weatherreporter/docs/roadmap/audit-remediation.md

Repository Audit Remediation Roadmap

Status: Ready for implementation.

Purpose And Authority

This roadmap translates the confirmed findings in the repository audit ledger into dependency-ordered implementation stages. The ledger owns discovery evidence and final finding disposition. This document owns remediation scope, ordering, locked behavior, verification, and completion state until the work is finished.

All 74 confirmed findings are accepted for remediation. None is priority- deferred and none requires a separate product or architecture decision before work can begin. Four rejected standalone findings remain consolidated into their confirmed owners and are not separate work items.

This roadmap describes future work. Until an individual stage is implemented, canonical current-state documentation and executable behavior remain authoritative.

Implementation Rules

Every stage must:

• read docs/development.md, all files under docs/policy/, this roadmap, and the task-specific canonical documents identified below;
• implement only its listed findings and prerequisites;
• preserve the architecture policy's stateless pipeline, adapter boundaries, curated prompt boundary, operator-owned outputs, comparison ordering, and notification rules unless the stage explicitly corrects that contract;
• add durable tests at the narrowest stable boundary and avoid duplicating behavior already owned elsewhere;
• update every listed canonical documentation owner in the same change as an implemented contract change;
• use deterministic, offline, credential-free tests and synthetic fixtures;
• run gofmt on changed Go files, the stage's focused commands, GOWORK=off go test -count=1 ./..., and git diff --check; and
• commit the completed stage separately when the implementing prompt requests commits.

Stages affecting concurrent execution, cancellation, filesystem mutation, or process-global state must also run the affected packages with -race. No stage may weaken a safety invariant merely to make a test pass.

Priority And Finding Allocation

Each confirmed finding appears exactly once below. Priority describes remediation order, not confidence; every listed finding has high confidence.

Priority	Stages	Findings	Decision
P0: generated forecast integrity	1	AUD-029, AUD-030, AUD-031, AUD-033	Accepted now
P1: security, correctness, and data integrity	2-22	AUD-002 through AUD-021 excluding rejected AUD-022; AUD-023 through AUD-028; AUD-034 through AUD-038; AUD-040 through AUD-058; AUD-073, AUD-074, AUD-077, and AUD-078	Accepted now
P2: deterministic test and operational quality	23-27	AUD-059 through AUD-062, AUD-064, AUD-065, and AUD-066	Accepted now
P3: behavior-preserving consolidation and cleanup	28-32	AUD-039, AUD-067 through AUD-072	Accepted now
P4: documentation lifecycle and audit retirement	33-35	AUD-075 and AUD-076; final audit-record retirement	Accepted now

Rejected AUD-001, AUD-022, and AUD-032 are represented only through AUD-072; rejected AUD-063 is represented only through AUD-039.

Remediation Stages

Stage 1: Correct The Curated Prompt Package Contract

• Findings: AUD-029, AUD-030, AUD-031, AUD-033.
• Affected areas: internal/promptinput, shared embedded prompt assets, and focused prompt-input/prompt-asset tests.
• Work: remove raw transport-shaped warning details from provider input; make shared prompt paths match serialized YAML; describe regional versus point- matched hazard products accurately; and cover stanza serialization failure.
• Locked behavior: deterministic category/stanza order, exact prompt identity, safe normal diagnostics, and byte-stable valid YAML remain unchanged.
• Documentation owners: docs/internal/prompt-input.md and docs/integrations/promptkit.md if their implemented contract changes.
• Exit commands: focused tests for ./internal/promptinput and ./internal/promptassets, then the standard repository commands.

