json-rest-api 1.0.20 → 1.0.22

package/audit/00-charter.md

@@ -0,0 +1,103 @@
+# Technical Audit Charter
+
+## Mission
+Produce a formal, evidence-driven audit of architecture quality, code quality, standards alignment, competitive positioning, and operational risk for:
+- `/home/merc/Development/current/json-rest-api`
+- `/home/merc/Development/current/json-rest-schema`
+
+## Scope
+### Included
+- Runtime architecture, data/control flow, and plugin interactions for non-`anyapi` code paths.
+- Schema compilation/validation behavior in `json-rest-schema` and its integration surface in `json-rest-api`.
+- Test and documentation alignment for critical behavior.
+- Runtime/test corroboration for risk classification.
+
+### Explicit Exclusions
+- `anyapi` implementation and behavior are fully out-of-scope for conclusions, scoring, and recommendations.
+- Excluded path classes (json-rest-api):
+  - `plugins/core/lib/anyapi/**`
+  - `plugins/core/rest-api-anyapi-knex-plugin.js`
+  - `tests/anyapi-*.test.js`
+  - `scripts/*anyapi*`
+
+## Baseline Freeze
+- Baseline commits: `audit/evidence/runtime/baseline-commits.txt`
+- Environment metadata: `audit/evidence/runtime/environment.txt`
+- DB adapter assumptions: `audit/evidence/runtime/db-adapter-assumptions.txt`
+- Standards/competitor corpus freeze: `audit/evidence/external/corpus-freeze.md`
+
+## Evidence Policy
+1. No claim without file-level and/or runtime/test evidence reference.
+2. No high-severity risk without corroborating runtime/test signal.
+3. Critical files require dual-pass review (pass 1 + cross-review pass 2).
+4. Assertions must be tagged as:
+   - `Verified`: directly confirmed by code/runtime/test evidence.
+   - `Inferred`: logically derived from verified evidence.
+   - `Unknown`: evidence missing or inconclusive.
+5. Unknowns are tracked explicitly in subsystem reports and findings.
+
+## Severity Model
+- Inputs:
+  - Impact: `1-5`
+  - Likelihood: `1-5`
+  - Detectability: `1-5` (higher means easier to detect)
+- Formula:
+  - `severity_score = impact * likelihood * (6 - detectability)`
+  - Range: `1..125`
+- Bands:
+  - `High`: `>= 60`
+  - `Medium`: `30-59`
+  - `Low`: `< 30`
+
+## Confidence Model
+- `C1 Very Low`: weak signal, mostly inferred.
+- `C2 Low`: limited direct evidence.
+- `C3 Medium`: direct code evidence + partial corroboration.
+- `C4 High`: direct code evidence + test/runtime corroboration.
+- `C5 Very High`: repeated corroboration across code, runtime, and tests.
+
+## Scoring Model
+Each major dimension scored `1-5`, evidence-backed:
+- Correctness
+- Security
+- Resilience
+- Performance
+- Maintainability
+- Observability
+- Test quality
+
+Aggregate score is reported as profile (not single opaque number) plus weighted composite:
+- Correctness `20%`
+- Security `20%`
+- Resilience `15%`
+- Performance `15%`
+- Maintainability `15%`
+- Observability `5%`
+- Test quality `10%`
+
+## Deliverables
+- `audit/00-charter.md`
+- `audit/01-scope-map.md`
+- `audit/02-coverage-matrix.csv`
+- `audit/03-invariants.md`
+- `audit/04-standards-rubric.md`
+- `audit/05-competitor-rubric.md`
+- `audit/06-findings.md`
+- `audit/07-risk-register.csv`
+- `audit/08-remediation-roadmap.md`
+- `audit/subsystems/*.md`
+- `audit/traces/*.md`
+- `audit/evidence/**`
+
+## Signoff Criteria
+1. 100% critical-file dual-pass coverage.
+2. 100% invariants not left unknown in final state.
+3. 100% high-severity risks have mitigation + verification test.
+4. Standards and competitor matrices complete with evidence.
+5. Prioritized remediation roadmap with exit criteria.
