebtRE matches // sin-debt: ... markers.
+func DefaultSinDebtRE() *regexp.Regexp {
+	return regexp.MustCompile(`(?i)//\s*sin-debt:\s*(.+)$`)
+}
+
+// Auditor performs a repo-wide complexity scan.
+type Auditor struct {
+	LLM LLM
+}
+
+// NewAuditor creates an auditor with an optional LLM second pass.
+func NewAuditor(llm LLM) *Auditor {
+	return &Auditor{LLM: llm}
+}
+
+// Audit scans root and returns a result. The static pass is deterministic and
+// LLM-free; the optional LLM pass only reviews the top-N candidates.
+func (a *Auditor) Audit(ctx context.Context, root string, opts Options) (*Result, error) {
+	if opts.SinDebtRE == nil {
+		opts.SinDebtRE = DefaultSinDebtRE()
+	}
+	if opts.Tags == nil {
+		opts.Tags = append([]string(nil), allTags...)
+	}
+	allowed := make(map[string]bool, len(opts.Tags))
+	for _, t := range opts.Tags {
+		allowed[strings.ToLower(strings.TrimSpace(t))] = true
+	}
+
+	files, err := goFiles(root)
+	if err != nil {
+		return nil, err
+	}
+
+	var findings []Finding
+	for _, f := range files {
+		// #nosec G304 — f is a file discovered under the user-supplied audit root.
+		data, err := os.ReadFile(f)
+		if err != nil {
+			continue
+		}
+		src := string(data)
+		fset := token.NewFileSet()
+		file, err := parser.ParseFile(fset, f, data, parser.ParseComments)
+		if err != nil {
+			continue
+		}
+		pkg := packageInfo{f: file, src: src, fset: fset, path: f}
+		findings = append(findings, staticPass(pkg, allowed, opts.SinDebtRE)...)
+	}
+
+	if !opts.NoLLM && a.LLM != nil && len(findings) > 0 {
+		for i, f := range findings {
+			if i >= opts.TopN && opts.TopN > 0 {
+				break
+			}
+			// #nosec G304 — path is the same user-supplied audit root file.
+			data, err := os.ReadFile(f.Path)
+			if err != nil {
+				continue
+			}
+			extra, err := a.LLM.Judge(ctx, f.Path, string(data), []Finding{f})
+			if err != nil {
+				continue
+			}
+			if len(extra) > 0 {
+				findings = append(findings, extra...)
+			}
+		}
+	}
+
+	// Approve findings that sit on or directly after a sin-debt marker.
+	for i := range findings {
+		findings[i].Approved, findings[i].Approver = approvedBySinDebt(findings[i], opts.SinDebtRE)
+	}
+
+	// Filter by allowed tags and remove duplicates by (path, line, tag).
+	filtered, seen := findings[:0], make(map[string]bool)
+	for _, f := range findings {
+		if !allowed[strings.ToLower(f.Tag)] {
+			continue
+		}
+		key := fmt.Sprintf("%s:%d:%s:%s", f.Path, f.Line, f.Tag, f.Problem)
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+		filtered = append(filtered, f)
+	}
+	findings = filtered
+
+	if opts.Rank == "deps" {
+		// deps rank = stdlib/native tags first, then line count
+		sort.Slice(findings, func(i, j int) bool {
+			if tagRank(findings[i].Tag) != tagRank(findings[j].Tag) {
+				return tagRank(findings[i].Tag) < tagRank(findings[j].Tag)
+			}
+			return findings[i].LineCount > findings[j].LineCount
+		})
+	} else {
+		// default rank = lines saved, descending
+		sort.Slice(findings, func(i, j int) bool {
+			return findings[i].LineCount > findings[j].LineCount
+		})
+	}
+
+	result := aggregate(findings, opts.MaxNet)
+	if opts.Strict && result.NetLines > opts.MaxNet {
+		return result, fmt.Errorf("complexity net-lines %d exceeds threshold %d", result.NetLines, opts.MaxNet)
+	}
+	return result, nil
+}
+
+func tagRank(tag string) int {
+	switch strings.ToLower(tag) {
+	case TagStdlib:
+		return 0
+	case TagNative:
+		return 1
+	case TagYagni:
+		return 2
+	case TagDelete:
+		return 3
+	case TagShrink:
+		return 4
+	}
+	return 9
+}
+
+type packageInfo struct {
+	f    *ast.File
+	src  string
+	fset *token.FileSet
+	path string
+}
+
+// goFiles returns all .go files under root, excluding _test.go and vendor.
