docs(DOC-003): record the July 2026 review waves in the audit register [stacked on #106]

[DoRmAmMu1997]

⚠️ Stacked PR — merge order matters

Base: chore/qual-007-mypy-tests (#106), which stacks on #105. Merge #105 → #106 → this in that order; GitHub retargets each PR as its base branch merges and is deleted. Stacked at the user's request so each diff shows only its own ticket.

Ticket scope (DOC-003 — the wave's closing record)

Goal: keep docs/architecture/audit-2026-06.md what AGENTS.md says it is — the single durable record future audits read before re-flagging anything. Without this section, the next reviewer would re-derive the July history from 20 PRs.

In scope — one appended "July 2026" section containing:

• Both waves indexed: wave 1 (docs(DOC-002): add IPO subsystem to the AGENTS.md repo map #88–refactor(REF-002): extract fundamentals panel + scan view from app.py #97, other session) as a compact ticket list; wave 2 (test(TEST-007): render-path tests for fundamentals_panel + scan_view #98–docs(DOC-003): record the July 2026 review waves in the audit register [stacked on #106] #107, this session) as a per-PR table with the one-line "why".
• Findings verified FALSE this round (the register's core job): the cpr_yearly float "violation" (framework-wide indicator convention, not a Decimal-rule breach), the cpr_yearly "untested" claim (4 tests + golden existed), and the technical-agent injection "gap" (locked TEST-003 posture with regression tests).
• Wave 1's considered-and-REJECTED list recorded with one-line rationales so those five ideas (session-state registry, indicators decorator, sectors iterrows, DNS-rebinding on the fixed listing URLs, run_scan split) are not re-proposed cold.
• The June deferral table closed out item by item — including two entries with correction value for future estimators: pandas-stubs (June estimate "hundreds of errors"; actual, with version-matched stubs: 22) and the parquet sidecar (superseded by footer statistics with no second cache format, benchmark-gated exactly as the June objection demanded, plus the review hardening that treats footer bounds as an advisory index).

Out of scope (deliberate)

• No rewriting of the June content — the register is append-only history; even its June-era wording about "deferred" items stays, with the July table providing the closure.
• No new ADRs — decisions of record made this wave live in their own documents (REFACTOR-003 amendment, IPO-006 wrappers) and are linked from the PR trail.

This is ticket 10 of 10 — the second improvement wave is complete: TEST-007 #98, REF-003 #99, AI-006 #100, IPO-006 #101, TEST-006 #102, PERF-002 #103, DEPLOY-004 #104, QUAL-006 #105, QUAL-007 #106, DOC-003 #107.

Gates (docs-only diff, still run)

Gate	Result
Full suite --cov-fail-under=87	1,386 passed, 1 skipped; coverage 88.13%
ruff / mypy (209 files)	clean

Review

/code-review: Approve — every PR number, ticket mapping, and factual claim in the section was written from this wave's own verified reconciliation (not memory); the register's append-only convention and voice are preserved. /security-review: no findings (markdown-only; no secrets, no commands, no URLs beyond the repo's own PR links).

🤖 Generated with Claude Code

[DoRmAmMu1997]

Self-review (posted as COMMENT — the bot runs as the PR author and cannot APPROVE). Verdict: Approve.

1. Accuracy over recall — every PR number and ticket mapping came from this wave's own reconciliation and the PRs I raised, not from memory. Where wave-1 PR-to-ticket mapping was not individually verified (#90–#92), the section says so by grouping them rather than asserting a specific mapping.
2. Append-only convention respected — the June content is untouched, including its now-outdated "deferred" wording; the July table provides the closure without rewriting history, matching how the TEST-003 and REFACTOR-002 follow-ups were appended before.
3. The correction entries are the highest-value lines — pandas-stubs "hundreds → 22" and the sidecar → footer-statistics supersession both exist to stop a future reviewer from repeating June's estimate or re-proposing the rejected format. The PERF-002 entry also records the post-review hardening (footer bounds as advisory index) so the register describes the PR as it will merge, not as first pushed.
4. Rejected-ideas list is faithful — the five wave-1 rejections carry one-line rationales in register voice so they can be re-opened only with new evidence, per the register's "read this before re-flagging" contract.
5. Docs-only diff — one file, +77 lines; full suite, ruff, and mypy (209 files) still run and clean; no verbatim-asserted doc strings live in this file (those are in operations.md).
6. Stack position — base is #106; the banner spells out the #105 → #106 → #107 merge order and GitHub's auto-retargeting.

The second improvement wave is complete with this PR: 10 tickets, 10 PRs (#98–#107).

[DoRmAmMu1997]

Codex review plan before fixes:

• I’m going to update the July audit table so test(TEST-007): render-path tests for fundamentals_panel + scan_view #98, refactor(AI-006): single shared verdict-JSON extractor in ai_runtime #100, refactor(IPO-006): one shared SEBI URL canonicalizer + downloader doc riders #101, and docs(DEPLOY-004): Postgres worked guide + pool_pre_ping for server DBs #104 describe the material hardening present in their final merged heads, not only Claude’s initial ticket scope.
• I’m going to update the architecture index so audit-2026-06.md is described as the June–July durable review register rather than a June-only list.
• I’ll merge the updated chore(QUAL-007): check the whole test tree with mypy [stacked on #105] #106 stack into this branch, preserve DOC-003’s append-only history, run the docs/full quality gates, and push the result back to this PR.

No application behavior or product scope will change.

[DoRmAmMu1997]

Codex review found one inline documentation-accuracy issue; the architecture-index issue is recorded in the top-level plan because that file is not in this PR diff.

[DoRmAmMu1997]

Codex review follow-up complete for DOC-003.

What I fixed:

• merged the final chore(QUAL-006): adopt pandas-stubs across the checked application code #105/chore(QUAL-007): check the whole test tree with mypy [stacked on #105] #106 lineage so this register describes the code actually under review;
• updated test(TEST-007): render-path tests for fundamentals_panel + scan_view #98 to record symbol-stable chart selection, cached/agent error redaction, and force-refresh reruns;
• updated refactor(AI-006): single shared verdict-JSON extractor in ai_runtime #100 to record strict rejection of non-finite JSON and parser failures plus allow_inf_nan=False;
• updated refactor(IPO-006): one shared SEBI URL canonicalizer + downloader doc riders #101 to record encoded traversal/separator rejection, redirect PDF-path enforcement, final-URL wrapper resolution, and safe error normalization;
• updated docs(DEPLOY-004): Postgres worked guide + pool_pre_ping for server DBs #104 to record the protected env/prompt workflow, Alembic encoded-password safety, correct audit_logs name, and server-only pool_pre_ping;
• updated chore(QUAL-007): check the whole test tree with mypy [stacked on #105] #106 to state that its shrink-only mypy debt list is mechanically enforced;
• updated the architecture index from a June-only description to the June-July register through PR docs(DOC-003): record the July 2026 review waves in the audit register [stacked on #106] #107.

Verification on the final composed #105 -> #106 -> #107 tree:

• 1517 passed, 1 skipped; coverage 89.31% (floor 87%)
• mypy: Success: no issues found in 221 source files
• compileall, Ruff, Bandit, pinned pip-audit, pre-commit validation/hooks, and git diff --check: passed
• Docker is not installed on this workstation; the hosted Docker image check is the authoritative container result

The diff-scoped docs security review found no reportable issues.