Severity: Med · Proposed priority: P2 · Audit ID: C4
The 11 injectors.*.enabled flags in session-start-config.json are dead config.
The file's _comment (line 2) promises "The Go adapter reads these thresholds + injector flags", and injectorEnabled() exists at cli/internal/mem/session_start_config.go:51 — but ClaudeContext (cli/internal/mem/session_start_adapter.go:44-80) never calls it. Every injector runs unconditionally; injectorEnabled has no non-test caller (verified by grep). Only the 6 thresholds keys are honored.
Scenario: a user sets "vault_health": {"enabled": false} to silence a noisy injector at session start — nothing changes. The config file and the SDD-004 spec both describe a contract that stopped being honored at the CLI-025 Go port.
Bonus drift in the same file: lessonsStaleDays = 14 is hardcoded in the adapter (line 24) rather than read as a threshold; the doctor_drift comment still says "via scripts/doctor.{sh,ps1}" (retired); the _comment points at specs/archive/SDD-004-session-start-config/ which does not exist (the spec is unarchived).
Fix: gate each injector on cfg.injectorEnabled(name) in ClaudeContext, or delete the injectors block and correct the comment. Add a test that a disabled injector is actually omitted.
Source: docs/audits/codebase-audit-2026-07-06.md (C4).
Severity: Med · Proposed priority: P2 · Audit ID: C4
The 11
injectors.*.enabledflags insession-start-config.jsonare dead config.The file's
_comment(line 2) promises "The Go adapter reads these thresholds + injector flags", andinjectorEnabled()exists atcli/internal/mem/session_start_config.go:51— butClaudeContext(cli/internal/mem/session_start_adapter.go:44-80) never calls it. Every injector runs unconditionally;injectorEnabledhas no non-test caller (verified by grep). Only the 6thresholdskeys are honored.Scenario: a user sets
"vault_health": {"enabled": false}to silence a noisy injector at session start — nothing changes. The config file and the SDD-004 spec both describe a contract that stopped being honored at the CLI-025 Go port.Bonus drift in the same file:
lessonsStaleDays = 14is hardcoded in the adapter (line 24) rather than read as a threshold; thedoctor_driftcomment still says "via scripts/doctor.{sh,ps1}" (retired); the_commentpoints atspecs/archive/SDD-004-session-start-config/which does not exist (the spec is unarchived).Fix: gate each injector on
cfg.injectorEnabled(name)inClaudeContext, or delete theinjectorsblock and correct the comment. Add a test that a disabled injector is actually omitted.Source:
docs/audits/codebase-audit-2026-07-06.md(C4).