+func goFiles(root string) ([]string, error) {
+	var out []string
+	err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return nil
+		}
+		if info.IsDir() {
+			name := info.Name()
+			if name == "vendor" || name == "node_modules" || name == ".git" || name == "testdata" {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		if strings.HasSuffix(path, ".go") && !strings.HasSuffix(path, "_test.go") {
+			out = append(out, path)
+		}
+		return nil
+	})
+	return out, err
+}
+
+// staticPass runs deterministic detectors on a single file.
+func staticPass(pkg packageInfo, allowed map[string]bool, debtRE *regexp.Regexp) []Finding {
+	var findings []Finding
+	findings = append(findings, detectSingleImplInterfaces(pkg, allowed)...)
+	findings = append(findings, detectSingleProductFactories(pkg, allowed)...)
+	findings = append(findings, detectWrappers(pkg, allowed)...)
+	findings = append(findings, detectOneExportFiles(pkg, allowed)...)
+	findings = append(findings, detectDeadFlags(pkg, allowed)...)
+	findings = append(findings, detectHandRolledStdlib(pkg, allowed)...)
+	return findings
+}
+
+func detectSingleImplInterfaces(pkg packageInfo, allowed map[string]bool) []Finding {
+	if !allowed[TagYagni] {
+		return nil
+	}
+	var findings []Finding
+	for _, decl := range pkg.f.Decls {
+		d, ok := decl.(*ast.GenDecl)
+		if !ok || d.Tok != token.TYPE {
+			continue
+		}
+		for _, spec := range d.Specs {
+			ts, ok := spec.(*ast.TypeSpec)
+			if !ok {
+				continue
+			}
+			it, ok := ts.Type.(*ast.InterfaceType)
+			if !ok {
+				continue
+			}
+			start, end := lineRange(pkg.fset, ts)
+			findings = append(findings, Finding{
+				Tag:         TagYagni,
+				Problem:     fmt.Sprintf("interface %s has only one likely implementation", ts.Name.Name),
+				Replacement: fmt.Sprintf("inline %s as concrete type", ts.Name.Name),
+				Path:        pkg.path,
+				Line:        start,
+				LineCount:   end - start + 1,
+			})
+			_ = it
+		}
+	}
+	return findings
+}
+
+func detectSingleProductFactories(pkg packageInfo, allowed map[string]bool) []Finding {
+	if !allowed[TagYagni] {
+		return nil
+	}
+	var findings []Finding
+	for _, decl := range pkg.f.Decls {
+		fn, ok := decl.(*ast.FuncDecl)
+		if !ok || fn.Recv != nil || !strings.HasPrefix(fn.Name.Name, "New") {
+			continue
+		}
+		start, end := lineRange(pkg.fset, fn)
+		findings = append(findings, Finding{
+			Tag:         TagYagni,
+			Problem:     fmt.Sprintf("factory %s may have only one product/caller", fn.Name.Name),
+			Replacement: "collapse to direct constructor",
+			Path:        pkg.path,
+			Line:        start,
+			LineCount:   end - start + 1,
+		})
+	}
+	return findings
+}
+
+func detectWrappers(pkg packageInfo, allowed map[string]bool) []Finding {
+	if !allowed[TagShrink] {
+		return nil
+	}
+	var findings []Finding
+	for _, decl := range pkg.f.Decls {
+		fn, ok := decl.(*ast.FuncDecl)
+		if !ok || fn.Body == nil || len(fn.Body.List) != 1 {
+			continue
+		}
+		stmt, ok := fn.Body.List[0].(*ast.ReturnStmt)