Stage 2: Make Configuration Validation Atomic And Explicit

• Findings: AUD-004, AUD-006, AUD-007, AUD-078.
• Affected areas: internal/config, report-key lookup, timezone parsing, maintained examples, and configuration tests.
• Work: reject unsupported missing-source keys; make programmatic report overrides obey the same presence semantics as loaded configuration; apply secrets only after the complete load succeeds; and document accepted report- key normalization and numeric-offset bounds.
• Locked behavior: file/CLI precedence, inactive-integration policy, exact command-name lookup, and secret redaction remain unchanged.
• Documentation owners: docs/config.md and maintained examples only where executable behavior requires them.
• Exit commands: GOWORK=off go test -race -count=1 ./internal/config ./internal/cli, followed by the standard repository commands.

Stage 3: Require Complete Single-Report Notification Identity

• Findings: AUD-005.
• Affected areas: Distributor notification configuration, bundle-ID rendering, and focused config/app tests.
• Work: reject enabled single-report notification configurations that can produce blank required identity fields before report work begins.
• Locked behavior: inactive notification settings remain optional; configured templates and publication-before-notification ordering remain intact.
• Documentation owners: docs/config.md, docs/operations.md, and Distributor integration docs if accepted values or failures change.
• Exit commands: focused config and app notification tests, then the standard repository commands.

Stage 4: Correct CLI Cancellation, Preflight, And Visible Contracts

• Findings: AUD-008, AUD-009, AUD-010, AUD-074.
• Affected areas: cmd/weatherreporter, internal/cli, assembled CLI tests, help text, and CLI documentation.
• Work: propagate process interrupts through action contexts; validate report dates before executor construction; add representative generate and batch result/exit tests; and align help/internal guidance with quiet, date, and comparison behavior.
• Locked behavior: command/flag ownership, structured summary shapes, stream separation, and one executor per action remain unchanged.
• Documentation owners: docs/cli.md and docs/internal/cli.md.
• Exit commands: GOWORK=off go test -race -count=1 ./internal/cli ./internal/app ./cmd/weatherreporter, both root and comparison help commands, then the standard repository commands.

Stage 5: Harden The Weather API Transport Boundary

• Findings: AUD-011, AUD-012, AUD-013, AUD-014, AUD-015.
• Affected areas: Weather API configuration/adapter, normalized hourly data, local HTTP fixtures, and collection tests.
• Work: accept only supported endpoint forms; bound and redact non-success diagnostics; reject rather than truncate oversized bodies; require usable hourly time bounds; and retry warmup only for transient failures.
• Locked behavior: all eight source contracts, checked-empty optional products, cancellation, provenance, and offline testing remain intact.
• Documentation owners: docs/config.md, docs/integrations/weatherapi.md, docs/internal/weather-data.md, and docs/internal/collect.md as applicable.
• Exit commands: focused adapter/collection tests including boundary-size and cancellation cases, then the standard repository commands.

Stage 6: Correct Civil-Time And Forecast Derivation Boundaries

• Findings: AUD-002, AUD-003, AUD-016, AUD-017, AUD-018, AUD-019.
• Affected areas: internal/timeutil, internal/report, internal/forecast, internal/facts, and their focused tests.
• Work: construct configured clocks as local civil times across DST; protect Daily run-ID uniqueness; preserve units in fallback values; include the full overnight alert interval; reject invalid precipitation percentages; and classify ordinary icy wording consistently.
• Locked behavior: half-open selection, chronological ordering, rolling Hourly elapsed time, and source-period identity remain unchanged.
• Documentation owners: docs/internal/report-registry.md, docs/internal/forecast-derivation.md, and docs/internal/facts.md.
• Exit commands: focused time/report/forecast/facts tests with both DST transitions and metric cases, then the standard repository commands.

Stage 7: Correct Source-Facing Briefing Module Semantics

• Findings: AUD-020, AUD-021.
• Affected areas: briefing module option validation, weather-story construction, module registry tests, and normalized source fixtures.
• Work: make accepted AFD option shapes constructible and omit semantically empty weather stories instead of publishing false availability.
• Locked behavior: report support, default compositions, checked-empty alerts, and ordered module snapshots remain unchanged.
• Documentation owners: docs/internal/module.md and docs/internal/briefing.md.
• Exit commands: focused briefing/module tests, then the standard repository commands.

