docs(audit): full 2026-07-15 codebase audit report#9641
Open
MarkusNeusinger wants to merge 3 commits into
Open
docs(audit): full 2026-07-15 codebase audit report#9641MarkusNeusinger wants to merge 3 commits into
MarkusNeusinger wants to merge 3 commits into
Conversation
Full 16-auditor /audit run with domain-routed cross-validation. 109 findings (1 critical, 14 high, 45 medium); Health Score 30/100 with correctness (C, 60) as the weak pillar, all other dimensions A-/B+. Headline items: live heatmap-calendar retry loop (#1010), pipeline/config drift against the 15-library reality, dark-mode white-surface leaks, and 97 reviewer-rejected implementations live on main. Includes an open-issue triage with a recommended work queue. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014fhNUHgWcnq9EbJiJu3rD2
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the audit documentation set by adding the full persisted output of the 2026-07-15 /audit run and updating agentic/audits/latest.md to reflect that latest report.
Changes:
- Added the full 2026-07-15 audit report (
agentic/audits/2026-07-15-all.md). - Updated
agentic/audits/latest.mdto the 2026-07-15 audit content.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| agentic/audits/latest.md | Updates the “latest” audit report to the 2026-07-15 full-scope run output. |
| agentic/audits/2026-07-15-all.md | Adds the full persisted audit report for 2026-07-15. |
Address Copilot review on #9641: - Fix header auditor breakdown to match the Coverage line (16 ran, 14 returned findings, 4 degraded: gcloud/plausible/pagespeed blocked, seo structural-only). - Add the audit-report entry under CHANGELOG [Unreleased] > Added. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014fhNUHgWcnq9EbJiJu3rD2
Separate the (#9641) PR reference from the "work queue" sentence per Copilot review on #9641. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014fhNUHgWcnq9EbJiJu3rD2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the persisted output of a full
/auditrun (16 specialist auditors + domain-routed adversarial cross-validation) underagentic/audits/2026-07-15-all.mdand updateslatest.md. This is audit-harness output — no source code changes.Health Score 30/100 (formula floor — breadth-dominated, not a "broken repo"). The weak pillar is Correctness (C, 60); every other dimension is A-/B+.
Headline findings
heatmap-calendargeneration retry loop ([heatmap-calendar] Basic Calendar Heatmap #1010) — ~1,200 Actions runs / 38h; the comment-counting attempt cap fails open under rate limiting.spec-create.ymlquoted heredocs,impl-merge.ymlstale 11-lib auto-close,evaluate-plot.pylooks forplot.pngvs emittedplot-{THEME}.png); dark-mode white-surface leaks (MUI Paper/Menu + overlay buttons); unauthenticated prompt-injection into write-privileged Claude agents; 97 reviewer-REJECTED implementations live on main.Coverage note
gcloud, Plausible, and PageSpeed-lab auditors ran degraded (no credentials / anonymous quota exhausted) in this environment — live GCP/analytics/lab-CWV posture is unverified this run and those grades reflect code-side evidence only.Statistics
109 findings (1 critical, 14 high, 45 medium, 35 low, 14 positive). Cross-validation: 18 reviewed, 0 dropped, 1 downgraded. Baseline clean (ruff 0 issues, format OK).
🤖 Generated with Claude Code
https://claude.ai/code/session_014fhNUHgWcnq9EbJiJu3rD2
Generated by Claude Code