Codebase Audit — Post-E.3 Reality Check
What the repository can now defend after the Core-first pivot, what remains documentation or ops follow-up, and where paper claims should anchor.
TL;DR
The important change since the earlier audit pass is that the repository no longer tells two competing architectural stories. The Core-first pivot is now reflected in runtime code, route ownership, audit persistence, type vocabulary, and public docs. That does not mean every follow-up task is done, but it does mean the central scientific claim is now simpler and more honest: AIJIM Core is the normative execution, governance, and audit substrate, while LINA is the interaction and voice runtime layered on top of it.
For papers and formal scope statements, the canonical citation anchor remainsservices/aijim-core/CORE_SCOPE.md. This page is the human-readable audit summary of where the code now stands after blocks E.1, E.2, E.3, the docs sweeps, and the post-E.3 ops audit.
Verdict Dashboard
| Audit area | Verdict | Current reality |
|---|---|---|
| Core-first runtime ownership | Substantially complete | Normative audit writes now sit in `services/aijim-core`; LINA consumes Core through proxies instead of maintaining a parallel target architecture. |
| Paper-facing invariant story | Defensible | Canonical I1-I5 mapping, error-code surface, and enforcement loci are aligned across `CORE_SCOPE.md`, docs, and audit runbooks. |
| Formal RFC completeness | Now materially aligned | The TeX RFC corpus now includes RFC-011 and RFC-012, so the remaining gaps are follow-up quality work rather than missing architecture formalization. |
| Operational hygiene | Mostly clean | Workflow secret references, post-E.3 audit notes, historical numbering reconciliation, and docs alignment are in repo; GitHub secret verification and staging migration repair remain operator tasks. |
What changed after E.3
What Is Now Defensibly Implemented
| Area | Primary anchor | Why it matters |
|---|---|---|
| Core-owned audit surface | `/workspaces/{workspace_id}/audit/{replay,publications,signature-envelopes,signers}` in `services/aijim-core/src/api/routers/` | The normative writer is now Python/Core, not TypeScript route code. |
| LINA/Core boundary | `documentation/runbooks/LINA_CORE_BOUNDARY_CONTRACT.md` and `apps/docs/src/app/architecture/lina-core-boundary/page.tsx` | The ownership split is explicit and frozen against silent drift. |
| Type vocabulary alignment | `AuditReplayRecord`, `AuditPublication`, `AuditSignatureEnvelope`, `AuditSignerRegistryEntry` in TypeScript | Audit entities now use the same conceptual names across Core, docs, and app code. |
| Portable verification / audit semantics | `documentation/runbooks/LINA_AUDIT_CROSSREFS.md`, `audit_bundle.py`, replay/publication/envelope routes | Operational codes P0001-P0008 are grounded in live runtime behavior, not only planning text. |
| Architecture truth in docs | `apps/docs/src/app/architecture/*`, `developer/*`, `science/reference-model` | Public-facing docs now describe the actual post-E.3 runtime instead of the pre-pivot split stack. |
What Is Still Follow-Up Work
| Gap | Category | Current status |
|---|---|---|
| Coverage restoration to 95% | Test hygiene | Core coverage is intentionally held at 92% during consolidation and still needs the targeted Block Y follow-up. |
| Staging migration metadata reconcile | Ops metadata | The staging schema is correct, but direct SQL application left a `supabase migration repair` follow-up for metadata consistency. |
| Live proxy smoke in CI | Operational confidence | The reusable app workflow now references all four relevant secrets, but the next PR run is the final proof that secret injection is complete in GitHub Settings. |
Publication-Grade Reading of the Repo
If you are reading the codebase as a paper reviewer, the honest posture is now stronger than before. The repository no longer depends on the reader mentally reconciling a Python truth model with a separate TypeScript audit writer. Core owns the normative audit ingress, the docs say so, the type system says so, and the runbooks say so.
The remaining caveats are narrower: not whether the architecture is real, but whether the formal RFC corpus and top-end coverage target have fully caught up. Those are important, but they are follow-up blocks on top of a coherent runtime, not warning signs that the central design is still hypothetical.