refactor: strip Phase/Plan/R-number references from source comments

packages/core-audit/src/di/bind-audit.ts

@@ -26,7 +26,7 @@ export type BindAuditOpts = {
  * if not — better to refuse to start than to ship audit data with a dev-fallback
  * salt that an attacker could reverse.
  *
- * The returned auditLog is wrapped in TraceIdEnrichingAuditLog (Phase 4)
+ * The returned auditLog is wrapped in TraceIdEnrichingAuditLog
  * so all sinks receive AuditEntry.correlationId auto-populated from the
  * active OTel span. The inner sink/fan-out is accessible via `.inner`.
  */
@@ -34,7 +34,10 @@ export function bindAudit(
   container: Container,
   opts: BindAuditOpts = {},
 ): { auditLog: IAuditLog } {
-  if (process.env.NODE_ENV === "production" && !process.env.AUDIT_PSEUDONYM_SALT) {
+  if (
+    process.env.NODE_ENV === "production" &&
+    !process.env.AUDIT_PSEUDONYM_SALT
+  ) {
     throw new Error(
       "AUDIT_PSEUDONYM_SALT environment variable is required in production. " +
         "Generate via `openssl rand -hex 32` and store in your secrets manager.",
@@ -52,9 +55,11 @@ export function bindAudit(
   }
 
   const inner: IAuditLog =
-    sinks.length > 1 ? new MultiSinkAuditLog(sinks)
-    : sinks.length === 1 ? sinks[0]!
-    : new NoopAuditLog();
+    sinks.length > 1
+      ? new MultiSinkAuditLog(sinks)
+      : sinks.length === 1
+        ? sinks[0]!
+        : new NoopAuditLog();
   const auditLog: IAuditLog = new TraceIdEnrichingAuditLog(inner);
 
   if (container.isBound(AUDIT_SYMBOLS.IAuditLog)) {

packages/core-audit/src/index.ts

@@ -1,5 +1,9 @@
 export type { IAuditLog } from "./audit-log.interface";
-export type { AuditEntry, AuditAction, AuditFrom } from "@repo/core-shared/audit";
+export type {
+  AuditEntry,
+  AuditAction,
+  AuditFrom,
+} from "@repo/core-shared/audit";
 export { NoopAuditLog } from "./noop-audit-log";
 export { StdoutJsonAuditLog } from "./stdout-json-audit-log";
 export { PayloadAuditLog } from "./payload-audit-log";
@@ -8,17 +12,14 @@ export { auditLogsCollection } from "./audit-logs-collection";
 export { bindAudit, type BindAuditOpts } from "./di/bind-audit";
 export { TraceIdEnrichingAuditLog } from "./trace-id-enriching-audit-log";
 export { AUDIT_SYMBOLS } from "./di/symbols";
-// Phase 3 — GDPR erasure
+// GDPR erasure
 export { pseudonymize } from "./pseudonymize";
 export {
   createAuditErasureHook,
   type AuditErasureHookOpts,
 } from "./hooks/audit-erasure-hook";
-// Phase 5 — VIEW capture
-export {
-  createAuditAfterReadHook,
-  type AuditAfterReadHookOpts,
-} from "./hooks";
+// VIEW capture
+export { createAuditAfterReadHook, type AuditAfterReadHookOpts } from "./hooks";
 export {
   createAuditRouter,
   auditRouter,

packages/core-audit/src/with-audit.ts

@@ -21,7 +21,7 @@ export type Audited<F> = F & { readonly __audited: true };
  * tests).
  */
 export function withAudit<Args extends unknown[], R>(
-  // TODO(conformance milestone iii+): wire automated recording from manifest
+  // TODO: wire automated recording from manifest declarations.
   // `audits[]` declarations. For now, the wrapper exists to:
   //   (1) require callers to pass the auditLog at bind time (dep is available)
   //   (2) attach the `__audited` brand so the boot-time assertion can verify