Systemic audit (Fable 5): 6 findings, 4 executor-ready plans [skip release]

[Livingooal]

What this is

A whole-repository systemic audit of Hoplight at 80451e6 (v0.1.13), run with the
grumpy-systemic-audit skill in audit standard direct mode (conductor-only, no shards), plus
four executor-ready implementation plans. This PR adds planning artifacts only under
audit-plans/; no source, docs, or config files are touched.

AI model disclosure (per CONTRIBUTING.md): Claude Fable 5 (claude-fable-5). This is the
Fable half of a two-model benchmark; a parallel session runs the same skill on another branch.

Scope exclusion: security and privacy categories were explicitly excluded by the operator.
Silence on them is not a clean bill.

Verification baseline

• bun run typecheck: clean
• bun run test: 2250 pass / 1 skip / 0 fail (5.3s)

Findings (all conductor-verified against source; key ones live-reproduced)

ID	Sev	Finding	Proof
CORR-01	HIGH	hoplight convert cannot convert regex or preset files (5 regex + 4 preset adapters are registered and advertised); the error blames "different entity kinds" for a same-kind request. The studio export path already does this correctly, so it is pure CLI wiring rot.	live-proven, both repros exit 1
GATE-01	MED	bun test rewrites docs/FORMAT-SUPPORT.md via an import-time side effect in scripts/format-matrix.ts; since verify:ci runs tests before matrix:check, the stale-matrix gate can never fail in CI, and every dev test run dirties the tree.	live-proven
DOCS-01	MED	AGENTS.md-mandated reading (docs/02, 03) describes the unbuilt vaudeville-studios/vaud product; the committed, auto-generated FORMAT-SUPPORT.md instructs four bun run vaud ... commands that all fail on paste.	live-proven
UX-01	MED	Entity files that fail to read are silently skipped by StudioStore.list(): a damaged card vanishes from the library with no signal the bytes still exist.	code-read
TEST-01	MED	No conversion-wiring test covers non-character kinds, which is how CORR-01 shipped twice (preset, then regex).	code-read
PERF-01	LOW	Library list/portrait re-parse full entity JSON incl. base64 carriers; measured 88ms/40 heavyweight cards, linear in library bytes. Recorded as not worth fixing yet.	measured

Rejected candidates (registry detect hardening, switch-system concerns, atomic-write layer, lore
engine spot checks) are recorded with evidence in audit-plans/AUDIT.md; the version-switch and
atomic-write layers came out clean and are called out as such.

Plans

Plan	Outcome	Effort
001	Generic same-kind path in convertFile + registry-wide conversion sweep test	S-M
002	Entry-guard scripts/format-matrix.ts so tests stop writing docs and matrix:check really gates	S
003	Planning-era preambles on docs/02+03, fix the generated usage block to bun run hoplight, add --strict to built-in help	S
004	listDamaged() + /api/studio/damaged + a library notice band for unreadable files	M

Recommended order: 002, 001, 003, 004. Each plan carries exact anchors, RED/GREEN gates, live
journeys, done criteria, STOP conditions, and rollback notes; they are written for a
context-poor executor.

Adversarial review

A blind fresh-context reviewer (also Fable 5, no shared conversation state) opened every cited
file:line, independently re-reproduced CORR-01 and DOCS-01 live, and tried to falsify each root
cause. It returned REVISE on all six artifacts: 0 CRITICAL, 5 MAJOR, 6 MINOR defects, the sharpest
being that my original DOCS-01 under-scoped the stale-naming class (docs/README.md itself says
"Its engine and CLI are called vaud") and that plan 004 leaned on a shared notice component that
does not exist. Every objection was conductor-verified, held, and is revised into the committed
artifacts; the full reviewer report is posted as a comment below, and AUDIT.md records the
before/after.

Notes for the maintainer

• Suggest [skip release] in the squash/merge commit message (per CONTRIBUTING.md this marker
  must be in the landing commit itself); this PR is planning artifacts only.
• The one dirty file this branch does NOT touch: docs/FORMAT-SUPPORT.md regenerates its date
  stamp on every bun test run in any checkout; that is finding GATE-01, fixed by plan 002.

