general-audit lessons: 2026-05-02

[intendednull]

caveman lessons. master: #513. 53 raw → 38 filed. cargo audit clean.

What worked

• 9 parallel sweep agents fanned out cleanly. No timeouts. All under 6 min budget. Stream-append-as-found discipline (one finding per Write) held — no batched-write loss.
• Concern split kept noise low. Security split into 4 sub-areas (validation, auth, web, supply) prevented one agent owning too much. Tech-debt + arch + testcov + general-review filled the rest.
• Sibling-of-closed pass found 3 real bugs out of 11 PRs. F1 (replay missing storage's heads-cap), F2 (VoiceJoin/VoiceLeave peer_id spoof, dup [security] Voice peer ID spoofing — no signer verification on voice messages #172), F3 (reduced-motion 0.01ms flunks is_zero_duration). High-yield pass — keep first.
• Dedup subagent caught 7 dups + 6 supersedes out of 53. Narrow search_issues queries (file path, symbol name) avoided 78k-char overflow.
• Verification subagent caught 2 false-premise findings (F28, F52) that survived dedup. Spot-checking the cited line saved us from filing inaccurate child issues.

What didn't

• Broad search_issues query overflowed 78k cap twice. Query like is:issue "general-audit" returns every prior audit master + lessons + child = ~66k chars. Always pin a narrowing keyword.
• cargo audit first run failed with "advisory-db not found" because -n (no-fetch) was used before db was cached. Second run without -n worked. SKILL.md says -n always — should note the first-run case.
• F28 + F52 false premises snuck past dedup because keywords matched plausibly. Body of F28 said "missing lock-ok marker" but marker was at line 23 (the finding cited line 31). Body of F52 said "no aria-live for chat" but chat.rs:387 has it. Lesson: sweep agent must Read ±10 lines around the cited line before asserting "missing"/"absent".
• Auto-fix batch PRs in the merged-since list (auto-fix batch claude/friendly-maxwell-cVhhm (2026-04-30) #501, auto-fix batch claude/friendly-maxwell-uPyR3 (2026-04-30) #503, auto-fix batch claude/friendly-maxwell-EjeTz (2026-05-01) #505, auto-fix batch claude/friendly-maxwell-BjjKA (2026-05-02) #507) carry many small changes — sibling-of-closed agent had to inspect each commit individually, expensive. Could pre-filter PRs by commit-prefix (fix:/feat:/perf:) before drilling.

Suggested edits to .claude/skills/general-audit/SKILL.md

1. Pass 2 sweep agents must read ±10 lines around any cited line before asserting "missing"/"absent"/"no X exists". Prevents F28/F52-class false positives.
2. Dedup subagent prompt: never use bare is:issue "general-audit"-style queries. Always pin a file path, symbol name, or RUSTSEC ID. Add to "Hard Rules" → "Synthesis".
3. Pass 3 cargo-audit: drop the -n flag from the documented one-liner OR document a one-time cargo audit (no -n) prefetch step. First run after toolchain rebuild always fails with -n.
4. Verification subagent should drop any finding marked partially-verified whose body claim contradicts the verification spot-check, not just FAILED. Currently the rule says "drop FAILED" only — partial-correctness still made it to filing without F28/F52 manual override by the orchestrator.
5. Sibling-of-closed agent: prefer commit-prefix filter (fix:/feat:/perf:) over PR-by-PR drill when N merged PRs > 5. Auto-fix-batch PRs especially benefit.
6. Add explicit note: 38 issues × 4 API calls each (create + sub-issue + 2 reads) = 150+ MCP calls — budget for that. Suggest issue creation in batches of 8-10 in parallel; sub-issue link in batches of 14.

Stats

• raw findings: 53
• dups (pre-existing issues): 7 ([security] Voice peer ID spoofing — no signer verification on voice messages #172, [SEC-V-02] 256 KB envelope cap is the only app-layer gate; SyncBatch.events has no element cap #233, [SEC-V-05] ProfileState.names / ChatMetaState.typing_peers accept unbounded attacker-supplied strings #234, [GEN-01] Deploy workflow uses sshpass -p with password + root@ + StrictHostKeyChecking=no #227, [DEP-04] CI Rust toolchain and install-action use mutable tags (including in deploy.yml) #248, F5-intra, [GEN-10] HLC wall_clock_ms panics on backwards system clock (SystemTime < UNIX_EPOCH) #270)
• superseded by broader issues: 6 ([ARCH-04] Three catch-all _ => arms in materialize.rs silently absorb new EventKind variants #230, [security] XSS-prone js_sys::eval() in pinned message jump #171, [TD-04] .ok() silently swallows ~16 errors in listeners.rs event-pump hot loop #253, [TD-14] anyhow used in 8 library crates contradicts CLAUDE.md convention #332, [TD-02] 1521 unwrap()/expect() call sites; 18 in network/mem.rs production path #321, [ARCH-07] crates/client/src/lib.rs is 1,941 LOC with 18 pub mod entries — unbounded public surface #259)
• dropped (false premise after verification): 2 (F28, F52)
• filed: 38 (audit F1 [robustness]: replay/role.rs missing storage's heads-cap rejection #514–audit F53 [quality]: worker/identity.rs uses println! in lib code #551)
• run wall time: ~12 min (sweep) + ~3 min (synthesis) + ~5 min (filing) = ~20 min total
• agent count: 9 sweep + 1 dedup + 1 verify = 11 subagents, all in parallel batches