docs(audit): 2026-09-07 constitution-vs-reality audit — zero drift

[rosscado]

Why

Monthly constitution-vs-reality audit per doc/constitution-audit.md (#535), fired by the now-active monthly cloud routine (doc/scheduled-routines.md, ACTIVE since 2026-09-06). Second run overall, first automated one — the July run (doc/audit-reports/2026-07-07.md) was manual.

What

doc/audit-reports/2026-09-07.md, executed end-to-end against origin/main@a909676:

• Lens (a) — governance docs vs reality: PASS. Every standing grant, gate, and load-bearing claim in AGENTS.md verified — labels, workflows, the merge gate, the founder-gated path enumeration (now aligned with path-guard-lib.mjs exactly, closing the forward-note the July report left for PR safety: path-guard — mechanical check for founder-gated paths (#530) #539), the spend ledger/caps, every referenced doc, every npm alias, the .cursor/rules staleness warning, doc/scheduled-routines.md's self-description.
• Lens (b) — Layer-3 harness health: PASS. npm ci, npm run e2e:build, and full npm test (3024 passed/1 skipped) all green locally. The full Playwright test:e2e run could not complete in this session's sandbox — a stale pre-baked Chromium revision (1194) vs the one @playwright/test@1.60.0 pins (1223), an environment-provisioning gap, not a repo defect — but the required e2e CI check is success on the last 8 consecutive pushes to main, and July's one drift finding (e2e/README.md spec inventory documents 7 of 12 Layer-3 specs — 5 undocumented #551, spec-inventory coverage) is now enforced by an automated Vitest guard (test/e2e/readme-spec-inventory.spec.ts, ran directly: 5/5 passing).
• Lens (c) — Layer-4 + ops tooling (static only): PASS. Every harness script, subcommand, flag, and target list matches its documentation exactly; release:status/release:freshness both degrade cleanly to SKIPPED with no credentials present, as documented.

Verdict: zero genuine drift. No issues filed. 3 issues (#652, #556, #554) are correctly in-flight behind awaiting-founder and are listed in the report, not filed as findings.

Verification

• npm ci && npm run e2e:build — clean.
• npm test — 262 files, 3024 passed / 1 skipped, type-check clean.
• npx vitest run test/e2e/readme-spec-inventory.spec.ts — 5/5 passed.
• node scripts/l4-ledger.mjs report, npm run release:status -- --json, npm run release:freshness -- --json — all ran clean.
• A diagnostic-only local edit to e2e/fixtures/extension.ts (to isolate the Playwright browser-mismatch cause) was reverted before commit; git status was clean prior to staging the report.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Hj6iM8GodEG1SEXsmmpg1M

---

Generated by Claude Code

[rosscado]

Independent subagent review: APPROVE. Spot-checked claims across all three lenses against live repo/GitHub state (path-guard pattern list, label colors/descriptions, npm aliases, ledger caps, e2e CI history, spec counts, sweep target lists) — all matched exactly. Confirmed e2e/fixtures/extension.ts is byte-identical to main (the diagnostic edit-and-revert during the local Playwright run left no trace). One non-blocking wording nit (section header phrasing vs. the procedure doc's exact wording) — not worth blocking on.

CI green on all 5 checks (test (22.x), e2e, e2e-firefox, path-guard, gitleaks). Merging per the constitution's self-merge grant (normal-gate docs PR, no code changes).

---

Generated by Claude Code