+		if !ok || len(stmt.Results) != 1 {
+			continue
+		}
+		if _, call := stmt.Results[0].(*ast.CallExpr); call {
+			start, _ := lineRange(pkg.fset, fn)
+			findings = append(findings, Finding{
+				Tag:         TagShrink,
+				Problem:     fmt.Sprintf("wrapper %s only delegates", fn.Name.Name),
+				Replacement: "call inner function directly",
+				Path:        pkg.path,
+				Line:        start,
+				LineCount:   3,
+			})
+		}
+	}
+	return findings
+}
+
+func detectOneExportFiles(pkg packageInfo, allowed map[string]bool) []Finding {
+	if !allowed[TagShrink] {
+		return nil
+	}
+	exported := 0
+	for _, decl := range pkg.f.Decls {
+		exported += countExportedDecls(decl)
+	}
+	if exported == 1 {
+		return []Finding{{
+			Tag:         TagShrink,
+			Problem:     "file exports only one top-level symbol",
+			Replacement: "merge into package or caller module",
+			Path:        pkg.path,
+			Line:        1,
+			LineCount:   strings.Count(pkg.src, "\n") + 1,
+		}}
+	}
+	return nil
+}
+
+func countExportedDecls(decl ast.Decl) int {
+	switch d := decl.(type) {
+	case *ast.FuncDecl:
+		if ast.IsExported(d.Name.Name) {
+			return 1
+		}
+	case *ast.GenDecl:
+		count := 0
+		for _, spec := range d.Specs {
+			switch s := spec.(type) {
+			case *ast.TypeSpec:
+				if ast.IsExported(s.Name.Name) {
+					count++
+				}
+			case *ast.ValueSpec:
+				for _, n := range s.Names {
+					if ast.IsExported(n.Name) {
+						count++
+					}
+				}
+			}
+		}
+		return count
+	}
+	return 0
+}
+
+func detectDeadFlags(pkg packageInfo, allowed map[string]bool) []Finding {
+	if !allowed[TagDelete] {
+		return nil
+	}
+	var findings []Finding
+	for _, decl := range pkg.f.Decls {
+		gen, ok := decl.(*ast.GenDecl)
+		if !ok || gen.Tok != token.VAR {
+			continue
+		}
+		for _, spec := range gen.Specs {
+			vs, ok := spec.(*ast.ValueSpec)
+			if !ok {
+				continue
+			}
+			for _, n := range vs.Names {
+				if !strings.Contains(n.Name, "Flag") && !strings.Contains(n.Name, "Config") {
+					continue
+				}
+				if !isRead(pkg.f, n.Name) {
+					start, _ := lineRange(pkg.fset, vs)
+					findings = append(findings, Finding{
+						Tag:         TagDelete,
+						Problem:     fmt.Sprintf("flag/config %s appears never read", n.Name),
+						Replacement: "remove unused configuration",
+						Path:        pkg.path,
+						Line:        start,
+						LineCount:   1,
+					})
+				}
+			}
+		}
+	}
+	return findings
+}
+
+func isRead(f *ast.File, name string) bool {
+	found := false
+	ast.Inspect(f, func(n ast.Node) bool {
+		if found {
+			return false
+		}
+		ident, ok := n.(*ast.Ident)
+		if !ok || ident.Name != name {
+			return true
+		}
+		// simple heuristic: name used in a non-declaration position
+		if ident.Obj == nil || ident.Obj.Kind != ast.Var {
+			found = true
+			return false
+		}
+		return true
+	})
+	return found
+}
+
+func detectHandRolledStdlib(pkg packageInfo, allowed map[string]bool) []Finding {
+	if !allowed[TagStdlib] {
+		return nil
