⚠️ No Changeset found

Latest commit: d3ce17d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Observability map

As of d3ce17d.

19/100 over 413 measured of 428 entry points (base 19, no change)

What this PR changed

FIX FIRST

• /api/v1/obsmap-canary/tokens (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 11 of 413 entry points name a tenant on a failure path. 328 appear only here, 42 of them sensitive, in the JSON rather than the fix list.

CHECKS
  error-classification  166 applicable,  94 pass,   0 sole, global without it 10
  auth-boundary          63 applicable,  59 pass,   0 sole, global without it 15
  auth-scope             19 applicable,  17 pass,   0 sole, global without it 18
  request-context       413 applicable,  11 pass, 223 sole, global without it 65
  audit-trail            50 applicable,   3 pass,   0 sole, not in the score

Report only, nothing here gates the merge. The rules and their reasons: internal-packages/observability-map/README.md.

Test complete. All four states of the delta rule confirmed on the real runner, plus the stale-comment gap this exposed (fixed in 042c9c3) and its reconcile path. Closing; branch deleted.