Stage 8: Correct Derived Briefing Language And Ranking

• Findings: AUD-023, AUD-026, AUD-027.
• Affected areas: derived daily summaries, outdoor-window scoring, temperature band wording, and briefing tests.
• Work: label apparent temperature accurately; include snow, ice, and fog in outdoor-window ranking; and preserve negative-zero temperature meaning.
• Locked behavior: deterministic ranking, Today-only planning scope, and existing module/schema identities remain unchanged.
• Documentation owners: docs/internal/briefing.md and prompt-facing field documentation if names or meaning change.
• Exit commands: focused briefing tests with metric, subzero, and hazard cases, then the standard repository commands.

Stage 9: Establish One Daypart Canonicalization Mechanism

• Findings: AUD-067.
• Affected areas: duplicated canonical-key helpers in briefing and generated-text packages plus their behavior tests.
• Work: establish one domain-owned canonical key contract and route both current consumers through it without changing accepted ASCII behavior.
• Locked behavior: display labels, report-specific semantic roles, ordering, and current valid output remain unchanged.
• Documentation owners: focused internal briefing/generated-text docs only if ownership needs explanation.
• Exit commands: focused briefing and generated-text tests, then the standard repository commands.

Stage 10: Correct Daypart Identity, Collision, And Display Behavior

• Findings: AUD-024, AUD-025, AUD-073.
• Affected areas: derived daypart summaries, planning builders, display capitalization, configuration fixtures, and rendering tests.
• Work: reject canonical-key collisions; use configured identities consistently across planning; and make non-ASCII display capitalization rune-safe.
• Locked behavior: Stage 9's canonical identity remains separate from display text; stable ordering and default dayparts remain unchanged.
• Documentation owners: docs/config.md, docs/internal/briefing.md, and generated-text/template docs if visible labels change.
• Exit commands: focused config/briefing/generated-text/reporttemplate tests, then the standard repository commands.

Stage 11: Refresh The Official SPC Definition Asset

• Findings: AUD-028.
• Affected areas: embedded SPC category definitions, source attribution, and risk-digest tests.
• Work: reconcile descriptions with the current authoritative SPC table and record a durable source/review mechanism without changing risk thresholds accidentally.
• Locked behavior: deterministic category ordering, threshold selection, and overlap logic remain unchanged unless current official semantics require an explicit reviewed correction.
• Documentation owners: docs/internal/briefing.md or another single canonical maintainer owner for the external definition source.
• Exit commands: focused briefing asset/risk tests, then the standard repository commands.

Stage 12: Secure Prompt-Debug Redaction And Filesystem Traversal

• Findings: AUD-034, AUD-035.
• Affected areas: internal/promptdebug, Promptkit debug callbacks, endpoint redaction, filesystem operations, and adversarial tests.
• Work: redact common credential aliases and URL credential forms; replace pathname check/use gaps with a race-resistant secure creation strategy.
• Locked behavior: debug remains explicit opt-in with 0700 directories, 0600 files, deterministic references, and no sensitive normal output.
• Documentation owners: docs/operations.md and docs/integrations/promptkit.md.
• Exit commands: focused promptdebug/Promptkit tests plus GOWORK=off go test -race -count=1 ./internal/promptdebug ./internal/adapters/promptkit ./internal/app, then standard commands.

Stage 13: Enforce Generated-Text Identity, Shape, And Size

• Findings: AUD-036, AUD-037, AUD-038.
• Affected areas: generated-text catalog, decoders, schemas, typed validators, Promptkit result handling, and focused tests.
• Work: require report-specific schema/template pairs; reject case-variant properties that schemas reject; and bound prose, arrays, and diagnostic context before allocation or normal error projection.
• Locked behavior: typed normalization, exact registered identities, schema copy isolation, and valid generated content remain unchanged.
• Documentation owners: docs/internal/generatedtext.md, template docs, and Promptkit integration limits where externally relevant.
• Exit commands: focused generated-text/promptassets/app tests including limit boundaries, then the standard repository commands.