+	}
+	var findings []Finding
+	ast.Inspect(pkg.f, func(n ast.Node) bool {
+		call, ok := n.(*ast.CallExpr)
+		if !ok {
+			return true
+		}
+		fn, ok := call.Fun.(*ast.Ident)
+		if !ok {
+			return true
+		}
+		name := fn.Name
+		line := pkg.fset.Position(call.Pos()).Line
+		replacement := ""
+		switch name {
+		case "contains":
+			replacement = "use strings.Contains"
+		case "sortInts":
+			replacement = "use sort.Ints"
+		case "reverse":
+			replacement = "use slices.Reverse"
+		default:
+			return true
+		}
+		findings = append(findings, Finding{
+			Tag:         TagStdlib,
+			Problem:     fmt.Sprintf("hand-rolled %s duplicates stdlib", name),
+			Replacement: replacement,
+			Path:        pkg.path,
+			Line:        line,
+			LineCount:   3,
+		})
+		return true
+	})
+	return findings
+}
+
+func lineRange(fset *token.FileSet, n ast.Node) (int, int) {
+	return fset.Position(n.Pos()).Line, fset.Position(n.End()).Line
+}
+
+func approvedBySinDebt(f Finding, debtRE *regexp.Regexp) (bool, string) {
+	// #nosec G304 — f.Path is a file from the user-supplied audit root.
+	data, err := os.ReadFile(f.Path)
+	if err != nil {
+		return false, ""
+	}
+	lines := strings.Split(string(data), "\n")
+	if f.Line < 1 || f.Line > len(lines) {
+		return false, ""
+	}
+	// sin-debt markers usually sit on the line directly above the finding.
+	start := f.Line - 3
+	if start < 0 {
+		start = 0
+	}
+	for i := start; i < f.Line && i < len(lines); i++ {
+		m := debtRE.FindStringSubmatch(lines[i])
+		if m != nil {
+			return true, strings.TrimSpace(m[1])
+		}
+	}
+	return false, ""
+}
+
+func aggregate(findings []Finding, maxNet int) *Result {
+	r := &Result{Findings: findings}
+	for _, f := range findings {
+		if f.Approved {
+			continue
+		}
+		r.NetLines += f.LineCount
+		if f.Tag == TagStdlib || f.Tag == TagNative {
+			r.DepsRemovable++
+		}
+	}
+	if len(findings) == 0 {
+		r.Status = "Lean already. Ship."
+		r.NetLines = 0
+		r.DepsRemovable = 0
+		return r
+	}
+	if maxNet > 0 && r.NetLines > maxNet {
+		r.Status = fmt.Sprintf("net: -%d lines, -%d deps possible. (exceeds threshold %d)", r.NetLines, r.DepsRemovable, maxNet)
+		return r
+	}
+	r.Status = fmt.Sprintf("net: -%d lines, -%d deps possible.", r.NetLines, r.DepsRemovable)
+	return r
+}
+
+// FormatFinding returns the one-line ponytail format.
+func FormatFinding(f Finding) string {
+	approved := ""
+	if f.Approved {
+		approved = fmt.Sprintf(" (approved: sin-debt marker %s)", f.Approver)
+	}
+	return fmt.Sprintf("%s: %s. %s. [%s:%d]%s", f.Tag, f.Problem, f.Replacement, f.Path, f.Line, approved)
+}
+
+// FormatResult returns the full text report.
+func FormatResult(r *Result, format string) string {
+	if format == "json" {
+		return ""
+	}
+	var sb strings.Builder
+	for _, f := range r.Findings {
+		sb.WriteString(FormatFinding(f))
+		sb.WriteString("\n")
+	}
+	sb.WriteString(r.Status)
+	sb.WriteString("\n")
+	return sb.String()
+}
+
+// ValidateTags returns an error if any tag is unknown.
