# Oshun V1 PWA — Walkthrough + E2E Completeness Audit **Date:** 2026-06-22 · **Synthesis lead:** Codex · **Scope:** 8 newly-written route walkthroughs, an adversarial re-grade of all 52 journeys' TRUE e2e depth, and a staleness sample of the per-view docs (44 sampled across 3 surface clusters). > 2026-06-23 supersession note: the `/operator/lms` page-DOM gap called out in > this dated audit is now resolved by `operator-lms.spec.ts` against a seeded > real BFF roster plus `lms-connectors.spec.ts` seeded API coverage. The current > source-of-truth row is `WALKTHROUGH/journeys/coverage.md`. > > 2026-06-23 supersession note: the `/personas` page-DOM gap called out in this > dated audit is now resolved and deepened by `personas-picker.spec.ts`. The > browser page now renders real BFF top-level `blocked[]` persona cards, and the > spec drives a live browser→BFF pre-consent blocked roster, real voice-consent > grant, select, active read-back after reload, and clear persistence. The pure > `persona-session-picker.spec.ts` BFF round-trip remains the companion API > guard. > > 2026-06-23 supersession note: `veritas-retraction-cascade-customer-view` is no > longer render-only/shallow. `veritas-retraction-cascade.spec.ts` now covers > the `/library` saved-claim retraction notice with corrected-source, recourse, > and remove-from-library affordances; the 2026-06-27 update adds the > authenticated BFF personal-letter route plus per-user 404/no-leak browser > coverage; the 2026-06-29 update adds polished `/nisaba/notebook` > retraction-disclosure drill-down with corrected-source navigation and honest > keep-with-marker placeholder state. Customer-shell subscriber/audit fan-out, > persisted notebook acknowledgement writes, and kept-offering re-render remain > open; current depth is partial. > > 2026-06-23 supersession note: `nyx-tonight-observation` now covers the event > detail → observation-log handoff, local `oshun.nyx` persistence, an > eventId-backed History row, and Home Nyx support-card read-back of the newly > saved target/notes. 2026-06-24 deepening adds real `/v1/nyx/observations` > POST/GET read-back plus a local-storage-cleared observation-log reload from > the BFF. A later 2026-06-24 pass adds the Home footing "Sky observations" > current-week KPI read-back and click-through to > `/domains/nyx/observation-log`. A later 2026-06-24 pass verifies every > generated Nyx event-detail Nisaba, Veritas, Tara, and Metis cross-domain card > target against hydrated shell destinations. A later 2026-06-24 pass fixes and > verifies the event-calendar close route for both direct and hydrated-shell > arrivals; residual documentation-only Nyx gaps keep the depth partial. > > 2026-06-23 supersession note: `arete-create-habit` now covers the > `/domains/arete/habits?wizard=loop` handoff, Cue→Routine→Reward wizard > step-through, real `/v1/arete/habits` POST, returned BFF habit id persisted in > local `oshun.arete`, the newly-created dashboard row, real > `/v1/arete/habits/:habitId/check-in` POST, polished `/arete` Done-today / > 1-day streak / `1 / 7` KPI read-back through `/v1/arete/room`, and Home Arete > `1d streak • done today` read-back. Cross-device check-in sync remains open; > Home legacy `KpiGrid` is not live per the home walkthrough; current depth is > partial. > > 2026-06-24 supersession note: the `arete-create-habit` cross-device check-in > gap is now closed for the polished `/arete` BFF read model. > `arete-create-habit.spec.ts` creates and checks in a habit on device A, then > opens `/arete` in a second browser context using the same real member session > with no `oshun.arete` local store; device B reads `Done today`, > `1-day streak`, and `1 / 7` from the fresh authenticated `/v1/arete/room` > response. A later 2026-06-24 pass also asserts the wizard's selected > `sampleIdentityStatements` line in the real habit-create `whyItMatters` > request, persists that identity id locally, and reads the created habit back > from `IdentityPanel`; another pass