[Livingooal]

Adversarial review record (blind fresh-context reviewer, Claude Fable 5)

Posted verbatim for transparency; the committed artifacts already incorporate every objection below. Initial verdicts were REVISE on all six artifacts with 0 CRITICAL / 5 MAJOR / 6 MINOR defects; the conductor re-verified each objection against source before revising.

Verdicts (pre-revision)

Artifact	Verdict
AUDIT.md	REVISE
README.md	REVISE (minor)
Plan 001 (regex/preset CLI)	REVISE (near-shippable)
Plan 002 (matrix gate)	REVISE (minor)
Plan 003 (front-door docs)	REVISE (weakest artifact)
Plan 004 (damaged entities)	REVISE

All four finding mechanisms were confirmed; the reviewer independently reproduced CORR-01 and DOCS-01 live and verified GATE-01's and UX-01's citations.

MAJOR defects (all fixed in the committed artifacts)

• M1: DOCS-01 root cause overstated: docs/README.md:50-53 already labels 01/02/03 as founding planning docs; the audit missed that file, which itself claims "Its engine and CLI are called vaud" (docs/README.md:13) and vaud ui (docs/README.md:39).
• M2: Plan 003's outcome was not delivered by its steps: vaud label at scripts/format-matrix.ts:80, vaud ui in docs/README.md, and vaud commands at docs/ROADMAP.md:81-82 all survived the original plan; its done criterion grepped only for the one instance the auditor had found.
• M3: Plan 003's maintainer-signal STOP condition was already triggered at planning time by docs/README.md:51 calling 03-CONVENTIONS "the binding code and process conventions", and the plan never had the executor read that file.
• M4: Plan 004 relied on a shared notice/banner component family that does not exist; the only cataloged notice is workbench-local (WorkshopNotice) and Settings hand-rolls local classes, so the original UI step was unimplementable without violating app isolation.
• M5: Plan 001's "diff touches only two files" done criterion was unsatisfiable before Plan 002 lands, because bun run test rewrites docs/FORMAT-SUPPORT.md (the audit's own GATE-01).

MINOR defects (all fixed)

• m1: Plan 002 claimed verification evidence about generator tests that do not exist (docs-index/fields/figures have no tests).
• m2: Plan 002's code shape missed that the module-scope row helper is typed off typeof found and must be retyped.
• m3: Plan 001 cited two format-id line anchors off by a few lines (marinara-regex is index.ts:64; the ST preset id is preset.ts:19/25).
• m4: Plan 003 falsely claimed AGENTS.md restates the testing law; demoting 03-CONVENTIONS wholesale would have orphaned the deterministic-test law.
• m5: An untracked local CLAUDE.md was cited as repo authority; it is absent at 80451e6.
• m6: Plan 004 named a fake-backend test exemplar in store.test.ts, which actually uses real mkdtemp temp dirs (the fake handle tree lives in the OPFS twin's test).

What the reviewer tried to falsify and could not

• CORR-01: reran both CLI conversions; exact self-contradictory error, exit 1. Verified convertFile branches/throw lines, the server-engine generic export path byte-for-byte, adapter contract lines, fixtures, and that convertFile's only callers are cli.ts and its test.
• GATE-01: verified the module-scope side effects, the test import, the verify:ci ordering, ci.yml, and the predicted date-only dirt in the worktree; proved the plan's subprocess RED-test mechanism works without writes.
• DOCS-01: reran bun run vaud formats (fails) and bun run hoplight -- formats (works); verified every quoted doc line.
• UX-01: verified the silent catch-continue, the error collapse, the eight required schema groups, and that StudioStore.list has exactly one caller.
• Rejected-ledger claims: reran the 28-adapter garbage-input probe (0 throws); confirmed the saveBundle comment-vs-mutation nit; confirmed .tmp-file exclusion via the path policy's leading-character rule.
• Prose gates: all six artifacts clean of em dashes, en dashes, and emoji.

Accepted as reported (not independently verifiable read-only): the 2250-test baseline numbers and PERF-01's millisecond measurements (all its code citations checked out).