json-rest-api 1.0.22 → 1.0.23

package/audit/06-findings.md

@@ -1,160 +0,0 @@
-# Consolidated Findings (M6, non-anyapi)
-
-## Executive synthesis
-- The non-anyapi architecture is fundamentally sound and modular, with strong coverage breadth and clear layering.
-- Current release risk is dominated by one runtime-confirmed high-severity defect: relationship PATCH failure handling (`RISK-001`).
-- Operational quality is mixed: core CRUD/relationship/read flows are stable, but edge reliability/performance and contract-consistency gaps remain.
-
-## Technical synthesis
-- Layering contract is mostly respected (`transport -> methods -> helpers -> storage -> DB`) with limited, intentional plugin-level direct DB use.
-- Invariant status is now fully classified (no unknowns): `2 fail`, `4 pass`, `6 partial`.
-- Runtime corroboration found three concrete failure classes:
-  - relationship PATCH error-path defect (high),
-  - positioning multifilter regressions (medium),
-  - schema export/test contract drift (medium).
-
-## Audit synthesis status
-- Repos audited:
-  - `/home/merc/Development/current/json-rest-api`
-  - `/home/merc/Development/current/json-rest-schema`
-- Baseline commits:
-  - `json-rest-api`: `72c08eec75f696a80c70b25608ed7c19eb505698`
-  - `json-rest-schema`: `9c30d3ba7317407a69231515fd58196862b25b34`
-- Runtime/test evidence captured in:
-  - [test-summary.md](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/test-summary.md)
-  - [failing-tests-summary.txt](/home/merc/Development/current/json-rest-api/audit/evidence/tests/failing-tests-summary.txt)
-  - [trace-write-patch.md](/home/merc/Development/current/json-rest-api/audit/traces/trace-write-patch.md)
-
-## Quality profile (1-5)
-- Correctness: `3.1`
-- Security: `3.4`
-- Resilience: `2.8`
-- Performance: `3.0`
-- Maintainability: `3.6`
-- Observability: `3.0`
-- Test quality: `3.3`
-- Weighted composite (charter weights): `3.2/5`
-
-## Findings by severity
-
-### High
-
-#### F-001 Relationship PATCH error-path defect (runtime-confirmed)
-- Type: defect
-- Assertion: [Verified][C5]
-- Evidence:
-  - [patch-relationship.js:53](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:53)
-  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
-- Impact:
-  - Masks root errors with `ReferenceError`.
-  - Breaks canonical write error handler path and rollback-hook behavior guarantees.
-- Invariant linkage: `INV-001`, `INV-008`.
-- Risk linkage: `RISK-001`.
-
-### Medium
-
-#### F-002 Positioning multifilter edge cases failing in regression suite
-- Type: defect
-- Assertion: [Verified][C5]
-- Evidence:
-  - [failing-tests-summary.txt](/home/merc/Development/current/json-rest-api/audit/evidence/tests/failing-tests-summary.txt)
-  - failing tests in `tests/positioning-multifilter.test.js`.
-- Impact:
-  - Incorrect ordering/filter semantics for edge cases.
-- Invariant linkage: `INV-010`, `INV-012`.
-- Risk linkage: `RISK-002`.
-
-#### F-003 Error envelope inconsistency across paths
-- Type: defect
-- Assertion: [Verified][C4]
-- Evidence:
-  - [rest-api-cors-plugin.js:112](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-cors-plugin.js:112)
-  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
-- Impact:
-  - Client error handling complexity; standards consistency erosion.
-- Invariant linkage: `INV-008`.
-- Risk linkage: `RISK-003`.
-
-#### F-004 Schema package test failure indicates export/contract drift
-- Type: defect
-- Assertion: [Verified][C5]
-- Evidence:
-  - [npm-test-json-rest-schema.log](/home/merc/Development/current/json-rest-api/audit/evidence/tests/npm-test-json-rest-schema.log)
-  - `SyntaxError`: missing `createKnexTable` export in `./src/index.js` import path.
-- Impact:
-  - Breaks schema-side test contract and affects migration/table tooling confidence.
-- Invariant linkage: `INV-012`.
-- Risk linkage: `RISK-004`.
