CLAUDE.md and README still asserted a state the code had moved past:
- JWT "no revocation (B-34)" — token_version implements exactly that
revocation, and the tv-claim behaviour (including why the deploy did not
log everyone out) is worth stating instead of denying;
- /report-bug "a placeholder" — it shipped fully implemented and
translated, with an admin triage section, a reporter-side status view and
its own audit event; only /guida is still a stub, and /admin has six
sections now, not five;
- three stale test counts (CLAUDE.md twice, README once);
- a code map missing app/auth/rate_limit.py, app/api/client_ip.py and
app/api/routes/bug_reports.py;
- README linking flowchart.mmd (the diagrams live in flowchart/), the
anchor CLAUDE.md#tech-stack-mvp (gone), and describing
docs/running-the-server.md as "local venv vs. Docker" after B-44 made
Docker the only supported way to run the server.
The rate-limiting bullet the audit also flagged already reads correctly.
tests/unit/test_docs_current.py pins all of it: the documented counts must
equal what the suite actually collects, the retired claims must stay
retired, the code map must name those modules, and every relative README
link and CLAUDE.md anchor must resolve. None of this is catchable by
reading the code, which is how it drifted in the first place.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
davideandClaude Opus 5
162ceed40f