+6. Final synthesis includes residual risk and confidence summary.
+
+## Reproducibility Commands (Baseline)
+- `git rev-parse HEAD` in each repo.
+- `node -v && npm -v && uname -a`
+- `git ls-files` inventories captured under `audit/evidence/code/`.

package/audit/01-scope-map.md

@@ -0,0 +1,84 @@
+# Scope Map (M1)
+
+## Inventory Baseline (In Scope)
+- `json-rest-api`: 160 tracked files in scope (`audit/evidence/code/in-scope-files-json-rest-api.txt`)
+- `json-rest-schema`: 13 tracked files in scope (`audit/evidence/code/in-scope-files-json-rest-schema.txt`)
+- Coverage matrix rows: 173 files + header (`audit/02-coverage-matrix.csv`)
+
+## Architecture Boundaries (Expected Layer Contract)
+`transport -> REST methods -> helper contracts -> storage adapter -> DB`
+
+### schema-core
+- Repo: `json-rest-schema`
+- Core files: `src/index.js`, `src/Schema.js`, `src/CorePlugin.js`
+- Responsibility: field casting, validation pipeline, validator/type plugin system.
+
+### rest-orchestration
+- Repo: `json-rest-api`
+- Core files: `plugins/core/rest-api-plugin.js`, `plugins/core/rest-api-plugin-methods/*.js`, `plugins/core/rest-api-plugin-hooks/*.js`
+- Responsibility: request lifecycle orchestration, permission hook dispatch, transaction lifecycle, response shape mode.
+
+### transport-express
+- Core files: `plugins/core/connectors/express-plugin.js`, `plugins/core/connectors/lib/*`
+- Responsibility: HTTP ingress/egress, request parsing, status mapping, transport hooks.
+
+### storage-knex
+- Core files: `plugins/core/rest-api-knex-plugin.js`, `plugins/core/lib/storage/storage-adapter.js`, `plugins/core/lib/querying-writing/*`
+- Responsibility: data adapter abstraction, SQL query/write execution, schema compilation and ID/column translation.
+
+### query-engine
+- Core files: `plugins/core/lib/querying/*`, `plugins/core/rest-api-plugin-methods/query.js`, `.../get.js`
+- Responsibility: filtering/sorting/pagination/include processing and JSON:API assembly.
+
+### relationships
+- Core files: `plugins/core/lib/writing/relationship-processor.js`, `.../many-to-many-manipulations.js`, relationship endpoint methods
+- Responsibility: relation semantics across CRUD + relationship endpoints.
+
+### plugin subsystems
+- Access: `plugins/core/rest-api-access.js`
+- CORS: `plugins/core/rest-api-cors-plugin.js`
+- File: `plugins/core/file-handling-plugin.js`
+- Positioning: `plugins/core/rest-api-positioning-plugin.js`, `plugins/core/lib/fractional-positioning.js`
+- Multihome: `plugins/core/rest-api-multihome-plugin.js`
+- SocketIO: `plugins/core/socketio-plugin.js`
+- Bulk: `plugins/core/bulk-operations-plugin.js`
+
+## Primary Data/Control Flows
+### Read flow
+1. Route registration: `register-scope-routes.js` + `add-route.js`
+2. Transport ingress + parsing: `express-plugin.js`, `connectors-query-parser.js`
+3. Method orchestration: `query.js`/`get.js` -> payload validation -> `checkPermissions`
+4. Storage read: `rest-api-knex-plugin.js` (`helpers.dataQuery`/`helpers.dataGet`)
+5. Include/transform: `knex-process-includes.js`, `knex-relationship-includes.js`, `knex-json-api-transformers-querying.js`
+6. Field enrichment/filtering: `enrich-attributes.js`, `field-utils.js`
+7. Transport response/error mapping: `express-plugin.js`
+
+### Write flow
+1. Transport ingress/body validation.
