update monorepo-tooling and audits specs to match verified repo state

[transphorm]

Summary

• Docs-only. Makes docs/pnpm-migration-status.md authoritative for "is the yarn→pnpm migration done" (it is), and separates that from "is the hardening workstream closed" (it isn't).
• Reconciles monorepo-tooling/SPEC.md against the actual repo state — it misreported 6 tracks. Backlog collapses from 13 rows to 6 live ones; 7 settled plans are archived; two overdue decisions (MT-12, MT-24) are recorded instead of left open.
• Marks the audits workstream dormant and unowned, fills in the 9 Linear issue IDs its plans said were TBD, and corrects 9 plan statuses that used a value the spec's own vocabulary doesn't allow.
• No config, code, lockfile, or CI changes. Circuits deliberately untouched — the one finding there is written up for its owner rather than fixed.

Why two workstreams in one PR: both are the same defect class (spec files that drift from the repo they describe) found in one verification pass, and the fix is identical in kind — no behavior, no shared files, reviewable as one read. Splitting would duplicate the rationale across two PRs of ~13 doc files each.

Changes

Docs — pnpm migration status

• Marked authoritative and re-verified 2026-08-06.
• Fixed a stale pin: the doc claimed packageManager was pnpm@11.1.1; root is pnpm@11.12.0. It now points readers at root package.json rather than naming a copy that drifts, and records the 11.1.1 → 11.5.3 → 11.7.0 → 11.12.0 history.
• Added a Gotchas section — pnpm format breaking on Yarn portal: (use link:), prettier EACCES from /Volumes dropping the exec bit, stale yarn-era workspace node_modules shadowing root versions, and the .watchmanconfig guard (fix Reanimated native integration and Metro/watchman build config #2178) that must not ignore node_modules/dist.
• Noted that pnpm 11 reads workspace settings from pnpm-workspace.yaml and silently ignores the root pnpm field.
• Residual-yarn list re-verified: all four entries still accurate, none on the install/build path.

Specs — monorepo-tooling

Verified each track against the repo rather than trusting the table:

Track	Was	Now
MT-3, MT-4	Landed in SPEC, Draft in plan files	Completed + archived
MT-6	Partial	Completed — allowBuilds audited per-entry, 6 patchedDependencies, pin enforced
MT-13	Partial	Completed — residual "hit-rate tuning" dropped as unmeasured
MT-21	Open	Completed — pin is live in pnpm-workspace.yaml
MT-29	Open	Completed via #2236
MT-12	Open	Won't-do — nodeLinker: hoisted is load-bearing; RN autolinking requires a flat node_modules
MT-1/2	Open	Partial, with the nuance written down: the dep was added but 5 react-native-blur-effect declarations plus the Jest mock remain, and the nested-RN symptom is neutralized by the 1.1.3 override rather than by the removal
MT-9	Open	Blocked by MT-22, sole remaining blocker, and both flags live in two files (pnpm-workspace.yaml and .npmrc)

• MT-24 resolved. It was an overdue decision, not a note — "after Migrate monorepo from Yarn to pnpm #2069 merges, evaluate whether to keep the sentinel." Keep: .github/CI_FORCE_RUN became general infra (documents four reuse cases, listed in 10+ workflows' paths:/check_changes allowlists, enforced by pnpm lint:ci-sentinel).
• Corrected the MT-8 row: it prescribed a "lefthook" guardrail, but this repo uses husky — lefthook isn't installed.
• Confirmed the SPEC's own warning that Turbo's gradle exclusion could lose kmp coverage is satisfied: kmp-ci.yml runs :shared:jvmTest, :shared:iosSimulatorArm64Test, and :composeApp:testDebugUnitTest directly.
• Track Order rewritten so MT-22 leads, since it gates MT-9.

Specs — audits

• Owner: UNASSIGNED, Status: Dormant, plus a Current State block. The protocol and all nine plans landed in one PR (add codebase-audits workstream spec and nine audit plans #2167, 2026-06-11) and nothing has run since — no commits in ~2 months, no AUD-NN findings doc in docs/reviews/.
• Plans said Linear: TBD — create the tracking issue, but the issues exist. Filled in SELF-3180…3188 (all unassigned; 8 Backlog, AUD-02 Todo).
• All 9 plans used Status: Draft, which is not in the spec's allowed vocabulary (Ready | Planned | In Progress | In Review | Blocked | Done). Corrected to Planned — awaiting workstream owner, preserving each pre-draft caveat.
• Recorded that every plan needs its recon refresh before activation — path:line citations date from June 2026 and the RN/Expo and pnpm work has moved code since.

Archive

• 7 settled plans moved to specs/archive/monorepo-tooling/ (tracked as renames), each stamped with its outcome.
• 7 rows appended to specs/ARCHIVE.md following the existing convention, each carrying the durable decision rather than just "done".
• specs/projects/sdk/INDEX.md focus line updated for the narrowed scope.

Note for the circuits owner

Documented, not fixed — circuits is separately owned. Written up at the top of the MT-22 plan:

• circuits/package.json:67 pins circom_tester to github:remicolin/circom_tester#main — a floating branch. The workspace override pins sha 81e963ce and wins today, so installs are deterministic, but the floating ref contradicts the repo's minimumReleaseAge posture and goes live the moment that override is dropped — including by MT-22's own step that removes it.
• MT-22's "Files Modified" table pointed at root package.json for the override; it actually lives in pnpm-workspace.yaml, which would have sent the implementer to the wrong file.

Linear Issues

• Closes SELF-3712 — Handover: yarn→pnpm migration status
• Related: SELF-3786 — RN/Expo upgrade items, split out of SELF-3712
• Referenced (not closed): SELF-3180 … SELF-3188 — the nine AUD audit issues, now linked from their plans

Test Plan

Docs-only change: no runtime, build, or dependency surface touched. Lockfile unchanged.

