Documentation Integrity Report

Field	Value
Protocol	/docs-verify
Date (local)	2026-07-11
Mode	CORPUS
Scope paths	docs/**/*.md (excl. node_modules, .vitepress)
Repos consulted	vtrc-api, cu-central-api, centralize-api, vtrc-web, vtrc-rc-backoffice
Files in scope	205
Files trap-swept	All volume-* + audit (mandatory traps T1–T14)
Overall verdict	CONDITIONAL PASS
Evidence standard	Static code + config re-measured this run (no e2e)
Prior audits	Leads only — docs-verify-2026-07-11-corpus-pass.md, DELTA, A.8

---

1. Executive Verdict

English: VitePress volumes clear all P0 trap classes against code re-measured in this run (live bridge = cu-central, ports layered in Vol 0/3/5/10/16, KBANK = กสิกรไทย, OTP in MariaDB, statusKcash ids 6–10, cron gating, Vol 6/7 inventories, A.4↔Vol 14). Verdict is CONDITIONAL PASS because Volume 2 still oversimplifies cu-central as “port 8082” without CODE_DEFAULT 8080 classification (P1 PARTIAL), and superseded docs/audit/* bodies remain partially stale under banners (P2).

ไทย: คู่มือ VitePress ผ่านเกณฑ์ P0 หลังวัดโค้ดใหม่ในรอบนี้ — แต่สถานะรวมเป็น CONDITIONAL PASS เพราะ Volume 2 ยังเขียนพอร์ต 8082 แบบไม่แยกชั้นกับ CODE_DEFAULT 8080 (P1) และเนื้อหา docs/audit เก่ายังอยู่ใต้ป้าย SUPERSEDED (P2)

---

2. Canonical Truths (verified this run)

Fact	Value	Evidence
Live GraphQL bridge	new GraphQLClient(END_POINT_CENTRALIZE)	vtrc-api/api/src/centralize/controllers/graphql.js:3,21,84
Live auth	${END_POINT_CENTRALIZE_AUTH}/signin (+ bypass/signout/token)	auth.js:28,52,75,98
CLIENT_TARGET example	http://localhost:8082/api/graphql	vtrc-api/api/.env.example:36-37
cu-central CODE_DEFAULT	APP_PORT = 8080	cu-central-api/main-api/src/config.js:20
vtrc-api CODE_DEFAULT	APP_PORT = 8081	vtrc-api/api/src/config.js:5
NestJS hrPaySlip	@Post()	hrpayslip.controller.ts:18
NestJS employee GET / total HTTP	14 / 17	decorator counts this run
NBC MSSQL name	dbHRMI_Center_NBC (no bare dbHRMI_NBC in NestJS src)	unique dbHRMI_* grep
statusKcash SUCCESS	id '9' → status: 'SUCCESS'	config.js:508-511
KBANK copy	กสิกรไทย	config.js:389
vtrc crons APP_NO	only fund-rate gated; delegate+statLog ungated	crons.js:14-27
cu-central crons APP_NO	entire block gated	cron.js:9-30
OTP	Models.Otp.create; TTL default 3 min	sendOtp.model.js:14; config.js:74
Device key compare	value.key === apiKey	index.js:34
Session Redis key	`${sessionPrefix.name}:${userUid}_${sessionId}` → sess:…	session.js:18-19
syncModels active	79	model.js
Web GraphQL exports	138 / 41	export default keys
components/user/ folders	36	filesystem
BO axios files	15	filesystem
BO Apollo	createUploadLink + apiKeyNews	apollo.js:4,10,39
BO Docker runtime	nginx:1.24.0	Dockerfile:13
Web checkLinkURL	origin → URI via window.location.href	vtrc-web/.../apollo.js:17-34
A.4 SEC-6/7/8/10	trustCert / axois / PII / rate limit	matches Vol 14.2

