Audit Run — main @ 2f26d91 (2026-04-26) — skipped, sweep + fixes only

[intendednull]

prior audit: #276 @ 2f26d91. main HEAD == 2f26d91. skip rule trip → no new full audit.

#300 ran on 679f9fe (not on main, 11 commits ahead on a feature branch). most #300 findings still apply since the gap is tooling commits, not code.

sweep (89 audit-finding issues triaged)

• RESOLVED: 0
• FALSE-POSITIVE: 0
• OBVIOUS-FIX: 14 (5 auto-PR'd, 9 deferred to next run)
• AMBIGUOUS: ~55

3 RESOLVED candidates (#344 #354 #355) re-classified: search component absent on main now, but pending feature branch carries it. annotated as deferred, kept open. git ls-tree origin/main → only docs/specs/2026-04-19-ui-design/local-search.md.

auto-fix PRs

• docs: drop willow-channel from README/CLAUDE.md + EventKind drift #388 — drop willow-channel + EventKind drift fixes (closes [ARCH-02/GEN-11] README + CLAUDE.md drift: lists removed willow-channel crate, wrong EventKind count #255)
• fix(agent): const-time bearer + scope gates #389 — fix(agent): const-time bearer + scope gates (closes [SEC-V-01] Bearer token compared with non-constant-time == #301 [SEC-A-01] Bearer token compared with non-constant-time equality #304 [SEC-A-02] Agent read_resource does not enforce allows_resource scope #305 [SEC-A-09] Agent HTTP server defaults to TokenScope::Full with no CLI flag #311)
• fix(worker): gate test_config() behind test-utils feature #390 — fix(worker): gate test_config behind test-utils feature (closes [TD-13] pub fn test_config() (with /tmp/test-worker.key) lives in non-test module #331)

CI in flight at write time. fmt / clippy / browser / wasm / cargo-audit green across all 3. test + playwright running.

deferred obvious-fix (next run pickups)

#303 voice.participants caps · #302 sync_since heads cap · #235 TopicAnnounce cap · #236 Event/RotateChannelKey vec caps · #234 display_name length cap · #238 bootstrap CRLF buffer · #227 deploy sshpass replace · #319 trunk version pin · #314 docker USER directive · #269 MessageDb error logging.

stale-sweep

closures: 0. notes added: #344 #354 #355.

lessons

• skip-rule load-bearing. cross-checking Codebase Audit — main @ 2f26d91 (2026-04-24) #276 / Codebase Audit — main @ 679f9fe (2026-04-25) #300 against git merge-base --is-ancestor caught that Codebase Audit — main @ 679f9fe (2026-04-25) #300 ran on a non-main branch. saved a redundant 8-agent matrix.
• triage agent over-eager on RESOLVED. file-absence ≠ finding-resolved when the file is on a pending feature branch. always cross-check git ls-tree origin/main + open PRs touching the path before closing.
• never switch the parent checkout off main during an audit. one verification grep returned wrong evidence after a branch flip. keep the parent pinned to main; do branch work in worktrees only.
• auto-fix prompt template: worktree path + base branch + file:line + narrow cargo check -p <crate> (NOT just check) + caveman PR body + blocker file fallback. that template held up across 3 willow PRs.
• cargo install --locked cargo-audit panicked silently here (binary not in ~/.cargo/bin after exit-0 install). check which cargo-audit before relying on it; existing [DEP-08] Unmaintained paste 1.0.15 (RUSTSEC-2024-0436) — not in CI ignore list #316 [DEP-09] Unmaintained proc-macro-error 0.4.12 (RUSTSEC-2024-0370) — not in CI ignore list #317 [DEP-10] Unmaintained atomic-polyfill 1.0.3 (RUSTSEC-2023-0089) — not in CI ignore list #318 already track the RUSTSEC IDs anyway.
• GitHub MCP list_issues exceeds token cap on big repos — pipe to jq + JSONL early so audit agents work from a flat file.

session: https://claude.ai/code/session_01KvXynFPgSaqWTBo65iMnD9