Run: audit-e2e — complete end-to-end audit

[Ansh-699]

Tracking issue for factory run audit-e2e.

Goal: complete end-to-end audit of SlipStream — on-chain program, client SDK,
keepers, frontend, API surface, ops/secrets, tests, and docs.

• run marker: audit-e2e
• factory branch: factory/audit-e2e
• spec: docs/spec/audit-e2e.md
• checks: docs/checks/audit-e2e/
• manifest: docs/runs/audit-e2e/manifest.md (local, gitignored)
• base commit: 698dd4f
• strategist: claude/best · builders: claude/tier-down · tracker: github

Assumptions

(to be filled from intake rulings)

Preflight

• tracker canary: SHELLS_OK (gh authed, Ansh-699/SlipStream)
• ground: ERROR->resolved (fresh run, manifest created at intake)

[Ansh-699]

RULING PENDING — run shape (default applies after ~5m silence)

The goal says "audit". The factory can run two ways:

• A (default, recommended): audit-only. Ground → parallel specialist audit
  wave → adversarial verification of every finding → synthesis → confirmed
  findings filed as sub-issues. No program/frontend code is modified in this run.
• B: audit + fix in one run. Same, then a builder wave that edits the money
  path and ships fixes behind the closing PR.

Default: A. Reasons: the request is an audit, not a remediation; findings must
be confirmed before anyone edits the money path; and B is a superset — if fixes
are wanted, A's filed issues are exactly the input for a follow-up run. Choosing
B silently would also be the scope growth the Hard Stops guard against.

Also recorded: GROUND: DRIFT no freeze commit recorded for docs/checks/audit-e2e/
— expected at intake; checks freeze at step 3.

[Ansh-699]

RULING (orchestrator) — builder isolation for a read-only wave

Hard Rule 5 requires a fresh builder per issue, worktree-isolated. For this run
the "builders" are auditors: they read source and write exactly one findings
file each, at disjoint paths. They do not mutate shared source, so worktrees buy
no conflict protection here and cost a checkout per slice.

Decision: run the audit wave without per-slice worktrees. Isolation is
preserved by (a) fresh agent per slice, (b) disjoint output paths, (c) read-only
instruction on all source. Recorded rather than silently substituted, per Hard
Rule 9. The final-review strategist still gets its own worktree from the factory
branch head, as the procedure requires.

If the wave is later extended to fix findings (ruling B), worktree isolation
comes back for that wave — those builders do mutate shared source.

[Ansh-699]

RULING (auto, 5m silence): run shape = A, audit-only - the goal says audit not remediation; findings must be confirmed before anything edits the money path; and A is a strict prefix of B, so the filed sub-issues are exactly the input for a follow-up fix run if one is wanted.

[Ansh-699]

RULING — spec intake questions (6/6 resolved, defaults accepted with 3 amendments)

Spec committed: d047658 → docs/spec/audit-e2e.md (12 slices, partition verified against git ls-files: 251 files, 0 overlaps, 0 unassigned).

1. Severity baseline = mainnet threat model, with a mandatory [reachable-now]/[mainnet-only] tag on every P0/P1. Devnet-actual grading would demote every money-path defect to P3 and make the audit worthless; PRODUCT.md makes "don't foreclose mainnet" binding.
2. Devnet access = read-only RPC, no signer. A signer means on-chain mutation — Hard-Stop territory in an audit-only run. Amendment: the frozen-mark condition is already CONFIRMED over read-only RPC this session (last_mark_price $74.114 vs a fresh $91.85 on the market's own configured feed; last_funding_ts 2026-08-05). Findings resting on it are CONFIRMED, not SUSPECTED.
3. Local builds = yes, read-only. Amendment: full suite is cargo test --workspace (123). The per-manifest form runs only 25. slipstream.so built at intake.
4. Findings artifact = docs/audit/audit-e2e/<slice-id>.md. Amendment: COMMITTED — it is the deliverable. Only docs/runs/ and docs/jobs/ are gitignored.
5. Filing = P0/P1 individually, P2/P3 batched thematically.
6. DESIGN.md untracked = flag only. Committing it is a code change and this run makes none. For the digest: surfaced to the human twice already with no ruling, so it stays genuinely open.

Baseline recorded: 123/123 Rust, tsc clean, lint 17 warnings (pre-existing).