claude-file-auditlisted

# Claude-file audit These files are the repo's instructions to future sessions, and **almost nothing in CI checks a word of them**. A rule that quietly stopped being true is worse than no rule: it reads authoritative and sends the next session down a path that no longer exists. Finding those is the main job. ## Scope `CLAUDE.md`, everything committed under `.claude/` (rules, skills, `launch.json`), the five root documents — **`README.md`, `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, `LICENSE`** — and the committed **community-health files under `.github/`**: `ISSUE_TEMPLATE/` (the issue forms and `config.yml`), `PULL_REQUEST_TEMPLATE.md` and `FUNDING.yml`. All of them are in scope because **no other skill owns them** and they drift the same way: `legal-audit` covers the published legal pages and `docs/legal/`, `security-audit` covers code controls (it *cites* `SECURITY.md` as a norm without ever checking it), and `implement`/`review-pr` *consume* `CONTRIBUTING.md`'s DCO rule rather than auditing it. They are also the highest-stakes drift in the repo: `SECURITY.md` calibrates how an external reporter rates a vulnerability, and it spent the days after the 2026-07-24 go-live telling researchers registration was closed and the user data wasn't public. The `.github/` files joined on 2026-07-26, when they were created. They are contributor-facing rather than agent-facing, but they fail in the same silent way — a PR-template checklist that has drifted from the real m