End-to-end: run /hipaa on demo app, document every failure

[aanishs]

What

Run em-dash against demo/hipaa-demo-app/ end-to-end and document what happens.

Why

Nobody has done this yet. The demo app has intentional HIPAA violations planted in it. We need to know: does em-dash actually find them? What breaks? What's confusing?

Steps

1. cd demo/hipaa-demo-app && bun install
2. bin/comply-db init --framework hipaa
3. Run /comply-auto (or manually: /comply-scan, then /comply-fix)
4. Document every step: what worked, what broke, what was confusing
5. Run /comply-report — does the audit packet generate?

Expected output

A markdown file or issue comment with:

• Every check that ran and its result
• Every error or confusing moment
• Screenshots of the dashboard
• Whether the audit packet is usable

Who should do this

Anyone. No compliance knowledge needed. You're testing the tool, not the compliance.