Tracking: July 2026 maintenance audit (83 verified findings)

Tracking issue for the July 2026 full-repository maintenance audit. Milestone: Maintenance audit 2026-07.

A multi-agent sweep of every tracked file across 14 dimensions, then two adversarial verification passes: 135 raw findings, 63 rejected, 72 confirmed, 11 added by four completeness sweeps, 83 actioned. Nothing found is architectural.

The work, ordered by dependency

• #103 — repair the container publish and validation pipeline (infrastructure high-priority) — done in v0.9.0 (#111): uppercase ghcr.io/QuantEcon/… from github.repository_owner made buildx registry cache refs fail non-fatally, leaving builds cold and green (CHANGELOG.md:233-237); an unserialised workflow let an older commit win :latest (:238-240); a concurrency group shared across runs cancelled most of the lecture-validation matrix (:241-247); both unattended workflows now open a deduplicated failure issue via scripts/create-ci-failure-issue.sh (:194-200), the alerting nine red weeks in Feb–Apr 2026 lacked.
• #104 — restore-jupyter-cache save-mode outputs (bug high-priority) — done in v0.9.0 (#112); unblocks the #92 save-cache rollout. Top-level actions/cache@v6 declares only cache-hit, so save mode's outputs came back empty — cache-hit false on a perfect restore, fail-on-miss failing unconditionally; restore now always uses actions/cache/restore@v6, with a lookup-only: true step registering the job-end save hook (CHANGELOG.md:213-221). In CI since v0.10.0: both cache types × both modes, fail-on-miss both ways (CHANGELOG.md:141-151).
• #105 — preview deploy errors, CLI pinning, fork guidance (bug security high-priority). Partly overtaken by v0.11.1 (#131): deploy-url now comes from the pr-N alias, not a grep of wrangler output, and the surviving deployment-url extraction ends || true (preview-cloudflare/action.yml:124, :131-134). Untouched: DEPLOY_OUTPUT=$(wrangler … 2>&1) at :93 still aborts under -e, leaving the output dump at :102-104 and friendly error at :106-109 unreachable, and wrangler@latest is unpinned at :71. Line numbers have drifted; re-derive before editing. Closes PLAN item 8.
• #106 — Anaconda 2026.06 baseline and measured sizes (documentation high-priority). CHANGELOG half closed: #95/#90/#94 gaps filled in the v0.9.0 section (CHANGELOG.md:203-210), #101 recorded retrospectively in v0.10.0 (CHANGELOG.md:166-169). Seven sites still say Anaconda 2025.12 while both images ship anaconda=2026.06 (containers/quantecon/environment.yml:11): docs/ARCHITECTURE.md:12, docs/CONTAINER-GUIDE.md:9, containers/README.md:18, containers/quantecon/README.md:15 and :107, containers/quantecon-build/README.md:26 and :82. The dependency policy in PLAN.md, which actively misled by pinning containers back to a superseded baseline, was corrected in #139. Six docs also carry the round ~8GB / ~3GB pair and a "~60% smaller" claim README.md:147-148 contradicts (containers/README.md:9 and :35); v0.11.0 moved CI size reporting to compressed manifest bytes (CHANGELOG.md:83-84), not comparable, so stragglers need re-measuring, not copying.
• #107 — batch of small correctness fixes (bug). 7 of 10 boxes remain. The if: always() fix landed — both guards read always() && … != 'true' at build-jupyter-cache/action.yml:384 and :649 — and #122 deleted build-jupyter-cache/scripts/, mooting its two create-failure-issue.sh items. The substring builder parse is still live: validation at build-jupyter-cache/action.yml:106, the same three *"jupyter"* / *"pdflatex"* / *"html"* tests repeated at :120-136. Advances PLAN items 7 and 15.
• #108 — unify container smoke tests, fix the fixture (infrastructure). Mostly shipped in v0.11.0 (#125): containers/quantecon/tests/smoke-test.sh covers the container marker, xelatex, an executing HTML build and pdflatex, plus a --self-test that fails if a raising cell stays green; .github/workflows/test-container.yml:14-37 is one two-image matrix (:24-25) running a real container: job (:32-37) instead of docker run, size split to a sibling job (:77-101); smoke-test.sh:83-84 runs unconditionally, giving the lean image its first pdflatex build; the fixture executes and asserts; run-local-tests.sh:5 has set -euo pipefail. Two residuals, one PR's worth: containers/quantecon/tests/test-container.sh survives untouched with containers/quantecon/README.md:227 still pointing at it, and the fixture keeps html_theme: sphinx_book_theme and fontpkg: "" (containers/quantecon/tests/minimal-jupyter-book/_config.yml:26 and :28), leaving quantecon_book_theme and FreeSerif untested. Distinct from #100 — these tests exist but could not fail.
• #109 — reconcile READMEs and templates with shipped code (documentation). Fold in #99 while in the same file.

Tracker structure

QEP-2 routes umbrella issues to native sub-issues with no Type label on the parent.

• Add #105–#109 as native sub-issues, plus closed #103 and #104 for the audit trail. — done; all seven are linked.
• Then remove the maintenance Type label — done, in that order: QEP-2's exemption from "unlabelled means needs triage" keys on the sub-issue relationship, so dropping it first would have left the tracker looking untriaged rather than structural.

Labelling and related issues

Labels follow QEP-2, now Accepted: infrastructure not maintenance for CI/build/deploy work, grouping by milestone rather than an audit label. security on #105 is a cross-cutting modifier, not a second Type. testing is retired to infrastructure/maintenance; #108 and #100 both moved, so nothing here uses it.

Nothing supersedes an existing issue. #100 (action-logic test coverage) stays open: its stage-1 harness shipped in v0.10.0, #108 covers only existing container tests being unable to fail, and its release-gating stage is tracked in #135. #99 folds into #109. #92 is open and unblocked. #83 and #14 were advanced here but closed elsewhere — #83 in v0.11.0 (#122, #123 variant in #127), which moots PLAN item 14 since create-failure-issue.sh was deleted rather than hardened, and #14 in v0.11.1 (#131). PLAN items 7, 8 and 15 remain open.

The full ranked report — 83 findings, a 26-row quick-wins table, per-finding evidence — sits outside the repo.

This is an umbrella tracker, not a self-contained change; start with the open sub-issues #105–#109 and their named files, such as preview-cloudflare/action.yml, CHANGELOG.md, and the container documentation and tests. Read the relevant sub-issue first, then verify its stated tests or documentation checks. Done means the remaining sub-issue work is completed and this audit checklist is updated.