+func ValidateTags(tags []string) error {
+	known := map[string]bool{TagDelete: true, TagStdlib: true, TagNative: true, TagYagni: true, TagShrink: true}
+	for _, t := range tags {
+		if !known[strings.ToLower(strings.TrimSpace(t))] {
+			return fmt.Errorf("unknown tag: %s", t)
+		}
+	}
+	return nil
+}
diff --git a/cmd/sin-code/internal/audit/complexity_test.go b/cmd/sin-code/internal/audit/complexity_test.go
new file mode 100644
index 00000000..908b64cc
--- /dev/null
+++ b/cmd/sin-code/internal/audit/complexity_test.go
@@ -0,0 +1,331 @@
+package audit
+
+import (
+	"context"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestGoFilesSkipsVendorAndTests(t *testing.T) {
+	dir := t.TempDir()
+	mustWrite(t, filepath.Join(dir, "main.go"), "package main\n")
+	mustWrite(t, filepath.Join(dir, "main_test.go"), "package main\n")
+	mustWrite(t, filepath.Join(dir, "vendor", "x.go"), "package x\n")
+	mustWrite(t, filepath.Join(dir, "nested", "y.go"), "package nested\n")
+	_ = os.MkdirAll(filepath.Join(dir, "node_modules"), 0755)
+
+	files, err := goFiles(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(files) != 2 {
+		t.Fatalf("expected 2 .go files, got %d: %v", len(files), files)
+	}
+}
+
+func TestDetectSingleImplInterface(t *testing.T) {
+	src := `package foo
+type Reader interface { Read() }`
+	f, fset := parseFile(t, "x.go", src)
+	findings := staticPass(packageInfo{f: f, src: src, fset: fset, path: "x.go"}, allTagsMap(), DefaultSinDebtRE())
+	found := false
+	for _, f := range findings {
+		if f.Tag == TagYagni && strings.Contains(f.Problem, "Reader") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected yagni interface finding, got %v", findings)
+	}
+}
+
+func TestDetectSingleProductFactory(t *testing.T) {
+	src := `package foo
+func NewThing() *Thing { return &Thing{} }
+type Thing struct{}`
+	f, fset := parseFile(t, "x.go", src)
+	findings := staticPass(packageInfo{f: f, src: src, fset: fset, path: "x.go"}, allTagsMap(), DefaultSinDebtRE())
+	found := false
+	for _, f := range findings {
+		if f.Tag == TagYagni && strings.Contains(f.Problem, "NewThing") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected yagni factory finding, got %v", findings)
+	}
+}
+
+func TestDetectWrapper(t *testing.T) {
+	src := `package foo
+func Wrap(s string) string { return lower(s) }
+func lower(s string) string { return strings.ToLower(s) }`
+	f, fset := parseFile(t, "x.go", src)
+	findings := staticPass(packageInfo{f: f, src: src, fset: fset, path: "x.go"}, allTagsMap(), DefaultSinDebtRE())
+	found := false
+	for _, f := range findings {
+		if f.Tag == TagShrink && strings.Contains(f.Problem, "Wrap") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected shrink wrapper finding, got %v", findings)
+	}
+}
+
+func TestDetectOneExportFile(t *testing.T) {
+	src := `package foo
+func Exported() {}`
+	f, fset := parseFile(t, "x.go", src)
+	findings := staticPass(packageInfo{f: f, src: src, fset: fset, path: "x.go"}, allTagsMap(), DefaultSinDebtRE())
+	found := false
+	for _, f := range findings {
+		if f.Tag == TagShrink && strings.Contains(f.Problem, "exports only one") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected one-export finding, got %v", findings)
+	}
+}
+
+func TestDetectDeadFlag(t *testing.T) {
+	src := `package foo
+var VerboseFlag bool`
+	f, fset := parseFile(t, "x.go", src)
+	findings := staticPass(packageInfo{f: f, src: src, fset: fset, path: "x.go"}, allTagsMap(), DefaultSinDebtRE())
+	found := false
+	for _, f := range findings {
+		if f.Tag == TagDelete && strings.Contains(f.Problem, "VerboseFlag") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected dead flag finding, got %v", findings)
+	}
+}
+
+func TestDetectHandRolledStdlib(t *testing.T) {
+	src := `package foo