asserts seeded sample-habit toggles remain > local-only and emit no BFF check-in write. Home Arete remains same-browser > local continuity; a later pass asserts the live Home `HomeFootingSummaryStrip` > practice-streak metric adds the pending same-day local Arete check-in while > profile sync is still pending. > > 2026-06-23 supersession note: `themis-assessment-appeal` now covers the > teacher override branch over real BFF HTTP: repeat adjudication accepts > `teacherOverride`, downgrades to `verdictClass: "inconclusive"`, records > `status: "overturned"`, uses `decision.decidedBy: "teacher-op"`, and persists > the override rationale into the audit read-back. Detection from the customer > assessment submit, `/operator/metis` review UI, gradebook, and `/messages` > notification remain open; current depth is partial. > > 2026-06-24 supersession note: `themis-assessment-appeal` now also covers the > upheld branch over real BFF HTTP: repeat adjudication with a matching > `teacherOverride.verdictClass` keeps `verdictClass: "violation"`, records > `status: "upheld"`, preserves `recommendedAction: "score_hold"`, and persists > the upheld rationale into the audit read-back before the appeal is resolved. > > 2026-06-26 supersession note: customer assessment submit adjudication is now > covered. `/metis/assessment` posts to `/v1/metis/assessment-submissions`, runs > detection + Themis adjudication, renders the compact verdict read-back, and > follows appealable verdicts into `/integrity//appeal`. > > 2026-06-26 supersession note: the learner-safe evidence/rationale pane is now > covered on `/integrity//appeal`; it renders real audit rationale, > signal metadata, evidence excerpts, policy binding, and classifier provenance > from the BFF audit record. Upheld-without-`teacherOverride`, `/operator/metis` > review UI, gradebook, and `/messages` remain open. > > 2026-06-26 supersession note: the `/operator/metis` review UI now reads the > live BFF appeal queue, renders dispute/evidence/timeline/due-process detail, > blocks blank resolution, resolves through the real BFF, and reads back > `status: "closed"`. Remaining Themis gaps are upheld-without- > `teacherOverride`, dedicated verdict-class controls, gradebook read-back, and > `/messages`. > > 2026-06-26 supersession note: the Themis decision notification bridge is now > covered. `POST /v1/metis/integrity/appeals/:appealId/resolve` publishes an > in-app `incident` row to the claimant's customer message center, and > `operator-metis-themis-review` verifies `/messages` render, appeal-record > follow, clicked receipt, and mark-read read-back over real dev infra. > Remaining Themis gaps are upheld-without-`teacherOverride`, dedicated > verdict-class controls, and gradebook read-back. > > 2026-06-26 supersession note: terminal gradebook correction read-back is now > covered. Appealable non-clear submissions emit an initial `pending` Metis > gradebook entry; appeal resolution emits the terminal integrity verdict as an > `integrity_verdict_change` correction with `cascadeFrom: "appeal"`, and > `operator-metis-themis-review` renders the correction plus reads > `GET /v1/metis/gradebook//latest` from the real BFF. Remaining > Themis gaps are upheld-without-`teacherOverride` and dedicated verdict-class > controls. > > 2026-06-26 supersession note: the remaining Themis appeal-decision gaps are > now covered. `/operator/metis` renders Uphold / Revise / Dismiss / Escalate > verdict controls, submits `outcome: "uphold"` to > `POST /v1/metis/integrity/appeals/:appealId/decision` without a raw client > `teacherOverride`, reads back `verdict.status: "upheld"`, and keeps the > gradebook and `/messages` read-backs. BFF route tests cover the > `inconclusive`, `clear`, and `severe` outcome mappings through the canonical > bridge. No current `themis-assessment-appeal` gaps remain tracked. > > 2026-06-23 supersession note: the high-severity > `studio-neith-inverse-modeling.md` drift is closed. The walkthrough now > matches the