Skip to content
50 changes: 47 additions & 3 deletions docs/product-technical-gap-baseline.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,52 @@
# Naruon Product and Technical Gap Baseline

**Baseline version:** 1.2
**Observed on:** 2026-08-26 (Asia/Seoul)
**Observed protected branch (current scan; row Base-SHA values remain historical):** `develop@e5e99b4e3bb081b92c602358878856536030e2ca`
## 2026-09-08 visual evidence: smoke success is not product acceptance

This observation supplements the historical inventory below. PR
[#1599](https://github.com/ContextualWisdomLab/naruon/pull/1599) built source
`877f0d5c1b96c3ac212ecc86630afb75532f5880` and ran the same implementation
through test descendant `af4df216b3533ebb82dab9d361b415ddb941fa24`.
The production build and mocked browser smoke exited zero across ten routes at
1440×1024 and 390×844, and all twenty PNGs were directly inspected. The
[inspection receipt](https://github.com/ContextualWisdomLab/naruon/pull/1599#issuecomment-5578964200)
records scope and observed defects. It does not prove live provider writes,
real backend contracts, every locale, deployment, or complete accessibility.
PR #1600 then retained the same ten-route desktop evidence from hosted
Application CI run `34189161122` for exact head `d30f0b7c`. Direct inspection
confirmed that artifact creation succeeded while the customer-facing defects
below remained visible; a green smoke job is therefore evidence availability,
not visual acceptance.

| Observed customer gap | Canonical owner action | Acceptance evidence still required |
| --- | --- | --- |
| Home exposed English skip-link and `source-linked` | #1578 owns customer status copy; #1601 owns keyboard navigation copy | Merge both successors normally, then repeat keyboard-focused desktop/mobile inspection on the deployed product |
| Search displayed raw source/thread identifiers, `sender_context`, `reply_count`, API/Ontology labels, and machine action codes | [PR #1603](https://github.com/ContextualWisdomLab/naruon/pull/1603) retains scoped identifiers in requests/state while replacing visible plumbing with relationship, action, and mail-flow outcomes; exact head `462b134acf858061019d3ffe37b7b3d60e6f7e74` normalizes production `Colleague` casing, translates all four production action codes, and fails closed to neutral customer copy for unknown values | Full Vitest passed 51 files / 447 tests; scoped ESLint, TypeScript, diff checks, Application CI, Bandit, Docker validation, Security, Semgrep, coverage evidence/source, Strix, and GitHub Advanced Security CodeQL are GREEN. Required compatibility CodeQL remains failed on the central terminal-verdict ordering defect tracked by `.github#1929`; OpenCode and Noema are failed, no qualifying current-head formal approval or durable responsive-browser inspection exists, and the UI Delivery Gate remains **FAIL** pending owner repair, protected merge, and deployed inspection |
| Calendar, Data, Security, and Settings exposed intent/ETag, verifier commands/schema names, event codes, `signed-session`, RBAC/ABAC, and OIDC/provider plumbing | Each product surface must replace implementation vocabulary with outcomes and next actions while retaining evidence in authorized diagnostics | Rendered-copy tests, authorization tests, and responsive screenshots |
| Mail toast and several route captures obscured or clipped primary navigation | Shared workspace layout must preserve navigation visibility while transient feedback is present | Desktop/mobile screenshots with active toast, sticky header, scroll, and keyboard focus |
| Mobile Search, Projects, and Settings placed content behind sticky headers | Reproduce scrolling and keyboard focus before selecting a layout repair | Focused controls and relevant text remain visible and reachable at 390×844 |

The screenshot-failure RED at `af4df216` returned a diagnostic text path as
successful screenshot evidence. PR #1599 successor `9bb0dc7e` now throws the
capture error, leaves no false PNG, closes the page, and retains late browser
error detection; its focused suite passed 16/16. PR #1600 separately owns
source-head-bound artifact retention. Both remain Proposed until current-head
hosted checks and independent review finish. Unknown `/api/**` mocks can still
default to HTTP 200 `{ok: true}` and remain a separate reality-gap repair.

## 2026-09-09 owner succession and review-gateway evidence

These rows integrate the incoming #1611 observations into this single-writer
baseline. They bind each gap to its actual bounded-context owner and do not
reuse predecessor approvals or checks.

| Observed responsibility gap | Canonical owner action | Current status and required evidence |
| --- | --- | --- |
| [#1590](https://github.com/ContextualWisdomLab/naruon/pull/1590) repeatedly acquired provider/model fixture changes outside its URL-extraction responsibility | [#1418](https://github.com/ContextualWisdomLab/naruon/pull/1418) remains the canonical Naruon URL/contact-hygiene owner and already carries the valid hostname and scheme delta | #1590 preserved all intervening ancestry and restored verified tree `24480909a7e8b8e5c707b52c976d820018389a77` at exact head `9d545440f556a3aa24213d690ab62bd45bfc6bdf`; #1418 is open/Draft and mergeable at `a4a4da69ff9df89bac9d0a00e7473f35685be567`. Completion requires fresh exact-head checks, independent approval, ordinary protected integration of #1418, and succession verification before retiring #1590. |
| Required Noema review lacked a terminal verdict after consumer-owned preflight selected the free gateway route | [contextual-orchestrator#1106](https://github.com/ContextualWisdomLab/contextual-orchestrator/issues/1106) owns free-pool admission/routing; [.github#2042](https://github.com/ContextualWisdomLab/.github/issues/2042) owns removal of the temporary leaf routing bridge after an immutable owner release; [.github#2035](https://github.com/ContextualWisdomLab/.github/pull/2035) remains only the review-publication repair | The freshest #2035 exact-head evidence is run `34183702988`, job `102003278065`: HTTP 429 after 322.5 seconds with `orchestrator/free`, caller attempts=1, served model `deepseek-ai/deepseek-v4-flash-0731`. Keep the review fail closed with no paid, local, or direct-provider bypass; completion requires immutable owner release, consumer version bump and bridge deletion, then exact-head contract/security/review GREEN. |

**Baseline version:** 1.5
**Observed on:** 2026-09-09 (Asia/Seoul)
**Observed protected branch (current scan; row Base-SHA values remain historical):** `develop@042b0c70531b229af3acbd0421a2f23098d848b3`
**Observed product version:** `0.14.4`
**Canonical completion issue:** [#1428](https://github.com/ContextualWisdomLab/naruon/issues/1428)

Expand Down
Loading