The "all" domain had no findings — six claims re-measured, one comment was lying

[satvikOS]

ship-now-by-domain/all.json contains exactly one entry, OB-6, and it is a
pointer entry — "severity": "n/a", "file": "(pointer entry, not a finding)",
and an explicit instruction: "Do not re-file." So the deliverable for this
domain is the re-measurement, not a pile of fixes. Six claims, all checked at
9358bc24.

The entry's one actionable line was a WARNING: "packages/ is empty on main —
confirm the audit package work is actually in flight." It is not in flight. It
landed. And the application still carries a comment insisting it does not exist,
which is the only thing in this domain I changed.

The one fix

apps/web/src/lib/audit-record.ts opened by telling its reader:

The engine repository has @tenure/audit and its buildAuditRecord. That
package does not exist in this repository — grep -rn '@tenure/audit' finds
exactly one hit, and it is the comment in reconcile.ts explaining the absence.

Every clause is false on main. packages/audit is git-tracked (record.ts 465
lines, verify.ts 360, retention.ts 306, index.ts 74, plus audit.test.ts);
the grep finds four hits; and reconcile.ts:381 now says the opposite in as
many words — "This comment used to say ... @tenure/audit exists only in the
engine repository ... The gap is closed."

It is wired, not merely present: root workspaces: ["packages/*"],
apps/web/tsconfig.json:23 path map, jest roots: ["<rootDir>", ".../packages"],
and a moduleNameMapper for the bare specifier. Its 71 tests are collected
among the suite's 354 files and pass (0.149s).

Corrected in place rather than deleted — the convention reconcile.ts already
set — and it now states what remains true and is the actual reason the file
exists: the two are separate on purpose. buildAuditRecord is a pure
function over records touching no database; recordAuditEvent is the Prisma
write path; nothing in apps/web imports the package yet. Comment-only.

Refuted, with evidence

Claim in OB-6	Measured
"packages/ is empty on main"	False. 7 tracked files; packages/audit complete, wired through four configs, 71 tests green.
"36 writers bypassing buildAuditRecord"	False / stale. 58 sites go through recordAuditEvent. Exactly one raw db.auditEvent.create remains outside the builder.
task #24 — budget.override guards an unread table while adminAdjustBudget holds the real power	Already fixed. admin/actions.ts:1569 "The BINDING happened"; lib/finance-override.ts:110 calls requireCapability("budget.override", …).

The single remaining hand-assembled audit write, approvals/actions.ts:506, is
not a defect to sweep up. It is deliberate and documented on the spot:
recordAuditEvent reads before it writes, so it cannot be an element of an array
$transaction, and making the batch interactive would run eventUpdates and
reimbursementOps — already bound to db — outside the transaction, moving
two compare-and-swaps out with them. verifyAuditChain reports it unchained
and its successor still links through legacyHashOf, so deleting it stays
detectable. The comment names the real fix and says it belongs in its own PR on
the money path. Agreed; left alone.

Confirmed, and correctly owned elsewhere — not re-filed

• governance/register.ts:182 — currency as a bare String. Already
  registered, status: "FAIL", citing Financial Bible §14 and Payments Bible §5.
• task docs(handoff): correct §7.4, and record four traps that cost time tonight #23, composite keys — in flight in Count the rows that would lock the boot, before writing the DDL #258 (census + plan done, DDL to
  write). Note for whoever writes it: 12 composite FKs already exist, written
  references: [id, institutionId]. The sweep's own brief flags this exact
  pattern as the one a naive grep misses.
• multi-institution tenant-resolution divergence — confirmed unreachable. No
  switcher exists: zero hits for switchInstitution, InstitutionSwitcher,
  switch-institution, activeInstitutionId, currentInstitutionId.

Verification

• tsc --noEmit -p apps/web/tsconfig.json → 307 errors = parity.
• jest audit-record audit.test → 2 suites, 95 tests, all pass.
• Mutation proved by md5 before/after against an asserted anchor, not a guessed
  indentation.
• Touches no file held by A key holds one version's bytes, forever #255, Give the assistant the reach the 216 questions need, as three tools #257, The assistant answers from the same shelf the page shows #261, A narrowing migration must say how the old image survives it #263, A sign-in page is a door, not a document #265 or Do not promise a list there is nothing to fill #266 — confirmed
  against the open-PR file lists.

What I did not do

No behavioural change anywhere. I did not converge recordAuditEvent onto
buildAuditRecord — the shapes genuinely differ (pure function vs. Prisma write
path) and that is real work with its own tests. I did not run the full jest
suite; a comment-only diff cannot reach the three suites that fail on pristine
main, and I did not want to report a baseline I had not isolated.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Updated internal documentation to reflect the availability and configuration of the audit package.
  • Clarified the current separation between audit record-building and event-recording functionality.
  • Documented the existing test coverage and current application usage.

[greptile-apps]

satvikOS has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5255212c-4e34-428e-b232-ea3354ba6e43

📥 Commits

Reviewing files that changed from the base of the PR and between 9358bc2 and c7b5507.

📒 Files selected for processing (1)

• apps/web/src/lib/audit-record.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The module documentation now describes the existing @tenure/audit package, its exports and configuration, its collected tests, and its separation from the app’s recordAuditEvent implementation.

Changes

Audit documentation

Layer / File(s)	Summary
Audit package documentation apps/web/src/lib/audit-record.ts	The documentation now describes @tenure/audit exports, TypeScript and Jest resolution, test inclusion, and the separate app audit write path.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to c7b55

This PR corrects outdated documentation without changing application behavior or runtime configuration; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the comment correction and the six re-measured claims related to the "all" domain. It is specific enough to identify the primary change, although "lying" is informal.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch all-domain-verify-audit-package-landed

---

_{Comment @coderabbitai help to get the list of available commands.}