current JSON-payload fit-quality workspace, and > `studio-neith-inverse-modeling.spec.ts` covers direct admin navigation, live > BFF catalog/evaluate success, non-admin fail-closed, client invalid JSON with > no POST, BFF invalid-payload detail, route-map, and Isis quick links. > > 2026-06-23 supersession note: the false Arete "unwired / DO NOT click" drift > is closed for `arete-living-offering-create` and `weekly-review-arete`. The > journey steps, failure modes, open questions, and spec headers now name the > wired `AreteOfferingActions` / `AreteReviewClose` BFF paths and leave only the > real residual gaps (draft gallery read-back, C2PA/receipt, crisis pre-screen). > > 2026-06-23 supersession note: the `weekly-review-arete` step-9 `/arete` > continuity read-back gap is closed. `AreteRoom` now renders the latest > member-scoped review closure from `/v1/arete/room`, backed by the same > `areteReviewStore` used by `/v1/arete/review/closed`; `arete-review-close` > returns to `/arete` and asserts the week-closed card. > > 2026-06-23 supersession note: the `veritas-evidence-trail` step-9 `test.skip` > finding is closed for the standard local Playwright stack. The test BFF now > honors `OSHUN_VERITAS_ADAPTER=mock`, `veritas-full-journey` and > `veritas-evidence-trail` assert the seeded grounded-lead Save/Report actions > without conditional skips, and `veritas-route.test.ts` guards the env override > plus the fail-closed home-briefing outage path. Browser-level unavailable > rendering and the remaining static claim/source drill gaps keep the journey > partial. > > 2026-06-23 supersession note: the `veritas-evidence-trail` browser-level > unavailable rendering gap is now partially closed by `veritas-full-journey`. > The spec first proves the live BFF returns `403 domain_scope_missing` for a > signed-in token without `domain:veritas`, then loads `/veritas` with that same > token and asserts the honest no-lead UI, `Evidence · 0 claims`, method note, > and absent Save/Report actions. Downstream outage remains covered at > `veritas-route.test.ts` and shares the same RSC non-2xx fallback. The static > claim-underlines, source-row drill, and browser-induced downstream 503 called > out here are closed by later supersession notes below. > > 2026-06-23 supersession note: the `veritas-evidence-trail` polished claim-mode > interaction gap is now closed. `/veritas/claim` delegates to > `VeritasClaimInteractive`, whose underlined claim buttons and all-claims table > update `data-veritas-selected-claim`; selected evidence rows are real anchors > to `/veritas/source/[sourceId]`. `veritas-evidence-trail.spec.ts` drives that > browser chain and lands on the matching source profile. The source-id route is > now closed; the journey remains partial because the downstream-outage browser > 503 leg remains open. > > 2026-06-23 supersession note: the `veritas-evidence-trail` browser-induced > downstream 503 gap is now closed by `veritas-home-outage.spec.ts` plus > `playwright.veritas-outage.config.ts`. That dedicated run boots the real BFF > with `OSHUN_VERITAS_ADAPTER=outage`, proves `/v1/veritas/briefing/home` > returns `503 veritas_home_briefing_unavailable`, then loads `/veritas` against > that BFF and asserts the honest no-lead UI with no Save/Report action row. > > 2026-06-23 supersession note: the `citation-drift-resolution` seeded-ledger > `test.skip` finding is closed for the standard local Playwright stack. Next > now honors the harness-only `OSHUN_ISIS_PROVENANCE_LEDGER_FIXTURE=clean` path > when `OSHUN_ENABLE_TEST_HARNESSES=true`; the browser spec asserts the clean > hash-chain verdict, 16-field bundle detail, empty tenant, unavailable ledger, > and broken-ledger verdict with no conditional skips. Recheck/re-render/retract > write paths remain unwired, so the journey stays partial. > > 2026-06-23 supersession note: the `sophia-grounded-answer` grounded-WITH- > citations BFF gap is closed for the real `/v1/sophia/answer` branch. > `sophia-answer-bff.spec.ts` now