This commit is contained in:
Oleg Maslov
219
docs/audits/2026-07-08-source-inventory-consistency-audit.md
Normal file
219
docs/audits/2026-07-08-source-inventory-consistency-audit.md
Normal file
@@ -0,0 +1,219 @@
|
||||
# Source Inventory Consistency Audit - 2026-07-08
|
||||
|
||||
Status: analysis supplement. No product code was changed.
|
||||
|
||||
Purpose: compare the UX audit packet against the current source inventory so the final "complete UX" claim does not silently miss reachable routes, command destinations, apps, packages, or non-main user surfaces.
|
||||
|
||||
Deeper T19 follow-up: `docs/audits/2026-07-08-browser-companion-t19-analysis.md`.
|
||||
|
||||
## Commands
|
||||
|
||||
```powershell
|
||||
Get-Content apps/web/src/App.tsx
|
||||
Get-Content apps/web/src/lib/routes.ts
|
||||
Get-Content apps/web/src/lib/dock-tiers.ts
|
||||
Get-Content apps/web/src/lib/command-catalog.ts
|
||||
Get-ChildItem apps -Directory
|
||||
Get-ChildItem packages -Directory
|
||||
Get-ChildItem apps/www/app -Recurse -File
|
||||
Get-ChildItem apps/browser-ext -Recurse -File
|
||||
rg -n "browser-ext|WAGGLE_BROWSER_EXT|WAGGLE_DEV_ALLOW_ANY_EXTENSION|chrome-extension" packages apps tests docs --glob '!docs/audits/2026-07-08-*.md'
|
||||
node --check apps/browser-ext/popup.js
|
||||
node --check apps/browser-ext/background.js
|
||||
node --check apps/browser-ext/content.js
|
||||
npx tsc --noEmit --project packages/server/tsconfig.json
|
||||
Test-NetConnection 127.0.0.1 -Port 3333
|
||||
```
|
||||
|
||||
## In-App Route Registry Check
|
||||
|
||||
Source: `apps/web/src/App.tsx`.
|
||||
|
||||
Result: every production shell route is represented in `docs/audits/2026-07-08-ux-route-scenario-manifest.md`.
|
||||
|
||||
Routes verified:
|
||||
|
||||
```text
|
||||
/auth
|
||||
/ -> /home
|
||||
/home
|
||||
/workspaces
|
||||
/workspaces/:workspaceId/:tab?
|
||||
/memory/:mindScope?
|
||||
/artifacts
|
||||
/files
|
||||
/agents
|
||||
/automations
|
||||
/skills
|
||||
/room
|
||||
/waggle-dance
|
||||
/approvals
|
||||
/connectors
|
||||
/mcps
|
||||
/marketplace
|
||||
/launcher
|
||||
/team
|
||||
/settings
|
||||
/settings/vault
|
||||
/settings/profile
|
||||
/settings/mission-control
|
||||
/settings/timeline
|
||||
/settings/events
|
||||
/settings/usage
|
||||
/benchmarks
|
||||
/platform
|
||||
/payment-success
|
||||
/payment-cancelled
|
||||
*
|
||||
```
|
||||
|
||||
Notes:
|
||||
|
||||
- `/motion-spec` is registered only under `import.meta.env.DEV`, outside the AppShell subtree. It is a development reference surface, not part of the production five-persona score, unless the user explicitly asks to judge developer-only visual tooling.
|
||||
- The index route is represented in the manifest as `/ -> /home`; the automated string check did not count the separate index element because it has no `path` string.
|
||||
|
||||
## Dock And Command Destination Check
|
||||
|
||||
Sources:
|
||||
|
||||
- `apps/web/src/lib/routes.ts`
|
||||
- `apps/web/src/lib/dock-tiers.ts`
|
||||
- `apps/web/src/lib/command-catalog.ts`
|
||||
|
||||
Result: dock/app route destinations are represented in the manifest. Two command-query destinations need explicit evidence ownership because they are real user-facing command outcomes:
|
||||
|
||||
```text
|
||||
apps/web/src/lib/command-catalog.ts:75 - /launcher?watch=1
|
||||
apps/web/src/lib/command-catalog.ts:78 - /settings?tab=billing
|
||||
```
|
||||
|
||||
Correction owner: T11 route evidence. These are not new top-level routes, but the final judge packet should prove the watch-mode Launcher state and billing-tab deep link, or explicitly defer them.
|
||||
|
||||
The same source check also reinforces T3:
|
||||
|
||||
```text
|
||||
apps/web/src/lib/command-catalog.ts:113 - heading "Pinned - Pro" is active Command Center copy
|
||||
apps/web/src/lib/dock-tiers.ts:81 - stale Pro comment in approvals copy context
|
||||
```
|
||||
|
||||
## Apps Inventory
|
||||
|
||||
Current `apps/` inventory:
|
||||
|
||||
```text
|
||||
apps/browser-ext - no package.json; Chrome MV3 extension
|
||||
apps/web - package.json; main installed cockpit UI
|
||||
apps/www - package.json; public launch funnel
|
||||
```
|
||||
|
||||
Audit consequence:
|
||||
|
||||
- `apps/web` is the main installed product surface.
|
||||
- `apps/www` is already T13.
|
||||
- `apps/browser-ext` was underrepresented in the July UX packet and should be a separate non-main gate because it is a real user-facing capture surface.
