# Audit Plan & Subagent Roles

## Subagent Execution Mode
**Operational Mode**: `ISOLATED_SEQUENTIAL_ROLE_EXECUTION`
> [!IMPORTANT]
> The current workspace environment does not feature independent parallel repository-reading subagents. All audit roles will be executed sequentially with isolated file scopes and strict domain boundaries.

---

## Mandatory Global Audit Exclusions
All roles must explicitly exclude generated artifacts, build outputs, and dependencies:
- `**/node_modules/**`
- `**/.next/**`
- `**/dist/**`
- `**/build/**`
- `**/coverage/**`
- `**/.turbo/**`
- `**/.cache/**`
- `**/*.tsbuildinfo`
- `frontend/application/**` (Generated/Placeholder directory)
- `frontend/admin-panel/**` (Placeholder directory)
- Generated Prisma client (`.prisma/client`, `@prisma/client`)

---

## Reconciled Audit Roles & Assignments

### 1. Lead Architect / Orchestrator
- **Scope**: System architecture, cross-cutting contracts, global governance, and Phase 2 report consolidation.
- **Included Paths**: `package.json`, `README.md`, `BACKEND_INTEGRATION.md`, `DATABASE_SCHEMA.md`, `docs/audit/*`.
- **Expected Output**: `docs/audit/05-architectural-audit.md`

### 2. React / Vite Storefront Auditor
- **Scope**: Active customer storefront UI, React components, state management (Zustand), client-side routing, styling, and asset management.
- **Included Paths**: `src/**/*`, `index.html`, `vite.config.ts`, `tsconfig.json`, `package.json`.
- **Expected Output**: `docs/audit/06-storefront-audit.md`

### 3. NestJS Backend Auditor
- **Scope**: Controller handlers, injectable services, NestJS modules, guards, exception filters, DTO validation, and route structure.
- **Included Paths**: `backend/src/**/*`, `backend/tsconfig.json`, `backend/nest-cli.json`, `backend/package.json`.
- **Expected Output**: `docs/audit/07-backend-audit.md`

### 4. Admin Features Auditor
- **Scope**: Backend administrative endpoints (`backend/src/settings`), role-based protection for admin capabilities (`Admin` role guard checks), and backend management DTOs. (Note: Standalone admin frontend is absent; scope focuses on backend admin features).
- **Included Paths**: `backend/src/settings/**/*`, `backend/src/auth/guards/**/*`, `src/components/**/*` (if admin UI controls exist).
- **Expected Output**: `docs/audit/08-admin-features-audit.md`

### 5. Database & Data Integrity Auditor
- **Scope**: Schema definitions, relational constraints, indices, migration history, monetary/weight decimal precision (`Decimal(15,2)`), and data seeding logic.
- **Included Paths**: `backend/prisma/schema.prisma`, `backend/prisma/seed.ts`, `DATABASE_SCHEMA.md`.
- **Expected Output**: `docs/audit/09-database-audit.md`

### 6. Security Auditor
- **Scope**: Authentication flows, JWT token lifecycle, password hashing (`bcrypt`), Helmet HTTP security headers, rate limiting (`@nestjs/throttler`), CORS, and secret exposure risks.
- **Included Paths**: `backend/src/auth/**/*`, `backend/src/common/**/*`, `.env.example`, `docker-compose.yml`, `nginx.conf`.
- **Expected Output**: `docs/audit/10-security-audit.md`

### 7. TypeScript & Code Quality Auditor
- **Scope**: Strict type safety, avoiding `any` assertions, compiler configuration alignment, code formatting compliance, and lint rule enforcement.
- **Included Paths**: `tsconfig.json`, `backend/tsconfig.json`, `src/**/*`, `backend/src/**/*`.
- **Expected Output**: `docs/audit/11-code-quality-audit.md`

### 8. Testing & Reliability Auditor
- **Scope**: Unit test suites, integration test setups, spec assertion completeness, mocking strategies, and edge-case handling.
- **Included Paths**: `src/test/**/*`, `backend/test/**/*`, `backend/src/**/*.spec.ts`, `package.json`, `backend/package.json`.
- **Expected Output**: `docs/audit/12-testing-audit.md`

### 9. DevOps & CI/CD Auditor
- **Scope**: Multi-stage Docker builds, container orchestration, reverse proxy NGINX rules, Prometheus metrics endpoints, and missing CI/CD pipeline gaps.
- **Included Paths**: `Dockerfile`, `backend/Dockerfile`, `docker-compose.yml`, `nginx.conf`, `prometheus.yml`, `.dockerignore`, `backend/.dockerignore`.
- **Expected Output**: `docs/audit/13-devops-audit.md`

### 10. Documentation Engineer
- **Scope**: Synchronization between source implementation and documentation artifacts (Swagger OpenAPI specs, markdown architecture guides).
- **Included Paths**: `README.md`, `swagger.yml`, `BACKEND_INTEGRATION.md`, `DATABASE_SCHEMA.md`, `backend/README.md`.
- **Expected Output**: `docs/audit/14-documentation-audit.md`

---

## Strategy for Deduplication & Consolidation
- **Strict File Ownership**: Each auditor evaluates code only within their assigned primary directory paths.
- **Cross-Cutting References**: If an auditor discovers an issue spanning another domain (e.g. security issue inside NestJS controller), they record the specific code location and defer root-cause analysis to the primary domain owner.
- **Unified Synthesis**: The Lead Orchestrator reviews all auditor outputs to create the final synthesized executive summary.