Waggle OS — Consolidated "What's Left for GA"

Date: 2026-05-30 · Baseline: main @ 6a526a6 (pushed, synced) · Owner: Marko (solo) Companion docs: PRODUCTION-PLAN.md (5-phase roadmap) · RECONCILIATION-2026-05-30.md (verified residuals) · TRUST-REPORT.md (verified state) · PHASE2-FAILURE-INJECTION-2026-05-30.md

This supersedes the open-item lists in the companion docs where they conflict. Every "DONE" below is a commit on origin/main; every "OPEN" names why it's blocked (platform vs. visual vs. upstream).

1. One-paragraph headline

The security cluster is closed (2 real production bugs found + fixed this session, both surfaced by running code, not auditing it), billing correctness is closed, all 5 CI gates give real signal, deploy manifests are correctly wired per-target, and failure-injection E2E + a11y + light-mode tokens landed with regression ratchets. What remains for GA is not codeable headlessly on this Windows host: macOS signing/notarization + binary runtime smokes (need a Mac / signed build), and the broad light-mode Tailwind-utility migration (needs a build + human visual contrast QA). The CLI is correctly packaged but its npm publish is gated on unpublished workspace deps. GA is close on the engineering axis; the gating work is environmental, not unknown.

2. GA gate checklist (from PRODUCTION-PLAN §1) — current truth

Gate	Status	Evidence
5/5 CI gates real (build-web, build-packages, lint, tauri-tsc, test)	✅ DONE	`ci.yml`: tsc `:29`, lint `:32`, tauri-tsc `:35`, test `:37`, build `:65`
Security: AV-1..5 + R2-006 + R6-005 + R1-011 closed, adversarially re-verified	✅ DONE	`9f76344`, `3a4f70a`, `0e4dfa7`; + D1 `d28abed`/`99347da`
Billing correctness (R1-002 payment gate, AV-4)	✅ DONE	`e511f04` (webhook payment_status gate); AV-4 already closed `27a98f7`
E2E journeys + failure-injection in CI	🟡 PARTIAL	network-drop 3/3 (`25cb5c0`); harness revived (`b732a5f`); broader persona journeys exist; no full failure-injection matrix
Win signed + mac notarized installers from CI; updater verifies	🔴 OPEN (platform)	R7-008 — needs Mac + signing certs
Web deploys to staging; live-mode Stripe round-trips; prod CORS exact-match	🟡 PARTIAL	env wired (`adf607b`), CORS fail-closed (`c00232c`); live round-trip untested (needs a real deploy + Stripe keys)
drizzle 0.44→0.45; light-mode contrast audit passes; a11y basics	🟡 PARTIAL	drizzle ✅ (`fb33ca8`); a11y modals ✅ (`3300b1e`); light tokens ✅ AA (`dc6090c`); broad util migration + visual audit OPEN
Commits pushed; tag cut	✅/🟡	all pushed; `v0.1.0-ga-hardening-phase1` tagged; final GA tag not cut

3. DONE this session (all on `origin/main`, 22 commits `0f6bb4c..6a526a6`)

Security & billing (the high-value finds):

🐛 R1-002 Stripe webhook bypass (e511f04) — checkout.session.completed granted paid tiers on unpaid sessions in both handlers. Now gated on payment_status. TDD, 30/30 stripe green.
🐛 D1 SPA-asset auth regression (99347da) — D1 gated the SPA shell + static assets behind a bearer token → browsers/webview got 401 MISSING_TOKEN on load, unbootstrappable; bricked the hosted web deploy. Exempted non-API GETs; auth boundary intact (negative-control tests).
AV-1/2/3/5, R2-006, R6-005, R1-011 (9f76344, 3a4f70a, 0e4dfa7) — network/auth boundary, dev-tier-override gate, webhook serialize, rate-limit mkdir.
CORS fail-closed in prod (c00232c) — team server throws on missing CORS_ORIGIN instead of silent localhost fallback.

