Epic: Strict audit 2026-04-28 — ProjectKeystone

[mvillmow]

ProjectKeystone — Strict Repository Audit Report

Date: 2026-04-28
Auditor: Sonnet Specialist Auditor (claude-sonnet-4-6)
Rubric: repo-analyze-strict v3.0.0 (ProjectHephaestus)
Repository: HomericIntelligence/ProjectKeystone
Commit audited: HEAD at time of clone (2026-04-28)

---

Executive Scorecard

Section	Weight	Grade	Score
1. Repository Hygiene	5%	B	83
2. Documentation	7%	B-	80
3. Architecture	15%	C+	77
4. Source Code Quality	15%	B-	80
5. Testing	12%	C+	77
6. CI/CD	8%	A-	91
7. Dependency Management	5%	B-	81
8. Security	12%	B-	81
9. Observability & Ops	4%	C+	77
10. Planning / Roadmap	4%	C+	77
11. AI Agent Tooling	5%	C	74
12. Containerization	4%	C	74
13. Developer Experience	3%	B	83
14. API Design	5%	C	74
15. Compliance / Legal	4%	D	60

Weighted Score: 79%
Letter Grade: C+
Verdict: CONDITIONAL GO — Multiple issues must be resolved before production use.

---

Verdict Blockers

1. [BLOCKER] Resolve the license conflict. LICENSE file must match the stated BSD-3-Clause in CHANGELOG.md. The legal status is indeterminate until this is corrected.
2. [BLOCKER] Complete or abandon ADR-015/016. Either finish the extraction (remove src/agents/, include/agents/, src/keystone/*.py, and update CMakeLists.txt) or revert the ADRs to "Superseded". The codebase must not contradict its own accepted ADRs.
3. [RECOMMENDED] Fix or re-enable test_work_stealing_queue.cpp. A core data structure with a non-compiling test is unacceptable.
4. [RECOMMENDED] Fix the production Containerfile. Stage 3 should ship a service binary, not test executables.
5. [RECOMMENDED] Implement TransparentBridge or remove from documentation. The documented automatic promotion behavior is not implemented; CLAUDE.md is misleading.

Child Issues (29 findings)

• [CRITICAL] §3: Incomplete architectural extraction: agents + Python still in repo #505
• [CRITICAL] §15: License inconsistency: MIT in LICENSE file vs BSD-3-Clause in CHANGELOG #506
• [MAJOR] §3: keystone_agents library still built despite ADR-015 extraction #507
• [MAJOR] §3: Python orchestration package still present despite ADR-016 and C++20 mandate #508
• [MAJOR] §4: Synchronous getMessage() polling inside async coroutine in ChiefArchitectAgent #509
• [MAJOR] §5: test_work_stealing_queue.cpp disabled due to compilation error #510
• [MAJOR] §5: Multiple test targets disabled without tracking issues #511
• [MAJOR] §9: TransparentBridge not implemented despite CLAUDE.md documentation #512
• [MAJOR] §12: Production container stage runs test executables, not a service binary #513
• [MAJOR] §14: NatsConnection::fetch() returns raw natsMsg* with manual ownership #514
• [MAJOR] §14: KeystoneMessage struct carries orchestration concerns in transport layer #515
• [MAJOR] §2: README badges point to personal account, not organization #516
• [MAJOR] §10: Ghost workflow: /notes/issues/ directory referenced but does not exist #517
• [MAJOR] §8: std::getenv() called with concurrency-mt-unsafe suppression in NATS code #518
• [MAJOR] §11: mojo-language-review-specialist.md referenced but does not exist #519
• [MINOR] §11: CLAUDE.md C++20 mandate contradicts presence of Python modules #520
• [MINOR] §4: NATSListener.start() subscribes but does not wire message callback #521
• [MINOR] §4: getenv() called during NatsConfig constructor initialization #522
• [MINOR] §7: requirements.txt and pyproject.toml are redundant Python dep manifests #523
• [MINOR] §7: FetchContent C++ deps not covered by Dependabot vulnerability scanning #524
• [MINOR] §6: Benchmark failures suppressed in CI with '|| true' #525
• [MINOR] §8: Production container missing allowPrivilegeEscalation and readOnlyRootFilesystem #526
• [MINOR] §9: NATSListener.stop() does not drain or close subscription #527
• [MINOR] §15: CPack CONTACT set to placeholder email address #528
• [MINOR] §13: setup-env.sh required for Docker but its contents are undocumented #529
• [MINOR] §12: Helm values.yaml uses 'latest' as default image tag #530
• [NITPICK] §4: KeystoneMessage.command field is 'legacy' but not marked [[deprecated]] #531
• [NITPICK] §6: actions/checkout@v6 used without SHA pin in _required.yml #532
• [NITPICK] §2: GLOSSARY.md exists but is not linked from README or CLAUDE.md #533