Stage 14: Establish One Prepared Metadata Authority

• Findings: AUD-069.
• Affected areas: briefing metadata construction, prepared reports, prompt metadata projection, render-context inputs, and focused app/briefing tests.
• Work: establish one prepared identity/timing source and narrow projections without changing serialized YAML or rendered Markdown.
• Locked behavior: prompt and output bytes for valid fixtures, immutable prepared inputs, and module ordering remain unchanged.
• Documentation owners: docs/internal/prepared-report.md, docs/internal/briefing.md, and docs/internal/prompt-input.md.
• Exit commands: focused briefing/app/promptinput/generatedtext tests, then the standard repository commands.

Stage 15: Enforce Render Identity And Markdown Structure

• Findings: AUD-040, AUD-041, AUD-042.
• Affected areas: render-context builders, repository templates/partials, generated prose insertion, and rendering tests.
• Work: reject conflicting report identities; prevent dynamic prose from impersonating deterministic Markdown structure; and suppress or replace an empty Today daypart section.
• Locked behavior: repository templates remain Markdown owners, deterministic facts remain authoritative, and normal section order remains unchanged.
• Documentation owners: docs/templates.md, docs/internal/generatedtext.md, and docs/internal/reporttemplate.md.
• Exit commands: focused generated-text/reporttemplate/app tests including adversarial heading content, then the standard repository commands.

Stage 16: Move Prompt Compatibility And Provenance Checks Before Work

• Findings: AUD-043, AUD-044.
• Affected areas: application prompt inspection/preparation/execution, generated-text catalog preflight, provenance values, and app tests.
• Work: validate catalog compatibility before collection and reconcile inspected, prepared, callback, completed, and schema identities before accepting generated output.
• Locked behavior: one inspection/preparation, profile precedence, immutable execution copies, and partial execution result ownership remain unchanged.
• Documentation owners: docs/internal/prepared-report.md, docs/internal/app-orchestration.md, and Promptkit integration docs.
• Exit commands: focused app/promptexec/generatedtext tests, then the standard repository commands.

Stage 17: Make Single-Report Publication Type-Safe And Cancelable

• Findings: AUD-045, AUD-046, AUD-047.
• Affected areas: internal/fileutil, app output planning/publication, destination error projection, and filesystem tests.
• Work: reject non-regular final destinations; use bounded temporary naming without leaving new directories on precommit failure; and check cancellation at the rename linearization point.
• Locked behavior: same-directory atomic visibility, preservation of prior regular files, restrictive new-file mode, truthful committed paths, and notification-after-publication remain unchanged.
• Documentation owners: docs/operations.md, architecture policy if an invariant needs clarification, and app orchestration internals.
• Exit commands: focused fileutil/app/CLI filesystem tests plus GOWORK=off go test -race -count=1 ./internal/fileutil ./internal/app ./internal/cli, then standard commands.

Stage 18: Bound And Validate The Distributor Adapter Boundary

• Findings: AUD-048, AUD-049, AUD-050, AUD-052.
• Affected areas: Distributor config validation, repository adapter, pinned client interaction, local HTTP tests, and safe batch diagnostics.
• Work: reject unsupported endpoints before publication; bound response reads; redact or classify remote text before normal results; and exercise the real production HTTP boundary with a local server.
• Locked behavior: exactly-once upload/status mapping, published-file source selection, token redaction, and dependency types remaining adapter-local.
• Documentation owners: docs/config.md, docs/operations.md, docs/internal/distributor-adapter.md, and Distributor integration docs.
• Exit commands: focused config/distributor/app tests including oversized and malicious response bodies, then the standard repository commands.