drives the live BFF through the in-process > Nisaba public-domain corpus and asserts `groundingState: "grounded"`, stable > citation IDs, retrieved claims, and citation-map invariants; it also preserves > the no-sources abstention guard. `sophia-grounded-answer-page.spec.ts` submits > the shipped `/sophia` form to the live BFF and renders grounding state, > witnesses, claim rows, and the live citation handoff into a Nisaba passage > reading frame. The same spec now also saves the grounded answer through the > real saved-items BFF and verifies a fresh `/library` context hydrates the > saved Sophia answer snapshot, witness trail, and grounded trust state; it now > also carries the citation locator into Nisaba, highlights the exact reading > excerpt, and verifies browser-back restores the `/sophia` answer card and > scroll position. The same spec now submits the shipped `/search` input to the > live `/v1/search` BFF for a Nisaba query and verifies the grounded preview > evidence context. Contradiction loop UI, synthetic/retracted/cross-tenant > failure modes, and labels beyond the current extractive `retrieved` path > remain open, so the journey stays partial. > > 2026-06-24 supersession note: `pwa-update-flow` no longer has open > browser-level gaps for the reading-mode prompt, lost `OSHUN_SKIP_WAITING`, or > `controllerchange` reload-loop guard. `pwa-smoke` drives the Nisaba > reading-mode prompt, Keep-reading deferral, and mid-passage scroll restore > after an explicit refresh; `pwa-failure-modes` now drives the lost-message > manual reload escape and a real apply path that reloads exactly once, clears > the prompt, and preserves `/explore`. The journey remains partial: the real > `sw.js` stale-cache purge, multi-tab reload sequence, cold-start no-prompt > behavior, and the in-flight BFF write/read-back leg are now browser-driven in > `pwa-lifecycle-deepening`; the raw service-worker queue/replay substrate is > browser-driven in `offline-background-sync`. 2026-06-26 adds the queued-write > update-prompt UI and telemetry: `sw.js` publishes `OSHUN_SYNC_QUEUE_STATUS`, > `pwa-lifecycle-deepening` verifies a real pending service-worker queue row is > surfaced in the Refresh-now prompt, and the same spec now asserts > `pwa_update_applied` for both the Refresh-now `controllerchange` path and the > silent standalone cold-start path plus `pwa_sync_queued` for the pending queue > row. Current canonical matrix depth for `pwa-update-flow` is **deep**. > > 2026-06-24 supersession note: `public-scene-abuse-report` now covers the real > operator decision write verbs. `public-scene-abuse-report.spec.ts` seeds fresh > public reports, resolves one through > `POST /v1/admin/abuse-reports/:id/resolve` with note/actor/list read-back, > dismisses another through `POST /v1/admin/abuse-reports/:id/dismiss`, and > asserts an unknown report id returns `404 abuse_report_not_found`. The prior > operator-row/deep-link leg and the public form/report edges remain covered. > The artifact takedown cascade is now covered as real-BFF infrastructure by > `scene-password-and-grants.spec.ts`: an operator-scoped > `originating-user-account-deletion` takedown tombstones both public share > links for one artifact, denies both embeds as revoked, makes an existing > download grant return `410 download_grant_inactive_share`, and writes > `takedown_cascaded` to tenant audit. Remaining public-report gaps are the > unbuilt operator-detail UI that connects a public-report INC to that cascade > action, actor restriction branch, modal rationale-floor UX, brigade > clustering, and signed-in reporter status surface. > > 2026-06-24 supersession note: `scene-keep-and-share` now covers the > password-protected embed branch. `scene-password-and-grants.spec.ts` seeds a > link-with-password share, opens `/scene/:shortCode/embed` in the browser, and > asserts the iframe-safe "not embeddable" card, `target="_top"` Open-offering > link, and absence of full viewer chrome, Report, Download-grant, and