Verification infra (Phase 2):

network-drop failure-injection E2E (25cb5c0) — 3/3 green; SSE abort / mid-stream truncation / re-send recovery, LLM-mode-independent.
Harness-wide trust + revived dormant UI suite (b732a5f) — WAGGLE_TRUST_LOCALHOST for API-contract specs; §14 UI suite was silently skipping on a dead :8080 probe, repointed at :3333.
Repaired broken Playwright npm scripts (c3c569b) — --project=api/visual referenced non-existent projects.

Perf & a11y (P4):

Harvest skip-unchanged (da29e77) — R3-004; harvestSetHash wired into the dedup path + 3 callsites. +7 tests.
Shared modal focus-trap (3300b1e) — R5-004; reusable useFocusTrap on 3 modals. +5 tests.
Light-mode token set (dc6090c) — R5-006 tokens; 4 missing status + 5 KG tokens defined, all WCAG-AA verified numerically. +12-test contrast ratchet.

Deploy & packaging (P3):

Per-manifest env wiring (adf607b) — render.yaml (sidecar) += Stripe; docker-compose (team) += CORS_ORIGIN. Corrected 2 false reconciliation claims.
@waggle/cli publish config (6a526a6) — files:[dist,bin], full metadata; pack verified 0 src/test files.

4. What genuinely remains — by blocker class

4a. 🔴 Platform-blocked on Windows (need a Mac and/or signed binary)

R7-008 — macOS signing + notarization + updater signature verification. Developer ID + notarytool need macOS.
Windows code-signing — can be wired from here once an EV cert is procured (cert procurement is the blocker, not the code).
Binary runtime smokes — orphan-sidecar kill, updater URL, static/Clerk first-run, and the D1 desktop first-run connect (the one path still only server-level tested; revert hatch = WAGGLE_TRUST_LOCALHOST=1).

4b. 🟡 Needs a build + human visual QA (not headless-verifiable)

R5-006 broad light-mode migration — ~462 hardcoded Tailwind color utilities (bg-red-500 etc.) + 20 hex in apps/web/src. The token layer is done + AA-ratcheted; these utilities need a running build and independent visual contrast audit (the plan's anti-self-grading doctrine). Do not blind-rewrite.
Live-mode Stripe round-trip — env is wired; needs a real staging deploy + live Stripe keys to confirm checkout + webhook end-to-end.

4c. 🟢 Codeable headless — small remaining

Full failure-injection matrix — only network-drop landed; capability-missing/traversal/unpaid-tier are unit-covered, sidecar-restart is architecturally infeasible (documented). A persona-journey E2E expansion is optional-not-blocking.
@waggle/cli end-to-end publish — packaging done; gated upstream: @waggle/core/agent/weaver are pinned "*" and unpublished (404). Publish those (or bundle) to unblock.
§7.5 CI path-drift — deprecated sync workflows still hard-code old packages/core/src/mind paths (inert, but flagged in RECONCILIATION).

5. Recommended path to GA cut

On a Mac (or mac CI runner): wire signing/notarization (R7-008), produce signed installers, run the binary runtime smokes incl. D1 desktop first-run. ← the critical-path blocker.
One staging deploy: apply render.yaml with real Stripe keys → confirm a live checkout + webhook round-trip; apply docker-compose.production with CORS_ORIGIN → confirm team server boots + exact-match CORS.
Light-mode visual pass: build, open light mode, audit the 462-util surface with a contrast tool; migrate failures to tokens. Independent QA, not self-graded.
Then: full verification re-run, cut the GA tag, wire Enterprise CTA → kvark.ai.

Bottom line: the headless-codeable GA backlog is essentially cleared. Remaining work is gated on a macOS/binary environment, a real staging deploy, and human visual QA — none of which are unknowns, all of which are outside this Windows session's reach.

7.5 KiB Raw Blame History