moving

docs/audits/2026-07-13-final-goal-verification.md

@@ -0,0 +1,144 @@
+# Final UX Goal Verification - 2026-07-13
+
+## Verdict
+
+The five-persona in-product UX gate is met on commit `2a672bda`:
+
+| Persona | Score | Verdict |
+|---|---:|---|
+| Solo founder | 9.4/10 | Pass |
+| Researcher | 9.5/10 | Pass |
+| Engineer / power user | 9.3/10 | Pass |
+| Team admin / security reviewer | 9.1/10 | Pass |
+| Mobile executive | 9.3/10 | Pass |
+
+No persona is averaged away. All five independently clear 9/10, no normalized
+dimension is below 8/10, and no rubric score cap was triggered.
+
+This is not a claim that public release operations are complete. Product UX and
+release availability are reported separately so an unavailable domain, missing
+signing, or an untested paid external account cannot be hidden inside a score.
+
+## Scored Evidence
+
+The final deterministic judge run passed 5/5. Its state bundles cover:
+
+- 15 primary route states.
+- 25 offline, unavailable, slow, large-data, success, cancellation, and trust states.
+- 3 selected overlays with open, fit, Escape-close, and focus behavior.
+- Desktop 1440 x 900 and mobile 390 x 844 viewports.
+- 0 critical console errors, 0 page errors, and 0 unexpected critical network failures.
+- 0 visible horizontal-overflow findings in the captured route, failure, and overlay states.
+
+The persona lanes were:
+
+- Solo founder: Home continuity, Profile, chat-offline recovery, and Workspace Switcher.
+- Researcher: Memory, Artifacts, Timeline, unavailable/slow/large memory, large timeline, and failed export.
+- Engineer: Tool Launcher, MCP Hub, Files, degraded health, tool detection failure, slow/large agents, marketplace recovery, and file operations.
+- Team admin: Billing, Vault, Team settings, Approvals, active Team state, checkout success/cancel/unavailable, backup failures, and revoke-all confirmation.
+- Mobile executive: Home, Models/Settings, Memory, unavailable local runtime, chat-offline recovery, Notifications, and Command Center.
+
+Screenshots were captured only after visible `aria-busy` loaders and known route
+loading labels settled. Animations were disabled during capture. The settled
+Home, Memory, Launcher, Approvals, mobile Settings, and mobile Command Center
+screens were inspected directly.
+
+## Current-Head Quality Gates
+
+All of these gates passed on the integrated branch:
+
+- Root Vitest: 2,683 suites; 8,613 tests; 8,611 passed and 2 pending/skipped.
+- Full product browser audit: 204/204.
+- User journeys, network loss, and corrected Spawn Agent lane: 36/36.
+- Runtime accessibility: 2/2 desktop/mobile matrices with zero axe violations across the core route set, including Channels.
+- Visual and UAT regression: 27/27 in dark, light, desktop, mobile, and constrained viewports.
+- Performance regression: 13/13.
+- Provider model discovery: 43/43.
+- Channels: 105 backend tests and 7 focused UI tests; loopback manager/auth slice 29/29.
+- PostgreSQL/Redis integration: 19 files and 161 tests.
+- Admin: 42 unit tests and 14 rendered Chromium tests.
+- TypeScript: web, server, and Tauri app projects pass.
+- Lint: full repository pass.
+- Production build: `build:all` pass; web build transformed 2,616 modules.
+- Dependency audit for the standalone Tauri app: 0 vulnerabilities after lock refresh.
+
+## Functional Corrections Included
+
+The integrated work closes the main UX and runtime failures found during the
+complete audit:
+
+- API-key onboarding and Settings use the same recoverable contract and keep key validation separate from router readiness.
+- Provider catalogs are fetched from provider APIs. New provider models can appear without a Waggle source-code release.
+- Anthropic cursor and Google page-token pagination are exhausted; Perplexity uses its current `/v1/models` catalog endpoint.