-
-#### F-005 Documentation drift on write payload behavior (`included`)
-- Type: documentation drift
-- Assertion: [Verified][C4]
-- Evidence:
-  - [payload-validators.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js)
-  - [common.js:171](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js:171)
-  - [docs-drift.md](/home/merc/Development/current/json-rest-api/audit/subsystems/docs-drift.md)
-- Impact:
-  - Onboarding and integration errors from contradictory guidance.
-- Invariant linkage: `INV-011`.
-- Risk linkage: `RISK-005`.
-
-#### F-006 Include performance assurances are incomplete
-- Type: design choice / test gap
-- Assertion: [Inferred][C3]
-- Evidence:
-  - include logic code + passing include tests, but no query-count guard tests.
-  - [trace-read-query.md](/home/merc/Development/current/json-rest-api/audit/traces/trace-read-query.md)
-- Impact:
-  - Potential N+1/performance cliffs under high fanout/depth not bounded by tests.
-- Invariant linkage: `INV-007`, `INV-012`.
-- Risk linkage: `RISK-006`.
-
-#### F-007 Multi-tenant bypass resistance is strong but not exhaustively validated
-- Type: design choice / residual risk
-- Assertion: [Inferred][C3]
-- Evidence:
-  - access + multihome implementations and passing suites.
-  - [plugins-access.md](/home/merc/Development/current/json-rest-api/audit/subsystems/plugins-access.md)
-  - [plugins-multihome.md](/home/merc/Development/current/json-rest-api/audit/subsystems/plugins-multihome.md)
-- Impact:
-  - Alternate-path bypass risk remains partially unbounded.
-- Invariant linkage: `INV-009`.
-- Risk linkage: `RISK-007`.
-
-### Low
-
-#### F-008 Bulk optimization hook execution path clarity gap
-- Type: design choice
-- Assertion: [Inferred][C3]
-- Evidence:
-  - [plugins-bulk.md](/home/merc/Development/current/json-rest-api/audit/subsystems/plugins-bulk.md)
-- Impact:
-  - Maintainability and performance predictability concern.
-- Invariant linkage: `INV-010`.
-- Risk linkage: `RISK-008`.
-
-#### F-009 Unknown-error message exposure risk in transport
-- Type: design choice
-- Assertion: [Inferred][C3]
-- Evidence:
-  - [express-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/connectors/express-plugin.js)
-- Impact:
-  - Potential internal message leakage.
-- Invariant linkage: `INV-008`.
-- Risk linkage: `RISK-009`.
-
-## Architecture and boundary verdict
-- [Verified][C4] Primary layer contract is mostly respected: `transport -> methods -> helpers -> storage -> DB`.
-- [Verified][C4] No direct transport-level DB access found in express connector.
-- [Inferred][C3] Select plugins can access knex directly for specialized behavior (positioning/bulk), acceptable but increases contract-risk surface.
-- Evidence: [boundary-leak-checks.txt](/home/merc/Development/current/json-rest-api/audit/evidence/code/boundary-leak-checks.txt), [import-cycles-non-anyapi.txt](/home/merc/Development/current/json-rest-api/audit/evidence/code/import-cycles-non-anyapi.txt).
-
-## Residual uncertainty
-- Query-count behavior under deep include fanout.
-- File-upload + DB rollback compensation.
-- Full multi-tenant bypass matrix across all alternate endpoint combinations.
-- Production-like load behavior for socketio and bulk paths.
-
-Confidence summary:
-- High confidence (`C4-C5`): primary defects and failing runtime/test signals.
-- Medium confidence (`C3`): performance/security posture in scenarios not explicitly load-tested.