Stage 19: Preserve Batch Cancellation As A Distinct Outcome

• Findings: AUD-051.
• Affected areas: batch orchestration, result/error types, CLI projection, and cancellation tests.
• Work: stop starting later reports after cancellation and preserve cancellation separately from independent report failures and notification state.
• Locked behavior: collect once, deterministic planned order, continuation after non-cancellation failures, report-only counters, and all-success notification gating remain unchanged.
• Documentation owners: docs/cli.md, docs/operations.md, and docs/internal/app-orchestration.md.
• Exit commands: focused app/CLI tests plus GOWORK=off go test -race -count=1 ./internal/app ./internal/cli, then standard commands.

Stage 20: Tighten Comparison Manifest Compatibility

• Findings: AUD-053, AUD-054.
• Affected areas: comparison JSON decoding, manifest/logical-bundle validation, filename helpers, and compatibility tests.
• Work: reject duplicate and case-variant fields and require each successful report path to equal the canonical ordinal/profile filename.
• Locked behavior: current schema version, deterministic encoding/hashing, flat exact file set, ordered profiles, and bounded recognition errors remain.
• Documentation owners: docs/integrations/comparison-bundle.md and docs/internal/comparison-publication.md.
• Exit commands: focused comparison compatibility tests, then the standard repository commands.

Stage 21: Make Comparison Replacement Cancellation And Recovery Truthful

• Findings: AUD-055, AUD-056, AUD-057.
• Affected areas: comparison planning/publication, backup cleanup/result state, sibling naming, app/CLI recovery projection, and filesystem tests.
• Work: honor cancellation before replacement commit; distinguish a complete retained recovery bundle from a partially removed backup; and fail long-name constraints during preflight without residual directories.
• Locked behavior: post-move authorization, rollback, no forced destructive cleanup, committed-new-bundle truth, and actionable recovery paths remain.
• Documentation owners: comparison bundle/publication docs, operations, and CLI result docs where state representation changes.
• Exit commands: focused comparison/app/CLI tests plus GOWORK=off go test -race -count=1 ./internal/comparison ./internal/app ./internal/cli, then standard commands.

Stage 22: State Executor Concurrency And Preserve Profile Failures

• Findings: AUD-058, AUD-077.
• Affected areas: promptexec.Executor contract, comparison execution/result aggregation, Promptkit adapter, app fakes, and CLI tests.
• Work: document and test concurrent-call substitutability and preserve already-completed profile failures when later command cancellation occurs.
• Locked behavior: one shared executor, one goroutine per explicit profile, provider-owned capacity, joined workers, selection ordering, and no Distributor notification remain unchanged.
• Documentation owners: Promptkit integration and comparison execution/app orchestration internals.
• Exit commands: focused promptexec/Promptkit/app/CLI tests plus GOWORK=off go test -race -count=1 ./internal/adapters/promptkit ./internal/app ./internal/cli, then standard commands.

Stage 23: Make Tests Independent Of Ambient Host State

• Findings: AUD-059, AUD-060.
• Affected areas: Promptkit credential tests and symlink tests in app, promptdebug, and comparison packages.
• Work: explicitly control the credential environment and treat inability to create symlinks as a tested capability prerequisite rather than product failure.
• Locked behavior: real supported-host symlink safety assertions and missing- credential behavior remain fully protected.
• Documentation owners: testing policy only if supported-platform policy is deliberately changed; normally none.
• Exit commands: focused packages under scrubbed and ordinary environments, race-enabled focused tests, then standard commands.

Stage 24: Remove Redundant Assertions And Production Test Waits

• Findings: AUD-061, AUD-062.
• Affected areas: briefing SPC tests, collection wrapper tests, Distributor polling tests, and narrow timing seams.
• Work: remove the private-constant assertion while retaining observable risk behavior; inject only the wait controls necessary to avoid production delays in deterministic tests.
• Locked behavior: production retry/poll intervals and observable SPC policy remain unchanged.
• Documentation owners: none unless a contributor-facing test seam warrants a focused internal note.
• Exit commands: focused briefing/collect/distributor tests with repeated runs, then the standard repository commands.

