🔁 Source Control, CI/CD & Development Practices

📋 Summary

The repository was supplied as a single squashed commit, so the actual history of how the software was built — branching, commit habits, code review, slowdowns — cannot be seen and must be requested. What the repository does reveal is a disciplined, well-automated local process: a single script runs six quality gates (tests, type-checking, linting, a confidentiality scrub, a route/test-harness contract check and a production build), and the same gates run in GitHub Actions on every push and pull request. The documented workflow, however, is trunk-based with changes merged straight to main by fast-forward, with no pull-request review step, and the process documents are written for AI coding "sessions" working under one owner's direction. There is no security or dependency scanning in the pipeline, no automated deployment or migration step visible in the repository, and no branch protection that the repository can evidence. For a buyer this means good automated hygiene but little evidence of independent human review.

🎯 Rating

🟡 ●●●○○ 3 / 5 — Amber. Strong, mechanically enforced quality gates and CI, offset by no evidenced code review, no security scanning, hand-applied migrations, and a history that cannot be inspected.

🔍 Findings

Repository structure and organisation

Organisation is coherent and follows framework conventions. One oddity: a production route tree also contains the test harness (src/app/qa, gated at runtime by NEXT_PUBLIC_QA=1) — see Module 9.

Branching model

• Determined from history: [Unavailable] — one commit (3789df6, 721 files, 125,806 insertions); git rev-parse --is-shallow-repository → false, so history was squashed deliberately rather than truncated by the clone.
• Documented model: trunk-based with short-lived worktree branches, rebased on main and merged with git merge --ff-only then pushed directly to origin main; "Never force-push". [Observed] docs/HANDOVER.md lines 26–60.
• SECURITY.md: "main only. There are no release branches or tags; every deployment builds from main." [Observed]

Commit hygiene

[Unavailable] — commit size, message quality, frequency, dormant periods and recent slowdowns all require the unsquashed history. The documented convention (HANDOVER.md) requires a fixed committer identity, two trailers supplied by "the session reminder", "reasons not sources" in messages, and no model names. [Observed] This convention indicates commits are authored by AI coding sessions under the owner's identity. [Inferred]

Evidence of code review

• No PR template, CODEOWNERS, or review configuration in .github/. [Observed] ls .github → workflows/ only.
• Documented landing path bypasses pull requests (fast-forward merge to main). [Observed] HANDOVER.md.
• Review appears to happen as owner inspection of a "build board" (screenshots published as a web page) and a "comment ledger", i.e. product/visual review rather than code review. [Observed] HANDOVER.md "Where things stand", "The board". [Inferred] that no second human reviews code.
• Branch protection settings live in GitHub, not the repository. [Unavailable — requires GitHub repository admin access.]

CI/CD

Workflow permissions are least-privilege (contents: read) and runs are de-duplicated with concurrency. [Observed] ci.yml.

Automated checks and bypassability

• Local: npm run gates (scripts/gates.sh) runs six gates by exit code and stops on first red — explicitly designed after two incidents where a red gate was missed by piping through grep. [Observed] script header comment.
• Custom static gates enforced through unit tests: src/lib/write-results.test.ts (every awaited write must read its result), src/lib/schema-columns.test.ts (every column the code names must exist in baseline.sql). These are unusually strong, project-specific guard rails. [Observed]
• Bypass: because the documented flow pushes directly to main, CI is after-the-fact; whether main is protected so a red CI blocks deploy cannot be determined. [Unavailable — GitHub branch protection and Vercel "ignored build step" settings.] CLAUDE.md itself records "Three pushes to main sat red … on 2026-09-06". [Observed]

🧾 Evidence

• git log --all --format=… → single commit; git show --stat HEAD → 721 files, 125,806 insertions.
• git rev-parse --is-shallow-repository → false.
• Files: .github/workflows/ci.yml, .github/workflows/walk.yml, scripts/gates.sh, docs/HANDOVER.md (lines 1–62), SECURITY.md, CLAUDE.md ("Verification", "Migrations").
• Local runs: npx tsc --noEmit (exit 0), npx eslint (exit 0), npx vitest run (687 passed), node scripts/scrub.js, node scripts/harness-contract.js.

⚠️ Risks

✅ Recommendations