+2. Method setup + transaction open: `common.js::setupCommonRequest`
+3. Payload validation and schema validation: `payload-validators.js` + `validateResourceAttributesBeforeWrite`
+4. Permission checks before storage side effects: `scope.checkPermissions`
+5. Storage mutation: `helpers.dataPost|dataPut|dataPatch|dataDelete`
+6. Relationship side effects: `relationship-processor.js`, `many-to-many-manipulations.js`
+7. Return mode and hooks: `handleRecordReturnAfterWrite`
+8. Commit/rollback path: `common.js::handleWriteMethodError` and method-level transaction logic
+
+## Early Silent Zones (Initial Detection)
+### Files with weak direct test linkage (heuristic)
+- Source: `audit/evidence/code/early-silent-zones-no-test-token.txt`
+- 54/67 runtime files had no direct token mention in tests (heuristic, not execution coverage).
+- Notable high-risk modules in this set: file upload detector libs, relationship endpoint methods, core helper glue, error formatting.
+
+### Docs claims with likely weak direct code/test mapping (to validate in M2/M6)
+- File upload guides vs no dedicated file-upload test suite name match.
+- Label plugin present (`rest-api-label-plugin.js`) with no dedicated test suite name match.
+- Transport helper internals (`connectors/lib/*`) lack targeted test files by name.
+
+### Weak call-site coverage candidates (initial static signal)
+- Relationship endpoint error path consistency needs runtime confirmation (`patch-relationship.js` catch path references symbols not declared in-file).
+- Cross-table/polymorphic filter branches require targeted scenario coverage beyond happy-path query tests.
+
+## Unknown Queue (Must Resolve)
+- Exact runtime path usage for some helper modules without explicit test targeting.
+- Relationship endpoint error envelope consistency under thrown failures.
+- Performance behavior under nested includes and cross-table filter combinations.

package/audit/02-coverage-matrix.csv

@@ -0,0 +1,174 @@
+"repo","path","layer","subsystem","criticality","review_pass_1","review_pass_2","runtime_touched","test_touched","notes_ref"
+"json-rest-api",".claude/agents/library-guide-expert.md","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api",".claude/agents/rest-api-internals-expert.md","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api",".gitignore","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","AGENTS.md","docs","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","CLAUDE.md","docs","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","connectors_ideas/fastify.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","connectors_ideas/koa-plugin.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","CRUSH.md","docs","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/_config.yml","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/_layouts/default.html","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/.bundle/config","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/API.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/apple-touch-icon.svg","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/assets/css/style.scss","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/COMPARISON.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/favicon.svg","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/Gemfile","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/Gemfile.lock","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_1_Initial_Setup.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_2_1_The_Starting_Point.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_2_2_Manipulating_And_Searching_Tables.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_2_3_BelongsTo_Relationships.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_2_4_HasMany_Records.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_2_5_HasMany_Polymorphic.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_2_6_Many_To_Many.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_2_7_Pagination_And_Ordering.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_2_8_Effects_of_PUT_and_PATCH.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_2_9_Relationships_Urls.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_2_Data_And_Relations.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_3_Field_Transformations.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_4_Authentication_And_Permissions.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_5_Non-Db_Resources.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_6_Positioning.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_7_Hooks_Data_Management_And_Plugins.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_X_Bulk_Operations.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_X_Cors.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_X_File_Uploads.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_X_Multihome.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_X_SocketIO.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_X_URL_Management.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/GUIDE_Y_Appendices.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/GUIDE/index.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/index.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/mini-guides/file-uploads-complete.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/ONBOARDING.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","docs/QUICKSTART.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","eslint.config.js","meta","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","examples/url-override-example.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","index.js","runtime-core","rest-orchestration","important","pending","pending","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","lib/enhanced-logger.js","runtime-core","rest-orchestration","important","pending","pending","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","lib/error-formatter.js","runtime-core","rest-orchestration","important","pending","pending","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","lib/rest-api-errors.js","runtime-core","rest-orchestration","important","pending","pending","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","LICENSE","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","package-lock.json","meta","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","package.json","meta","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","plugins/core/bulk-operations-plugin.js","plugin","plugins-bulk","critical","yes","yes","yes","yes","audit/subsystems/plugins-bulk.md"