Stage 25: Make Comparison Test Failure Cleanup Total

• Findings: AUD-064.
• Affected areas: comparison execution test barriers and worker cleanup in internal/app tests.
• Work: release and join workers on timeout, early completion, duplicate start, and every diagnostic exit without weakening liveness detection.
• Locked behavior: production comparison scheduling and five-second deadlock diagnostics remain unchanged.
• Documentation owners: none.
• Exit commands: repeat focused comparison-execution tests and run them with -race, then the standard repository commands.

Stage 26: Remove Redundant Weather Fetches And Safe Serialization

• Findings: AUD-065.
• Affected areas: Weather API bundle acquisition, request-result aggregation, provenance ordering, cancellation, and adapter/collection tests.
• Work: reuse or remove the discarded warmup current response and execute independent source requests concurrently through one deterministic merge.
• Locked behavior: source-local validation/errors, exact source order, required/optional policy, retry policy after Stage 5, and context cancellation remain authoritative.
• Documentation owners: Weather API integration and collection internals if operational request behavior changes materially.
• Exit commands: focused latency/request-count and cancellation tests plus GOWORK=off go test -race -count=1 ./internal/adapters/weatherapi ./internal/collect, then standard commands.

Stage 27: Eliminate Repeated Comparison Bundle Reads

• Findings: AUD-066.
• Affected areas: comparison recognition/planning/publication and app comparison preflight.
• Work: pass or cache only the recognition evidence needed to avoid four full reads while retaining reauthorization at every mutation boundary.
• Locked behavior: early rejection, exact file/type validation, post-move authorization, deterministic hashes, and concurrent destination safety after Stage 21 remain unchanged.
• Documentation owners: comparison publication internals if ownership or transaction phases change.
• Exit commands: focused read-count and adversarial replacement tests plus GOWORK=off go test -race -count=1 ./internal/comparison ./internal/app, then standard commands.

Stage 28: Consolidate Distributor Template Parsing

• Findings: AUD-068.
• Affected areas: single and batch notification template rendering and config tests.
• Work: extract one private grammar/parser with typed callbacks while preserving each template family's variable allowlist and error context.
• Locked behavior: accepted syntax, rejected malformed forms, exact rendering, and single-versus-batch policy remain unchanged.
• Documentation owners: none unless the user-visible grammar changes, which is outside this behavior-preserving stage.
• Exit commands: focused config tests, then the standard repository commands.

Stage 29: Centralize Fact Requirement Policy

• Findings: AUD-070.
• Affected areas: module requirement vocabulary, briefing definitions, availability checks, constructor validation, and tests.
• Work: define requirement identity/category/predicate once while leaving each module's requirement list and missing-data policy explicit.
• Locked behavior: all current compositions, supported reports, availability, and diagnostic identity remain byte-for-byte or semantically unchanged.
• Documentation owners: module and briefing internals if ownership changes.
• Exit commands: focused module/briefing/config tests, then the standard repository commands.

Stage 30: Consolidate CLI Report-Date Policy

• Findings: AUD-071.
• Affected areas: generate/comparison flag registration and date resolution, CLI parser/action tests, and private CLI descriptors.
• Work: establish one private report-date policy/resolver used by both actions after Stage 4 has locked corrected behavior.
• Locked behavior: accepted flags, required/default dates, action-specific errors, and request types remain unchanged.
• Documentation owners: none unless implementation reveals a current contract mismatch; CLI docs remain authoritative.
• Exit commands: focused CLI parser/action tests and help commands, then the standard repository commands.

