felhom-controller/AUDIT-2026-06-13.md

AUDIT — felhom-controller deep sweep — 2026-06-13

Branch: audit/2026-06-13-deep-sweep Auditor: Claude Code (unattended overnight session)

Repo	HEAD commit	Note
felhom-controller	76a570da3284a742829cfeabe588255e3c74095f	v0.51.0 (2026-06-12) — all findings cite this commit
felhom-agent (reference)	716cbcd70500602f80a3e71869308a171396f1b6	v0.28.0
felhom.eu / hub (reference)	d59691dd826a901da39562aeaa5d989b8ea1a7ee	hub v0.11.0

Tooling: go1.26.0 windows/amd64; staticcheck (latest, installed this session); go vet. Prior art: BUGHUNT.md (2026-02-25, v0.30.3) read in full — findings there are NOT re-reported unless regressed; note that many BUGHUNT items refer to packages deleted in slice 8C.

Progress log

• 2026-06-13 ~00:05 — Phase 0 start: repos pulled, branch created, baseline run.
• (in progress)

Baseline (Phase 0)

Check	Result
go build ./...	PASS
go vet ./...	PASS (clean)
gofmt -l .	~75 files flagged — all CRLF noise from core.autocrlf=true on this Windows checkout; gofmt -d shows whitespace-only diffs. Not a code finding; see Info section (missing .gitattributes).
go test ./...	1 pre-existing FAIL: TestBackupCopiesOnPath (internal/web/storage_handlers_test.go:295) — see findings.
staticcheck	17 reports — triaged in Phase 1.

Executive summary

(to be written in Phase 6)

Top-10 action list

(to be written in Phase 6)

Findings — Critical / High

(pending)

Findings — Medium / Low

(pending)

Findings — Info

(pending)

Contract checks (controller↔agent, controller↔hub)

(pending)

Invariant checklist results

(pending)

Refactor & shared-code opportunities

(pending)

Test-gap analysis

(pending)

Dead code inventory

(pending)

Session notes, assumptions, open questions

• Session is unattended; conservative assumptions recorded inline.
• gofmt noise: repo is checked out with CRLF (core.autocrlf=true); gofmt -l flags nearly every file. Treated as environment artifact.

What was NOT covered

(to be written honestly in Phase 6)