+func use(s, sub string) bool { return contains(s, sub) }
+func contains(s, sub string) bool { return strings.Contains(s, sub) }`
+	f, fset := parseFile(t, "x.go", src)
+	findings := staticPass(packageInfo{f: f, src: src, fset: fset, path: "x.go"}, allTagsMap(), DefaultSinDebtRE())
+	found := false
+	for _, f := range findings {
+		if f.Tag == TagStdlib && strings.Contains(f.Problem, "contains") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected stdlib hand-roll finding, got %v", findings)
+	}
+}
+
+func TestSinDebtApproval(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "x.go")
+	mustWrite(t, path, "package foo\n// sin-debt: legacy shim\ntype Reader interface { Read() }\n")
+	re := DefaultSinDebtRE()
+
+	f, fset := parseFile(t, path, string(mustRead(t, path)))
+	src := string(mustRead(t, path))
+	findings := staticPass(packageInfo{f: f, src: src, fset: fset, path: path}, allTagsMap(), re)
+	var target Finding
+	for _, f := range findings {
+		if f.Tag == TagYagni && strings.Contains(f.Problem, "Reader") {
+			target = f
+			break
+		}
+	}
+	if target.Path == "" {
+		t.Fatalf("expected yagni Reader finding, got %v", findings)
+	}
+	approved, approver := approvedBySinDebt(target, re)
+	if !approved || approver != "legacy shim" {
+		t.Fatalf("expected approval 'legacy shim', got %v %q", approved, approver)
+	}
+}
+
+func TestAggregateEmpty(t *testing.T) {
+	r := aggregate(nil, 0)
+	if r.Status != "Lean already. Ship." || r.NetLines != 0 {
+		t.Fatalf("expected lean status, got %+v", r)
+	}
+}
+
+func TestAggregateNetLines(t *testing.T) {
+	findings := []Finding{
+		{Tag: TagDelete, LineCount: 50, Approved: false},
+		{Tag: TagStdlib, LineCount: 30, Approved: false},
+		{Tag: TagYagni, LineCount: 20, Approved: true, Approver: "kept"},
+	}
+	r := aggregate(findings, 0)
+	if r.NetLines != 80 || r.DepsRemovable != 1 {
+		t.Fatalf("expected net 80/1, got %+v", r)
+	}
+	if !strings.HasPrefix(r.Status, "net: -80") {
+		t.Fatalf("unexpected status: %s", r.Status)
+	}
+}
+
+func TestAuditIntegration(t *testing.T) {
+	dir := t.TempDir()
+	mustWrite(t, filepath.Join(dir, "a.go"), `package demo
+
+type Reader interface { Read() }
+func NewReader() Reader { return &reader{} }
+type reader struct{}
+func (r *reader) Read() {}
+`)
+
+	aud := NewAuditor(nil)
+	opts := Options{NoLLM: true, Tags: []string{TagYagni}}
+	res, err := aud.Audit(context.Background(), dir, opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(res.Findings) == 0 {
+		t.Fatal("expected findings")
+	}
+	if res.Status == "Lean already. Ship." {
+		t.Fatal("expected non-lean status")
+	}
+}
+
+func TestAuditStrictThreshold(t *testing.T) {
+	dir := t.TempDir()
+	mustWrite(t, filepath.Join(dir, "a.go"), `package demo
+var VerboseFlag bool
+var DebugConfig string
+`)
+	aud := NewAuditor(nil)
+	opts := Options{NoLLM: true, Tags: []string{TagDelete}, Strict: true, MaxNet: 1}
+	_, err := aud.Audit(context.Background(), dir, opts)
+	if err == nil {
+		t.Fatal("expected strict threshold error")
+	}
+}
+
+func TestValidateTags(t *testing.T) {
+	if err := ValidateTags([]string{"delete", "shrink"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := ValidateTags([]string{"bad"}); err == nil {
+		t.Fatal("expected error for unknown tag")
+	}
+}
+
+func TestFormatFinding(t *testing.T) {
+	f := Finding{Tag: TagShrink, Problem: "x", Replacement: "y", Path: "p.go", Line: 7}
+	got := FormatFinding(f)
+	want := "shrink: x. y. [p.go:7]"
+	if got != want {
+		t.Fatalf("want %q, got %q", want, got)
+	}
+}
+
+func TestAuditRankDeps(t *testing.T) {
+	findings := []Finding{
+		{Tag: TagDelete, LineCount: 100},
+		{Tag: TagStdlib, LineCount: 10},
+		{Tag: TagNative, LineCount: 20},
+	}
+	r := aggregate(findings, 0)
+	if r.NetLines != 130 || r.DepsRemovable != 2 {
