internal/service/acme.go

@@ -1039,7 +1039,7 @@ type FinalizeOrderResult struct {
 //
 // The window between Step B and Step C can leave a managed_certificates
 // row whose order is still in `processing`. Phase 5's GC scheduler
-// reconciles. Documented in cowork/acme-server-prompts/03-... + the
+// reconciles. Documented in the project's ACME-server design notes + the
 // service file's design notes.
 func (s *ACMEService) FinalizeOrder(
 	ctx context.Context,
@@ -1293,7 +1293,7 @@ func randIDSuffix() string {
 // base32encode emits the lowercase Crockford-style base32 alphabet
 // without padding. Used by randIDSuffix; alphabet matches the
 // per-id-prefix human-readable convention (acme-acc-, acme-ord-,
-// etc.) — see CLAUDE.md "TEXT primary keys with human-readable
+// etc.) — see the project's "TEXT primary keys with human-readable
 // prefixes" architecture decision.
 func base32encode(b []byte) string {
 	const alpha = "0123456789abcdefghjkmnpqrstvwxyz"

internal/service/expiry_alert_metrics.go

@@ -9,7 +9,7 @@ import (
 // ExpiryAlertMetrics is a thread-safe counter table for the per-policy
 // multi-channel expiry-alert dispatch path. Rank 4 of the 2026-05-03
 // Infisical deep-research deliverable
-// (cowork/infisical-deep-research-results.md Part 5). Closes the
+// (the project's deep-research deliverable, Part 5). Closes the
 // procurement-checklist gap where a customer who configured PagerDuty
 // for cert-expiry pages got silent nothing — ExpirationWarning shipped
 // only to Email pre-fix.

internal/service/renewal.go

@@ -324,7 +324,7 @@ func (s *RenewalService) CheckExpiringCertificates(ctx context.Context) error {
 //     team get paged?".
 //
 // Rank 4 of the 2026-05-03 Infisical deep-research deliverable
-// (cowork/infisical-deep-research-results.md Part 5). The policy
+// (the project's deep-research deliverable, Part 5). The policy
 // argument is nil-safe — a cert with no RenewalPolicy attached gets the
 // back-compat Email-only default matrix.
 func (s *RenewalService) sendThresholdAlerts(

internal/service/renewal_expiry_alerts_test.go

@@ -1,7 +1,7 @@
 package service
 
 // Rank 4 of the 2026-05-03 Infisical deep-research deliverable
-// (cowork/infisical-deep-research-results.md Part 5). Pins every leg of
+// (the project's deep-research deliverable, Part 5). Pins every leg of
 // the per-policy multi-channel expiry-alert fan-out matrix:
 //
 //   1. Default matrix → Email-only at every tier (back-compat).

internal/service/scep.go

@@ -57,7 +57,7 @@ type SCEPService struct {
 
 	// Per-profile metadata surfaced by the new /admin/scep/profiles
 	// endpoint. SCEP RFC 8894 + Intune master bundle Phase 9 follow-up
-	// (cowork/scep-gui-restructure-prompt.md). All fields are nil/zero
+	// (the project's SCEP GUI restructure spec). All fields are nil/zero
 	// when the operator runs without Intune AND without mTLS — we still
 	// surface the always-present challenge-password-set + RA cert
 	// expiry on the Profiles tab for those.
@@ -292,7 +292,7 @@ func (s *SCEPService) SetMTLSConfig(enabled bool, bundlePath string) {
 // compatibility for the Phase 9 admin contract.
 //
 // SCEP RFC 8894 + Intune master bundle Phase 9 follow-up
-// (cowork/scep-gui-restructure-prompt.md).
+// (the project's SCEP GUI restructure spec).
 type SCEPProfileStatsSnapshot struct {
 	// Always-present per-profile fields.
 	PathID               string    `json:"path_id"`

internal/service/target.go

@@ -16,7 +16,7 @@ import (
 // ErrAgentNotFound is returned by [TargetService.CreateTarget] when the caller
 // references an agent_id that is empty or does not correspond to a registered
 // agent. The handler layer maps this to HTTP 400 via [errors.Is]. See C-002 in
-// cowork/certctl-coverage-gap-audit.md — this sentinel replaces a silent
+// the project's coverage-gap audit — this sentinel replaces a silent
 // Postgres FK violation (23503 → HTTP 500) with a deterministic 400.
 var ErrAgentNotFound = errors.New("referenced agent does not exist")