Research-Stack/audit/MASTER_AUDIT_SYNTHESIS.md

# Master Audit Synthesis
## Research-Stack Full Codebase Audit — June 21, 2026
### 6 parallel auditors, 2,068 lines of findings, 9,606 objects inspected

---

## The Honest Picture After 10+ Iterations

This repository has been through more than 10 development iterations. Each iteration added value. Each iteration also left debris. The debris has accumulated to the point where **the documentation describes a project that doesn't exist**, the **CI fails 74% of the time**, and **441 files are duplicates** of other files in the same repo.

This is not unusual for a solo researcher using AI agents. It's the expected state. What matters is seeing it clearly.

---

## Summary by Severity

| Severity | Count | Meaning |
|----------|-------|---------|
| **CRITICAL** | 7 | Security risk, data corruption, or fundamental dishonesty |
| **HIGH** | 12 | Broken functionality that affects correctness |
| **MEDIUM** | 23 | Quality issues that impede development |
| **LOW** | 31 | Cleanup, consistency, polish |

---

## The 7 Critical Issues

### C1: Hardcoded API Key (Security — revoke today)
**File:** `wolfram_verify.py`  
**Finding:** Hardcoded Wolfram Alpha API key `APPID = "HYJE3R3R63"`  
**Impact:** Anyone with git access can use this key. If repo is public (it is: 0 stars but public), key is exposed.  
**Fix:** Revoke key immediately. Move to env var. Scrub from git history.

### C2: Q16_16 Conversion Divergence (Data Corruption)
**Files:** `FixedPoint.lean`, `lib/q16.py`, `manifold_binary.h`  
**Finding:** Lean uses `floor()`, Python uses `round()`, C uses truncation. Values at half-LSB boundaries diverge silently across the entire pipeline.  
**Impact:** The same Q16_16 value means different things in different languages. This corrupts every cross-language data flow.  
**Fix:** Define canonical rounding mode in one file. All languages must implement identical conversion.

### C3: Receipts Describe Non-Existent Files (Fundamental Dishonesty)
**Files:** `e2e/E2E_MASTER_RECEIPT.md`, `library/CONCEPTUAL_UPGRADE_RECEIPT.md`  
**Finding:** Both receipts claim detailed test results from files (`E2EMasterTrace.lean`, `hachimoji_codec_v2.py`, `ClosedTrace.lean`, etc.) that **do not exist** in the `e2e/` or `library/` directories.  
**Impact:** The receipts are fabrications. This is the most dangerous kind of technical debt — the kind that makes you believe things are proven when they aren't.  
**Fix:** Generate the actual files, or remove the receipts until the files exist.

### C4: "3,500+ Proofs" Claim Is Inflated (Marketing vs. Reality)
**Files:** `README.md`, `GETTING_STARTED.md`, `EXPLANATION_FOR_HUMANS.md`  
**Finding:** The "3,500+ proofs" number matches the **compilation unit count**, not actual proved theorems. Many `.lean` files contain only definitions (e.g., `CarnotEfficiency.lean` = 377 bytes, one definition + `#eval`). The 26 `sorry` markers in core theorems are not counted.  
**Impact:** Visitors and potential collaborators are misled about the project's maturity.  
**Fix:** Replace with accurate count (e.g., "883 lines of Chentsov proof, 0 sorry; 26 sorry markers in core theorems under active development").

### C5: NaN Sentinel Collision (Silent Data Corruption)
**Files:** `BindServer.lean` (Lean side), `manifold_binary.h` (C side)  
**Finding:** Lean uses `0xFFFFFFFF` as NaN sentinel. C interprets `0xFFFFFFFF` as a valid large positive integer. On overflow, Lean sends "NaN", C receives a valid number.  
**Impact:** Overflow errors become silently wrong data instead of errors.  
**Fix:** Use IEEE 754 NaN encoding on both sides, or explicit error flags.

### C6: Eigensolid Convergence Theorem Is a Tautology
**File:** `BraidEigensolid.lean`  
**Finding:** The flagship compressor correctness theorem `eigensolid_convergence` literally restates its hypothesis (`h_eig`). It proves nothing. Cited as complete across multiple documents.  
**Impact:** A core correctness claim is vacuous.  
**Fix:** Either prove it properly or downgrade the claim to a conjecture.

### C7: 74% CI Failure Rate (Systemic Unreliability)
**Files:** `.github/workflows/`  
**Finding:** Math-First Checks, Pages Build, and Batch Compute workflows fail consistently. Only Wolfram Alpha verification passes. `.pre-commit-config.yaml` is referenced by CI but **does not exist**.  
**Impact:** Every push to main has a 74% chance of failing CI. This trains developers to ignore CI.  
**Fix:** Fix the 3 broken workflows. Create `.pre-commit-config.yaml`.

---

## The 12 High Issues

### H1: IsSidonSet Defined Twice (Lean)
Two different definitions in `SidonSets.lean` and `ErdosRenyiPipeline.lean` with slightly different signatures. Any theorem using one won't work with the other.

