waggle-os/docs/audits/2026-07-08-source-inventory-consistency-audit.md

Source Inventory Consistency Audit - 2026-07-08

Status: analysis supplement. No product code was changed.

Purpose: compare the UX audit packet against the current source inventory so the final "complete UX" claim does not silently miss reachable routes, command destinations, apps, packages, or non-main user surfaces.

Deeper T19 follow-up: docs/audits/2026-07-08-browser-companion-t19-analysis.md.

Commands

Get-Content apps/web/src/App.tsx
Get-Content apps/web/src/lib/routes.ts
Get-Content apps/web/src/lib/dock-tiers.ts
Get-Content apps/web/src/lib/command-catalog.ts
Get-ChildItem apps -Directory
Get-ChildItem packages -Directory
Get-ChildItem apps/www/app -Recurse -File
Get-ChildItem apps/browser-ext -Recurse -File
rg -n "browser-ext|WAGGLE_BROWSER_EXT|WAGGLE_DEV_ALLOW_ANY_EXTENSION|chrome-extension" packages apps tests docs --glob '!docs/audits/2026-07-08-*.md'
node --check apps/browser-ext/popup.js
node --check apps/browser-ext/background.js
node --check apps/browser-ext/content.js
npx tsc --noEmit --project packages/server/tsconfig.json
Test-NetConnection 127.0.0.1 -Port 3333

In-App Route Registry Check

Source: apps/web/src/App.tsx.

Result: every production shell route is represented in docs/audits/2026-07-08-ux-route-scenario-manifest.md.

Routes verified:

/auth
/ -> /home
/home
/workspaces
/workspaces/:workspaceId/:tab?
/memory/:mindScope?
/artifacts
/files
/agents
/automations
/skills
/room
/waggle-dance
/approvals
/connectors
/mcps
/marketplace
/launcher
/team
/settings
/settings/vault
/settings/profile
/settings/mission-control
/settings/timeline
/settings/events
/settings/usage
/benchmarks
/platform
/payment-success
/payment-cancelled
*

Notes:

• /motion-spec is registered only under import.meta.env.DEV, outside the AppShell subtree. It is a development reference surface, not part of the production five-persona score, unless the user explicitly asks to judge developer-only visual tooling.
• The index route is represented in the manifest as / -> /home; the automated string check did not count the separate index element because it has no path string.

Dock And Command Destination Check

Sources:

• apps/web/src/lib/routes.ts
• apps/web/src/lib/dock-tiers.ts
• apps/web/src/lib/command-catalog.ts

Result: dock/app route destinations are represented in the manifest. Two command-query destinations need explicit evidence ownership because they are real user-facing command outcomes:

apps/web/src/lib/command-catalog.ts:75 - /launcher?watch=1
apps/web/src/lib/command-catalog.ts:78 - /settings?tab=billing

Correction owner: T11 route evidence. These are not new top-level routes, but the final judge packet should prove the watch-mode Launcher state and billing-tab deep link, or explicitly defer them.

The same source check also reinforces T3:

apps/web/src/lib/command-catalog.ts:113 - heading "Pinned - Pro" is active Command Center copy
apps/web/src/lib/dock-tiers.ts:81 - stale Pro comment in approvals copy context

Apps Inventory

Current apps/ inventory:

apps/browser-ext - no package.json; Chrome MV3 extension
apps/web - package.json; main installed cockpit UI
apps/www - package.json; public launch funnel

Audit consequence:

• apps/web is the main installed product surface.
• apps/www is already T13.
• apps/browser-ext was underrepresented in the July UX packet and should be a separate non-main gate because it is a real user-facing capture surface.

