Tracking: July 2026 maintenance audit (83 verified findings)

[mmcky]

Tracking issue for the July 2026 full-repository maintenance audit. Milestone: Maintenance audit 2026-07.

What was done

A multi-agent audit swept every tracked file in the repo across 14 dimensions — shell correctness in each composite action, input/output contract consistency, security and supply chain, containers, CI workflows, documentation consistency, docs-vs-code accuracy, testing, duplication, observability, architecture, and repo hygiene — followed by four completeness sweeps.

Every candidate finding was then independently verified by two adversarial reviewers with different lenses (one trying to refute the technical claim, one judging whether it actually matters), and anything either reviewer rejected was dropped.

Raw findings	135
Rejected on verification	63
Confirmed	72
Added by completeness sweeps	11
Total actioned	83

Headline conclusions

The action logic is broadly sound — env-var passing in build-lectures, SHA-pinned third-party actions, explicit exit-code capture are all better than typical. Nothing found is architectural. Three things stand out:

restore-jupyter-cache is functionally broken in save-cache: true mode. Every output is wired to a step output that actions/cache does not expose, so cache-hit is always false and fail-on-miss always fails the job. That is precisely the mode the preview-optimisation work plans to roll out — it blocks #92.

The container publishing pipeline is quietly degraded. Registry layer cache has never worked (mixed-case org in the cache ref), :latest can be won by an older commit, the lecture-validation matrix silently cancels most of its jobs, and nothing alerts when a scheduled run fails — container validation was red for nine consecutive weeks in Feb–Apr 2026 with no notification. All four show green.

The docs are a release behind the containers. Eight places state Anaconda 2025.12 while both images ship anaconda=2026.06, including the repo's own stated dependency policy in PLAN.md. Five of the seven commits since v0.8.0 have no CHANGELOG entry, including the migration that is already live in :latest.

The work, in suggested order

Ordered by dependency, not just severity.

#	Issue	Labels	Notes
1	#103 — repair the container publish and validation pipeline	infrastructure high priority	Highest value per line changed; nothing depends on it
2	#104 — restore-jupyter-cache save-mode outputs	bug high priority	Blocks #92 — land before the save-cache rollout
3	#105 — preview deploy errors, CLI pinning, fork guidance	bug security high priority	Closes PLAN item 8; sets up #14
4	#106 — Anaconda 2026.06 baseline and measured sizes	documentation high priority	Prerequisite for trusting anything else in the docs
5	#107 — batch of small correctness fixes	bug	Advances #83; PLAN items 14/15
6	#108 — unify container smoke tests, fix the fixture	infrastructure testing	Distinct from #100 — these tests exist but cannot fail
7	#109 — reconcile READMEs and templates with shipped code	documentation	Fold in #99 while in the same file

Relationship to existing open issues

Nothing here supersedes an existing issue. #100 (no automated tests for publish/preview/cache logic) stays open — #108 covers only the container tests that already exist being unable to fail. #99 is folded into #109 as a same-file convenience. #83, #92, #14 and PLAN items 7/8/14/15 are advanced but not closed by this batch.

Labelling

Labels follow QEP-2: one Type label per issue, with infrastructure rather than maintenance for the CI/build/deploy work, and the batch grouped by milestone rather than an audit label — per QEP-2's rule that project/grouping labels belong in milestones. Two labels used here (security, testing) are local to this repo and not in QEP-2's core 18; see the comment on that PR.

Provenance

Full ranked report with all 83 findings, a 26-row quick-wins table, and per-finding evidence is held outside the repo and can be attached here on request.