package/audit/07-risk-register.csv

@@ -1,10 +0,0 @@
-risk_id,title,subsystem,description,trigger,impact,likelihood,detectability,severity_score,confidence,evidence_refs,invariant_refs,owner_candidate,mitigation,verification_test,status
-RISK-001,Relationship PATCH error handler undefined,relationships,"patchRelationship catch path calls undefined handleWriteMethodError causing ReferenceError and masking root errors",Malformed/invalid relationship PATCH payload or downstream PATCH failure,5,4,2,80,C5,"plugins/core/rest-api-plugin-methods/patch-relationship.js:52-54; audit/evidence/runtime/probe-patch-relationship-referenceerror.log",INV-001|INV-008,REST methods maintainer,"Import and wire handleWriteMethodError + log + runHooks arguments exactly as post/delete relationship methods; add regression tests",Add test: patchRelationship invalid payload returns structured REST_API_PAYLOAD error and transaction hooks run,open
-RISK-002,Positioning multi-filter semantic regression,plugins-positioning,"Edge-case filters (empty/null and numeric/string) fail expectations in current suite",Running positioning multifilter scenarios with mixed-type filters,4,4,3,48,C5,"audit/evidence/tests/failing-tests-summary.txt; tests/positioning-multifilter.test.js",INV-010|INV-012,Positioning plugin maintainer,"Fix normalization/comparison logic for multifilter edge cases; preserve existing passing cases",Unskip/retain multifilter edge tests and add additional mixed-value fixtures,open
-RISK-003,Error envelope inconsistency across paths,transport-express+plugins-cors+relationships,"Some error paths do not return consistent JSON:API errors envelope",Blocked CORS origin or relationship PATCH failure path,4,3,3,36,C4,"plugins/core/rest-api-cors-plugin.js:112-117; audit/evidence/runtime/probe-patch-relationship-referenceerror.log",INV-008,Transport+REST maintainers,"Standardize all error responses through central envelope helper",Add transport-level tests asserting `errors[]` shape for blocked CORS and relationship endpoint failures,open
-RISK-004,Schema export/test contract drift,schema-core,"json-rest-schema test imports createKnexTable from src/index.js but export is missing",Running json-rest-schema test suite,4,3,2,48,C5,"audit/evidence/tests/npm-test-json-rest-schema.log",INV-012,Schema maintainer,"Either restore exported API contract or update tests/docs to current API surface",Add contract test for expected public exports in src/index.js,open
-RISK-005,Docs-write-payload drift (`included`),docs-drift,"Docs/comments imply included payload support while common write setup rejects included for writes",Users send included arrays in write payloads based on docs examples/comments,3,4,4,24,C4,"plugins/core/lib/querying-writing/payload-validators.js; plugins/core/rest-api-plugin-methods/common.js:171-176; audit/subsystems/docs-drift.md",INV-011,Docs owner + core maintainer,"Align docs/comments with runtime or implement explicitly supported behavior",Add executable docs test for write payload contract,open
-RISK-006,Include performance guardrail gap,query-engine,"No explicit query-count budget tests for deep/high-cardinality includes",High-fanout include queries in production-sized datasets,4,3,2,48,C3,"plugins/core/lib/querying/knex-relationship-includes.js; audit/traces/trace-read-query.md",INV-007|INV-012,Query engine maintainer,"Add query-count instrumentation tests and bounded include strategy checks",Add tests asserting max query count for representative include graphs,open
-RISK-007,Multi-tenant bypass matrix incomplete,plugins-access+plugins-multihome,"Core enforcement exists but alternate-path bypass attempts are not exhaustively tested",Complex combinations of relationship endpoints/includes/custom filters,5,2,2,40,C3,"plugins/core/rest-api-access.js; plugins/core/rest-api-multihome-plugin.js; tests/multihome.test.js",INV-009,Access/multitenancy maintainer,"Expand negative-path matrix across all endpoint families",Add red-team style integration suite covering query/get/relationship/include paths per tenant,open
-RISK-008,Bulk optimization hook path ambiguity,plugins-bulk,"beforeBulkPost optimization path appears under-specified in runtime flow",High-volume bulk POST with expected optimization,2,3,2,24,C3,"plugins/core/bulk-operations-plugin.js; audit/subsystems/plugins-bulk.md",INV-010,Bulk plugin maintainer,"Document or wire optimization path explicitly and test activation",Add explicit hook-activation test proving optimized/non-optimized branch behavior,open
-RISK-009,Raw unexpected error message exposure,transport-express,"Unknown errors may expose raw internal messages in API responses",Unhandled exception from plugin/helper path,3,3,3,27,C3,"plugins/core/connectors/express-plugin.js",INV-008,Transport maintainer,"Sanitize unknown error details and include correlation id for internals",Add test ensuring unknown exceptions return generic client-safe detail,open

package/audit/08-remediation-roadmap.md

@@ -1,177 +0,0 @@
-# Remediation Roadmap (non-anyapi)
-
-## Lane A (0-2 weeks): high-severity quick wins, low blast radius
-
-### ROADMAP-A-001 Fix relationship PATCH error-path handler wiring
-- Problem: `patchRelationship` catch path uses undefined `handleWriteMethodError` and missing handler args.
