docs: deep production audit 2026-05-07 (supersedes 2026-04-13)

[diskhacker]

Summary

Adds DEEP-AUDIT-REPORT-2026-05-07.md — a cross-repo deep audit, supersedes DEEP-AUDIT-REPORT-2026-04-13.md already in repo root. Same file committed to claude/create-main-branch-audit-SsbNG in all 7 repos.

Status of prior P0 / P1 (sigops-only)

Prior issue	Status
Missing crypto import in server/src/db/schema.ts	FIXED (line 1)
No graceful shutdown	FIXED (server/src/index.ts SIGTERM/SIGINT)
Permissive CORS	OPEN — no CORS middleware in app.ts
Missing security headers (helmet)	PARTIAL — manual headers, no CSP/Referrer-Policy/Permissions-Policy
Rate limiting	OPEN
Coverage in CI	PARTIAL — runs test:coverage, no upload
ESLint in CI	REGRESSED — explicitly disabled
@cluster/* consumption	OPEN — zero deps

Sigops-specific new findings

• P1: No CORS allow-list (FRONTEND_URL env defined but unused).
• P1: No rate limiter on /api/v1/ingest — trivial DoS / log-flood vector for a public ingest endpoint.
• P1: runSpikeDetection() cron in server/src/index.ts:19-33 runs in every replica → duplicate spike signals + duplicate notifications under HPA. Needs leader election or BullMQ repeatable job.
• P1: OpenAPI spec covers 5 of 16 mounted route groups — Swagger materially incomplete.
• P1: CI runs cd server only — UI + CLI tests never executed.
• P2: auditLogs.tenantId nullable; notifications.scope is free text not pgEnum; spike numerics stored as text.
• P2: Mixed package managers (pnpm-lock.yaml + sigops-cli/package-lock.json).

Test plan

• Review report
• Open issues per P1 finding
• Triage runSpikeDetection leader-election approach (BullMQ repeatable vs LEADER_REPLICA flag)
• Schedule OpenAPI completion against the 16 mounted route groups

Draft for visibility only — no code changes.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 49c13715-6b91-4e5d-a5b6-74137e0aafb8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/create-main-branch-audit-SsbNG

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[diskhacker]

CI note: the server check failure on this PR is pre-existing on main, not caused by this change.

This PR adds a single file at the repo root (DEEP-AUDIT-REPORT-2026-05-07.md) — no source, manifest, or config changes. A markdown-only diff cannot cause pnpm typecheck or pnpm test:coverage to fail. The CI workflow triggers on every PR with no paths-ignore filter, so doc PRs inherit any breakage already on main.

The most recent main commit is ad0b215 (2026-04-21, 2+ weeks ago) — a dependabot bump that pushed drizzle-orm 0.38.4 → 0.45.2 (a major-version jump). No PR has exercised CI against main since then, so this is the first time we're seeing whether that bump (or a runner-image change since) regressed the build.

This breakage is itself an audit finding — the report flags "CI runs cd server only" and "Lint disabled in CI". I'm leaving this PR's CI red rather than pushing speculative fixes; the underlying regression on main should be investigated and fixed separately.

---

Generated by Claude Code