Stage 31: Retire Dormant Compatibility And Persistence Surfaces

• Findings: AUD-072.
• Affected areas: unused prompt YAML loading/saving, Weather API bundle saving, JSON atomic helper if orphaned, module snapshot compatibility implication, forecast threshold exports, full alert envelope copies, normalized generated JSON returns, and sole-purpose tests/docs.
• Work: remove the no-owner surfaces identified by the audit. If an actual production consumer appears before implementation, stop this stage and replace the retirement with a separately approved narrow contract; do not retain speculative compatibility.
• Locked behavior: normal Build/Validate/MarshalYAML, report publication, comparison bundles, prompt debugging, alert item provenance, real forecast decisions, typed normalization, and all workflows remain unchanged.
• Documentation owners: affected focused internal documents; remove stale descriptions rather than documenting retired APIs.
• Exit commands: graph/text caller checks showing no remaining references, focused affected package tests, then the standard repository commands.

Stage 32: Consolidate Generated-Text Test Ownership

• Findings: AUD-039.
• Affected areas: generated-text day-style and render-context tests, promptassets schema tests, and reporttemplate tests.
• Work: keep one shared semantic suite plus thin report-identity cases; put schema ownership in promptassets and Markdown ownership in reporttemplate; retain one real typed-context render integration.
• Locked behavior: every public validator identity, distinct Hourly behavior, schema/type agreement, typed projection, template semantics, and composition remain protected.
• Documentation owners: none.
• Exit commands: focused promptassets/generatedtext/reporttemplate tests, then the standard repository commands.

Stage 33: Reconcile Stale Internal Implementation Guides

• Findings: AUD-075.
• Affected areas: forecast derivation, collection, report registry, and prompt- input internal guides plus incoming links.
• Work: replace nonexistent API/flow/test claims with concise descriptions of the implemented owners and link to canonical contracts instead of duplicating volatile details.
• Locked behavior: documentation-only; no executable contract changes.
• Documentation owners: the four affected docs/internal/ files and docs/development.md only if task routing changes.
• Exit commands: repository link/fence checks, focused test inventories used to verify claims, GOWORK=off go test -count=1 ./..., and git diff --check.

Stage 34: Retire Completed Comparison Roadmaps

• Findings: AUD-076.
• Affected areas: docs/roadmap/profile-comparison.md, docs/roadmap/implementation.md, and all incoming links.
• Work: verify useful implemented contracts have one durable canonical owner, repair incoming navigation, then remove the completed roadmaps so they no longer duplicate current behavior.
• Locked behavior: documentation lifecycle only; no code, tests, dependencies, schemas, or current contracts change.
• Documentation owners: CLI, operations, comparison integration/publication, comparison execution, Promptkit integration, architecture, and development docs only where an incoming link or missing durable fact requires correction.
• Exit commands: repository link/fence checks, both CLI help commands, GOWORK=off go test -count=1 ./..., and git diff --check.

Stage 35: Close Remediation And Retire Audit Records

• Findings: none; this is the roadmap lifecycle gate.
• Prerequisite: Stages 1-34 are complete and every referenced finding's tests and canonical documentation have landed.
• Affected areas: docs/roadmap/audit.md, audit-plan.md, this roadmap, and incoming links.
• Work: verify every finding is resolved, superseded, or explicitly moved to a newly approved roadmap; move any durable rationale to its canonical owner; verify no active work or incoming link depends on these coordination files; then remove the temporary audit plan, ledger, and this roadmap in the final lifecycle change.
• Locked behavior: documentation lifecycle only; do not rewrite historical ADRs or release notes and do not create a second current-state reference.
• Documentation owners: all durable owners touched by earlier stages, solely to fill a demonstrated ownership gap.
• Exit commands: repository link/fence and secret-pattern checks; all focused stage exits; GOWORK=off go test -count=1 ./..., GOWORK=off go test -race -count=1 ./..., both CLI help commands, GOWORK=off go vet ./..., and git diff --check.

Completion Tracking

Update a stage heading or add a concise completion note only after its code, tests, canonical documentation, and exit commands pass together. Do not copy implemented contracts into this roadmap. When all work is complete, follow Stage 35 rather than retaining this file as a parallel reference.