batch-api-audit

Run the audit against the PR or stack, providing each layer's real base branch from gh pr view and the owned-file matrix from the feature manifest. It outputs a Markdown checklist report with PASS, FAIL, or N-A per item and file:line evidence for every failure.

It verifies packages/batch stays runtime-agnostic with no Cloudflare or Spanner dependencies, the edge worker contains only auth and forwarding, and consumers import only subpaths listed in the package.json exports map. It also checks error handling, streaming invariants, and shared helper usage.

No, the audit is strictly read-only and never edits code. It produces a report, and fixes are applied separately following the stacked PR workflow, starting from the lowest owning PR and rebasing the stack.

Yes, it diffs each layer against its actual base branch to confirm only owned files changed, verifies no layer imports symbols from higher layers, and checks the stack has linear history without rebase markers.

It confirms is_byok flows from submit into the async_jobs row and finalize, affordability preflight skips BYOK endpoints, and emitted generations classify BYOK cost as byok_usage_inference with zero credits usage rather than credits usage.