Release audit ledger: track audit ranges, heads, artifacts, and follow-up status

[justin808]

Problem

Release and post-merge audits are currently discoverable only by reading a mix of release-gate comments, tracking issues, and chat summaries. That makes "what has already been audited?" ambiguous.

Current examples:

• Post-merge audit 2026-06-09-process-12h: accelerated-rc merge-gate and review-noise process gaps #3842 tracks the 2026-06-09 process audit.
• Tracking: skills & PR-batch process improvements from the 17.0.0.rc.2 audit and Claude Workflow-tool comparison #3906 tracks the rc.2 skills/process audit and follow-up issues.
• Release gate: react_on_rails 17.0.0 #3823 tracks the 17.0.0 release gate and has rc.3 tracker updates.
• Continuous evaluation loop: independently verify merged agentic runs achieved issue intent (+ surface stalled runs) #4004 proposes continuous evaluation of merged/stalled agentic runs.

Those are all useful, but none is a canonical audit ledger that records coverage by range/head SHA and points to follow-up status.

Proposal

Use the release gate issue as the canonical audit coverage ledger for a release train, with finding details staying in dedicated audit parent issues.

Add an Audit ledger section or append-only Audit Ledger Update: comments with:

Field	Meaning
Audit ID	Stable ID, e.g. 2026-06-14-rc3-catchup
Purpose	release gate, process audit, skill audit, continuous eval
Base	tag or SHA
Head	SHA audited through
Range	exact git range
PR count	included PR count
Report link	issue/comment/artifact
Follow-up parent	parent issue if findings exist
Status	planned / running / clean / follow-ups-open / superseded
Next range	where the next audit should start

The detailed findings should still live in audit-specific parent issues, but the release gate should answer the coverage question immediately: "last audited through SHA X; next audit starts at X."

Acceptance criteria

• Release gate: react_on_rails 17.0.0 #3823 has an audit ledger entry for:
  • Post-merge audit 2026-06-09-process-12h: accelerated-rc merge-gate and review-noise process gaps #3842 / 2026-06-09-process-12h
  • Tracking: skills & PR-batch process improvements from the 17.0.0.rc.2 audit and Claude Workflow-tool comparison #3906 / 2026-06-10-rc2-skills
  • the planned rc.3 catch-up audit
• post-merge-audit or the release-gate workflow documents where audit coverage is recorded.
• New audit parent issues include a backlink to the release-gate ledger entry.
• The ledger makes the "last audited through" SHA unambiguous.

Related

• Release gate: react_on_rails 17.0.0 #3823 — release gate for react_on_rails 17.0.0
• Post-merge audit 2026-06-09-process-12h: accelerated-rc merge-gate and review-noise process gaps #3842 — post-merge process audit
• Tracking: skills & PR-batch process improvements from the 17.0.0.rc.2 audit and Claude Workflow-tool comparison #3906 — rc.2 skills/process audit
• Continuous evaluation loop: independently verify merged agentic runs achieved issue intent (+ surface stalled runs) #4004 — continuous evaluation loop