Doc Gap Detector

Sweep completed tickets for changes that alter a client's security posture or
configuration and verify each one left a documentation trail. Report the gaps; do not
fix them silently.

1. Pull resolved tickets for the window (default: last 30 days), running SEPARATE
   searches per change class: firewall/network rules, MFA/conditional access, DNS
   records, admin/privileged access grants, VPN config, backup config,
   licensing/tenant changes.

2. For each hit, confirm from the thread that a change was actually MADE (not merely
   proposed or recommended) — zero-assumption: a recommendation is not a change.

3. For each confirmed change, look for a documentation trail: a doc reference/link in
   the ticket notes, or a matching, recently updated entry in the documentation
   platform (IT Glue / Hudu where connected) and the knowledge base.

4. Classify each change: DOCUMENTED (trail found), GAP (no trail), or UNVERIFIABLE
   (docs platform not searchable for this tenant, or result cap hit). Absence of
   evidence is reported as a "gap to verify", not an accusation — the doc may live
   somewhere unsearchable; say so.

5. Output the gap report grouped by <client>: change made, ticket number, date,
   engineer, change class, and what documentation is missing. Rank security-impacting
   gaps (MFA, admin access, firewall) first. Report ONLY changes the thread confirms
   were executed — never list a recommendation or quote as an undocumented change.
   RESULT-CAP HONESTY: if searches cap out, state the sweep is partial and name the
   classes affected. If neither IT Glue nor Hudu is connected, check ticket notes and
   the Thread KB only, and say external doc platforms were not checked.

6. If asked, leave a plain-text internal note on each gap ticket ("Documentation gap:
   <change class> change has no doc update — please document") — but confirm the ticket
   list with the requester BEFORE posting any notes. That is the only write; never edit
   documentation or tickets beyond it.

UNATTENDED (Flow): the entire reply is the plain-text gap report, security-impacting
gaps first, no narration. Capped or unsearchable classes appear under an UNVERIFIABLE
heading, never silently dropped. No gaps found -> reply exactly "NO DOC GAPS FOUND."
(append " (SWEEP PARTIAL)" if any search capped). The per-ticket gap notes stay
attended — they require the requester to confirm the ticket list.