waggle-os/docs/ga/RECONCILIATION-2026-05-30.md

# Waggle-OS GA Reconciliation — 2026-05-30

> Baseline: `main @ 5ccfa53` (2026-05-29). This reconciles `PRODUCTION-PLAN.md` Phases 2–5 against the code after the Phase0/Phase1 security track (AV-1/2/3/5, D1, gates) and the parallel-session Phase7a–e + S4 full type-ratchet (`no-explicit-any` 937→0 repo-wide) both landed. The plan was authored **before** that work, so some items are now closed and some plan claims — especially Phase 7d's "light-mode finish" — are corrected against verified evidence below.

## 1. Headline — what genuinely remains for GA

The hard security and supply-chain work is done (drizzle 0.45 migrated and clean; Stripe `billingPeriod` fail-closed validation in place), but **GA is not shippable as-is**: there is a live **CORS suffix-attack vulnerability in the team server** (`packages/server/src/index.ts:46` passes a raw origin array to Fastify CORS instead of the exact-match `corsOriginAllowed()` the local server already uses), a **payment-gate bypass in both Stripe webhook handlers** (checkout.session.completed grants paid tiers without checking `payment_status`), **no real browser/persona E2E or failure-injection coverage**, **deployment manifests missing all Stripe/CORS env vars**, **light mode ~0.6% migrated** (4 status tokens + 5 KG tokens missing for light theme, 60+ files still hardcoded, contrast never visually validated), and **desktop signing + R7-008 updater-signature unfixed** (these are platform-blocked on Windows). The two items the verifiers downgraded from CLOSED→OPEN/PARTIAL (P3-stripe webhook gate, P3-cors) are the most urgent because they are security regressions, not gaps.

## 2. Cluster status matrix

| Cluster | Phase | Final Status | Key Residuals | Evidence |
|---|---|---|---|---|
| P2-e2e | Phase 2 (WS-B) | **PARTIAL** | No Playwright persona journeys; no failure-injection suite; no R3-002 cycle test; CI bypasses npm scripts | `tests/e2e/user-journeys.spec.ts` (generic J1–J10 only); `.github/workflows/ci.yml:71` runs `npx playwright test tests/e2e/` directly |
| P3-sign | Phase 3 (WS-C desktop) | **PARTIAL** | Win cert not in CI; mac Developer ID/notarization not in CI; R7-008 empty `signature:""` | `release.yml:56-65,111-121,137/141/145`; `tauri.conf.json`; pilot self-sign scripts exist but manual |
| P3-cli | Phase 3 (WS-C desktop) | **PARTIAL** | `@waggle/cli` missing `files`, `publishConfig`, metadata, `exports` (publishes tests/src) | `packages/cli/package.json:7-9,16-22`; vs fully-configured `hive-mind-cli` |
| P3-deploy | Phase 3 (WS-C web) | **PARTIAL** | Stripe + CORS env vars absent from both deploy manifests; `render.yaml` build path mismatch (`cd app` vs `apps/web`) | `render.yaml:1-63`; `docker-compose.production.yml:16-57`; Dockerfile non-root OK (`:91-115`) |
| P3-stripe | Phase 3 (WS-C web) | **PARTIAL** ⚠️ *(verifier downgraded from CLOSED)* | Webhook handlers grant tiers without `payment_status` check (R1-002 bypass) | `packages/server/src/stripe/webhook.ts:115-126`; `apps/www/app/api/webhooks/stripe/route.ts:98-110` |
| P3-cors | Phase 3 (WS-C web) | **OPEN** ⚠️ *(verifier downgraded from PARTIAL)* | Team server passes raw array to Fastify CORS → suffix attack; deploy `CORS_ORIGIN` unset | `packages/server/src/index.ts:46` vs correct local `index.ts:1912-1920` + `cors-config.ts:57-59` |
| P3-drizzle | Phase 3 (WS-C migration) | **CLOSED** ✓ | None | `packages/server/package.json:32` `drizzle-orm@^0.45.2`; journal v7; commit `fb33ca8`; tsc clean |
| discovered-drift | Discovered §7.5 | **PARTIAL** ⚠️ *(verifier downgraded from CLOSED)* | Stale `packages/core/src/mind/**` paths + hard-coded script paths in deprecated sync workflows | `sync-mind.yml:51,117-118`; `mind-parity-check.yml:35,41,118,170-171` |
| P4-light | Phase 4 (WS-D) | **OPEN** | 4 light status tokens + 5 KG tokens missing; 60+ files hardcoded; contrast never validated | `apps/web/src/index.css:190`; commit `6a3d598` ("Contrast NOT visually validated"); TRUST-REPORT "~0.6% done" |
| P4-a11y-perf | Phase 4 (WS-D) | **PARTIAL** | ComplianceTemplateModal no Escape/focus-trap/labelledby; window controls absent; harvest `contentHash` never computed/passed | `ComplianceTemplateModal.tsx:171-172`; `harvest.ts:409` + `index.ts:1226,1449` call `recordSync` w/ 3 args; `tauri.conf.json:37` |