+"json-rest-api","plugins/core/connectors/express-plugin.js","transport","transport-express","critical","yes","yes","yes","yes","audit/subsystems/transport-express.md"
+"json-rest-api","plugins/core/connectors/lib/busboy-detector.js","transport","transport-express","critical","yes","yes","no","no","audit/subsystems/transport-express.md"
+"json-rest-api","plugins/core/connectors/lib/formidable-detector.js","transport","transport-express","critical","yes","yes","no","no","audit/subsystems/transport-express.md"
+"json-rest-api","plugins/core/connectors/lib/request-helpers.js","transport","transport-express","critical","yes","yes","no","no","audit/subsystems/transport-express.md"
+"json-rest-api","plugins/core/file-handling-plugin.js","plugin","plugins-file","critical","yes","yes","no","no","audit/subsystems/plugins-file.md"
+"json-rest-api","plugins/core/lib/dbTablesOperations.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/fractional-positioning.js","plugin","plugins-positioning","critical","yes","yes","no","no","audit/subsystems/plugins-positioning.md"
+"json-rest-api","plugins/core/lib/querying-writing/compile-schemas.js","runtime-storage","storage-knex","critical","yes","yes","yes","yes","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/connectors-query-parser.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/database-capabilities.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/database-value-normalizers.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/default-data-helpers.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/field-utils.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/knex-constants.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/knex-field-helpers.js","runtime-storage","storage-knex","critical","yes","yes","yes","yes","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/knex-json-api-transformers.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/payload-validators.js","runtime-storage","storage-knex","critical","yes","yes","yes","yes","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/schema-helpers.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/scope-validations.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying-writing/simplified-helpers.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/querying/knex-cross-table-search.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
+"json-rest-api","plugins/core/lib/querying/knex-json-api-transformers-querying.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
+"json-rest-api","plugins/core/lib/querying/knex-pagination-helpers.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
+"json-rest-api","plugins/core/lib/querying/knex-process-includes.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
+"json-rest-api","plugins/core/lib/querying/knex-query-helpers-base.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
+"json-rest-api","plugins/core/lib/querying/knex-query-helpers.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
+"json-rest-api","plugins/core/lib/querying/knex-relationship-includes.js","runtime-query","query-engine","critical","yes","yes","yes","yes","audit/subsystems/query-engine.md"
+"json-rest-api","plugins/core/lib/querying/knex-window-queries.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
+"json-rest-api","plugins/core/lib/querying/url-helpers.js","runtime-query","query-engine","critical","yes","yes","no","no","audit/subsystems/query-engine.md"
+"json-rest-api","plugins/core/lib/storage/storage-adapter.js","runtime-storage","storage-knex","critical","yes","yes","no","no","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/lib/writing/knex-json-api-transformers-writing.js","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","plugins/core/lib/writing/many-to-many-manipulations.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
+"json-rest-api","plugins/core/lib/writing/relationship-processor.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
+"json-rest-api","plugins/core/rest-api-access.js","plugin","plugins-access","critical","yes","yes","yes","yes","audit/subsystems/plugins-access.md"
+"json-rest-api","plugins/core/rest-api-cors-plugin.js","plugin","plugins-cors","critical","yes","yes","yes","yes","audit/subsystems/plugins-cors.md"
+"json-rest-api","plugins/core/rest-api-knex-plugin.js","runtime-storage","storage-knex","critical","yes","yes","yes","yes","audit/subsystems/storage-knex.md"
+"json-rest-api","plugins/core/rest-api-label-plugin.js","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","plugins/core/rest-api-multihome-plugin.js","plugin","plugins-multihome","critical","yes","yes","yes","yes","audit/subsystems/plugins-multihome.md"
+"json-rest-api","plugins/core/rest-api-plugin-hooks/compile-resource-schemas.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-hooks/register-relationship-routes.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-hooks/register-scope-routes.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-hooks/turn-scope-init-into-vars.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-hooks/validate-include-configurations.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/add-route.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/check-permissions.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/common.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/delete-relationship.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/delete.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/enrich-attributes.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/get-related.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/get-relationship.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/get.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/patch-relationship.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/patch.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/post-relationship.js","runtime-relationships","relationships","critical","yes","yes","yes","yes","audit/subsystems/relationships.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/post.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/put.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/query.js","runtime-query","query-engine","critical","yes","yes","yes","yes","audit/subsystems/query-engine.md"
