Move ASVS_CHECKLIST_v0.12.6.md, PENTEST_REPORT_VEZA_v0.12.6.md, and
REMEDIATION_MATRIX_v0.12.6.md to docs/archive/ — all reference a
pentest conducted on v0.12.6 (2026-03), stale relative to the current
v1.0.7 codebase (different security middleware, different payment
flow, different config validation).
Update CLAUDE.md tree listing and AUDIT_REPORT.md §9.1 to reflect the
archive location. Keep docs/SECURITY_SCAN_RC1.md (still current).
Closes AUDIT_REPORT §9.1 obsolete-doc item.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Triple cleanup, landed together because they share the same cleanup
branch intent and touch non-overlapping trees.
1. 38× tracked .playwright-mcp/*.yml stage-deleted
MCP session recordings that had been inadvertently committed.
.gitignore already covers .playwright-mcp/ (post-audit J2 block
added in d12b901de). Working tree copies removed separately.
2. 19× disabled CI workflows moved to docs/archive/workflows/
Legacy .yml.disabled files in .github/workflows/ were 1676 LOC of
dead config (backend-ci, cd, staging-validation, accessibility,
chromatic, visual-regression, storybook-audit, contract-testing,
zap-dast, container-scan, semgrep, sast, mutation-testing,
rust-mutation, load-test-nightly, flaky-report, openapi-lint,
commitlint, performance). Preserved in docs/archive/workflows/
for historical reference; `.github/workflows/` now only lists the
5 actually-running pipelines.
3. Orphan code removed (0 consumers confirmed via grep)
- veza-backend-api/internal/repository/user_repository.go
In-memory UserRepository mock, never imported anywhere.
- proto/chat/chat.proto
Chat server Rust deleted 2026-02-22 (commit 279a10d31); proto
file was orphan spec. Chat lives 100% in Go backend now.
- veza-common/src/types/chat.rs (Conversation, Message, MessageType,
Attachment, Reaction)
- veza-common/src/types/websocket.rs (WebSocketMessage,
PresenceStatus, CallType — depended on chat::MessageType)
- veza-common/src/types/mod.rs updated: removed `pub mod chat;`,
`pub mod websocket;`, and their re-exports.
Only `veza_common::logging` is consumed by veza-stream-server
(verified with `grep -r "veza_common::"`). `cargo check` on
veza-common passes post-removal.
Refs: AUDIT_REPORT.md §8.2 "Code mort / orphelin" + §9.1.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
First-attempt commit 3a5c6e184 only captured the .gitignore change; the
pre-commit hook silently dropped the 343 staged moves/deletes during
lint-staged's "no matching task" path. This commit re-applies the intended
J1 content on top of bec75f143 (which was pushed in parallel).
Uses --no-verify because:
- J1 only touches .md/.json/.log/.png/binaries — zero code that would
benefit from lint-staged, typecheck, or vitest
- The hook demonstrated it corrupts pure-rename commits in this repo
- Explicitly authorized by user for this one commit
Changes (343 total: 169 deletions + 174 renames):
Binaries purged (~167 MB):
- veza-backend-api/{server,modern-server,encrypt_oauth_tokens,seed,seed-v2}
Generated reports purged:
- 9 apps/web/lint_report*.json (~32 MB)
- 8 apps/web/tsc_*.{log,txt} + ts_*.log (TS error snapshots)
- 3 apps/web/storybook_*.json (1375+ stored errors)
- apps/web/{build_errors*,build_output,final_errors}.txt
- 70 veza-backend-api/coverage*.out + coverage_groups/ (~4 MB)
- 3 veza-backend-api/internal/handlers/*.bak
Root cleanup:
- 54 audit-*.png (visual regression baselines, ~11 MB)
- 9 stale MVP-era scripts (Jan 27, hardcoded v0.101):
start_{iteration,mvp,recovery}.sh,
test_{mvp_endpoints,protected_endpoints,user_journey}.sh,
validate_v0101.sh, verify_logs_setup.sh, gen_hash.py
Session docs archived (not deleted — preserved under docs/archive/):
- 78 apps/web/*.md → docs/archive/frontend-sessions-2026/
- 43 veza-backend-api/*.md → docs/archive/backend-sessions-2026/
- 53 docs/{RETROSPECTIVE_V,SMOKE_TEST_V,PLAN_V0_,V0_*_RELEASE_SCOPE,
AUDIT_,PLAN_ACTION_AUDIT,REMEDIATION_PROGRESS}*.md
→ docs/archive/v0-history/
README.md and CONTRIBUTING.md preserved in apps/web/ and veza-backend-api/.
Note: The .gitignore rules preventing recurrence were already pushed in
3a5c6e184 and remain in place — this commit does not modify .gitignore.
Refs: AUDIT_REPORT.md §11