Legend: ⚠️ = adversarial verifier overrode the original investigator status.

## 3. Per-phase: what's actually left

### Phase 2 (WS-B) — E2E + failure-injection — PARTIAL
The "E2E" that exists is Vitest server-level tests plus generic Playwright UI journeys. None of the plan's persona/failure-recovery intent is met.
- Add Playwright **persona journeys** for researcher, analyst, coder, product-manager, executive-assistant (chat → tool invocation → result), distinct from generic J1–J10. The 17-persona coverage that exists is behavioral unit tests in `packages/agent/tests/behaviors/`, not browser journeys.
- Add a **failure-injection suite** (e.g. `tests/e2e/failure-injection.spec.ts`): network-drop mid-stream, capability-missing hard error, traversal-rejected 403, unpaid-tier gate, sidecar-restart.
- Add the **R3-002 circular-dependency test** asserting `@waggle/shared` / `@waggle/server` / `@waggle/agent` / `@waggle/core` form an acyclic import graph (none exists; grep for `R3-002` returns nothing).
- Fix **CI wiring**: `.github/workflows/ci.yml:71` invokes Playwright directly instead of `npm run test:all` / `test:e2e`, so CI and local diverge from the package.json scripts.
- Publish a **persona→journey coverage map** for CI visibility.

### Phase 3 (WS-C) — desktop, web, migration — mixed
**P3-drizzle is genuinely CLOSED** (verifier agreed): 0.44.7→0.45.2 across server/launcher/worker, journal v7, tsc clean, no audit findings — a pure security patch (GHSA-gpj5-g38j-94v9), 42 usage sites verified.

**P3-stripe — verifier OVERRODE CLOSED → PARTIAL.** Commit `27a98f7` correctly fixed `billingPeriod` (R1-003) and atomic writes (R1-011), but the R1-002 payment gate was only added to the `/api/stripe/sync` endpoint, **not the webhook handlers**. Both `webhook.ts:115-126` and `apps/www/.../route.ts:98-110` process `checkout.session.completed` without checking `session.payment_status`, so webhook delivery can grant a paid tier from an unpaid session. **Next action:** add a `payment_status === 'paid'` (or `'no_payment_required'`) guard in both webhook handlers before any tier grant; add a regression test.

**P3-cors — verifier OVERRODE PARTIAL → OPEN (security).** `packages/server/src/index.ts:46` passes `{ origin: config.corsOrigin }` (raw array) to `@fastify/cors`, which does substring/`includes`-style matching — vulnerable to suffix attacks (e.g. `localhost:1420.evil.com`). The local server already does it right at `index.ts:1912-1920` via `corsOriginAllowed()` (`cors-config.ts:57-59`). **Next action:** unify the team server onto the callback-based exact-match `corsOriginAllowed()`; set `CORS_ORIGIN` in both deploy manifests; add a test asserting lookalike-origin rejection. Treat as a release blocker for any team-server deployment.

**P3-deploy — PARTIAL.** `render.yaml` and `docker-compose.production.yml` declare DB/Redis/Anthropic/Clerk but **omit** `STRIPE_SECRET_KEY`, `STRIPE_WEBHOOK_SECRET`, `STRIPE_PRICE_*`, and `CORS_ORIGIN`. Non-root Docker user is correctly set (`Dockerfile:91-115`). **Next action:** add the Stripe + CORS env vars (`sync:false`) to both manifests; resolve the `render.yaml:16` build-path mismatch (`cd app` vs package.json `cd apps/web`) — confirm/alias or fix, since it is a latent deploy failure; document that `apps/www` is a separate Next.js deployment.