+"json-rest-api","plugins/core/rest-api-plugin-methods/release.js","runtime-orchestration","rest-orchestration","critical","yes","yes","no","no","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-plugin.js","runtime-orchestration","rest-orchestration","critical","yes","yes","yes","yes","audit/subsystems/rest-orchestration.md"
+"json-rest-api","plugins/core/rest-api-positioning-plugin.js","plugin","plugins-positioning","critical","yes","yes","yes","yes","audit/subsystems/plugins-positioning.md"
+"json-rest-api","plugins/core/socketio-plugin.js","plugin","plugins-socketio","critical","yes","yes","yes","yes","audit/subsystems/plugins-socketio.md"
+"json-rest-api","plugins/storage/local-storage.js","plugin","plugins-file","critical","yes","yes","no","no","audit/subsystems/plugins-file.md"
+"json-rest-api","plugins/storage/s3-storage.js","plugin","plugins-file","critical","yes","yes","no","no","audit/subsystems/plugins-file.md"
+"json-rest-api","quickTest.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","README.md","docs","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","scripts/run-docs.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","test-debug.js","tooling","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-api","tests/bulk-operations.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/computed-fields.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/cors.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/curl.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/custom-idproperty-relationships.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/field-getters.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/field-setters.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/fixtures/api-configs.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/helpers/storage-mode.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/helpers/test-utils.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/include-depth-validation.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/includes.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/multihome.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/nested-includes.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/ownership-optout.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/pagination-cursor-multifield.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/pagination-enhanced.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/polymorphic-relationships.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/polymorphic-simple.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/positioning-advanced.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/positioning-extended.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/positioning-multifilter.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/positioning.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/queries.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/query-limits.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/README.md","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/relationship-endpoints.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/relationships.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/rest-api-access.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/rest-api.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/searchschema-merge.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/socketio.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/TEST_TEMPLATE.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/test-development-guide.md","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","tests/virtual-fields.test.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-api","TODO.todo","meta","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-schema",".gitignore","support","docs-drift","supporting","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-schema","eslint.config.js","meta","schema-core","supporting","pending","pending","no","no","audit/subsystems/schema-core.md"
+"json-rest-schema","example.js","meta","schema-core","supporting","pending","pending","no","no","audit/subsystems/schema-core.md"
+"json-rest-schema","FUTURE_MIGRATION_MODULE.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-schema","ONBOARDING.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-schema","package-lock.json","meta","schema-core","supporting","pending","pending","no","no","audit/subsystems/schema-core.md"
+"json-rest-schema","package.json","meta","schema-core","supporting","pending","pending","no","no","audit/subsystems/schema-core.md"
+"json-rest-schema","README.md","docs","docs-drift","important","pending","pending","no","no","audit/subsystems/docs-drift.md"
+"json-rest-schema","src/CorePlugin.js","schema-runtime","schema-core","critical","yes","yes","yes","yes","audit/subsystems/schema-core.md"
+"json-rest-schema","src/index.js","schema-runtime","schema-core","critical","yes","yes","yes","yes","audit/subsystems/schema-core.md"
+"json-rest-schema","src/Schema.js","schema-runtime","schema-core","critical","yes","yes","yes","yes","audit/subsystems/schema-core.md"
+"json-rest-schema","test-knex-table-real.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"
+"json-rest-schema","tests.js","tests","tests","important","pending","pending","no","no","audit/subsystems/tests.md"

package/audit/03-invariants.md

@@ -0,0 +1,123 @@
+# Architecture Invariants (Final, non-anyapi)
+
+Scope note: anyapi-specific code paths are excluded from invariant evaluation.
+Status legend: `pass | fail | partial`.
+Assertion tags: `[Verified]`, `[Inferred]`.
