docs(audit): add the 2026-09-02 full codebase audit report

[cristim]

What

Adds docs/audits/codebase-audit-2026-09-02.md, the full report from a sharded audit of every
package at 3c0f8ac94048a2c36fce5ccddee54e6c4849a5cd.

545 findings. Each was written by one reviewer and then checked by an independent verifier that did
not write it:

Verdict	Count
CONFIRMED	454
PLAUSIBLE	46
REJECTED	45

Rejected findings are kept in a tail section with the verifier's reasoning, so nobody re-raises
them later.

Why it needs to be on main

The audit has already closed 48 issues with evidence, reopened one, extended 78 issue bodies, and
filed 60 new issues. Every one of those references a finding ID and this file path. Without the
report on main, those references dangle.

Two adjustments needed to land it

.markdownlintignore excludes docs/audits/. The pre-commit markdownlint --fix rewrote 2560
lines, and one of those edits stripped the trailing space inside `resource `, which is a real
git-secrets allowed-pattern quoted as evidence in finding A14-010. Evidence a formatter can edit is
not evidence. The rest of the rewrite was blank-line cosmetics on a generated file.

Redacted the synthetic AWS key in A14-010's reproduction. git-secrets blocked the commit on a
key-shaped literal in that finding, which is a pleasing result given the finding is about
git-secrets being bypassable. The key was always fake and its characters carry no meaning; the
surrounding text still shows the mechanism. Leaving it would block every future commit touching
this file.

Review notes

Nothing here is code. The file is a record, not a specification, and it is excluded from
markdownlint by design rather than by omission.

🤖 Generated with claude-flow

https://claude.ai/code/session_01Fu9uWjxtDFx5HDKeMRt1jC

Summary by CodeRabbit

• Chores
  • Excluded generated audit reports from standard Markdown linting.
  • Added documentation clarifying that these reports are validated by their producing process to preserve verbatim evidence.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Essentials

Run ID: b6a6f47d-2b0f-479f-8fa5-0a52949bfd97

📥 Commits

Reviewing files that changed from the base of the PR and between 3c0f8ac and 79caaf1.

📒 Files selected for processing (2)

• .markdownlintignore
• docs/audits/codebase-audit-2026-09-02.md

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The markdownlint ignore configuration now excludes generated audit reports under docs/audits/ and documents that the producing process validates these reports.

Changes

Markdown audit report linting

Layer / File(s)	Summary
Ignore generated audit reports .markdownlintignore	Adds docs/audits/ to the ignore list and documents the separate linting process for generated reports.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to e4de9

This change excludes generated audit reports from markdownlint as intended, with no remaining merge-readiness risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: adding the full codebase audit report dated September 2, 2026. It is concise and specific.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/audit-2026-09-02-report

---

_{Comment @coderabbitai help to get the list of available commands.}