form > controls. The direct public playable embed, revoke tombstone, delete cascade, > password unlock, explicit-consent 400, `tenant_internal_only` policy > public-share `403 denied_public_scope` on the Playwright dev-BFF override > path, mass-share 429, and download-grant request remain covered by sibling > scene specs. The `private_only` crisis-touched artifact branch is also now > covered: a crafted private-link share with > `x-oshun-living-scene-crisis-label: crisis-frame-active` fails with `422` and > `crisis-private-only:crisis-frame-active`. The production-mode > stored-tenant-policy posture is now covered by > `scene-stored-tenant-policy.e2e.ts` under > `playwright.living-scenes-stored-policy.config.ts`: the isolated real BFF runs > with header policy overrides off, rejects spoofed `tenant_lotus` public > sharing with `403 denied_public_scope`, records `share_denied` in tenant > audit, and still allows `tenant-internal`. At that point, the keep/share gaps > still included customer share-settings snippet/oEmbed copy UI, download-media > integrity, non-crisis Lilith pre-share failure, and network-idempotent retry. > > 2026-06-24 supersession note: the `scene-keep-and-share` network-idempotent > retry gap is now closed by the BFF share route and > `scene-viewer-deepening.spec.ts`: a retry for the same artifact + channel at a > later timestamp returns the existing active share with > `idempotentReplay: true` and the tenant audit API still has exactly one > `share_created` row for that artifact/channel. At that point, the keep/share > gaps still included customer share-settings snippet/oEmbed copy UI, > download-media integrity, and non-crisis Lilith pre-share failure. > > 2026-06-24 supersession note: the `scene-keep-and-share` non-crisis Lilith > pre-share failure gap is now closed by the BFF share route and > `scene-password-and-grants.spec.ts`. A kept artifact whose materialized > segment trips the safety-frame check is rejected with `422 lilith_blocked`, > returns structured `lilithReasons`, creates no share id, and records a > tenant-audit `share_denied` row with > `policyDisposition: "denied_lilith_pre_share"`. At that point, the keep/share > gaps still included customer share-settings snippet/oEmbed copy UI and > download-media integrity. > > 2026-06-24 supersession note: the prior download-media integrity gap is now > closed for the shipped V1 renderer by the BFF grant-redemption route and > `scene-password-and-grants.spec.ts`. `POST /download-grants` now returns the > actual APNG materialization format instead of claiming MP4; redeeming > `/download-grants//media` streams the same bytes signed into the > share's C2PA manifest, exposes the visible-mark short code, reports > `audioWatermarkIntact: "not-applicable"` for the silent renderer, and expires > after the 900-second TTL. At that point, the remaining keep/share gap was the > customer share-settings snippet/oEmbed copy UI. > > 2026-06-24 supersession note: the customer share-settings snippet/oEmbed copy > gap is now closed by > `apps/oshun/web/src/app/scene/[id]/ShareSettingsPanel.tsx` and > `living-scene-card.spec.ts`. The browser journey opens the public viewer, > asserts the literal 960×540 iframe snippet and oEmbed endpoint, clicks the > iframe and oEmbed copy controls, verifies clipboard contents, fetches > `/scene//oembed`, and asserts the returned oEmbed HTML matches the > copied iframe snippet. The journey remains partial until the persisted > customer kept-artifact share/revoke management surface is fully shipped and > browser-driven; the real lifecycle is currently proven through authenticated > BFF requests plus the public viewer/browser branches. --- ## 1. Executive Summary ### Routes documented this pass: 8 All 8 routes were written from source-reading (`status: drafted`, no live walk). Every one has real interactions; none is a render-only specimen. 