claude
c0f4074a5d
Nineteen of the twenty findings were open, and they lived in an untracked audit.md at the repo root that no next session would have read. The one that is closed, the unauthenticated mavgpud proxy, went out as V-673. The report is now a frozen measurement under docs/evals/, dated and never edited again — including when a finding it names gets fixed. The live state moved to docs/caveats/, one entry per limit, each carrying its Vikunja id and the condition that makes it worth fixing. A caveat with no revisit trigger is a complaint, so every entry has one. Closing a limit deletes its entry rather than editing the measurement that found it. Two directory indexes come with it. docs/CLAUDE.md states the tier rule the repo already followed by convention: living docs corrected in place, evals frozen by date, caveats deleted when fixed. docs/caveats/CLAUDE.md indexes the nineteen by claim and severity, because an index of filenames adds nothing a directory listing does not. Tasks V-675 through V-693 carry the plans. The doc line and the tracker now join in both directions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz
1.1 KiB
Layering and dead surface
Neither entry breaks anything today. Both make a later change cost more than it should, which is why they are low and not medium.
Domain packages depend on store and IPC types [#685]
Costs: dialogue exposes store.DialogueSessionRow in its port, the pure
morning planner takes a store.Fact, and auth policy imports IPC method and
caller types. There is no Go import cycle. A schema change reaches further than
it should.
Revisit when: the dialogue or fact schema changes, or a second transport
appears beside IPC.
Workaround: none needed. It compiles and it is correct.
Eleven symbols are unreachable [#686]
Costs: extra API and test surface, and comments that claim callers which no
longer exist. Three of the eleven must not be deleted. HisGender is a
documented seam tied to V-399. AudioDuration duplicates internal/audio and
should call it. CountWord is a one-line alias nobody uses and can go.
Revisit when: deadcode is wired into the audit gate, which needs the
allowlist this entry describes. An unannotated list invites deleting the
three above.
Workaround: none needed.