Add repository audit report and improvement plan

[alexander-yevsyukov]

What this PR contains

• docs/audit-2026-06.md — a full read-only technical audit of this repository and core-jvm-compiler (architecture, code quality, security, testing, performance, dependencies, DevEx, docs), with every finding cited as file:line and labeled FACT vs JUDGMENT.
• .agents/tasks/improvement-plan.md — the repo-scoped follow-up plan (status: draft, awaiting human review of the audit's open questions).
• Version bump to 2.0.0-SNAPSHOT.052 per the versioning policy (originally .047; re-bumped after merging master, which had advanced to the published .051).
• Dependency report files: self-version labels updated to match the bump; content as regenerated on master by PR Update dependencies #66.

Audit TL;DR

Health grade: B+. Clean module DAG, modern toolchain, disciplined tests (no disabled tests, no mocks, behavior assertions), thorough CI. The notable debts, all cheapest to fix pre-GA:

1. S1 (Medium): a scrambled GitHub PAT in buildSrc/.../repo/Repositories.kt deliberately evades secret scanning — vendored from config, needs an owner decision (audit §6, Q1).
2. A1 (Medium): jvm/build.gradle.kts:39 re-exports the whole backend engine via api(...) — freezes engine internals as de-facto public API at GA.
3. S2 (Medium): mavenLocal() is first in settings.gradle.kts resolution order (sibling repo orders differently).
4. Doc1 (Medium): no user-facing getting-started or plugin-author docs.

No Critical findings. Strengths and full reasoning are in the report. The audit snapshot is dated: it describes master @ 3fe9dcb (2026-06-10).

Note on dependency reports

The sandbox running this session cannot reach the Spine artifact registries (HTTP 403 from the egress policy), so generatePom / mergeAllLicenseReports could not run here. The report content is master's real regeneration (PR #66); only the self-version labels were updated to .052 — mechanically identical to what regeneration would emit for them. If a maintainer prefers, run ./gradlew build locally to regenerate properly.

https://claude.ai/code/session_01J8FpY1sQd1ehN3upW7HiUr

[Copilot]

Pull request overview

Adds a repository audit report and a follow-up improvement plan, while bumping the compiler snapshot version and updating the generated dependency-report self-version labels accordingly.

Changes:

• Bump compiler snapshot version 2.0.0-SNAPSHOT.046 → 2.0.0-SNAPSHOT.047.
• Update dependency report artifacts/headers to reflect the new snapshot version.
• Add a technical audit report (docs/audit-2026-06.md) and a draft improvement plan (.agents/tasks/improvement-plan.md) to track follow-up work.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
version.gradle.kts	Snapshot version bump for the build/publishing version.
docs/dependencies/pom.xml	Updates the dependency report POM’s self <version> to the new snapshot.
docs/dependencies/dependencies.md	Updates dependency report headers to the new snapshot version.
docs/audit-2026-06.md	Adds the audit report documenting findings and rationale.
.agents/tasks/improvement-plan.md	Adds a draft plan for addressing the audit findings (tracking/tasks).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.34%. Comparing base (6235d20) to head (89dd851).

Additional details and impacted files

@@            Coverage Diff            @@
##             master      #69   +/-   ##
=========================================
  Coverage     75.34%   75.34%           
  Complexity      672      672           
=========================================
  Files           202      202           
  Lines          3947     3947           
  Branches        393      393           
=========================================
  Hits           2974     2974           
  Misses          855      855           
  Partials        118      118           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.