Documentation drift

Ten specific claims in CLAUDE.md that the code no longer supports, which claims still hold, and the tooling that keeps these docs from drifting too.

CLAUDE.md was last verified on 2026-08-13. The Core MVP collaboration work has landed since, and ten of CLAUDE.md’s specific claims are now false. It has not been corrected: until it is, this site is the source of truth for anything on the list below. Anything downstream of it — onboarding notes, the Linear backlog, the recommendations doc — inherits the same errors.

Corrections

Still accurate

CLAUDE.md’s operations and security claims were re-checked against source on 2026-09-09 and still hold. These docs reproduce them:

• The Supabase connection traps and the RLS lockdown requirement.
• The dev → staging → main branch model and the drift guard.
• Branch protection is unenforced in both repos.
• Tokens live in localStorage and are XSS-exfiltratable.
• npm run lint mutates files; CI calls eslint directly.
• ssl.rejectUnauthorized: false applies outside production.
• A local .env tends to fall behind .env.example as new variables are added.
• Nothing is deployed (re-checked 2026-09-09).

Backend docs

The spec’s Swagger metadata — fixed

Generating the reference from the live server confirmed the controllers and the documented contract agree, but it also exposed how thin the Swagger metadata was. On 2026-09-09 blume check reported 10 duplicate sidebar labels in the generated reference, from two causes:

• Missing summaries. The collaboration controllers — ProjectController, TaskController, TaskCommentController, OrganizationController, DashboardController — carried no @ApiOperation({ summary }), so every operation fell back to its raw path. Three routes share /api/projects/{id} and three share /api/tasks/{id}, so the sidebar showed the same label three times.
• Reused summaries. GET /api/assets/logs and GET /api/assets/:id/asset-logs both passed swaggerAssetLogsResponse, so both rendered as “Retrieve asset activity logs”.

Both are now closed. Every operation carries a distinct @ApiOperation({ summary }):

@ApiOperation({ summary: 'Move a task to another column or position' })
@Patch('tasks/:id/position')
move(/* … */) {}

The two asset-log routes keep the shared response schema and override only the summary:

@ApiOperation({
  ...swaggerAssetLogsResponse,
  summary: "Retrieve the caller's asset activity logs",
})

All 73 operations in the published spec now have a summary, and none is duplicated — blume check reports zero warnings. That improves Swagger UI, the generated reference, llms.txt, and search results together.

Keeping these docs from drifting

The generated API reference is machine-derived rather than written by hand, so it never disagrees with the controllers it was generated from. It is still a snapshot: it goes stale the moment a controller changes and nobody regenerates openapi.json — see the note at the end of this page. Everything in these guides can drift, and will.

Three mechanical checks, all shipped with Blume:

cd docs
npx blume check       # build plus type-check, and the nav diagnostics below
npx blume validate    # internal, anchor, asset, and external links
npx blume audit       # SEO and site-health findings, mapped to source files
npx blume eval        # an agent answers questions using only these docs

blume eval is the interesting one for drift specifically: it tests whether the documentation is sufficient to answer a question, which catches the class of staleness where a page is still technically true but no longer describes the system anyone is working on.