5/8 already have a backing e2e spec; 3/8 (`/operator/lms`, `/operator/personas`, `/personas`) have **no** page-DOM spec and need one authored. > Dated finding: the `/operator/lms`, `/operator/personas`, and `/personas` > page-DOM gaps are now closed by the 2026-06-23 supersession notes above and > the reconciled route rows below. > > 2026-06-23 supersession note: the `/operator/personas` page-DOM gap is now > resolved and deepened by `operator-personas-console.spec.ts`. The browser > console reads the live BFF roster with persona-admin scope, covers auto-select > and empty fail-soft states, drives a real browser `submit-for-review` > transition to `in-review` with status/audit repaint and BFF read-back, > verifies approve-for-release field rendering, and keeps a deterministic 409 > inline-error branch. `persona-lifecycle-bff.spec.ts` remains the pure real-BFF > lifecycle chain/scope/rollback companion. ### Journeys by TRUE depth (52 total) | TRUE depth | Count | Journeys | | ----------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **deep** | 18 | aaa-upgrade-entitlement-bounce, first-time-anonymous-visitor, onboarding-ten-steps, scene-public-viewer-anonymous, telegram-bot-assistant-delivery, user-flag-to-review, account-deletion-and-dsar, incident-triage, messages-center-deliver-and-unsubscribe, tenant-audit-log-investigation, agentic-pipeline-customer-invocation, install-as-pwa, public-scene-abuse-report, lilith-studio-tara-scene-publish, metis-lesson-completion, multi-device-workspace-handoff, tara-daily-ritual, first-tara-sit, tara-to-nisaba-handoff, pwa-update-flow | | **partial** | 30 | assistant-handoff-context-carry, memory-edit-pause-forget, nisaba-notebook-capture-and-cite, atelier-image-to-library, nisaba-scholarly-read, persona-voice-avatar-approval-workflow, search-explore-deep-read-library-save, veritas-evidence-trail, citation-drift-resolution, messages-quiet-hours-and-channel-binding, nyx-event-calendar-sync-reminder, psyche-tutor-live-session-to-graded-record, sign-up-and-pay-crypto, tenant-bulk-member-invite-scim, arete-create-habit, crisis-aware-tone-policy, library-save-collection-share, metis-byom-ingest-to-course, nyx-to-tara-bridge, sophia-grounded-answer, tenant-onboard, veritas-to-nisaba-deeper, arete-living-offering-create, editorial-review-approval, nyx-tonight-observation, tenant-sso-config-saml-oidc-claim-mapping, weekly-review-arete, arete-streak-recovery, lms-connectors-operator, offline-first-time-use, scene-keep-and-share, themis-assessment-appeal, veritas-retraction-cascade-customer-view | | **shallow** | 0 | — | | **none** | 0 | — | > Note: this dated section has been superseded by the 2026-06-23 notes above for > `/operator/lms` and `veritas-retraction-cascade-customer-view`; use > `WALKTHROUGH/journeys/coverage.md` for canonical current counts. ### Over-claims (TRUE depth < claimed): 2 - **tenant-sso-config-saml-oidc-claim-mapping** — claimed deep, TRUE partial - **offline-first-time-use** — claimed deep, TRUE partial ### Under-claims (TRUE depth > claimed): 5 (grade up the matrix) scene-public-viewer-anonymous (partial→deep), account-deletion-and-dsar (partial→deep), incident-triage (partial→deep), lilith-studio-tara-scene-publish (partial→deep), metis-byom-ingest-to-course (shallow→partial). ### Walkthrough staleness drift (44 sampled) | Severity | Count | | -------- | ----- | | high | 1 | | low | 2 | | (clean) | 41 | - customer: 16 sampled, 0 drift - studio: 16 sampled, 1 high - operator+workspace+shell: 12 sampled, 2 low --- ## 2. The 8 Routes | route | wrote file | hasRealInteractions | specExists | renderOnlySpecimen | specPlan | | ------------------------------- | ----------------------------------------------------------- | ------------------- | ---------- | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/assistant` | WALKTHROUGH/customer/02-home-discovery/assistant.md | yes (4) | yes | no | Covered by `shared-shell-entry-routes.spec.ts` + `shell-surface-states.spec.ts` (live entry card + all 8 preview modes); 2026-06-24 deepening covers explicit `[data-assistant-entry-route-open]` click