81 lines
7.5 KiB
Markdown
81 lines
7.5 KiB
Markdown
# Waggle OS — Consolidated "What's Left for GA"
|
|
|
|
**Date:** 2026-05-30 · **Baseline:** `main @ 6a526a6` (pushed, synced) · **Owner:** Marko (solo)
|
|
**Companion docs:** `PRODUCTION-PLAN.md` (5-phase roadmap) · `RECONCILIATION-2026-05-30.md` (verified residuals) · `TRUST-REPORT.md` (verified state) · `PHASE2-FAILURE-INJECTION-2026-05-30.md`
|
|
|
|
> This supersedes the open-item lists in the companion docs where they conflict. Every "DONE" below is a commit on `origin/main`; every "OPEN" names why it's blocked (platform vs. visual vs. upstream).
|
|
|
|
---
|
|
|
|
## 1. One-paragraph headline
|
|
|
|
The **security cluster is closed** (2 real production bugs found + fixed this session, both surfaced by *running* code, not auditing it), **billing correctness is closed**, **all 5 CI gates give real signal**, **deploy manifests are correctly wired per-target**, and **failure-injection E2E + a11y + light-mode tokens** landed with regression ratchets. What remains for GA is **not codeable headlessly on this Windows host**: macOS signing/notarization + binary runtime smokes (need a Mac / signed build), and the broad light-mode Tailwind-utility migration (needs a build + human visual contrast QA). The CLI is correctly packaged but its npm publish is gated on unpublished workspace deps. **GA is close on the engineering axis; the gating work is environmental, not unknown.**
|
|
|
|
---
|
|
|
|
## 2. GA gate checklist (from PRODUCTION-PLAN §1) — current truth
|
|
|
|
| Gate | Status | Evidence |
|
|
|---|---|---|
|
|
| 5/5 CI gates real (build-web, build-packages, lint, tauri-tsc, test) | ✅ **DONE** | `ci.yml`: tsc `:29`, lint `:32`, tauri-tsc `:35`, test `:37`, build `:65` |
|
|
| Security: AV-1..5 + R2-006 + R6-005 + R1-011 closed, adversarially re-verified | ✅ **DONE** | `9f76344`, `3a4f70a`, `0e4dfa7`; + D1 `d28abed`/`99347da` |
|
|
| Billing correctness (R1-002 payment gate, AV-4) | ✅ **DONE** | `e511f04` (webhook payment_status gate); AV-4 already closed `27a98f7` |
|
|
| E2E journeys + failure-injection in CI | 🟡 **PARTIAL** | network-drop 3/3 (`25cb5c0`); harness revived (`b732a5f`); broader persona journeys exist; **no full failure-injection matrix** |
|
|
| Win signed + mac notarized installers from CI; updater verifies | 🔴 **OPEN (platform)** | R7-008 — needs Mac + signing certs |
|
|
| Web deploys to staging; live-mode Stripe round-trips; prod CORS exact-match | 🟡 **PARTIAL** | env wired (`adf607b`), CORS fail-closed (`c00232c`); **live round-trip untested** (needs a real deploy + Stripe keys) |
|
|
| drizzle 0.44→0.45; light-mode contrast audit passes; a11y basics | 🟡 **PARTIAL** | drizzle ✅ (`fb33ca8`); a11y modals ✅ (`3300b1e`); light tokens ✅ AA (`dc6090c`); **broad util migration + visual audit OPEN** |
|
|
| Commits pushed; tag cut | ✅/🟡 | all pushed; `v0.1.0-ga-hardening-phase1` tagged; **final GA tag not cut** |
|
|
|
|
---
|
|
|
|
## 3. DONE this session (all on `origin/main`, 22 commits `0f6bb4c..6a526a6`)
|
|
|
|
**Security & billing (the high-value finds):**
|
|
- 🐛 **R1-002 Stripe webhook bypass** (`e511f04`) — `checkout.session.completed` granted paid tiers on *unpaid* sessions in both handlers. Now gated on `payment_status`. TDD, 30/30 stripe green.
|
|
- 🐛 **D1 SPA-asset auth regression** (`99347da`) — D1 gated the SPA shell + static assets behind a bearer token → browsers/webview got `401 MISSING_TOKEN` on load, unbootstrappable; **bricked the hosted web deploy**. Exempted non-API GETs; auth boundary intact (negative-control tests).
|
|
- **AV-1/2/3/5, R2-006, R6-005, R1-011** (`9f76344`, `3a4f70a`, `0e4dfa7`) — network/auth boundary, dev-tier-override gate, webhook serialize, rate-limit mkdir.
|
|
- **CORS fail-closed in prod** (`c00232c`) — team server throws on missing `CORS_ORIGIN` instead of silent localhost fallback.