+
+## Summary Table
+
+| Invariant | Status | Confidence | Key evidence |
+|---|---|---:|---|
+| INV-001 Transactional mutation + rollback safety | fail | C5 | `patchRelationship` runtime `ReferenceError` in error path; catch handler broken |
+| INV-002 Permission checks before irreversible side effects | pass | C4 | method ordering + access/multihome tests |
+| INV-003 Validation/type normalization before query/write | pass | C4 | payload validators before data helpers; runtime malformed payload rejection |
+| INV-004 Relationship semantics consistency across write + relationship endpoints | partial | C4 | post/delete endpoint pass + patch endpoint error-path defect |
+| INV-005 idProperty consistency in query/write/transform/response | pass | C4 | compile + knex idProperty paths + custom idProperty tests |
+| INV-006 Sparse fieldsets do not leak hidden/internal fields | pass | C4 | field helper behavior + virtual/computed/fieldset tests |
+| INV-007 Include processing avoids N+1 in standard scenarios | partial | C3 | include correctness tests pass; no query-count budget assertions |
+| INV-008 Error envelope consistency across transport and method paths | fail | C4 | CORS blocked-origin envelope mismatch + patchRelationship error-path mismatch |
+| INV-009 Multi-tenant/ownership filters non-bypassable across alternate paths | partial | C3 | access/multihome checks pass; bypass matrix not exhaustive |
+| INV-010 Plugin side effects scoped and contract-safe | partial | C4 | positioning test failures + inferred bulk optimization dead-path |
+| INV-011 Docs claims match observed critical behavior | partial | C4 | `included` write docs/code mismatch; compliance wording drift |
+| INV-012 Tests cover critical invariants (not just happy paths) | partial | C4 | broad suite + explicit gaps (skipped tests, missing patchRelationship regression) |
+
+## INV-001 Transactional mutation + rollback safety
+- [Verified][C5] `patch-relationship` catch path references undefined `handleWriteMethodError`, breaking canonical rollback/error handler path.
+- Code evidence:
+  - [patch-relationship.js:52](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:52)
+  - [common.js:198](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js:198)
+- Runtime evidence:
+  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
+- Existing tests mapped:
+  - `tests/relationship-endpoints.test.js` covers post/delete but not patch failure path.
+- Scenario validation:
+  - malformed relationship payload -> `ReferenceError: handleWriteMethodError is not defined`.
+- Final: `fail`.
+- Remediation pointer: `ROADMAP-A-001`.
+
+## INV-002 Permission checks before irreversible side effects
+- [Verified][C4] CRUD method paths call `scope.checkPermissions` before `helpers.dataPost|Put|Patch|Delete`.
+- Code evidence: [post.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/post.js), [put.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/put.js), [patch.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch.js), [delete.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/delete.js).
+- Test evidence: `tests/rest-api-access.test.js`, `tests/multihome.test.js`, `tests/ownership-optout.test.js` (all in full suite run).
+- Final: `pass`.
+
+## INV-003 Validation/type normalization before query construction and writes
+- [Verified][C4] Method flows validate payload/query before storage helper calls.
+- Code evidence: [payload-validators.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js), [query.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/query.js), [common.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js).
+- Runtime evidence: malformed relationship payload rejected in probe before successful write (`REST_API_PAYLOAD` emitted before endpoint-level failure masking).
+- Final: `pass`.
+
+## INV-004 Relationship semantics consistency across POST/PUT/PATCH + relationship endpoints
+- [Verified][C4] POST/DELETE relationship endpoints pass in regression tests.
+- [Verified][C5] PATCH relationship endpoint has broken failure semantics (`ReferenceError`).
+- Evidence:
+  - [trace-relationship-endpoints.md](/home/merc/Development/current/json-rest-api/audit/traces/trace-relationship-endpoints.md)
+  - `audit/evidence/tests/npm-test-json-rest-api.log:5050,5060`
+- Final: `partial`.
+- Remediation pointer: `ROADMAP-A-001`, `ROADMAP-A-003`.
+
+## INV-005 idProperty consistency in query/write/transform/response
+- [Verified][C4] `idProperty` appears in compile metadata and knex read/write helpers.
+- Code evidence: [compile-schemas.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/compile-schemas.js), [rest-api-knex-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-knex-plugin.js).