-- Rationale: Resolves highest-severity defect and failed invariants (`INV-001`, `INV-008`).
-- Proposed change:
-  - Import `handleWriteMethodError` from `common.js`.
-  - Accept/pass `log` and `runHooks` into catch handler consistently with post/delete relationship methods.
-- Files touched:
-  - [patch-relationship.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js)
-  - [relationship-endpoints.test.js](/home/merc/Development/current/json-rest-api/tests/relationship-endpoints.test.js)
-- Tests to add/update:
-  - Add regression for malformed relationship payload and forced downstream failure to confirm structured error + rollback hooks.
-- Rollback plan:
-  - Revert method-level catch changes and restore previous behavior if compatibility break appears; keep added tests to document expected behavior.
-- Exit criteria:
-  - Probe no longer emits `ReferenceError`.
-  - New regression tests pass.
-  - `INV-001` moves from fail to pass/partial with evidence.
-
-### ROADMAP-A-002 Resolve positioning multi-filter failing edge cases
-- Problem: Two failing assertions in `tests/positioning-multifilter.test.js`.
-- Rationale: Existing regression failures reduce correctness confidence and block clean baseline.
-- Proposed change:
-  - Align filter normalization/typing rules for empty/null and numeric/string comparisons.
-- Files touched:
-  - [rest-api-positioning-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-positioning-plugin.js)
-  - [positioning-multifilter.test.js](/home/merc/Development/current/json-rest-api/tests/positioning-multifilter.test.js)
-- Tests to add/update:
-  - Keep existing failing cases as fixed regressions; add one mixed-null-string and one mixed-number-string case.
-- Rollback plan:
-  - Revert normalization change and isolate behind explicit config flag if behavior change is too broad.
-- Exit criteria:
-  - `npm test` in json-rest-api has 0 fails for positioning suite.
-
-### ROADMAP-A-003 Add missing relationship PATCH endpoint coverage
-- Problem: Patch relationship endpoint lacks direct success/failure lifecycle tests.
-- Rationale: Prevent recurrence of endpoint-specific error-path defects.
-- Proposed change:
-  - Add explicit `patchRelationship` success and failure tests, including rollback assertions.
-- Files touched:
-  - [relationship-endpoints.test.js](/home/merc/Development/current/json-rest-api/tests/relationship-endpoints.test.js)
-- Tests to add/update:
-  - Success patch semantics test.
-  - Failure-path envelope + transaction cleanup test.
-- Rollback plan:
-  - Keep tests even if implementation needs phased rollout; gate temporary exceptions with clear TODO.
-- Exit criteria:
-  - Direct patch endpoint tests present and passing.
-  - `INV-004`/`INV-012` confidence upgraded.
-
-## Lane B (2-6 weeks): medium complexity structural fixes
-
-### ROADMAP-B-001 Clarify or wire bulk optimization hook execution
-- Problem: `beforeBulkPost` optimization path appears under-specified/dead in current flow.
-- Rationale: Reduces maintainability ambiguity and performance unpredictability.
-- Proposed change:
-  - Either explicitly invoke optimization hook path or remove dead branch and document canonical behavior.
-- Files touched:
-  - [bulk-operations-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/bulk-operations-plugin.js)
-  - [GUIDE_X_Bulk_Operations.md](/home/merc/Development/current/json-rest-api/docs/GUIDE/GUIDE_X_Bulk_Operations.md)
-- Tests to add/update:
-  - Hook activation proof test for optimization path.
-- Rollback plan:
-  - Revert to current explicit per-item path if optimization creates regressions.
-- Exit criteria:
-  - Hook behavior is deterministic and test-asserted.
-
-### ROADMAP-B-002 Standardize error envelope contract across all transport/plugin failures
-- Problem: Mixed envelope shapes (`errors[]` vs `{error}`/raw exceptions).
-- Rationale: Improves standards alignment and client reliability.
-- Proposed change:
-  - Centralize error serialization and enforce it in transport + CORS + relationship endpoint handlers.
