[AlexJSully]

audit-pr findings now give their location as the file's path from the repository root plus the line number of the quoted line, for example src/features/billing/index.ts:42.

#588 removed the line range from the finding's File field and added the rule "No line number you did not read." Reviews then omitted line numbers. Nothing required a full path either, so a finding could cite only index.ts in a repository holding dozens of files with that name.

The line number is read from the file, never estimated. The refutation pass now checks that the number holds the quoted line, corrects a wrong number, and drops a finding whose line is not found.

The prompt file and the skill carry the same rule. The skill's finding template, worked examples, and finding-refuter agent follow it.

PR also includes the following changes:

• The prompt shortens four passages in its refutation pass, three that restated rules from other sections and one that stated no rule, to stay within its 52,000-character budget.

brag.mp4

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
portfolio	Ready	Preview	Nov 5, 2026 9:16pm UTC

[Copilot]

🟡 Changes recommended

Unresolved location-validation rules can discard deletion-only regressions and require invented line numbers for structural findings that have no line-level anchor.

2 open issues

• Allow path-only locations for structural findings · New
• Preserve verified locations for deletion-only regressions · New

What changed in this PR

This PR updates the repository’s audit-pr tooling to require repository-relative paths and verified line numbers, addressing ambiguous or missing locations following #588.

Changes:

• Aligns location rules across the prompt, skill, finding template, examples, and refuter.
• Adds location verification and shortens prompt passages to fit the character budget.
• Updates runtime and development dependencies, including Firebase’s major version.

File	Description
package.json	Updates runtime and development dependency ranges.
package-lock.json	Records updated dependencies and transitive resolutions.
.github/​prompts/​audit-pr.prompt.md	Requires verified locations and condenses refutation instructions.
.claude/​skills/​audit-pr/​SKILL.md	Adds matching location and verification rules.
.claude/​skills/​audit-pr/​assets/​review-summary.template.md	Updates finding fields, examples, and location checks.
.claude/​skills/​audit-pr/​agents/​finding-refuter.md	Verifies cited paths and line numbers during refutation.

_{Review effort: Balanced}