+- Test evidence: `tests/custom-idproperty-relationships.test.js` passes in full run.
+- Final: `pass`.
+
+## INV-006 Sparse fieldsets do not leak hidden/internal fields
+- [Verified][C4] field helper enforces hidden/sparse behavior and throws on unknown fields.
+- Code evidence: [knex-field-helpers.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/knex-field-helpers.js).
+- Test evidence: `tests/virtual-fields.test.js`, `tests/computed-fields.test.js`, `tests/field-getters.test.js` pass in full suite.
+- Final: `pass`.
+
+## INV-007 Include processing avoids N+1 in standard scenarios
+- [Verified][C3] include behavior is functionally correct in test suite.
+- [Inferred][C3] batching present in include code; no direct query-count budget test.
+- Evidence:
+  - [knex-relationship-includes.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying/knex-relationship-includes.js)
+  - `tests/includes.test.js`, `tests/nested-includes.test.js`
+- Final: `partial`.
+- Remediation pointer: `ROADMAP-B-003`.
+
+## INV-008 Error envelope consistency across transport and method paths
+- [Verified][C4] CORS blocked-origin path returns `{ error: ... }` shape, diverging from JSON:API `errors` envelope.
+- [Verified][C5] `patchRelationship` failure path returns runtime `ReferenceError` instead of normalized rest-api envelope.
+- Evidence:
+  - [rest-api-cors-plugin.js:112](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-cors-plugin.js:112)
+  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
+- Final: `fail`.
+- Remediation pointer: `ROADMAP-A-001`, `ROADMAP-B-002`.
+
+## INV-009 Multi-tenant and ownership filters non-bypassable
+- [Verified][C4] plugin-level filtering + permission checks exist and tests pass.
+- [Inferred][C3] alternate-path bypass matrix (relationship endpoints + includes + custom filters) not exhaustively runtime-proven.
+- Evidence:
+  - [rest-api-access.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-access.js)
+  - [rest-api-multihome-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-multihome-plugin.js)
+  - `tests/rest-api-access.test.js`, `tests/multihome.test.js`
+- Final: `partial`.
+- Remediation pointer: `ROADMAP-B-004`.
+
+## INV-010 Plugin side effects remain scoped and contract-safe
+- [Verified][C5] positioning plugin currently has failing multifilter edge tests.
+- [Inferred][C3] bulk optimization hook may be non-executed/dead path.
+- Evidence:
+  - `audit/evidence/tests/npm-test-json-rest-api.log:4235-4296`
+  - [bulk-operations-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/bulk-operations-plugin.js)
+- Final: `partial`.
+- Remediation pointer: `ROADMAP-A-002`, `ROADMAP-B-001`.
+
+## INV-011 Documentation claims match observed behavior
+- [Verified][C4] docs/comments claim patterns conflict with runtime behavior for write `included` handling.
+- Evidence:
+  - [payload-validators.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js)
+  - [common.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js)
+  - [docs-drift.md](/home/merc/Development/current/json-rest-api/audit/subsystems/docs-drift.md)
+- Final: `partial`.
+- Remediation pointer: `ROADMAP-B-005`.
+
+## INV-012 Tests cover critical invariants beyond happy paths
+- [Verified][C4] suite breadth is high, but critical gaps remain.
+- Gap evidence:
+  - skipped cursor tests: [skipped-tests.txt](/home/merc/Development/current/json-rest-api/audit/evidence/tests/skipped-tests.txt)
+  - no direct regression for `patchRelationship` failure path before this audit probe.
+- Final: `partial`.
+- Remediation pointer: `ROADMAP-A-003`, `ROADMAP-B-003`.

package/audit/04-standards-rubric.md

@@ -0,0 +1,56 @@
+# Standards Rubric (M6, non-anyapi)
+
+## Corpus freeze and sources
+- JSON:API spec: `https://jsonapi.org/format/`
+- HTTP Semantics: `https://www.rfc-editor.org/rfc/rfc9110`
+- HTTP PATCH: `https://www.rfc-editor.org/rfc/rfc5789`
+- Source snapshots:
+  - [standard-jsonapi-snippets.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/standard-jsonapi-snippets.txt)
+  - [standard-rfc-snippets.txt](/home/merc/Development/current/json-rest-api/audit/evidence/external/standard-rfc-snippets.txt)
+
+Scoring scale: `1` poor, `3` mixed, `5` strong.