-- Files touched:
-  - [express-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/connectors/express-plugin.js)
-  - [rest-api-cors-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-cors-plugin.js)
-  - [common.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js)
-- Tests to add/update:
-  - Contract tests for blocked origin, unknown exceptions, relationship endpoint failures.
-- Rollback plan:
-  - Feature flag strict envelope mode if downstream clients rely on legacy shape.
-- Exit criteria:
-  - `INV-008` becomes pass with transport and method-path test evidence.
-
-### ROADMAP-B-003 Add include performance guard tests (query-count budgets)
-- Problem: Include correctness is tested, but N+1 bounds are not.
-- Rationale: Converts performance unknown into measurable guardrails.
-- Proposed change:
-  - Add query instrumentation in test harness and enforce max-query thresholds for representative include graphs.
-- Files touched:
-  - [knex-relationship-includes.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying/knex-relationship-includes.js)
-  - [includes.test.js](/home/merc/Development/current/json-rest-api/tests/includes.test.js)
-  - [nested-includes.test.js](/home/merc/Development/current/json-rest-api/tests/nested-includes.test.js)
-- Tests to add/update:
-  - Query-count assertions for single-level and nested include scenarios.
-- Rollback plan:
-  - Start in soft-threshold mode if DB-dialect variance causes instability.
-- Exit criteria:
-  - `INV-007` moves from partial to pass/known-partial with quantified limits.
-
-### ROADMAP-B-004 Expand multitenancy bypass matrix
-- Problem: alternate endpoint combinations not exhaustively validated for tenant isolation.
-- Rationale: High-impact security invariant deserves explicit matrix tests.
-- Proposed change:
-  - Add matrix suite covering query/get/relationship/include paths across tenants and ownership roles.
-- Files touched:
-  - [multihome.test.js](/home/merc/Development/current/json-rest-api/tests/multihome.test.js)
-  - [rest-api-access.test.js](/home/merc/Development/current/json-rest-api/tests/rest-api-access.test.js)
-- Tests to add/update:
-  - Negative tests for each endpoint family and include variant.
-- Rollback plan:
-  - Isolate failing matrix cases with temporary allowlist while fixing implementation.
-- Exit criteria:
-  - `INV-009` confidence upgraded to C4+ with comprehensive negative coverage.
-
-### ROADMAP-B-005 Align docs/comments with observed critical behavior
-- Problem: docs drift on `included` write behavior and standards claims tone.
-- Rationale: lowers integration friction and trust risk.
-- Proposed change:
-  - Update docs/comments to match runtime behavior or explicitly document feature flags/limits.
-- Files touched:
-  - [payload-validators.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying-writing/payload-validators.js)
-  - [common.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/common.js)
-  - [docs/API.md](/home/merc/Development/current/json-rest-api/docs/API.md)
-  - relevant guide pages under `docs/GUIDE/`.
-- Tests to add/update:
-  - Executable docs examples for critical write/error semantics.
-- Rollback plan:
-  - Keep previous docs in changelog appendix if downstream teams need transition period.
-- Exit criteria:
-  - `INV-011` upgraded with docs-to-runtime contract checks.
-
-## Lane C (6+ weeks): larger architectural improvements
-
-### ROADMAP-C-001 Compatibility contract suite and deprecation policy
-- Problem: backward compatibility posture is implicit.
-- Rationale: stabilizes external contract and release risk.
-- Proposed change:
-  - Introduce contract-test suite + semver/deprecation policy doc for API behavior.
-- Files touched:
-  - new compatibility tests under `tests/`.
-  - docs policy section under `docs/`.
-- Tests to add/update:
-  - Golden response tests for core endpoints and error envelopes.
-- Rollback plan:
-  - Keep compatibility suite as non-blocking for one cycle before enforcing.
-- Exit criteria:
-  - Explicit compatibility guarantees published and CI-enforced.
-
-### ROADMAP-C-002 Operational observability hardening
-- Problem: limited invariant-level telemetry and correlation IDs for unexpected errors.
-- Rationale: improves incident detectability and MTTR.
-- Proposed change:
-  - Add structured error IDs, invariant tags, and optional query performance telemetry hooks.
-- Files touched:
-  - [express-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/connectors/express-plugin.js)
-  - selected method/common hook modules.
-- Tests to add/update:
-  - Assertions for correlation IDs and stable structured log fields in failure paths.
