Audit fixes group 1: docs and CI guards (D-132)

Merged
BI
1d ago
+1333-625

Requested by josh · project thread

Group 1 of the confirmed findings from the 10 Nov full audit. It covers docs and CI guards only, with no screen or clinical change. The ruling is recorded as D-132, which also records Josh's "yes to all recommendations" from the same day.

What changes

  • STATUS and backlog (A8-08): removes the two asks that are already done (the hold check and Dependabot) and re-dates STATUS to a6e405b2.
  • CI comments (A6-F12): say no merge queue is in use (D-107). The dormant merge_group triggers stay.
  • Docs-only PRs (A6-F09): plan.mjs scans the test files for the doc paths they read, so a change to one of those docs runs the unit job. If the scan fails, every doc counts as test-read.
  • Bundle secret guard (A4-06): adds patterns for Supabase sb_secret_ keys, service-role JWTs (the anon key still passes), Slack, Stripe and Sentry, each with a fixture test.
  • CSRF (A4-08): stops trusting a client-sent X-Forwarded-Host. Only the request host and the configured public host (NEXT_PUBLIC_SITE_URL or RAILWAY_PUBLIC_DOMAIN, http or https only) count.
  • testing.md (A8-09): gives the right counts (7 release journeys, 14 cases, 4 unit shards) and points the UI rows at the journey suite.
  • Go/no-go C3 (A3-08): ticked, with a new DOM test checking that the stored movement reminder label is an exact synthetic ED place label.
  • Bot-author policy (A6-F02):
    • Claude, Cursor and Codex become an advisory warning tier. Author identity is self-declared, so this tier is not an access control.
    • Workflows, CI scripts and the protected-test list become sensitive paths.
    • A Dependabot commit that only changes workflow uses: pins is still allowed, checked from the patch.
  • Stale-docs report (A6-F08): now an advisory step in the CI static job.
  • Runbook, desk guides and demo script (A8-10):
    • The runbook and desk guides were re-checked against source and re-dated.
    • DEMO-SCRIPT.md was rewritten against the current app and walked once end to end in a local production build.
    • docs:freshness blocks on the runbook and desk guides. On PRs it runs with --advisory.

Evidence

  • Hosted CI: all green on a33267e, including the 4 unit shards, coverage, backend, both browser journey groups, both release gates and the production build.
  • Since then: the demo script and a clean merge of main have been pushed. Hosted CI is re-running.
  • Local, after merging main: decision-log, freshness and scope tests pass, the owner-rulings index is current and there are 0 broken links.
  • Not addressed here: the whole-file source secret scan, which was line by line before this PR and is left for a follow-up (see the review reply).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GxPPxoMLDjMVhAE5QvdXbB