Package Inventory

Current packages/ inventory contains 28 package workspaces:

admin-web
agent
cli
core
hive-mind-cli
hive-mind-core
hive-mind-hooks-claude-code
hive-mind-hooks-claude-desktop
hive-mind-hooks-codex
hive-mind-hooks-codex-desktop
hive-mind-hooks-core
hive-mind-hooks-cursor
hive-mind-hooks-hermes
hive-mind-hooks-openclaw
hive-mind-mcp-server
hive-mind-shim-core
hive-mind-wiki-compiler
launcher
marketplace
memory-mcp
optimizer
sdk
server
shared
waggle-dance
weaver
wiki-compiler
worker

Audit consequence:

• The July packet's T15/T16/T17 grouping covers these packages by role, but future AGENTS/docs language that says "27 packages" is stale against current source.
• hive-mind-hooks-core is a package workspace and should stay in T16/T17 verification command scope, even though it is not a launchable AI-tool adapter.

Public Site Inventory

Current apps/www/app route/API files:

/
/account
/sign-in/[[...sign-in]]
/sign-up/[[...sign-up]]
/docs/methodology
/design/personas
/privacy
/terms
/cookies
/eu-ai-act
/api/stripe/checkout
/api/webhooks/stripe

Audit consequence:

• T13 already covers homepage, account/auth, methodology, legal pages, checkout, and webhook/deploy shape.
• /design/personas should be treated as a public/supporting route if public-site route evidence is expanded. It does not affect Phase 1.

Browser Companion Inventory

Current files:

apps/browser-ext/manifest.json
apps/browser-ext/popup.html
apps/browser-ext/popup.js
apps/browser-ext/background.js
apps/browser-ext/content.js
apps/browser-ext/README.md

Source contract:

• apps/browser-ext/README.md presents the surface as "Waggle Companion", a Chrome MV3 extension for saving pages/selections to workspace memory.
• packages/server/src/local/routes/browser-ext.ts exposes GET /api/browser-ext/session-token and GET /api/browser-ext/health.
• packages/server/src/local/cors-config.ts gates extension origins through WAGGLE_BROWSER_EXT_IDS or the dev-only WAGGLE_DEV_ALLOW_ANY_EXTENSION=1.
• apps/browser-ext/background.js calls /api/browser-ext/session-token, /api/browser-ext/health, and /api/memory/frames.

Current evidence gap:

• The T19 follow-up loaded the unpacked extension in Chromium and captured a disconnected popup screenshot at output/playwright/browser-companion-disconnected-state.png.
• JS syntax, manifest parse, and packages/server typecheck pass.
• The secure-default live smoke proves content-script extraction from a normal page, MV3 service-worker no-Origin header handling, token bootstrap during save, background save through chrome.runtime.sendMessage, and /api/memory/frames imported-frame confirmation. The popup keyboard/click smoke proves Tab order across popup actions, visible Save selection focus, Enter-to-save selection, Save page UI click, frame creation, /api/memory/search source: import provenance for both captures, and restricted-page disabled-state/recovery behavior.
• Remaining evidence gaps: native toolbar-bubble proof, native context-menu click flow, CORS-denied screenshot with a real extension origin, signed release-package proof if scored, and any future scored recall result shape. Stable packaged-ID sidecar pairing is now covered by output/playwright/browser-companion-toolbar-3333/packaged-id-pairing-summary.json, and existing chat auto_recall/catch-up imported provenance is covered by packages/agent/tests/orchestrator-recall-hardening.test.ts.

Recommended ticket: T19, Browser Companion Extension UX Gate.

Suggested acceptance:

• Load unpacked extension in Chromium with a fresh sidecar and extension origin allowlist.
• Verify connected and disconnected popup states.
• Verify save selected text and save whole page produce visible extension feedback and a memory frame in Waggle.
• Verify CORS-denied state tells the user how to start or configure Waggle.
• Verify popup accessibility basics beyond the proven keyboard/focus path if screen-reader announcement behavior enters scoring.
• Either add automated smoke evidence or explicitly defer the extension from the five-persona score.

Phase Impact

This supplement does not change Phase 1. It adds T19 as a final-product gate after the in-app P0 blockers are cleared.