### H2: SQL Injection Pattern (Python)
`finance_manager.py` lines 46, 62-64: f-string SQL with user input. Unfixed despite PR #76 claiming to patch it.

### H3: Command Injection (Python)
`verify_all_shims.py` uses `subprocess` with `shell=True` and user-controlled paths.

### H4: Duplicate q16.py (Python)
Two copies (`lib/q16.py` and `auto/lib/q16.py`) with different subsets of operations. Import ambiguity.

### H5: Stats_show Destructive Read (C)
`pist_neuromorphic.c`: `stats_show()` mutates frequency data during read. Subsequent reads return wrong values.

### H6: AGENTS.md References Non-Existent Components
The 27KB AGENTS.md describes extracted/verified components that don't exist in the codebase.

### H7: No Q16_16 Roundtrip Test
The full Lean→Python→C→Lean data path is completely untested in CI.

### H8: 66 Large Files in Git (Not LFS)
44.88 MB PDF, 25 MB GIF (duplicated), 187 MB WAV files, 24 MB compressed file. Should be in Git LFS.

### H9: 192 Build Artifacts Committed to Main
`.pist` and `.pist.meta` files are generated by Lean build but committed to git. Should be `.gitignore`d.

### H10: Dependencies Unpinned
`requirements.txt` uses `>=` for 20+ critical deps (qiskit, numpy, scipy) with no lock files.

### H11: 111 Misplaced Files
Documentation scattered in core formalism (24 files) and applications (75 files) instead of `6-Documentation/`.

### H12: NoDupeLabs Duplicated (1,029 Files)
Full project copied in both `4-Infrastructure/` and `5-Applications/`. 100+ confirmed identical via git blob hashes.

---

## Per-Dimension Breakdown

### Lean Formalism (1,295 files)
- 26+ `sorry` markers across core theorems
- T1_Coherence.lean: 12 sorry (the hardest — Chentsov-level)
- ErdosRenyiPipeline.lean: 6 sorry
- E8Sidon.lean: 5 sorry
- 4 duplicate definitions detected
- 220 naming convention violations (mostly lowercase_snake in Lean where PascalCase expected)
- ~119 files under 500 bytes (likely stubs)

### Infrastructure (Python/Rust/C/Shell)
- 3 secrets found (1 critical API key)
- 6 security issues (SQL injection, command injection, unsafe cast)
- 3 dead code functions
- 2 broken imports
- 3 path mismatches
- 2 build problems

### Documentation (1,956 Markdown files)
- 8 stale claims (including "3,500+ proofs")
- 16 broken cross-references
- 8 old TODOs (>2 months)
- 45 duplicate documentation pairs
- 15 empty/minimal READMEs
- 6 undocumented major modules

### Integration (Lean ↔ Python ↔ C)
- 18 integration points identified
- 3 critical type mismatches (Q16_16 rounding)
- 7 error handling gaps
- 2 broken CLI contracts
- 5 workflow gaps
- 2 race conditions

### Quality (CI/Tests/Cleanup)
- CI failure rate: 74%
- Only 2 actual pytest files out of 1,282 "test" named files
- 627 duplicate basenames
- 57 experimental files on main
- 66 large files (>1MB)
- 101 binary files in git
- ~297 files needing cleanup

### Consistency (Organization/Naming)
- 220 naming violations
- 111 misplaced files
- 5 version skew issues
- 2 dead symlinks
- 441 duplicate files
- 4 removed feature references
- 179 gitignore gaps

---

## The Brutal Truth

This is not a codebase that's ready for external use. It's a **research notebook** that has grown to 9,606 objects across 6 architecture layers. The core mathematical insight — chaos game + Sidon + Chentsov + Hachimoji — is sound and genuinely novel. But the implementation around it has accumulated 10 iterations of debris.

**What works:**
- ChentsovFinite.lean (883 lines, 0 sorry) — the keystone theorem
- HachimojiSubstitution.lean — the 8-state encoding with bijection
- qaoa_adapter.py — the QUBO ↔ QAOA bridge (solid engineering)
- The 6-layer architecture concept (even if the files are misplaced)

**What needs immediate attention:**
1. Revoke the API key (C1) — 5 minutes
2. Fix Q16_16 rounding to be canonical (C2) — 1 day
3. Delete or generate the missing files that receipts claim exist (C3) — 1 day
4. Fix the 3 broken CI workflows (C7) — 1 day
5. Remove 1,029 duplicate NoDuPeLabs files (H12) — 30 minutes

**What needs a focused cleanup sprint:**
- All 26 sorry markers in core theorems
- The SQL injection and command injection
- The 66 large files → Git LFS
- The 192 build artifacts → .gitignore
- The 111 misplaced files → correct directories

The ship in the bottle is still impressive. But the bottle has accumulated 10 layers of dust, a hardcoded API key, and 441 duplicate planks. Time to clean the glass.

---

*Audit conducted: June 21, 2026*  
*Auditors: 6 parallel specialist agents*  
*Objects inspected: 9,606*  
*Findings: 2,068 lines across 6 reports*  
*This synthesis: 1 report bringing all findings into focus*