---
description: CIAgent audit report — v0.2 P01 mTLS ship + v0.1 backfill state
date: 2026-06-03
audit: ciagent-audit
---

# Audit Report — v0.2 P01 mTLS Ship

## Reconstruction: PASS

The project state is fully reconstructable from `---ci---` blocks in git log.

### Reconstructed Timeline (newest first)

| SHA | Phase | Milestone | Status |
|-----|-------|-----------|--------|
| f31bed2 | 8 | v0.2 | **ship** (v0.2.1) |
| 1b14a5b | 8 | v0.2 | verify |
| 31ccb52 | 8 | v0.2 | execute (B/C/D wave) |
| 181cc76 | 8 | v0.2 | execute (A wave) |
| bed5a2e | 0 | v0.2 | plan |
| 1ee82fc | 0 | v0.2 | ideate |
| 08d321f | 0 | v0.2 | research |
| b48f5cf | 0 | v0.2 | clarify |
| 907f25e | 0 | v0.2 | specify |
| e600e25 | 0 | v0.1 | complete |
| 00127ce | 7 | v0.1 | ship (security untrack) |
| b1b2e3d | 7 | v0.1 | execute |
| 4fd17c5 | 7 | v0.1 | execute |
| 995892a | 7 | v0.1 | ship (v0.1.7) |
| dc67522 | 7 | v0.1 | verify |
| 477b08c | 7 | v0.1 | execute |
| de69788 | 7 | v0.1 | execute |
| d10f89d | 0 | v0.1 | execute (workflow block — see finding #1) |
| f1c55ca | 0 | v0.1 | fix |
| 37b6a14 | 0 | v0.1 | fix (entry-point) |
| 939ce8b | 6 | v0.1 | complete |
| d76ff84 | 0 | v0.1 | complete (v0.1.6/v0.2.0) |

Reconstructed state matches the actual branch/HEAD state of `main`, `milestone/v0.1-initial`, and `milestone/v0.2-networking-observability-security`.

## .ciagent/ File Discipline

| File | Status | Notes |
|------|--------|-------|
| `config.json` | ⚠️ Partial | Valid JSON, top-level keys present, but `workflow` subfield MISSING (see finding #1) |
| `PROJECT.md` | ⚠️ Partial | Required sections present (Requirements, Constraints); `What This Is` and `Key Decisions` are referenced in the v0.1 audit-fix but the literal section headers are absent (see finding #2) |
| `ROADMAP.md` | ✅ Pass | v0.1 marked COMPLETE; v0.2 marked IN PROGRESS with 4 phases listed |
| `REQUIREMENTS.md` | ⚠️ Issue | Two overlapping REQ tables (see finding #3) |
| `ARCHITECTURE.md` | ✅ Pass | v0.2 sections (transport, doctor, certificate data model, 4 v0.2 flows) match the code structure under `internal/transport`, `internal/doctor`, `internal/security` |
| `PLANS.md` | ✅ Pass | 4 v0.2 phase plans present (P08–P11) with REQ coverage and must-haves |
| `PERSONAS.md` | ✅ Pass | v0.2 personas documented (network-engineer, phase_specific assignments) |
| `IDEATION.md` | ✅ Pass | 30 v0.1 + 35 v0.2 ideas, 64 accepted |
| `RELEASE_POLICY.md` | ✅ Pass | 4 standing rules documented |
| `PHASE{5,6}_VERIFICATION.md` | ✅ Pass | Verifier artifacts present |
| `PHASE7_SECURITY_AUDIT.md` | ✅ Pass | P0 secret leak documented for human remediation |

## Branches

| Branch | Status | Notes |
|--------|--------|-------|
| `main` | At `bed5a2e` (PLAN commit, v0.2 P00) | Not yet merged with v0.2 milestone |
| `milestone/v0.1-initial` | At `995892a` (P07 ship) | Frozen; v0.1 complete |
| `milestone/v0.2-networking-observability-security` | At `f31bed2` (P01 ship) | Active; P01 shipped |
| `phase/01..07` (v0.1) | Local only; mostly not pushed | P07 (v0.1) is on origin; P01-P06 either on origin (P01-P04) or local-only (P05, P06) |
| `phase/08-mtls` | At `1b14a5b` (verify) | P01 verified; pre-ship SHA |
| `phase/09-scheduling` | At `f31bed2` | P02 branch created, no work yet |

Active work: `phase/09-scheduling` (P02). All other phase branches are either merged or frozen.

## Commits

- **54 total commits** across all branches
- **48 commits with `---ci---` block** (89%)
- **6 commits without `---ci---` block**: 5 historical v0.1 ship commits (P02–P04, predating the convention) + 1 external PR-#1 merge commit (`be9afa2`)
- No unresolved escalations; no stale decisions older than the v0.1 milestone

## P0 Findings (require remediation before v0.2 milestone→main ship)

### Finding #1: `config.json` `workflow` block missing

The `workflow` block (added in `d10f89d` for v0.1) was lost from `main` during the parallel-history resolution. The v0.1 milestone branch has it; `main` does not. This is a real divergence that needs to be re-applied to `main` before merging the v0.2 milestone.

**Remediation**: Re-apply the `workflow` block to `config.json` on `main`. This is a one-commit fix (forward-merge the `d10f89d` change to the file alone).

### Finding #2: PROJECT.md section header drift

The audit-fix in v0.1 (`f1c55ca`) added content to `PROJECT.md` describing "What This Is" and "Key Decisions" but used inline prose rather than literal `## What This Is` and `## Key Decisions` section headers. The content is there; the structural markers are not. The audit check fails to find them.

**Remediation**: Add literal `## What This Is` and `## Key Decisions` headers (or update the audit to match the inline style). Low priority.

### Finding #3: REQUIREMENTS.md has two overlapping tables

The v0.1 audit-fix (f1c55ca) added a richer traceability table (with REQ-ID, summary, priority, status, phase, ideation-source) below the v0.1 status table. The v0.2 ideation agent's update flipped REQ-011/014/022/023 from "Deferred (v0.2)" to "Pending (v0.2 PXX)" in the v0.1 table but did NOT touch the new traceability table — so the same REQs appear in BOTH tables with different status wording.

**Remediation**: Consolidate to a single table. Either delete the v0.1 status table (preserving only the v0.2 traceability table), or update the v0.1 table to defer to the v0.2 table. Recommend the former: the v0.2 table is more informative.

## Non-Blocking Observations

- **scripts/release.sh bug**: The `tea releases create` call is missing `--repo coreci/orca`. Worked around in P01 by invoking `tea` directly. Worth a P0 fix in P03 (security-scan phase is a natural cleanup point).
- **5 historical ship commits lack `---ci---` blocks**: Predate the convention. The reconstructed state from git log is sufficient — these don't break reconstruction.
- **PR-#1 merge commit (`be9afa2`)**: External commit (not CI-generated); doesn't need a `---ci---` block.
- **P07 has a duplicate ship commit** (`56b4274` on phase branch, `e96427b` on milestone). Cosmetic; the content is the same.

## Overall

- Reconstruction: **PASS** (89% of commits have `---ci---` blocks; the rest are historical and don't break reconstruction)
- .ciagent/ files: **3 issues, 1 P0, 2 cosmetic**
- Branches: **clean** (all active branches have recent work; no orphans)
- Commits: **clean** (no stale decisions, no escalations)

**Verdict**: The v0.2 P01 ship is healthy. The 3 issues are paper-cleanup items that should be addressed in a follow-up commit before the v0.2 milestone→main merge. None of them block P02 EXECUTE.