# План прогона технического аудита портала — Этап 2

## Цель

Выполнить наблюдательный технический аудит локальной dev-копии портала Лидерра по спеке
v2: статанализ (backend/frontend/docs/SQL), инвентарь окружения, тестовые своды, security,
мёртвый код. Каждый шаг — одиночная read-only команда; собранный вывод классифицируется в
находки P0–P3 и сверяется с известными хвостами. Деструктивных операций нет; тест-раннеры
работают только с изолированной тестовой БД.

```skills-json
["audit-portal"]
```

```steps-json
[
  {"op":"Bash","object":"composer --working-dir=app pint:test","ref":"D1"},
  {"op":"Bash","object":"composer --working-dir=app stan","ref":"D1"},
  {"op":"Bash","object":"composer --working-dir=app audit-offline","ref":"D1"},
  {"op":"Bash","object":"composer --working-dir=app show","ref":"D1"},
  {"op":"Bash","object":"npm --prefix app run lint:vue","ref":"D2"},
  {"op":"Bash","object":"npm --prefix app run type-check","ref":"D2"},
  {"op":"Bash","object":"npm --prefix app run format:check","ref":"D2"},
  {"op":"Bash","object":"npm run lint:md","ref":"D3"},
  {"op":"Bash","object":"npm run spell","ref":"D3"},
  {"op":"Bash","object":"npm run lint:sql","ref":"D3"},
  {"op":"Bash","object":"php app/artisan schedule:list","ref":"D4"},
  {"op":"Bash","object":"php app/artisan db:show","ref":"D4"},
  {"op":"Bash","object":"composer --working-dir=app test","ref":"D5"},
  {"op":"Bash","object":"npm --prefix app run test:vue","ref":"D5"},
  {"op":"Bash","object":"bin/gitleaks.exe detect --no-banner","ref":"D6"},
  {"op":"Bash","object":"npm run sast","ref":"D6"},
  {"op":"Bash","object":"npm --prefix app exec -- knip","ref":"D7"}
]
```

```verified-context-json
[
  {"id":"C1","kind":"EXTRACTED","ref":"app/composer.json","anchor":"\"test\": ["},
  {"id":"C2","kind":"EXTRACTED","ref":"package.json","anchor":"\"sast\": \"semgrep --config=p/php"},
  {"id":"C3","kind":"EXTRACTED","ref":"tools/cost-pricing.mjs","anchor":"export const PRICING = Object.freeze("}
]
```
