A page from a real drift report.

Do NOT reintroduce a Supabase/Vercel code path or env var.

CLAUDE.md#L382-383

Five of them are declared right now, in the build task's env array: VERCEL_ENV, VERCEL_GIT_COMMIT_REF, SUPABASE_URL, SUPABASE_ANON_KEY and SUPABASE_SERVICE_ROLE_KEY.

turbo.json#L10-16

Both vendors were fully decommissioned — the projects torn down, the code coupling removed — and the decision record says so in the same words the context file uses. The instruction not to reintroduce them was written while the build tooling already declared them.

{
  "claim": "Do NOT reintroduce a Supabase/Vercel code path or env var.",
  "kind": "env_var_absent",
  "args": { "name": "SUPABASE_URL", "files": ["turbo.json"] },
  "source": "CLAUDE.md#L382"
}

One assertion per variable — five in total. A rule naming five things becomes five checks, so a partial cleanup reports as partial rather than green.

One entitlements resolver: entitlementsFor() in src/lib/subscriptions/entitlements.ts is the single place Free/Pro/Founding/comped tier logic is decided — don't branch on plan/tier ad hoc elsewhere.

CLAUDE.md#L56-58, repeated at #L637

The named file is now a re-export shim. The resolver moved to the shared package so web and mobile compute entitlements identically, and the shim's own header comment says edit the resolver in packages/shared/src/subscriptions-entitlements.ts — which is where the function is defined, at line 146.

apps/web/src/lib/subscriptions/entitlements.ts#L1-12 · packages/shared/src/subscriptions-entitlements.ts#L146

The rule itself is still correct and still load-bearing: there is exactly one resolver. Only the address is wrong — and it is wrong in the file an agent reads before touching billing.

{
  "claim": "One entitlements resolver: `entitlementsFor()` in
            `src/lib/subscriptions/entitlements.ts`.",
  "kind": "symbol_at_path",
  "args": {
    "symbol": "entitlementsFor",
    "path": "apps/web/src/lib/subscriptions/entitlements.ts"
  },
  "source": "CLAUDE.md#L56-58"
}

Reported as a suspected finding and confirmed by hand before it went in the report. symbol_at_path is regex-based and documented as unable to see through a re-export, so a failure here could have been the tool's limitation rather than real drift. It was real drift: the resolver has genuinely moved. A finding that had turned out to be the tool's blind spot would appear in the report labelled as such, with this same reasoning — never silently dropped, and never quietly counted.

Exception (as of 2026-07-12): docs-only and Tier 1 trivial changes may push straight to main.

CLAUDE.md#L392-393 — the repository's own file

Every change in every repo lands through a pull request — decided 2026-08-04, replacing the 2026-07-31 rule that reserved pull requests for repos where a merge does something irreversible or public.

CLAUDE.md#L88 — the hub repository, which also lists this repository as pull request: required at #L100

Neither sentence is false on its own. Both files are current, both are read by agents, and the later rule — 2026-08-04 — supersedes the earlier one, which no agent reading only the repository's file will ever discover. The repository file still presents the withdrawn exception as live policy, and branch protection does not settle it either: it is a private repository, where the enforcement switch is a paid feature.

None. No assertion can express this.

Every mechanical check verifies one file against the repository. This finding is two files disagreeing with each other, and both pass. It comes out of the contradiction pass, which is a person reading each context file against the others — and it is the reason this is an audit rather than a tool you install. The report says plainly that nothing guards this one; a green suite that implied otherwise would be worse than no suite.

pnpm verify:push — typecheck + unit only (no DB needed).

CLAUDE.md#L170, repeated at #L440

The script is pnpm typecheck && pnpm lint && pnpm test. It also runs lint. The description has been two-thirds right for long enough that the missing third is invisible.

package.json#L38

The existing script_exists assertion, unchanged — and it will keep passing.

The honest limit of the gate, stated in the deliverable rather than discovered later. Six assertion kinds check whether the thing a sentence names exists; none reads the adjective attached to it. What the suite guarantees is that no claim silently becomes false about a file, a script, a symbol, a workflow trigger or an environment variable. Prose accuracy beyond that is what the read-out and the re-check are for.