Quarterly audit checklist

Run this audit every quarter and before a major release.

Source control

• Local instructions match the current architecture and commands.
• No obsolete migration, compatibility path, package name, or domain remains.
• Required workflows use valid full action SHAs and minimum permissions.
• Checkout does not persist credentials.
• Issue forms, PR template, security path, and CodeRabbit still work.

Dependencies and supply chain

• The 24-hour quarantine is explicit.
• Every quarantine exception is exact, justified, and not expired.
• Renovate is active and security alerts are reviewed.
• Full and production audits pass.
• Changelogen and the package manager are pinned as required.

npm and releases

• Every public package has the expected dist-tags and provenance on recent releases.
• Every trust record targets the current repository, publish.yml, and npm.
• The npm environment still requires review and only permits main.
• No npm token or duplicate publication path exists.
• Git tags, GitHub releases, changelog versions, and npm versions agree.

Production documentation

• Vercel uses docs as Root Directory and the canonical domain points to production.
• A clean deployment succeeds.
• The Plausible script ID matches the current site.
• docs-feedback events arrive.
• The production acceptance checklist passes.

Record each failure as a focused issue with an owner and deadline. Do not create a broad cleanup branch that mixes unrelated repositories.