platform-main — code-review audit pipeline
254 source files, reviewed one at a time, each with its own paper trail.
Every module gets a full pass — one file reviewed, one GitHub sub-issue
documenting the finding (even when the finding is "none"), one PR, one merge
by the repo owner, before the next file starts. Tried opening several PRs in
parallel once; every PR after the first needed a rebase because they all
touched the same tracking table, so the process stayed sequential on
purpose.
Per-File Pipeline
01
todo.md row
File path + the exact commit SHA that last touched it, added once
review starts
Claude
02
Sub-issue
Findings written up after the file is actually read, never an empty
placeholder created upfront
Claude
03
Pull Request
One PR per file — a real fix, or a docs-only "reviewed, no findings"
record
Claude
04
Review & merge
Every PR read and merged by hand — nothing self-merges
Repo owner
05
Board sync
Project-board status flipped to Done as the closing step, not a
separate cleanup pass later
Claude
The recurring bug pattern this process actually found: in
store, all 3 real bugs shared one shape — a function's
top-level entry point was missing a null/undefined
guard that its own recursive or nested-value handling already had
(freeze(), getUnserializable(),
combineReducers()). Once that pattern was named, every later
module got checked specifically for the same asymmetry — not found again
yet, but worth checking every time rather than assuming it was a one-off.
Module Status
done store
27/27
3 real bugs found and fixed, 1 test-coverage gap closed, 23 files clean
done entity
9/9
0 real bugs — 2 structural observations recorded, not defects
done effects
18/18
0 real bugs — one file's constructor ordering turned out to be
correctness-critical, confirmed correct as written
in progress router-store
3/12
3 real bugs found and fixed so far — every one so far, a
declared-type-vs-actual-value mismatch no runtime test caught
not started 9 modules
—
component, component-store, data, eslint-plugin, operators, schematics,
schematics-core, signals, store-devtools