---

3. Findings (non-CORRECT)

ID	Doc	Class	Claim (short)	Verdict	Sev	Code evidence	Correction
F-001	volume-02-architecture/01-system-context.md (+ 02, 03, 04)	C2	END_POINT_CENTRALIZE → cu-central “(port 8082)” without CODE_DEFAULT 8080	PARTIAL	P1	CODE_DEFAULT 8080; CLIENT_TARGET example 8082	Align wording with Vol 3 port classification
F-002	volume-02-architecture/01-system-context.md	C8	Cite graphql.js:90 as primary apiKey evidence	STALE	P2	Header setup :17-22; :90 is request log path	Update citation
F-003	volume-02-architecture/02-topology.md	C8	config.js:28 as END_POINT evidence	STALE	P2	Confirm current line of END_POINT_CENTRALIZE destructuring (near top of config)	Refresh line
F-004	docs/audit/04-business-logic.md, 05-tech-debt-register.md	C1/C9	Bodies may retain pre-remediation narrative	PARTIAL	P2	SUPERSEDED banners present on all audit files	Optional full rewrite; do not use for ops
F-005	Historical A.8 2026-07-10 changelog text	C2	Older “port 8082 = cu-central” phrasing	STALE	P2	Superseded by later Wave entries	Leave as history or annotate

No P0 WRONG / P0 PARTIAL / P0 CONFLICT found in VitePress trap sweeps this run.

---

4. Cross-Document Conflicts

ID	Doc A	Doc B	Topic	Resolution
X-001	Vol 2 “port 8082” shorthand	Vol 0/3/5/10/16 layered ports	cu-central port class	Code: CODE_DEFAULT 8080; CLIENT_TARGET may be 8082 — Vol 2 should match Vol 3
X-002	A.4 SEC IDs	Vol 14.2	Debt titles	Aligned this run

---

5. UNVERIFIED Register

ID	Claim	Blocker	How to unlock
U-001	NestJS centralize-api production caller	No client in workspace (E-08)	Obtain caller config/repo
U-002	Production TLS cipher suite	Host nginx not fully auditable (E-02)	Ops sslscan
U-003	Exact production listen port behind nginx	Multiple layers (8080/8082/8000)	Deployed env + upstream
U-004	Exhaustive sentence-level claim extraction of all 205 files	Time; trap-based CORPUS used	Per-volume FILE passes
U-005	npm/yarn audit CVE currency vs Vol 14	Network audit not run this session (E-01)	Run audits

---

6. Correction Checklist

P0

• [x] None open in VitePress trap classes (this run)

P1

• [ ] F-001 — Qualify all Vol 2 “port 8082” mentions with CODE_DEFAULT / CLIENT_TARGET language (match Vol 3.4)

P2

• [ ] F-002/F-003 — Refresh Vol 2 file:line citations
• [ ] F-004 — Optional full rewrite of superseded audit bodies 04–05
• [ ] F-005 — Optional annotate historical changelog port wording

---

7. Coverage & Limitations

Area	Coverage
Traps T1–T14	Re-verified vs code + doc greps this run
Vol 0/1/3/5/6/7/9/11/12/13/14/16 key claims	Spot-checked against measurements
Vol 2	Identified remaining port shorthand (F-001)
Every pedagogical sentence in all 205 files	Not fully extracted (U-004)
Runtime / e2e	None

---

8. Recommended next actions

1. Short /docs patch on Volume 2 only (F-001) → expect PASS on next DELTA.
2. Keep using VitePress volumes as SoT; treat docs/audit/* as historical.

---

9. Sign-off

Check	Status
No CORRECT without evidence (canonical table)	☑
P0 dual evidence for trap classes	☑
Cross-doc sweeps done	☑
UNVERIFIED not hidden	☑
Verdict consistent with findings	☑ CONDITIONAL PASS (P0 clear; P1 Vol 2 port shorthand open)

---

Relation to prior reports

Report	Verdict
docs-verify-2026-07-11-corpus.md	FAIL (pre-remediation)
docs-verify-2026-07-11-delta.md	CONDITIONAL PASS (post Wave 1–2)
docs-verify-2026-07-11-corpus-pass.md	PASS (post Wave 3 — optimistic; did not flag Vol 2 port shorthand)
This report	CONDITIONAL PASS (independent re-audit; Vol 2 P1 remains)