[codex] Add audit evidence notes

README.md

@@ -139,6 +139,7 @@ Only published SkillBuilder lessons are synchronized as Shopware products. Draft
 - [Recruiter project summary](docs/project-summary-for-recruiters.md)
 - [Portfolio audit report](docs/audit-report-2026-05-23.md)
 - [PHPStan audit evidence](docs/phpstan-audit-2026-06-05.md)
+- [Evidence index](docs/evidence/README.md)
 - [Demo script](docs/demo-script.md)
 - [Changelog](CHANGELOG.md)
 - [Demo checklist](docs/demo-checklist.md)
@@ -217,6 +218,7 @@ Additional checks performed:
 - router checks
 - live smoke checks for public and protected routes
 - PHPStan audit setup added in the private codebase; baseline reduced from 56 findings to 17 Doctrine generated-ID findings
+- Evidence notes added for the PHPStan baseline reduction and private codebase verification limits
 
 ## Portfolio Positioning
 

docs/evidence/README.md

@@ -0,0 +1,14 @@
+# Evidence Index
+
+This directory collects portfolio-safe evidence from the private SkillBuilder codebase.
+
+The private repository is not published here. Evidence files summarize relevant checks, command outcomes, and audit decisions without exposing credentials, production configuration, user data, or private source code.
+
+## Current Evidence
+
+- [PHPStan baseline reduction](phpstan-baseline-reduction-2026-06-05.md)
+- [Private codebase verification notes](private-codebase-verification-2026-06-05.md)
+
+## Interpretation
+
+These files are not a formal certification. They are audit evidence for the public showcase: enough to show that quality checks were actually performed, what they found, and which technical debt remains.

docs/evidence/phpstan-baseline-reduction-2026-06-05.md

@@ -0,0 +1,53 @@
+# PHPStan Baseline Reduction Evidence - 2026-06-05
+
+## Summary
+
+The private SkillBuilder PHPStan baseline was reduced from 56 entries to 17 entries.
+
+```text
+Before cleanup: 56 baseline entries
+After cleanup:  17 baseline entries
+```
+
+## Remaining Entries
+
+All remaining entries are Doctrine generated ID warnings:
+
+```text
+Property App\Entity\...\$id (int|null) is never assigned int
+```
+
+The remaining count was checked with:
+
+```powershell
+(Select-String -Path phpstan-baseline.neon -Pattern 'identifier: property\.unusedType').Count
+```
+
+Recorded result:
+
+```text
+17
+```
+
+## Why These Remain
+
+Doctrine assigns `#[GeneratedValue]` IDs at runtime after persistence. Removing `?int` from entity IDs would weaken the domain model before persistence and would not be the right fix.
+
+The correct next step is Doctrine-aware PHPStan support, so PHPStan can understand generated IDs instead of treating them as ordinary never-assigned properties.
+
+## Fixed Finding Types
+
+The reduction removed findings in these categories:
+
+- invalid or missing imports
+- unreachable controller branches
+- redundant `method_exists()` compatibility guards
+- redundant null-coalescing expressions
+- overly broad Symfony user type checks
+- direct session flash bag access where controller flash helpers are clearer
+- unused constructor dependency in GDPR export logic
+- redundant lifecycle fallback for an already initialized Doctrine timestamp
+
+## Audit Position
+
+The current baseline is intentionally narrow. It does not hide broad application risk; it documents one known static-analysis limitation around Doctrine generated IDs.

docs/evidence/private-codebase-verification-2026-06-05.md

@@ -0,0 +1,68 @@
+# Private Codebase Verification Notes - 2026-06-05
+
+## Scope
+
+These notes summarize local verification performed against the private SkillBuilder codebase during the PHPStan audit cleanup.
+
+The private repository itself is not published in this showcase.
+
+## Syntax Check
+
+Changed PHP files were checked with PHP syntax validation.
+
+Recorded outcome:
+
+```text
+No syntax errors detected
+```
+
+## PHPStan Targeted Checks
+
+PHPStan was run without the broad baseline against the command, controller, and service files that were changed during the cleanup.
+
+Recorded outcome:
+
+```text
+Command files:    OK
+Controller files: OK
+Service files:    OK
+```
+
+Entity checks were run with the reduced baseline:
+
+```text
+[OK] No errors
+```
+
+## Private PHPUnit Evidence
+
+The private codebase test evidence recorded for the showcase remains:
+
+```text
+PHPUnit 12.5.4
+Runtime: PHP 8.4.21
+
+14 tests
+650 assertions
+OK
+```
+
+The public showcase examples remain:
+
+```text
+4 tests
+7 assertions
+OK
+```
+
+## Environment Note
+
+The local Windows/P-drive environment required a PHPStan wrapper script that copies the PHPStan PHAR to `%TEMP%` before execution. This avoids local PHAR execution hangs from the network-mounted project path.
+
+The private repository also includes a `Testing` GitHub Actions workflow for running PHPStan in CI.
+
+## Limitation
+
+A full private-codebase PHPStan run in the local Windows/P-drive environment was not used as the primary evidence because the environment can hang on long PHPStan runs. The audit therefore records targeted baseline-free checks plus an entity check with the reduced baseline.
+
+This limitation is documented so the evidence stays honest and repeatable.

docs/phpstan-audit-2026-06-05.md

@@ -72,6 +72,11 @@ PHPStan on changed command/controller/service files without baseline: OK
 PHPStan on src/Entity with reduced baseline: OK
 ```
 
+Supporting evidence:
+
+- [PHPStan baseline reduction evidence](evidence/phpstan-baseline-reduction-2026-06-05.md)
+- [Private codebase verification notes](evidence/private-codebase-verification-2026-06-05.md)
+
 The full private-codebase PHPStan run is wired through the `Testing` workflow. The local Windows/P-drive environment required a PowerShell wrapper that copies the PHPStan PHAR to `%TEMP%` before execution.
 
 ## Current Quality Impact
@@ -82,4 +87,3 @@ This audit turns PHPStan from a one-off scan into repeatable project evidence:
 - real PHPStan findings were fixed rather than hidden
 - the baseline is narrow and explainable
 - the remaining debt has a clear next step: add Doctrine-aware PHPStan support
-

docs/quality-report.md

@@ -65,6 +65,12 @@ Performed checks:
 - Doctrine mapping validation
 - live smoke checks against production routes
 
+Detailed evidence:
+
+- [Evidence index](evidence/README.md)
+- [PHPStan baseline reduction evidence](evidence/phpstan-baseline-reduction-2026-06-05.md)
+- [Private codebase verification notes](evidence/private-codebase-verification-2026-06-05.md)
+
 ## Important Finding Fixed
 
 Doctrine validation found an inconsistent mapping between the lesson owner relation and the user lessons collection. The relationship was corrected by adding the inverse side to the owner relation.