re-dispatch and assistant surface reopen; 2026-06-25 covers 390 px tap target, assistant preview primary/secondary navigation, and proxy auth gate. | | `/auth/verify-email` | WALKTHROUGH/customer/00-public/auth-verify-email.md | yes (3) | yes | no | Covered deep by `email-verify-roundtrip.spec.ts`: real BFF fresh token → verified, replay → error, no-token missing state, delayed confirm → transient verifying copy, `alreadyVerified: true` alternate success copy, safe `next=/tara` Continue handoff, unsafe external `next` fallback to `/`, and 44 px Continue target at 390 px. | | `/integrity/[verdictId]/appeal` | WALKTHROUGH/customer/08-metis/integrity-verdictId-appeal.md | yes (5) | yes | no | Covered deep by `integrity-appeal.spec.ts` (seed verdict → file → read-back filed; 400/403; operator resolve); 2026-06-24 deepening covers browser-routed `load-error` and `file-error` branches; 2026-06-25 covers teacher-cleared `appealAllowed=false` over the real BFF, direct POST `409`, blocked customer render, delayed loading state, 390 px control targets, and proxy auth gate. | | `/notifications` | WALKTHROUGH/customer/02-home-discovery/notifications.md | yes (13) | yes (deep) | no | Covered by `notifications-route.spec.ts` at the full-page route: Activity-owned desktop/mobile nav state, no `/notifications` manifest shortcut, control strip, inbox/lane/domain filter/reset, BFF cursor-backed load-more, loading vs empty states, 500 unavailable disclosure, retry recovery, mobile tap targets, support→/profile, normalized notification-center telemetry, live BFF write persistence, bulk mark-all/dismiss writes, and swallowed write-failure behavior. | | `/operator/lms` | WALKTHROUGH/operator/operator-lms.md | yes (6) | yes | no | `operator-lms.spec.ts` now covers page-DOM seeded roster + invalid panel, wrong-scope fail-soft empty state, malformed-JSON no-POST, real-BFF 400/invalid/valid validate legs, native disabled/busy validator semantics, alert/status feedback, footer destinations/tap targets, and 503 failure copy; `lms-connectors.spec.ts` remains the companion BFF guard. | | `/operator/personas` | WALKTHROUGH/operator/operator-personas.md | yes (12) | yes | no | `operator-personas-console.spec.ts` now covers live roster read, auto-select/detail, no-scope empty fail-soft, real browser submit-for-review success + audit repaint, approve-for-release field rendering, mobile roster/detail stacking, 44 px controls/footer targets, native disabled/busy submit semantics, proxy gate, and 409 inline error/no optimistic mutation. | | `/personas` | WALKTHROUGH/customer/10-lilith/personas.md | yes (3) | yes | no | `personas-picker.spec.ts` now covers the page DOM, real BFF blocked roster, voice-consent unlock, select→active persistence, reload read-back, clear persistence, measured select/clear tap targets and ARIA labels, plus deterministic loading, recoverable retry, true-empty, BFF-401, and select-500 UI branches. | | `/settings` | WALKTHROUGH/customer/09-account/settings.md | yes (22) | yes | no | Covered by `shared-shell-entry-routes.spec.ts` + `shell-surface-states.spec.ts`; direct-route coverage includes live shell render, breadcrumbs to `/profile` and `/`, Account shortcut active state, edit/cancel, save PATCH handoff, sync refresh, export toast, sign-out busy/disabled state, 390 px tap targets, and proxy auth gate. Nested profile subsections remain covered by their dedicated profile specs. | --- ## 3. Journey Re-grade (worst-first) Legend: ⚠ = **over-claim** (TRUE < claimed); ⬆ = under-claim (grade up). | name | claimed | TRUE | key uncovered | | ------------------------------------------- | ------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | veritas-retraction-cascade-customer-view | shallow | **partial** | personal-letter path now runs through authenticated BFF personal-letter read, covers disabled read-once honesty + re-open-to-story navigation, and asserts per-user 404/no-leak for another authenticated reader; `/library` saved-claim notice now covers