• pnpm lint:headers passes (duplicate + license header checks)
• pnpm lint:ci-sentinel passes — sentinel coverage intact after the SPEC edits
• prettier --write clean across all changed markdown
• All relative .md links in changed files resolve
• No dangling references to the 7 archived plan paths anywhere in specs/
• pnpm lint && pnpm types pass in CI
• Reviewer sanity-check on the two recorded decisions (MT-12 won't-do, MT-24 keep) — these close questions rather than defer them, so they deserve a second opinion

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Confirmed the Yarn-to-pnpm migration and Turbo foundation are complete.
  • Updated setup, CI, workspace, compatibility, and verification guidance.
  • Archived completed or retired tooling plans and clarified remaining follow-up work.
  • Refreshed SDK workstream indexes and documented current ownership and review status.
  • Converted nine audit plans from Draft to Planned and added tracking references and review requirements.
  • Recorded remaining monorepo tooling blockers, priorities, and partial progress.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
self-webview-app	Ignored	Preview	Aug 6, 2026 5:41pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e0ba249-048e-43ca-bd1f-b98fe2a2e84d

📥 Commits

Reviewing files that changed from the base of the PR and between 5f8994b and 9361248.

📒 Files selected for processing (6)

• specs/ARCHIVE.md
• specs/archive/monorepo-tooling/MT-21-circom-tester-pin.md
• specs/archive/monorepo-tooling/MT-29-ncu-version-sweep.md
• specs/projects/sdk/workstreams/monorepo-tooling/SPEC.md
• specs/projects/sdk/workstreams/monorepo-tooling/plans/MT-22-circom-tester-migration.md
• specs/projects/sdk/workstreams/monorepo-tooling/plans/MT-9-peer-strictness.md

🚧 Files skipped from review as they are similar to previous changes (2)

• specs/archive/monorepo-tooling/MT-29-ncu-version-sweep.md
• specs/ARCHIVE.md

---

📝 Walkthrough

Walkthrough

The pull request updates pnpm migration documentation, monorepo tooling records, audit plans, and archive entries. It records completed work, remaining blockers, current ownership states, and planned audit tracking issues.

Changes

Tooling status and planning

Layer / File(s)	Summary
pnpm migration verification docs/pnpm-migration-status.md	Documents pnpm-only operation, residual Yarn references, pnpm and Metro gotchas, and clean-clone verification commands.
Monorepo tooling state specs/projects/sdk/workstreams/monorepo-tooling/...	Updates completed pnpm and Turbo work, Circuits and peer-strictness blockers, dependency records, plan ownership, and hoisted-linking decisions.
Audit workstream planning specs/projects/sdk/workstreams/audits/...	Marks the workstream dormant and unowned. Adds tracking issues and Planned status metadata to all nine audit plans.
Archive and workstream index specs/ARCHIVE.md, specs/archive/monorepo-tooling/*, specs/projects/sdk/INDEX.md	Records retired tooling plans and updates the SDK workstream summary.

Estimated code review effort: 2 (Simple) | ~15 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the documentation updates for the monorepo-tooling and audits specifications to reflect the verified repository state.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/self-3712-pnpm-spec-housekeeping

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fbf903cf-51ad-4e50-a380-d75a1099cd7b

📥 Commits

Reviewing files that changed from the base of the PR and between 0364456 and 5f8994b.

📒 Files selected for processing (26)

• docs/pnpm-migration-status.md
• specs/ARCHIVE.md
• specs/archive/monorepo-tooling/MT-12-isolated-linker.md
• specs/archive/monorepo-tooling/MT-13-pnpm-cache-audit.md
• specs/archive/monorepo-tooling/MT-21-circom-tester-pin.md
• specs/archive/monorepo-tooling/MT-29-ncu-version-sweep.md
• specs/archive/monorepo-tooling/MT-3-turbo-foundation.md
• specs/archive/monorepo-tooling/MT-4-root-script-migration.md
• specs/archive/monorepo-tooling/MT-6-pnpm-config-hardening.md
• specs/projects/sdk/INDEX.md
• specs/projects/sdk/workstreams/audits/SPEC.md
• specs/projects/sdk/workstreams/audits/plans/AUD-01-nfc-chip-reading-flow.md
• specs/projects/sdk/workstreams/audits/plans/AUD-02-key-material-keychain-lifecycle.md
• specs/projects/sdk/workstreams/audits/plans/AUD-03-startup-nav-routing.md
• specs/projects/sdk/workstreams/audits/plans/AUD-04-test-coverage-quality.md
• specs/projects/sdk/workstreams/audits/plans/AUD-05-bridge-protocol-surface.md
• specs/projects/sdk/workstreams/audits/plans/AUD-06-cruft-dead-code.md
• specs/projects/sdk/workstreams/audits/plans/AUD-07-config-ci-consolidation.md
• specs/projects/sdk/workstreams/audits/plans/AUD-08-analytics-observability.md
• specs/projects/sdk/workstreams/audits/plans/AUD-09-webview-app-surface.md
• specs/projects/sdk/workstreams/monorepo-tooling/SPEC.md
• specs/projects/sdk/workstreams/monorepo-tooling/plans/MT-1-blur-swap.md
• specs/projects/sdk/workstreams/monorepo-tooling/plans/MT-14-dedupe-audit.md
• specs/projects/sdk/workstreams/monorepo-tooling/plans/MT-22-circom-tester-migration.md
• specs/projects/sdk/workstreams/monorepo-tooling/plans/MT-8-yarn-residue-guardrail.md
• specs/projects/sdk/workstreams/monorepo-tooling/plans/MT-9-peer-strictness.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f8994b1b5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".