Land the twenty review reports in documentation/audit/

[gplanchat]

Documentation only — 22 files in documentation/audit/, no code, no tests.

What this is

Twenty independent reviews of the core, the Symfony bundle and the Sylius plugin, carried out on 3 September 2026 against main at 8fdc5ec4, plus their synthesis and an index.

Each axis was reviewed separately, without the reviews seeing one another. That is what makes the overlaps usable: four axes reach the hard-coded /admin route by four different paths, three reach the profiler running in production, two reach the sideEffect() hole.

Naming

The grids are named by their review axis, never by a person — 01-coherence-symfony.md, 15-messenger.md, 19-tests.md. These are areas of expertise, not authors: an opinion attributed to someone who did not voice it has no place in a repository.

Verified: no name and no account handle remains in the 22 files. Two occurrences of webmozart/assert remain, in an Upstream line where they cite a Composer package and its documentation — a library, not a profile.

Contents

• README.md — method, scope, index of the twenty axes, and a section "What the audit could not see".
• 00-synthese.md — verdict, 6 blockers, 43 deduplicated major findings, and what was verified as sound.
• 01-… through 20-… — one report per axis, eight findings maximum, each with its verified file:line, its upstream reference and its fix.

The scope explicitly excludes the 680 generated protobuf files of the Temporal bridge — 94 hand-written files out of 774 — as well as the Laravel and Magento packages.

Two editorial notes

The report on tests accused DUR041 of three false statements; there were only two. The "implemented for all four ports" status is accurate of the ports — all four do have their suite. What was false were the two present-tense statements about the Temporal adapters, plus the docblock of EventStoreReplayConformanceTestCase. The rest of the finding holds, and its count of three affected adapters is correct.

The correction is placed as an editorial note in the report and reworded in the synthesis, rather than by rewriting the original text: a report is a dated snapshot, and what it said is part of what it is.

What these reports are not

A list of accepted tasks. Only two follow-ups are under way at this stage — #270 (DUR041) and #269 (backend-data-parity) — and the README says so.

---

Editorial note — 2026-09-04, after cross-review of the open PRs

Two reports in this batch relied on incompatible facts. 13-documentation.md C3 claimed the word "Psalm" appeared only once in the whole repository — yet psalm.xml, psalm-baseline.xml, psalm-magento.xml and two passages of .github/workflows/ci.yml carry it, and 07-compatibilite-statique.md, in this same batch, devotes a whole finding to the Psalm baseline.

The substance of the finding holds: the suggest cites only one extension, and the ADR it points at is the wrong one. It was its proof that was false. That proof is retracted, replaced by what is verifiable — no Psalm extension package exists here — and the README carries the editorial note. An audit that corrects itself quietly is asking to be taken on trust a second time.

Still open, and not mine to settle: where these twenty-two files belong. They are in French under documentation/, which WA001 reserves for English, and none of the repository's three maps — INDEX.md, LIFECYCLE.md, HUGO.md — knows about documentation/audit/. The Hugo mount (hugo.toml:42-44) keeps them off the published site, so nothing leaks; this is a convention decision, not a defect.