fix(audit): eliminate 11 CRITICAL false positives at the source (no suppression)

[cryptoxdog]

Summary

python tools/audit_engine.py --strict (agent-check gate 6) reported 11 CRITICAL findings that .github/workflows/audit-pr-review.yml already acknowledged as false positives via its LEGACY_BASELINE. Per the directive, these are fixed at the source — the scanner's buggy heuristics are corrected and the one real code smell is refactored — rather than suppressed with ignore-annotations or a baseline.

Fixes by rule

Rule 11 — FastAPI import / chassis isolation (clears C-201..C-205)

The audit allowlist (api/, main.py, handlers.py) was narrower than the documented C-01 contract in AGENTS.md and the .github/workflows/compliance.yml gate, so it flagged governance-permitted transport-adjacent modules. Introduced a single _fastapi_import_allowed() helper matching C-01: api/, main.py, handlers.py, app/middleware/, app/bootstrap/ (chassis bootstrap, INV-ARCH-03), app/core/auth.py, app/score/score_api.py. Also added app/bootstrap/* to the chassis-isolation allowlists in compliance.yml and pr-pipeline.yml so all gates agree on one source of truth (previously those gates also failed on l9_contract_runtime.py).

Rule 10 — f-string SQL (clears C-101)

The regex matched a SQL verb anywhere in a string, misflagging prose ("...unqualified leads drop out...") in simulation_bridge.py. Now requires the verb at the start of the f-string literal, where real query strings begin.

Rule 2 — flatcase (clears C-001..C-004)

The heuristic flagged any long single word. Added a word-break check (_looks_like_flatcase) that only flags names decomposing into 2+ known word tokens — so genuine flatcase (accountnumber → account+number) is caught while valid single words (recommendation, configuration, classification, ...) pass.

salesforce_client.py — real refactor (clears C-102)

The SOQL was already injection-safe (object type + field names validated against _SOQL_FIELD_RE, values escaped via _soql_literal(), sent through the REST q param). Refactored the construction from an f-string to explicit concatenation of the validated parts, making the safe construction evident and removing the f-string-SQL pattern.

Verification

• python tools/audit_engine.py --strict → 0 CRITICAL, 0 HIGH (215 MEDIUM / 964 INFO unchanged — those are not --strict-blocking).
• Flatcase heuristic unit-checked: 10 valid long words all return False; 6 real concatenations return True.
• Chassis-isolation gate logic (with app/bootstrap/) → no violations.
• ruff check + ruff format --check clean; py_compile clean.
• tests/compliance/ + tests/ci/: 39 pass. The single failure (test_deprecated_compatibility_artifacts... needing REPO_MAP.md at root) is unrelated to this PR and is resolved by the docs-to-root PR.

Scope / tier

tools/audit_engine.py (T2), .github/workflows/* (T2), app/services/crm/salesforce_client.py (T3, engine service). No transport/schema (T4/T5) files touched.

  

[github-actions]

PR Size Report

Metric	Value	Limit
Lines changed	181	1000
Files changed	4	50
Additions	+172	-
Deletions	-9	-

✅ PR size is within recommended limits

[github-actions]

L9 Audit Review

Status

• Result: pass_with_advisories
• Mode: explicit_advisory_blocking_tier_policy
• Total findings visible: 1179
• Blocking findings: 0
• Advisory findings: 1179

Policy

• Flatcase/style findings are advisory.
• SQL/auth/security/chassis/transport/ingress/contract/runtime findings are blocking when new or touched.
• Unknown HIGH/CRITICAL findings fail closed as blocking.

---

Blocking Findings

• none

Advisory Findings

• app/api/v1/converge.py:19 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:20 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:21 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:22 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:23 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:24 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:25 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:26 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:32 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:132 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:133 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:197 Deep relative import (level=3) — advisory
• app/api/v1/converge.py:198 Deep relative import (level=3) — advisory
• app/api/v1/intake.py:18 Deep relative import (level=3) — advisory
• app/api/v1/fields.py:19 Deep relative import (level=3) — advisory
• app/api/v1/fields.py:20 Deep relative import (level=3) — advisory
• app/api/v1/fields.py:21 Deep relative import (level=3) — advisory
• app/api/v1/discover.py:21 Deep relative import (level=3) — advisory
• app/api/v1/discover.py:22 Deep relative import (level=3) — advisory
• app/api/v1/discover.py:23 Deep relative import (level=3) — advisory
• app/api/v1/discover.py:70 Deep relative import (level=3) — advisory
• app/api/v1/discover.py:100 Deep relative import (level=3) — advisory
• app/services/enrichment/sources/perplexity_adapter.py:21 Deep relative import (level=3) — advisory
• app/services/enrichment/sources/perplexity_adapter.py:22 Deep relative import (level=3) — advisory
• app/engines/convergence/loop_state.py:14 Deep relative import (level=3) — advisory

... truncated 1154 additional findings ...

---

Generated by L9 Audit Engine (tools/audit_engine.py)