|
|
|
|
**Verification infra (Phase 2):**
|
|
- **network-drop failure-injection E2E** (`25cb5c0`) — 3/3 green; SSE abort / mid-stream truncation / re-send recovery, LLM-mode-independent.
|
|
- **Harness-wide trust + revived dormant UI suite** (`b732a5f`) — `WAGGLE_TRUST_LOCALHOST` for API-contract specs; §14 UI suite was silently skipping on a dead `:8080` probe, repointed at `:3333`.
|
|
- **Repaired broken Playwright npm scripts** (`c3c569b`) — `--project=api/visual` referenced non-existent projects.
|
|
|
|
**Perf & a11y (P4):**
|
|
- **Harvest skip-unchanged** (`da29e77`) — R3-004; `harvestSetHash` wired into the dedup path + 3 callsites. +7 tests.
|
|
- **Shared modal focus-trap** (`3300b1e`) — R5-004; reusable `useFocusTrap` on 3 modals. +5 tests.
|
|
- **Light-mode token set** (`dc6090c`) — R5-006 tokens; 4 missing status + 5 KG tokens defined, all WCAG-AA verified numerically. +12-test contrast ratchet.
|
|
|
|
**Deploy & packaging (P3):**
|
|
- **Per-manifest env wiring** (`adf607b`) — render.yaml (sidecar) += Stripe; docker-compose (team) += CORS_ORIGIN. Corrected 2 false reconciliation claims.
|
|
- **@waggle/cli publish config** (`6a526a6`) — `files:[dist,bin]`, full metadata; pack verified 0 src/test files.
|
|
|
|
---
|
|
|
|
## 4. What genuinely remains — by blocker class
|
|
|
|
### 4a. 🔴 Platform-blocked on Windows (need a Mac and/or signed binary)
|
|
- **R7-008 — macOS signing + notarization** + updater signature verification. Developer ID + `notarytool` need macOS.
|
|
- **Windows code-signing** — *can* be wired from here once an EV cert is procured (cert procurement is the blocker, not the code).
|
|
- **Binary runtime smokes** — orphan-sidecar kill, updater URL, static/Clerk first-run, and the **D1 desktop first-run connect** (the one path still only server-level tested; revert hatch = `WAGGLE_TRUST_LOCALHOST=1`).
|
|
|
|
### 4b. 🟡 Needs a build + human visual QA (not headless-verifiable)
|
|
- **R5-006 broad light-mode migration** — **~462 hardcoded Tailwind color utilities** (`bg-red-500` etc.) + 20 hex in `apps/web/src`. The token layer is done + AA-ratcheted; these utilities need a running build and **independent visual contrast audit** (the plan's anti-self-grading doctrine). Do not blind-rewrite.
|
|
- **Live-mode Stripe round-trip** — env is wired; needs a real staging deploy + live Stripe keys to confirm checkout + webhook end-to-end.
|
|
|
|
### 4c. 🟢 Codeable headless — small remaining
|
|
- **Full failure-injection matrix** — only network-drop landed; capability-missing/traversal/unpaid-tier are unit-covered, sidecar-restart is architecturally infeasible (documented). A persona-journey E2E expansion is optional-not-blocking.
|
|
- **@waggle/cli end-to-end publish** — packaging done; **gated upstream**: `@waggle/core/agent/weaver` are pinned `"*"` and unpublished (404). Publish those (or bundle) to unblock.
|
|
- **§7.5 CI path-drift** — deprecated sync workflows still hard-code old `packages/core/src/mind` paths (inert, but flagged in RECONCILIATION).
|
|
|
|
---
|
|
|
|
## 5. Recommended path to GA cut
|
|
|
|
1. **On a Mac (or mac CI runner):** wire signing/notarization (R7-008), produce signed installers, run the binary runtime smokes incl. D1 desktop first-run. ← the critical-path blocker.
|
|
2. **One staging deploy:** apply `render.yaml` with real Stripe keys → confirm a live checkout + webhook round-trip; apply `docker-compose.production` with `CORS_ORIGIN` → confirm team server boots + exact-match CORS.
|
|
3. **Light-mode visual pass:** build, open light mode, audit the 462-util surface with a contrast tool; migrate failures to tokens. Independent QA, not self-graded.
|
|
4. **Then:** full verification re-run, cut the GA tag, wire Enterprise CTA → kvark.ai.
|
|
|
|
**Bottom line:** the headless-codeable GA backlog is essentially cleared. Remaining work is gated on a **macOS/binary environment**, a **real staging deploy**, and **human visual QA** — none of which are unknowns, all of which are outside this Windows session's reach.
|