-- Rollback plan:
-  - Keep telemetry additions behind config flags to avoid log-volume shocks.
-- Exit criteria:
-  - Detectability score improvements in next audit cycle.
-
-## Invariant-to-roadmap coverage check
-- Failed invariants:
-  - `INV-001` -> `ROADMAP-A-001`
-  - `INV-008` -> `ROADMAP-A-001`, `ROADMAP-B-002`
-- Partial invariants with direct roadmap items:
-  - `INV-004` -> `ROADMAP-A-003`
-  - `INV-007` -> `ROADMAP-B-003`
-  - `INV-009` -> `ROADMAP-B-004`
-  - `INV-010` -> `ROADMAP-A-002`, `ROADMAP-B-001`
-  - `INV-011` -> `ROADMAP-B-005`
-  - `INV-012` -> `ROADMAP-A-003`, `ROADMAP-B-003`, `ROADMAP-C-001`

package/audit/09-signoff-check.md

@@ -1,23 +0,0 @@
-# Signoff Check
-
-Generated: 2026-03-01 (local run)
-
-## Metric snapshot
-- Critical files total: 66
-- Critical pass1 yes: 66
-- Critical pass2 yes: 66
-- Invariant statuses: pass=4, fail=2, partial=6, unknown=0
-- High severity risks: 1
-- High severity risks with mitigation+verification: 1
-
-## Final signoff criteria
-1. 100% critical-file dual-pass coverage: PASS
-2. 100% invariants not left unknown: PASS
-3. 100% high-severity risks have mitigation + verification test: PASS
-4. Standards and competitor matrices complete with evidence: PASS
-5. Prioritized roadmap complete with exit criteria: PASS
-6. Final report includes residual risk and confidence summary: PASS
-
-## Notes
-- Criteria 4-6 are document-completeness checks validated against `audit/04-08` and `audit/06` content.
-- anyapi-specific paths were excluded from all scoring conclusions.

package/audit/10-final-synthesis.md

@@ -1,29 +0,0 @@
-# Final Executive + Technical Synthesis (non-anyapi)
-
-## Executive summary
-- Overall architecture quality is solid, modular, and extensible, but current release risk is not low due to one runtime-confirmed high-severity defect in relationship PATCH failure handling.
-- Test breadth is strong (324 passing tests in `json-rest-api`), but there are active failures (2 positioning tests) and one schema-side contract test failure.
-- Standards alignment is mixed: core behavior is mostly consistent, but error envelope and failure-path consistency gaps remain.
-- Competitive position is strong versus serializer-only libraries on end-to-end server capabilities, with weaker reliability posture on edge failure semantics.
-
-## Technical summary
-- Invariants: `4 pass`, `2 fail`, `6 partial`, `0 unknown`.
-- Highest-risk issue:
-  - `RISK-001` (`severity_score=80`, `C5`): `patchRelationship` catch path references undefined handler.
-- Additional material issues:
-  - positioning multifilter edge failures,
-  - schema export/test contract drift,
-  - error envelope inconsistency,
-  - performance guardrail gaps for include query counts.
-
-## Residual risk
-- Remaining uncertainty is concentrated in load/performance and bypass-matrix depth, not in baseline CRUD correctness.
-- Residual risk level: **moderate** after immediate fixes; **high** if `RISK-001` remains unresolved.
-
-## Confidence summary
-- High confidence (`C4-C5`) for primary defects and major architecture assertions (code + runtime corroboration).
-- Medium confidence (`C3`) for performance and security posture under production-scale scenario classes not fully load-tested.
-
-## Go/No-go recommendation
-- **No-go for strict production hardening** until `ROADMAP-A-001` and `ROADMAP-A-002` are complete.
-- **Conditional go for controlled environments** if relationship PATCH endpoint is not exposed and known failures are accepted short-term.