+
+## Criteria IDs
+- `STD-JAPI-01` JSON:API media/document envelope compliance.
+- `STD-JAPI-02` Relationship endpoint semantics and consistency.
+- `STD-HTTP-01` HTTP status code correctness.
+- `STD-HTTP-02` PATCH semantics and failure atomicity handling.
+- `STD-ERR-01` Error envelope quality/consistency.
+- `STD-SEC-01` Secure defaults and trust-boundary explicitness.
+- `STD-EXT-01` Extensibility/configurability hygiene.
+- `STD-OBS-01` Observability/operability diagnostics.
+- `STD-BC-01` Backward compatibility posture.
+- `STD-DOC-01` Documentation reliability.
+
+## Gap Matrix
+
+| ID | Score | Evidence-backed assessment | Gap class | Severity | Confidence |
+|---|---:|---|---|---|---|
+| STD-JAPI-01 | 3.5 | Core JSON:API document structures and media-type handling are broadly implemented; explicit JSON:API error object support exists in error classes. | design choice | medium | C4 |
+| STD-JAPI-02 | 2.5 | Relationship POST/DELETE endpoint paths pass; PATCH relationship error path is runtime-broken (`ReferenceError`), reducing conformance reliability. | defect | high | C5 |
+| STD-HTTP-01 | 4.0 | Transport maps major codes (400/403/404/415/500) and method-specific 201/204 behavior correctly in most paths. | design choice | low | C4 |
+| STD-HTTP-02 | 2.5 | PATCH baseline works for normal resource updates, but error-path handler defect in relationship PATCH violates robust failure handling expectations. | defect | high | C5 |
+| STD-ERR-01 | 2.0 | Envelope inconsistency observed: CORS blocked-origin returns `{ error: ... }`; relationship PATCH can surface raw `ReferenceError`. | defect | high | C4 |
+| STD-SEC-01 | 3.0 | Access/multitenancy plugins provide meaningful controls, but default CORS option combinations and error leakage behavior require explicit hardening guidance. | design choice | medium | C3 |
+| STD-EXT-01 | 3.5 | Hook/plugin architecture is flexible; bulk optimization hook path appears under-specified in execution wiring. | design choice | medium | C3 |
+| STD-OBS-01 | 3.0 | Logging is rich and structured, but unknown exceptions can surface raw messages; limited audit-style invariant telemetry. | design choice | medium | C3 |
+| STD-BC-01 | 2.5 | No explicit compatibility matrix/deprecation contract found; test failures indicate regression detection exists but policy is implicit. | documentation drift | medium | C3 |
+| STD-DOC-01 | 2.5 | Critical docs/comments drift found (`included` write behavior mismatch) and compliance language overstates edge consistency. | documentation drift | medium | C4 |
+
+## Rule-by-rule evidence pointers
+- Runtime and traces:
+  - [trace-write-patch.md](/home/merc/Development/current/json-rest-api/audit/traces/trace-write-patch.md)
+  - [trace-relationship-endpoints.md](/home/merc/Development/current/json-rest-api/audit/traces/trace-relationship-endpoints.md)
+  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
+- Code:
+  - [patch-relationship.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js)
+  - [rest-api-cors-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-cors-plugin.js)
+  - [express-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/connectors/express-plugin.js)
+  - [common.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js)
+- Docs drift:
+  - [docs-drift.md](/home/merc/Development/current/json-rest-api/audit/subsystems/docs-drift.md)
+
+## Standards takeaways
+- Strongest: method ordering discipline (validation/permissions before writes), broad JSON:API-oriented structure support, plugin extensibility.
+- Weakest: failure-path consistency for relationship PATCH and error envelope uniformity.
+- Immediate standards-critical fixes: `STD-JAPI-02`, `STD-HTTP-02`, `STD-ERR-01`.