audit: Phase 0 skeleton + baseline results

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

AUDIT-2026-06-13.md

@@ -0,0 +1,77 @@
+# AUDIT — felhom-controller deep sweep — 2026-06-13
+
+**Branch:** `audit/2026-06-13-deep-sweep`
+**Auditor:** Claude Code (unattended overnight session)
+
+| Repo | HEAD commit | Note |
+|---|---|---|
+| felhom-controller | `76a570da3284a742829cfeabe588255e3c74095f` | v0.51.0 (2026-06-12) — all findings cite this commit |
+| felhom-agent (reference) | `716cbcd70500602f80a3e71869308a171396f1b6` | v0.28.0 |
+| felhom.eu / hub (reference) | `d59691dd826a901da39562aeaa5d989b8ea1a7ee` | hub v0.11.0 |
+
+**Tooling:** go1.26.0 windows/amd64; staticcheck (latest, installed this session); go vet.
+**Prior art:** `BUGHUNT.md` (2026-02-25, v0.30.3) read in full — findings there are NOT re-reported unless regressed; note that many BUGHUNT items refer to packages deleted in slice 8C.
+
+## Progress log
+
+- 2026-06-13 ~00:05 — Phase 0 start: repos pulled, branch created, baseline run.
+- (in progress)
+
+## Baseline (Phase 0)
+
+| Check | Result |
+|---|---|
+| `go build ./...` | PASS |
+| `go vet ./...` | PASS (clean) |
+| `gofmt -l .` | ~75 files flagged — **all CRLF noise** from `core.autocrlf=true` on this Windows checkout; `gofmt -d` shows whitespace-only diffs. Not a code finding; see Info section (missing `.gitattributes`). |
+| `go test ./...` | **1 pre-existing FAIL**: `TestBackupCopiesOnPath` (internal/web/storage_handlers_test.go:295) — see findings. |
+| staticcheck | 17 reports — triaged in Phase 1. |
+
+## Executive summary
+
+(to be written in Phase 6)
+
+## Top-10 action list
+
+(to be written in Phase 6)
+
+## Findings — Critical / High
+
+(pending)
+
+## Findings — Medium / Low
+
+(pending)
+
+## Findings — Info
+
+(pending)
+
+## Contract checks (controller↔agent, controller↔hub)
+
+(pending)
+
+## Invariant checklist results
+
+(pending)
+
+## Refactor & shared-code opportunities
+
+(pending)
+
+## Test-gap analysis
+
+(pending)
+
+## Dead code inventory
+
+(pending)
+
+## Session notes, assumptions, open questions
+
+- Session is unattended; conservative assumptions recorded inline.
+- gofmt noise: repo is checked out with CRLF (`core.autocrlf=true`); `gofmt -l` flags nearly every file. Treated as environment artifact.
+
+## What was NOT covered
+
+(to be written honestly in Phase 6)