+		t.Fatalf("expected 130/2, got %+v", r)
+	}
+}
+
+func allTagsMap() map[string]bool {
+	m := make(map[string]bool)
+	for _, t := range allTags {
+		m[t] = true
+	}
+	return m
+}
+
+func parseFile(t *testing.T, path, src string) (*ast.File, *token.FileSet) {
+	t.Helper()
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, path, src, parser.ParseComments)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return f, fset
+}
+
+func mustWrite(t *testing.T, path, content string) {
+	t.Helper()
+	_ = os.MkdirAll(filepath.Dir(path), 0755)
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func mustRead(t *testing.T, path string) []byte {
+	t.Helper()
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+func TestDefaultSinDebtRE(t *testing.T) {
+	re := DefaultSinDebtRE()
+	if !re.MatchString("// sin-debt: reason") {
+		t.Fatal("expected match")
+	}
+}
+
+func TestTagRank(t *testing.T) {
+	if tagRank(TagStdlib) >= tagRank(TagShrink) {
+		t.Fatal("stdlib should rank before shrink")
+	}
+}
+
+func TestAuditLLMStub(t *testing.T) {
+	stub := &llmStub{extra: []Finding{{Tag: TagDelete, Problem: "stub", Replacement: "remove", Path: "x.go", Line: 1, LineCount: 1}}}
+	dir := t.TempDir()
+	mustWrite(t, filepath.Join(dir, "x.go"), "package demo\nfunc Unused() {}\n")
+	aud := NewAuditor(stub)
+	// Include shrink so static pass generates a candidate for the LLM pass.
+	opts := Options{TopN: 1, Tags: []string{TagDelete, TagShrink}}
+	res, err := aud.Audit(context.Background(), dir, opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, f := range res.Findings {
+		if f.Problem == "stub" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("expected LLM stub finding")
+	}
+}
+
+type llmStub struct {
+	extra []Finding
+}
+
+func (l *llmStub) Judge(ctx context.Context, filePath, content string, candidates []Finding) ([]Finding, error) {
+	return l.extra, nil
+}
+
+func TestApprovedFindingsExcludedFromNet(t *testing.T) {
+	findings := []Finding{
+		{Tag: TagDelete, LineCount: 100, Approved: true, Approver: "ok"},
+	}
+	r := aggregate(findings, 0)
+	if r.NetLines != 0 {
+		t.Fatalf("expected approved finding to not count, got %d", r.NetLines)
+	}
+}
diff --git a/cmd/sin-code/main.go b/cmd/sin-code/main.go
index aa92b089..8fbc1780 100644
--- a/cmd/sin-code/main.go
+++ b/cmd/sin-code/main.go
@@ -99,6 +99,10 @@ func init() {
 		NewCodeGraphCmd(),                                                                              // CodeGraph multi-language analysis bridge (issue #126)
 		NewSpecCmd(),                                                                                   // Spec-Layer: *.spec.md contracts (issue #122)
 		NewDebtCmd(),                                                                                   // issue #177: sin-debt marker manager (`// sin-debt: <ceiling>, upgrade: <trigger>`)
+		NewRtkCmd(),                     // rtk (Rust Token Killer) bridge (issue #123)
+		NewCodeGraphCmd(),               // CodeGraph multi-language analysis bridge (issue #126)
+		NewSpecCmd(),                    // Spec-Layer: *.spec.md contracts (issue #122)
+		NewAuditCmd(), NewCEOAUDITCmd(), // v3.18.0: complexity audit (issue #180) + 48-gate CEO audit
 		internal.InstinctCmd, internal.HooksCmd, internal.AssetsCmd, internal.EvalCmd, internal.PRPCmd, // continuous learning + lifecycle hooks + asset harvest + eval + prp workflow
 	)
 
diff --git a/docs/complexity-audit.md b/docs/complexity-audit.md
new file mode 100644
index 00000000..537de2f6
--- /dev/null
+++ b/docs/complexity-audit.md
@@ -0,0 +1,102 @@
+# Complexity Audit
+
+`sin-code audit complexity` is a repo-wide, ponytail-audit-style complexity scan. It lists candidates for reduction, ranks them, and respects `// sin-debt:` markers.
