Skip to main content

Evidence Audit Checklist

Purpose​

Provide a repeatable, evidence-first checklist to validate claims across the Portfolio App and Documentation App.

Scope​

In scope​

  • Portfolio App claims about SDLC, security, testing, and operations
  • Documentation App claims about governance artifacts and traceability
  • Evidence links in dossiers, ADRs, threat models, and runbooks

Out of scope​

  • New feature development
  • Deep refactors unrelated to evidence validation

Prereqs / Inputs​

  • Access to both repositories (portfolio-app, portfolio-docs)
  • Deployed docs site and app URLs (or local builds)
  • CI status for recent PRs

Procedure / Content​

1) Portfolio App claims (fast validation)​

  • Homepage narrative matches actual capabilities (no speculative claims)
  • Project summaries align with registry metadata
  • Evidence links on /projects/portfolio-app resolve to docs

Evidence to verify:

2) Testing and CI claims​

  • CI gate names match documentation
  • E2E and unit test counts align with dossier metrics
  • pnpm verify/pnpm test:e2e references are accurate

Evidence to verify:

3) Security and operations claims​

  • Threat model references current controls
  • Runbooks reflect current deploy/rollback behavior
  • No secrets or internal endpoints are documented

Evidence to verify:

4) Documentation integrity​

  • Dossier pages match required structure
  • Links are bidirectional and build passes
  • Roadmap and release notes match current status

Evidence to verify:

Validation / Expected outcomes​

  • Evidence links resolve without 404s
  • Claims are traceable to artifacts
  • CI and testing references are accurate

Failure modes / Troubleshooting​

  • Broken links: fix paths or update references to current doc locations
  • Outdated claims: edit narrative or update evidence artifacts
  • CI mismatch: update docs to match .github/workflows and scripts

References​