|
||||
|
||||
## Package Inventory
|
||||
|
||||
Current `packages/` inventory contains 28 package workspaces:
|
||||
|
||||
```text
|
||||
admin-web
|
||||
agent
|
||||
cli
|
||||
core
|
||||
hive-mind-cli
|
||||
hive-mind-core
|
||||
hive-mind-hooks-claude-code
|
||||
hive-mind-hooks-claude-desktop
|
||||
hive-mind-hooks-codex
|
||||
hive-mind-hooks-codex-desktop
|
||||
hive-mind-hooks-core
|
||||
hive-mind-hooks-cursor
|
||||
hive-mind-hooks-hermes
|
||||
hive-mind-hooks-openclaw
|
||||
hive-mind-mcp-server
|
||||
hive-mind-shim-core
|
||||
hive-mind-wiki-compiler
|
||||
launcher
|
||||
marketplace
|
||||
memory-mcp
|
||||
optimizer
|
||||
sdk
|
||||
server
|
||||
shared
|
||||
waggle-dance
|
||||
weaver
|
||||
wiki-compiler
|
||||
worker
|
||||
```
|
||||
|
||||
Audit consequence:
|
||||
|
||||
- The July packet's T15/T16/T17 grouping covers these packages by role, but future AGENTS/docs language that says "27 packages" is stale against current source.
|
||||
- `hive-mind-hooks-core` is a package workspace and should stay in T16/T17 verification command scope, even though it is not a launchable AI-tool adapter.
|
||||
|
||||
## Public Site Inventory
|
||||
|
||||
Current `apps/www/app` route/API files:
|
||||
|
||||
```text
|
||||
/
|
||||
/account
|
||||
/sign-in/[[...sign-in]]
|
||||
/sign-up/[[...sign-up]]
|
||||
/docs/methodology
|
||||
/design/personas
|
||||
/privacy
|
||||
/terms
|
||||
/cookies
|
||||
/eu-ai-act
|
||||
/api/stripe/checkout
|
||||
/api/webhooks/stripe
|
||||
```
|
||||
|
||||
Audit consequence:
|
||||
|
||||
- T13 already covers homepage, account/auth, methodology, legal pages, checkout, and webhook/deploy shape.
|
||||
- `/design/personas` should be treated as a public/supporting route if public-site route evidence is expanded. It does not affect Phase 1.
|
||||
|
||||
## Browser Companion Inventory
|
||||
|
||||
Current files:
|
||||
|
||||
```text
|
||||
apps/browser-ext/manifest.json
|
||||
apps/browser-ext/popup.html
|
||||
apps/browser-ext/popup.js
|
||||
apps/browser-ext/background.js
|
||||
apps/browser-ext/content.js
|
||||
apps/browser-ext/README.md
|
||||
```
|
||||
|
||||
Source contract:
|
||||
|
||||
- `apps/browser-ext/README.md` presents the surface as "Waggle Companion", a Chrome MV3 extension for saving pages/selections to workspace memory.
|
||||
- `packages/server/src/local/routes/browser-ext.ts` exposes `GET /api/browser-ext/session-token` and `GET /api/browser-ext/health`.
|
||||
- `packages/server/src/local/cors-config.ts` gates extension origins through `WAGGLE_BROWSER_EXT_IDS` or the dev-only `WAGGLE_DEV_ALLOW_ANY_EXTENSION=1`.
|
||||
- `apps/browser-ext/background.js` calls `/api/browser-ext/session-token`, `/api/browser-ext/health`, and `/api/memory/frames`.
|
||||
|
||||
Current evidence gap:
|
||||
|
||||
- The T19 follow-up loaded the unpacked extension in Chromium and captured a disconnected popup screenshot at `output/playwright/browser-companion-disconnected-state.png`.
|
||||
- JS syntax, manifest parse, and `packages/server` typecheck pass.
|
||||
- The secure-default live smoke proves content-script extraction from a normal page, MV3 service-worker no-Origin header handling, token bootstrap during save, background save through `chrome.runtime.sendMessage`, and `/api/memory/frames` imported-frame confirmation. The popup keyboard/click smoke proves Tab order across popup actions, visible Save selection focus, Enter-to-save selection, Save page UI click, frame creation, `/api/memory/search` `source: import` provenance for both captures, and restricted-page disabled-state/recovery behavior.
|
||||
- Remaining evidence gaps: native toolbar-bubble proof, native context-menu click flow, CORS-denied screenshot with a real extension origin, signed release-package proof if scored, and any future scored recall result shape. Stable packaged-ID sidecar pairing is now covered by `output/playwright/browser-companion-toolbar-3333/packaged-id-pairing-summary.json`, and existing chat `auto_recall`/catch-up imported provenance is covered by `packages/agent/tests/orchestrator-recall-hardening.test.ts`.
|
||||
|
||||
Recommended ticket: T19, Browser Companion Extension UX Gate.
|
||||
|
||||
Suggested acceptance:
|
||||
|
||||
- Load unpacked extension in Chromium with a fresh sidecar and extension origin allowlist.
|
||||
- Verify connected and disconnected popup states.
|
||||
- Verify save selected text and save whole page produce visible extension feedback and a memory frame in Waggle.
|
||||
- Verify CORS-denied state tells the user how to start or configure Waggle.
|
||||
- Verify popup accessibility basics beyond the proven keyboard/focus path if screen-reader announcement behavior enters scoring.
|
||||
- Either add automated smoke evidence or explicitly defer the extension from the five-persona score.
|
||||
|
||||
## Phase Impact
|
||||
|
||||
This supplement does not change Phase 1. It adds T19 as a final-product gate after the in-app P0 blockers are cleared.
|
||||
Reference in New Issue
Block a user