+
+## Tags
+
+| Tag | Meaning | Example |
+|-----|---------|---------|
+| `delete` | Dead code or unused flexibility | Unread flag/config variable |
+| `stdlib` | Hand-rolled thing the stdlib ships | Custom `contains` instead of `strings.Contains` |
+| `native` | Dependency or code the platform already ships | Custom slice reverse instead of `slices.Reverse` |
+| `yagni` | Abstraction with one implementation | Interface with a single implementation |
+| `shrink` | Same logic, fewer lines | Wrapper that only delegates, single-export file |
+
+## Output Format
+
+```text
+<tag> <what to cut>. <replacement>. [path]
+```
+
+Findings are followed by:
+
+```text
+net: -<N> lines, -<M> deps possible.
+```
+
+or, when no findings remain:
+
+```text
+Lean already. Ship.
+```
+
+## CLI
+
+```bash
+sin-code audit complexity
+sin-code audit complexity ./cmd/sin-code
+sin-code audit complexity --format json
+sin-code audit complexity --tags yagni,delete
+sin-code audit complexity --rank deps
+sin-code audit complexity --strict --max-net-lines 1000
+```
+
+## sin-debt markers
+
+A `// sin-debt:` comment above a finding marks it as approved and removes it from the net total:
+
+```go
+// sin-debt: legacy shim
+type Reader interface { Read() }
+```
+
+The output appends `(approved: sin-debt marker <reason>)` and the line is excluded from `net:`.
+
+## CEO-audit integration
+
+`sin-code ceo-audit` runs the complexity scan as gate 48. Score contribution: `+1` per 100 removable lines (rounded down).
+
+```bash
+sin-code ceo-audit .
+sin-code ceo-audit . --strict --max-net-lines 500
+```
+
+## Static pass
+
+The deterministic static pass (no LLM) detects:
+
+- Single-implementation interfaces (`yagni`)
+- `New*` factory functions with a single caller assumption (`yagni`)
+- Functions that only return the result of another call (`shrink`)
+- Files exporting exactly one top-level symbol (`shrink`)
+- Unread variables whose names contain `Flag` or `Config` (`delete`)
+- Common hand-rolled helpers (`stdlib`)
+
+The optional LLM second pass (`--no-llm` to disable) only receives the top-N static findings.
+
+## Markdown output
+
+`--format markdown` emits a table with tag, problem, replacement, path, and estimated lines.
+
+## JSON output
+
+`--format json` returns `audit.Result`:
+
+```json
+{
+  "findings": [
+    {
+      "tag": "yagni",
+      "problem": "interface Reader has only one likely implementation",
+      "replacement": "inline Reader as concrete type",
+      "path": "...",
+      "line": 5,
+      "line_count": 1,
+      "approved": false
+    }
+  ],
+  "net_lines": 1,
+  "deps_removable": 0,
+  "status": "net: -1 lines, -0 deps possible."
+}
+```