**P3-sign — PARTIAL (partly platform-blocked, see §4).** `release.yml` passes no signing secrets for Windows or macOS; the updater manifest hard-codes `signature:""` for all three targets (R7-008); pilot self-sign scripts exist but are manual. **Next action (codeable on Windows):** wire Windows EV cert + `TAURI_PRIVATE_KEY`/`TAURI_KEY_PASSWORD` into `release.yml`, add the GitHub Actions secrets, and populate the updater `signature` field from the signing step. Cert procurement (timeline T+14/2026-05-21 start) appears **overdue** with no in-repo evidence.

**P3-cli — PARTIAL.** `bin → dist/.js` routing works and workspace deps resolve, but `@waggle/cli` lacks `files`, `publishConfig.access`, standard metadata (`repository`/`bugs`/`homepage`/`types`/`author`/`keywords`/`engines`), and `exports` — so it would publish tests/src. **Next action:** mirror `hive-mind-cli`'s package.json publishing config.

**discovered-drift — verifier OVERRODE CLOSED → PARTIAL.** The stale `packages/core/src/mind/**` trigger paths in `sync-mind.yml` and `mind-parity-check.yml` won't fire (files moved to `packages/hive-mind-core` on `3b556c0`), but the shell scripts still hard-code stale paths (`mind-parity-check.yml:118,170-171`) and there's no re-activation runbook — inert by accident, not by design. **Next action:** either delete the deprecated workflows or clean the hard-coded paths and add a one-line runbook note.

### Phase 4 (WS-D) — light mode + a11y/perf — OPEN / PARTIAL
**P4-light — OPEN. The Phase 7d "light-mode finish" claim is materially false.** Verified: only `--status-healthy` has a light value (`index.css:190`); `--status-warning/error/info/ai` and `--kg-person/project/concept/org/default` have **no** light variants; 60+ component files still use hardcoded Tailwind classes (e.g. `UserProfileApp.tsx:232,268,279`); commit `6a3d598` explicitly states "Contrast NOT visually validated (no binary build)"; TRUST-REPORT puts it at "~0.6% done". **Next actions:** add the 4 missing status tokens + 5 KG tokens to the light-theme block; migrate hardcoded classes to semantic tokens; run an independent WCAG-AA contrast audit; review the ~13 flagged mid-tone `text-*-300` accents for regression.

**P4-a11y-perf — PARTIAL.** `ComplianceTemplateModal` has `role="dialog"`/`aria-modal` but no Escape handler, no `aria-labelledby`, no focus trap; `TrialExpiredModal`/`UpgradeModal` have Escape + labelledby but only focus-on-mount (no trap). Window min/max/close controls are absent (`tauri.conf.json:37` `decorations=true`, no custom titlebar). Harvest dedup is **half-wired**: `last_content_hash` exists in DDL and `recordSync()` accepts a 4th `contentHash` arg, but all three callsites (`harvest.ts:409`, `index.ts:1226`, `index.ts:1449`) pass only 3 args, so the O(n·500) rescan persists. **Next actions:** add Escape + `aria-labelledby` + a shared focus-trap to all three modals; build the custom Tauri titlebar; compute SHA-256 `contentHash`, pass it at all three callsites, and add the dedup skip on `last_content_hash`.

### Phase 5 — not present in reconciliation set
No Phase 5 clusters were verified in this pass. The plan's Phase 5 items are **unreconciled** here — treat as untracked and re-scope before GA sign-off (do not assume closed).

## 4. Platform-blocked on Windows (cannot be completed in this env)
These require a macOS host and/or real signed binary runtime and are **not codeable here**:
- **R7-008 / macOS signing + notarization** — Developer ID signing and `notarytool` need a Mac; the updater `signature` field cannot be populated with a real signature without an actual signed-build pipeline. (Windows EV signing *can* be wired from here once the cert is procured; only the mac half and live signature generation are blocked.)
- **Binary runtime smokes** — light-mode contrast validation, modal a11y smoke, and window-controls verification that the Phase 7d commit explicitly deferred ("no binary build") need a built desktop binary to observe; they cannot be visually validated in this environment.

## 5. Recommended next workflow
Fix the two security downgrades first as a TDD security pass — **P3-cors exact-match unification + P3-stripe webhook `payment_status` gate** (write failing tests, fix, verify), then run the Phase 2 E2E/failure-injection build-out and Phase 3 deploy-env wiring; defer all macOS-signing/binary-runtime items to a Mac/CI environment.