package/audit/evidence/code/all-files-json-rest-api.txt

@@ -1,168 +0,0 @@
-AGENTS.md
-CLAUDE.md
-CRUSH.md
-LICENSE
-README.md
-TODO.todo
-audit/evidence/code/all-files-json-rest-api.txt
-connectors_ideas/fastify.js
-connectors_ideas/koa-plugin.js
-docs/API.md
-docs/COMPARISON.md
-docs/GUIDE/GUIDE_1_Initial_Setup.md
-docs/GUIDE/GUIDE_2_1_The_Starting_Point.md
-docs/GUIDE/GUIDE_2_2_Manipulating_And_Searching_Tables.md
-docs/GUIDE/GUIDE_2_3_BelongsTo_Relationships.md
-docs/GUIDE/GUIDE_2_4_HasMany_Records.md
-docs/GUIDE/GUIDE_2_5_HasMany_Polymorphic.md
-docs/GUIDE/GUIDE_2_6_Many_To_Many.md
-docs/GUIDE/GUIDE_2_7_Pagination_And_Ordering.md
-docs/GUIDE/GUIDE_2_8_Effects_of_PUT_and_PATCH.md
-docs/GUIDE/GUIDE_2_9_Relationships_Urls.md
-docs/GUIDE/GUIDE_2_Data_And_Relations.md
-docs/GUIDE/GUIDE_3_Field_Transformations.md
-docs/GUIDE/GUIDE_4_Authentication_And_Permissions.md
-docs/GUIDE/GUIDE_5_Non-Db_Resources.md
-docs/GUIDE/GUIDE_6_Positioning.md
-docs/GUIDE/GUIDE_7_Hooks_Data_Management_And_Plugins.md
-docs/GUIDE/GUIDE_X_Bulk_Operations.md
-docs/GUIDE/GUIDE_X_Cors.md
-docs/GUIDE/GUIDE_X_File_Uploads.md
-docs/GUIDE/GUIDE_X_Multihome.md
-docs/GUIDE/GUIDE_X_SocketIO.md
-docs/GUIDE/GUIDE_X_URL_Management.md
-docs/GUIDE/GUIDE_Y_Appendices.md
-docs/GUIDE/index.md
-docs/Gemfile
-docs/Gemfile.lock
-docs/ONBOARDING.md
-docs/QUICKSTART.md
-docs/_config.yml
-docs/_layouts/default.html
-docs/apple-touch-icon.svg
-docs/assets/css/style.scss
-docs/favicon.svg
-docs/index.md
-docs/mini-guides/file-uploads-complete.md
-eslint.config.js
-examples/url-override-example.js
-index.js
-lib/enhanced-logger.js
-lib/error-formatter.js
-lib/rest-api-errors.js
-package-lock.json
-package.json
-plugins/core/bulk-operations-plugin.js
-plugins/core/connectors/express-plugin.js
-plugins/core/connectors/lib/busboy-detector.js
-plugins/core/connectors/lib/formidable-detector.js
-plugins/core/connectors/lib/request-helpers.js
-plugins/core/file-handling-plugin.js
-plugins/core/lib/anyapi/anyapi-registry.js
-plugins/core/lib/anyapi/query/anyapi-query-adapter.js
-plugins/core/lib/anyapi/schema-utils.js
-plugins/core/lib/anyapi/utils/descriptor-helpers.js
-plugins/core/lib/dbTablesOperations.js
-plugins/core/lib/fractional-positioning.js
-plugins/core/lib/querying-writing/compile-schemas.js
-plugins/core/lib/querying-writing/connectors-query-parser.js
-plugins/core/lib/querying-writing/database-capabilities.js
-plugins/core/lib/querying-writing/database-value-normalizers.js
-plugins/core/lib/querying-writing/default-data-helpers.js
-plugins/core/lib/querying-writing/field-utils.js
-plugins/core/lib/querying-writing/knex-constants.js
-plugins/core/lib/querying-writing/knex-field-helpers.js
-plugins/core/lib/querying-writing/knex-json-api-transformers.js
-plugins/core/lib/querying-writing/payload-validators.js
-plugins/core/lib/querying-writing/schema-helpers.js
-plugins/core/lib/querying-writing/scope-validations.js
-plugins/core/lib/querying-writing/simplified-helpers.js
-plugins/core/lib/querying/knex-cross-table-search.js
-plugins/core/lib/querying/knex-json-api-transformers-querying.js
-plugins/core/lib/querying/knex-pagination-helpers.js
-plugins/core/lib/querying/knex-process-includes.js
-plugins/core/lib/querying/knex-query-helpers-base.js
-plugins/core/lib/querying/knex-query-helpers.js
-plugins/core/lib/querying/knex-relationship-includes.js
-plugins/core/lib/querying/knex-window-queries.js
-plugins/core/lib/querying/url-helpers.js
