docs(examples): community example — vouchdev/vouch issue-tracker audit

[jonathanchang31]

Summary

Adds examples/community/vouch-issue-tracker-audit/, a real vouch KB
built by cross-referencing every open issue on this repo (93 at audit
time) against upstream/main and upstream/test for a commit that
already resolves it.

Findings:

• 11 issues are already fixed in code but left open on GitHub (likely
  because merges to test, or squash-merge commits, don't trigger
  GitHub's auto-close).
• 1 issue (Richer scopes on Claim/Source: (visibility, project, agent) retrieval filtering (VEP-0005) #189) is genuinely open and unclaimed — the VEP (feat: richer scopes on Claim/Source — (visibility, project, agent) [VEP] #100) was
  drafted but the feature it describes was never built.
• 1 issue (critical: Agent transport allows cross-agent approval #168, cross-agent approval bypassing the review gate) is
  still unfixed and security-relevant. A prior PR (fix: agent transport allows cross agent approval #169) attempted a fix
  and was closed after a maintainer review requested changes; this KB's
  claim cites that review verbatim so a future fix has exact acceptance
  criteria.
• A 14th, self-referential finding: vouch source add PATH --url URL
  silently drops --url (cli.py::source_add always passes an explicit
  locator, so storage.py's locator or url fallback never reaches
  url). Found while building this very KB — every source citation had
  to have its locator corrected by hand afterward.

Every claim went through the real CLI (vouch propose-claim → vouch approve, one round of vouch reject on a bad --type value, then
resubmit) and cites a source file with the actual evidence (a git log
transcript, a direct code excerpt, or a maintainer's PR-review comment
copied from GitHub) — nothing here is hand-authored YAML.

Related Issue

Addresses #338 (a standing call for community examples, not something a
single PR should close).

Change Type

• Documentation / example update
• Bug fix
• New feature
• Breaking change

Real Behavior Proof

A fresh copy of the shipped snapshot reconciles cleanly:

$ cp -r examples/community/vouch-issue-tracker-audit/vouch ./.vouch
$ vouch reindex
reindex: FTS5 rebuilt
$ vouch doctor
{'claims': 15, 'pages': 3, 'sources': 15, 'entities': 0, 'relations': 0,
 'sessions': 0, 'pending_proposals': 0, 'audit_events': 92, 'index_present': True}
$ vouch lint
clean
$ vouch fsck
clean

Checklist

• Checked issue docs(examples): call for real-world example kbs — screenshots and verifiable proof #338's acceptance criteria and matched the submission shape
• Every claim proposed and approved through the real CLI, cited to a source
• vouch doctor / lint / fsck clean on the snapshot, both in-place and from a fresh copy
• No PII, customer names, or internal URLs (all citations are public GitHub issues or this repo's own source)
• Added a row to examples/README.md under a new "Community examples" section
• Updated CHANGELOG.md under [Unreleased]
• Ran full test suite (pytest) — unaffected, all green
• Ran make lint

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bb5a90c5-2a91-4e0a-9d5a-f93fb73482b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}