[Code Quality] Document goroutine-safety field-ownership invariants on auditAnalysisResults

[github-actions]

Description

The auditAnalysisResults struct in pkg/cli/audit.go (line ~329) is written concurrently by multiple goroutines without a mutex. This is safe only because each goroutine exclusively owns exactly one field — but this invariant is invisible to readers and future maintainers. A future refactor that inadvertently shares a field could introduce a data race with no compile-time warning.

Suggested Changes

1. Add a doc comment to the auditAnalysisResults struct declaration explaining the field-ownership concurrency model (e.g. "Fields are written by exactly one goroutine each; see launch* comments for ownership")
2. Add a one-line comment to each launch* helper stating which fields it exclusively writes
3. No behavior changes required

Optionally, add a -race-gated integration test assertion or a compile-time static-analysis hint.

Files Affected

• pkg/cli/audit.go — auditAnalysisResults struct declaration and all launch* helpers

Success Criteria

• auditAnalysisResults struct has a doc comment explaining field-ownership concurrency model
• Each launch* helper has a comment naming its exclusively-owned fields
• make build passes; no behavior changes

Source

Extracted from Audit Goroutine Context Blindness discussion #46848

Priority

Medium — prevents future data races from invisible invariants

🔍 Task mining by Discussion Task Miner - Code Quality Improvement Agent · 46.7 AIC · ⌖ 7.94 AIC · ⊞ 7K · ◷

• expires on Jul 21, 2026, 5:17 PM UTC-08:00