Add a Full Review Claude Command

[b-at-neu]

Problem

The 2026-08-10 full platform audit was assembled ad hoc from parallel investigations plus a live click-through. It should be a repeatable command so it runs each release instead of once.

It must not regenerate the permissions matrix or the workflow catalogue — once PERMISSIONS.md and WORKFLOWS.md exist, those are the spec. It should check the code against them and flag drift in both directions: code the docs do not describe, and documented behaviour the code no longer implements.

Check classes

Each of these found something real in the first run:

• Applicant/reviewer state machine — every action must gate on record status, not just ownership
• UI ↔ backend permission parity, in three categories: backend allows / UI never offers; UI offers / backend refuses; and UI is the only gate (the dangerous one)
• Soft-delete join integrity — every query touching Application must join through to Position.deletedAt and status
• Snapshot-vs-live consistency — anywhere a client validates against one source and the server against another
• Link reachability by record state — every rendered link must resolve for the state and role that rendered it
• Denial-mechanism consistency — flag any new authorization branch not using the shared helper
• Measured accessibility — compute real contrast ratios per token pair in both themes and measure touch targets, rather than eyeballing
• Seed coverage — assert the seed produces every PositionStatus and ApplicationStatus

Acceptance criteria

• Command added under .claude/skills/, referencing ENGINEERING.md, DESIGN.md, PERMISSIONS.md, WORKFLOWS.md and CLAUDE.md
• Requires live verification against a running instance with full-state fixtures — several static findings in the first run were wrong until executed
• Tags every finding verified-live / verified-in-code / plausible, and explicitly lists what it tested and disproved. Four reported "criticals" evaporated under testing in the first run; a review that cannot disprove its own findings wastes engineering time
• Cross-references existing open and closed issues before reporting, to avoid duplicate findings

---

From the 2026-08-10 full platform audit.