# AUDIT — felhom-controller deep sweep — 2026-06-13

**Branch:** `audit/2026-06-13-deep-sweep`
**Auditor:** Claude Code (unattended overnight session)

| Repo | HEAD commit | Note |
|---|---|---|
| felhom-controller | `76a570da3284a742829cfeabe588255e3c74095f` | v0.51.0 (2026-06-12) — all findings cite this commit |
| felhom-agent (reference) | `716cbcd70500602f80a3e71869308a171396f1b6` | v0.28.0 |
| felhom.eu / hub (reference) | `d59691dd826a901da39562aeaa5d989b8ea1a7ee` | hub v0.11.0 |

**Tooling:** go1.26.0 windows/amd64; staticcheck (latest, installed this session); go vet.
**Prior art:** `BUGHUNT.md` (2026-02-25, v0.30.3) read in full — findings there are NOT re-reported unless regressed; note that many BUGHUNT items refer to packages deleted in slice 8C.

## Progress log

- 2026-06-13 ~00:05 — Phase 0 start: repos pulled, branch created, baseline run.
- (in progress)

## Baseline (Phase 0)

| Check | Result |
|---|---|
| `go build ./...` | PASS |
| `go vet ./...` | PASS (clean) |
| `gofmt -l .` | ~75 files flagged — **all CRLF noise** from `core.autocrlf=true` on this Windows checkout; `gofmt -d` shows whitespace-only diffs. Not a code finding; see Info section (missing `.gitattributes`). |
| `go test ./...` | **1 pre-existing FAIL**: `TestBackupCopiesOnPath` (internal/web/storage_handlers_test.go:295) — see findings. |
| staticcheck | 17 reports — triaged in Phase 1. |

## Executive summary

(to be written in Phase 6)

## Top-10 action list

(to be written in Phase 6)

## Findings — Critical / High

(pending)

## Findings — Medium / Low

(pending)

## Findings — Info

(pending)

## Contract checks (controller↔agent, controller↔hub)

(pending)

## Invariant checklist results

(pending)

## Refactor & shared-code opportunities

(pending)

## Test-gap analysis

(pending)

## Dead code inventory

(pending)

## Session notes, assumptions, open questions

- Session is unattended; conservative assumptions recorded inline.
- gofmt noise: repo is checked out with CRLF (`core.autocrlf=true`); `gofmt -l` flags nearly every file. Treated as environment artifact.

## What was NOT covered

(to be written honestly in Phase 6)