diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 98bc17d2a..d77c2b752 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,8 +1,52 @@ # Naruon Product and Technical Gap Baseline -**Baseline version:** 1.2 -**Observed on:** 2026-08-26 (Asia/Seoul) -**Observed protected branch (current scan; row Base-SHA values remain historical):** `develop@e5e99b4e3bb081b92c602358878856536030e2ca` +## 2026-09-08 visual evidence: smoke success is not product acceptance + +This observation supplements the historical inventory below. PR +[#1599](https://github.com/ContextualWisdomLab/naruon/pull/1599) built source +`877f0d5c1b96c3ac212ecc86630afb75532f5880` and ran the same implementation +through test descendant `af4df216b3533ebb82dab9d361b415ddb941fa24`. +The production build and mocked browser smoke exited zero across ten routes at +1440×1024 and 390×844, and all twenty PNGs were directly inspected. The +[inspection receipt](https://github.com/ContextualWisdomLab/naruon/pull/1599#issuecomment-5578964200) +records scope and observed defects. It does not prove live provider writes, +real backend contracts, every locale, deployment, or complete accessibility. +PR #1600 then retained the same ten-route desktop evidence from hosted +Application CI run `34189161122` for exact head `d30f0b7c`. Direct inspection +confirmed that artifact creation succeeded while the customer-facing defects +below remained visible; a green smoke job is therefore evidence availability, +not visual acceptance. + +| Observed customer gap | Canonical owner action | Acceptance evidence still required | +| --- | --- | --- | +| Home exposed English skip-link and `source-linked` | #1578 owns customer status copy; #1601 owns keyboard navigation copy | Merge both successors normally, then repeat keyboard-focused desktop/mobile inspection on the deployed product | +| Search displayed raw source/thread identifiers, `sender_context`, `reply_count`, API/Ontology labels, and machine action codes | [PR #1603](https://github.com/ContextualWisdomLab/naruon/pull/1603) retains scoped identifiers in requests/state while replacing visible plumbing with relationship, action, and mail-flow outcomes; exact head `462b134acf858061019d3ffe37b7b3d60e6f7e74` normalizes production `Colleague` casing, translates all four production action codes, and fails closed to neutral customer copy for unknown values | Full Vitest passed 51 files / 447 tests; scoped ESLint, TypeScript, diff checks, Application CI, Bandit, Docker validation, Security, Semgrep, coverage evidence/source, Strix, and GitHub Advanced Security CodeQL are GREEN. Required compatibility CodeQL remains failed on the central terminal-verdict ordering defect tracked by `.github#1929`; OpenCode and Noema are failed, no qualifying current-head formal approval or durable responsive-browser inspection exists, and the UI Delivery Gate remains **FAIL** pending owner repair, protected merge, and deployed inspection | +| Calendar, Data, Security, and Settings exposed intent/ETag, verifier commands/schema names, event codes, `signed-session`, RBAC/ABAC, and OIDC/provider plumbing | Each product surface must replace implementation vocabulary with outcomes and next actions while retaining evidence in authorized diagnostics | Rendered-copy tests, authorization tests, and responsive screenshots | +| Mail toast and several route captures obscured or clipped primary navigation | Shared workspace layout must preserve navigation visibility while transient feedback is present | Desktop/mobile screenshots with active toast, sticky header, scroll, and keyboard focus | +| Mobile Search, Projects, and Settings placed content behind sticky headers | Reproduce scrolling and keyboard focus before selecting a layout repair | Focused controls and relevant text remain visible and reachable at 390×844 | + +The screenshot-failure RED at `af4df216` returned a diagnostic text path as +successful screenshot evidence. PR #1599 successor `9bb0dc7e` now throws the +capture error, leaves no false PNG, closes the page, and retains late browser +error detection; its focused suite passed 16/16. PR #1600 separately owns +source-head-bound artifact retention. Both remain Proposed until current-head +hosted checks and independent review finish. Unknown `/api/**` mocks can still +default to HTTP 200 `{ok: true}` and remain a separate reality-gap repair. + +## 2026-09-09 owner succession and review-gateway evidence + +These rows integrate the incoming #1611 observations into this single-writer +baseline. They bind each gap to its actual bounded-context owner and do not +reuse predecessor approvals or checks. + +| Observed responsibility gap | Canonical owner action | Current status and required evidence | +| --- | --- | --- | +| [#1590](https://github.com/ContextualWisdomLab/naruon/pull/1590) repeatedly acquired provider/model fixture changes outside its URL-extraction responsibility | [#1418](https://github.com/ContextualWisdomLab/naruon/pull/1418) remains the canonical Naruon URL/contact-hygiene owner and already carries the valid hostname and scheme delta | #1590 preserved all intervening ancestry and restored verified tree `24480909a7e8b8e5c707b52c976d820018389a77` at exact head `9d545440f556a3aa24213d690ab62bd45bfc6bdf`; #1418 is open/Draft and mergeable at `a4a4da69ff9df89bac9d0a00e7473f35685be567`. Completion requires fresh exact-head checks, independent approval, ordinary protected integration of #1418, and succession verification before retiring #1590. | +| Required Noema review lacked a terminal verdict after consumer-owned preflight selected the free gateway route | [contextual-orchestrator#1106](https://github.com/ContextualWisdomLab/contextual-orchestrator/issues/1106) owns free-pool admission/routing; [.github#2042](https://github.com/ContextualWisdomLab/.github/issues/2042) owns removal of the temporary leaf routing bridge after an immutable owner release; [.github#2035](https://github.com/ContextualWisdomLab/.github/pull/2035) remains only the review-publication repair | The freshest #2035 exact-head evidence is run `34183702988`, job `102003278065`: HTTP 429 after 322.5 seconds with `orchestrator/free`, caller attempts=1, served model `deepseek-ai/deepseek-v4-flash-0731`. Keep the review fail closed with no paid, local, or direct-provider bypass; completion requires immutable owner release, consumer version bump and bridge deletion, then exact-head contract/security/review GREEN. | + +**Baseline version:** 1.5 +**Observed on:** 2026-09-09 (Asia/Seoul) +**Observed protected branch (current scan; row Base-SHA values remain historical):** `develop@042b0c70531b229af3acbd0421a2f23098d848b3` **Observed product version:** `0.14.4` **Canonical completion issue:** [#1428](https://github.com/ContextualWisdomLab/naruon/issues/1428)