-plugins/core/lib/storage/storage-adapter.js
-plugins/core/lib/writing/knex-json-api-transformers-writing.js
-plugins/core/lib/writing/many-to-many-manipulations.js
-plugins/core/lib/writing/relationship-processor.js
-plugins/core/rest-api-access.js
-plugins/core/rest-api-anyapi-knex-plugin.js
-plugins/core/rest-api-cors-plugin.js
-plugins/core/rest-api-knex-plugin.js
-plugins/core/rest-api-label-plugin.js
-plugins/core/rest-api-multihome-plugin.js
-plugins/core/rest-api-plugin-hooks/compile-resource-schemas.js
-plugins/core/rest-api-plugin-hooks/register-relationship-routes.js
-plugins/core/rest-api-plugin-hooks/register-scope-routes.js
-plugins/core/rest-api-plugin-hooks/turn-scope-init-into-vars.js
-plugins/core/rest-api-plugin-hooks/validate-include-configurations.js
-plugins/core/rest-api-plugin-methods/add-route.js
-plugins/core/rest-api-plugin-methods/check-permissions.js
-plugins/core/rest-api-plugin-methods/common.js
-plugins/core/rest-api-plugin-methods/delete-relationship.js
-plugins/core/rest-api-plugin-methods/delete.js
-plugins/core/rest-api-plugin-methods/enrich-attributes.js
-plugins/core/rest-api-plugin-methods/get-related.js
-plugins/core/rest-api-plugin-methods/get-relationship.js
-plugins/core/rest-api-plugin-methods/get.js
-plugins/core/rest-api-plugin-methods/patch-relationship.js
-plugins/core/rest-api-plugin-methods/patch.js
-plugins/core/rest-api-plugin-methods/post-relationship.js
-plugins/core/rest-api-plugin-methods/post.js
-plugins/core/rest-api-plugin-methods/put.js
-plugins/core/rest-api-plugin-methods/query.js
-plugins/core/rest-api-plugin-methods/release.js
-plugins/core/rest-api-plugin.js
-plugins/core/rest-api-positioning-plugin.js
-plugins/core/socketio-plugin.js
-plugins/storage/local-storage.js
-plugins/storage/s3-storage.js
-quickTest.js
-scripts/debug-anyapi-review-filter.mjs
-scripts/inspect-anyapi-descriptor-country.mjs
-scripts/inspect-anyapi-descriptor.mjs
-scripts/run-docs.js
-test-debug.js
-tests/README.md
-tests/TEST_TEMPLATE.test.js
-tests/anyapi-basic.test.js
-tests/anyapi-cursor-pagination.test.js
-tests/bulk-operations.test.js
-tests/computed-fields.test.js
-tests/cors.test.js
-tests/curl.test.js
-tests/custom-idproperty-relationships.test.js
-tests/field-getters.test.js
-tests/field-setters.test.js
-tests/fixtures/api-configs.js
-tests/helpers/storage-mode.js
-tests/helpers/test-utils.js
-tests/include-depth-validation.test.js
-tests/includes.test.js
-tests/multihome.test.js
-tests/multihome.test.js.bak
-tests/nested-includes.test.js
-tests/ownership-optout.test.js
-tests/pagination-cursor-multifield.test.js
-tests/pagination-enhanced.test.js
-tests/polymorphic-relationships.test.js
-tests/polymorphic-simple.test.js
-tests/positioning-advanced.test.js
-tests/positioning-extended.test.js
-tests/positioning-multifilter.test.js
-tests/positioning.test.js
-tests/queries.test.js
-tests/query-limits.test.js
-tests/relationship-endpoints.test.js
-tests/relationships.test.js
-tests/rest-api-access.test.js
-tests/rest-api.test.js
-tests/searchschema-merge.test.js
-tests/socketio.test.js
-tests/test-development-guide.md
-tests/virtual-fields.test.js

package/audit/evidence/code/all-files-json-rest-schema.txt

@@ -1,12 +0,0 @@
-FUTURE_MIGRATION_MODULE.md
-ONBOARDING.md
-README.md
-eslint.config.js
-example.js
-package-lock.json
-package.json
-src/CorePlugin.js
-src/Schema.js
-src/index.js
-test-knex-table-real.js
-tests.js