+- Stable provider/model identities reach Settings, Chat, Spawn Agent, fleet execution, and managed LiteLLM configuration.
+- Channels are integrated with protected loopback auth, encrypted WhatsApp state, atomic validation, durable approvals, duplicate suppression, same-chat ordering, mobile controls, and honest prerequisites/errors.
+- Persisted channel chat session IDs use a collision-resistant versioned encoding.
+- Home continuity, mobile onboarding, first-task handoff, overlay semantics, trust confirmations, focus metadata, light mode, visual baselines, and narrow-viewport layout are corrected and regression-locked.
+- The onboarding coachmark remains in bounds at constrained desktop width.
+- Memory, Launcher, Team, failure, and large-data judge states settle into inspectable UI rather than transient placeholders.
+
+## Desktop Distribution Proof
+
+The Tauri 2 debug package was built from the integrated source. The build produced:
+
+- `app/src-tauri/target/debug/waggle.exe` (39.6 MiB).
+- `app/src-tauri/target/debug/bundle/msi/Waggle_0.2.0_x64_en-US.msi` (152.4 MiB).
+- `app/src-tauri/target/debug/bundle/nsis/Waggle_0.2.0_x64-setup.exe` (97.6 MiB).
+
+The bundled application launched, created its tray, started the bundled Node
+sidecar, initialized the in-process embedder, and returned healthy from
+`/health`. An administrative MSI extraction produced 15,473 files and a 503.8
+MiB payload. The executable launched from that extracted MSI payload with a new
+data directory, used the packaged `resources/node.exe`, reached healthy, and
+released its port on shutdown.
+
+This proves packaging and packaged startup. It does not prove production code
+signing or signed updater delivery.
+
+## Dynamic Model Contract
+
+Model availability is API-driven. The live endpoint audit returned expected
+authentication responses for Anthropic, OpenAI, Google, DeepSeek, xAI, Mistral,
+Alibaba, MiniMax, Zhipu, and Moonshot; OpenRouter and the current Perplexity
+catalog endpoint returned catalogs without a Waggle-maintained model allowlist.
+
+Last-known catalogs remain available during a provider outage, and the UI says
+when refresh failed. Focus refresh makes newly released models available while
+Waggle is open. Empty maintained model arrays are intentional; they prevent a
+stale hardcoded catalog from becoming the product truth.
+
+## Honest Release Boundary
+
+The in-product five-persona goal is met. Public release readiness is not yet a
+9/10 claim because these external gates remain:
+
+- `waggle-os.ai` and `www.waggle-os.ai` did not resolve during the live DNS check.
+- The available Vercel credential was invalid, no Vercel project/org secrets were present, and no Hostinger API token was available.
+- Production signing and signed updater artifacts are not available.
+- Paid/live third-party credentials were unavailable for Telegram, Discord, Slack, Stripe checkout, and a fully paired WhatsApp lifecycle.
+- A real provider-held tool approval arriving through a live Channel remains a credential-dependent smoke.
+
+These do not invalidate the measured product UX score, but they block a claim
+that the public launch and every external integration are production-live. They
+require domain/deployment ownership, signing material, or third-party accounts;
+they cannot be completed honestly from repository code alone.
+
+## Reproduction
+
+Key commands used for the current-head evidence:
+
+```powershell
+npm run lint
+npx tsc --noEmit --project packages/server/tsconfig.json
+npx tsc --noEmit --project apps/web/tsconfig.app.json
+npx tsc --noEmit --project app/tsconfig.json
+npm run build:all
+npm run test -- --run
+npx playwright test tests/e2e/runtime-a11y.spec.ts --project=chromium
+npx playwright test tests/e2e/visual-regression.spec.ts --project=chromium
+npx playwright test tests/e2e/five-persona-state-bundles.spec.ts --project=chromium
+```
+
+The generated persona evidence lives under
+`output/playwright/five-persona-state-bundles/` during a local run and is not a
+source-controlled product artifact.