codebase-auditlisted

# codebase-audit `debugger` audits a diff. This audits **a system**. The output is a ranked, ticketed backlog — not an essay. ## Step 1 — Boundary and baseline Before reading code, write down: - Repo, branch, commit SHA under audit - What's in scope (packages, apps, services) and what's explicitly out - What evidence will count — the commands you'll run - Baseline: does it build? do tests pass? how long does the suite take? ```powershell git log --oneline -5; git status -sb ``` Run build + typecheck + full suite **once**, up front, and record the real output. An audit that starts without a baseline can't tell pre-existing rot from new damage. ## Step 2 — Map before judging Produce a one-screen map: entry points, major modules, data stores, external providers, auth boundary, deploy target. You cannot rank blast radius without knowing what's downstream of what. ## Step 3 — Sweep layer by layer For each layer, look for the specific things that layer gets wrong: **Entry points** (routes, handlers, CLI, jobs, webhooks) — unvalidated input; missing authz at the *real* entry rather than the UI; no timeout; unbounded payloads. **Domain / business logic** — logic leaking into controllers or UI; vocabulary drift from the glossary/ADRs; invariants asserted in comments instead of code; primitive obsession where a type would prevent a class of bug. **Data layer** — missing constraints/indexes; N+1 queries; transactions that don't wrap what they claim; migrations that aren't r