corrected-source, recourse, remove affordance, empty-state transition, and `item_unsaved` analytics for the removal; polished `/nisaba/notebook` now covers retraction notice disclosure, per-citation original-quote row, corrected Veritas source navigation, and honest keep-with-marker placeholder state. Cascade subscriber/audit fan-out, persisted notebook acknowledgement writes, and kept-offering re-render surfaces remain undriven or unwired | | pwa-update-flow | deep | **deep** | real `sw.js` activation stale-cache purge is browser-driven; reading-mode prompt + mid-passage scroll-restore are covered in `pwa-smoke`, and the 2026-06-25 update runs that reading-mode branch on the live Nisaba passage route without `stubNisabaWorkspaceApi`, clearing stale offline snapshots and asserting `/v1/nisaba/passages/:id` BFF hydration before/after refresh; two-tab controllerchange reload/URL-preservation/no-stale-chunk behavior, backgrounded-PWA cold-start no-prompt behavior, in-flight BFF write/read-back across refresh, explicit Refresh-now `pwa_update_applied`, silent-cold-start `pwa_update_applied`, real service-worker queued-write update-prompt note, `pwa_sync_queued`, and reduced-motion spinner are covered in `pwa-lifecycle-deepening`; raw service-worker queued-write persistence/replay is covered in `offline-background-sync` | | tenant-sso-config-saml-oidc-claim-mapping ⚠ | deep | **partial** | live OIDC callback now proves configured `lowercase` + `first-only` transforms and two fail-closed callback verdicts; BFF test-connection now proves successful/fail-closed OIDC probe outcomes; metadata-XML/OIDC-discovery import parsing now runs over real HTTP; `/operator/sso` now persists SAML XML/OIDC discovery imports, all seven claim slots, and all four transform options through the live BFF and renders successful/fail-closed Test verdicts; tenant-admin `/identity` now covers anonymous gating, tenant-scoped live SSO roster read-back, read-only sample identity-engine evidence, and axe; tenant-admin import/upload controls, per-tenant auth-policy edit panel, tenant-admin sandbox sign-in per-verdict UI, enable state-machine remain uncovered | | offline-first-time-use ⚠ | deep | **partial** | local save-while-offline, search-result offline-save local persistence + sync hint, Tara reflection offline local queue + sync dot, real-SW uncached navigation document fallback with service-worker recovery controls that hydrate when the client is available, auth/session real-SW cache denial plus profile Active devices denial copy, Nisaba fresh/expired 24h BFF cache responses plus component-level expired workspace copy, live Nisaba lexicon/morphology offline degradation copy, and raw service-worker write-queue/replay are now browser-driven; natural sync scheduling for the search/Tara writes remains undriven | | assistant-handoff-context-carry | partial | partial | customer memory-off shell branch now covered by `assistant-continuity-journey`: real `/v1/preferences` patch → hydrated customer handoff → `/v1/assistant/sessions` payload/BFF continuity/transcript/turn all `memoryScope=off`; selected-text PII redaction is now browser-driven into the live session-create handoff; `assistant-session-bff` now covers real Iris bridge bootstrap/profile-memory posture, profile + notebook recall through the live message route with `response.memoryRecall` and answer-text folding, assistant-turn persistence into `/v1/iris/adapter/review`, route-level mismatched-shell artifact sanitization (customer Veritas handoff accepted, admin artifact dropped before continuity merge), and operator-frame suppression; remaining gaps are browser-visible null-artifact/entity mismatch variants, exact continuity-copy variants, grounding inspect, and cross-domain nav depth | | memory-edit-pause-forget | partial | partial | `profile-memory-controls` covers edit/pause/export/hard-delete/full-clear grace plus browser telemetry for edit, pause header/banner source, hard-delete, full-clear request/cancel, and a no-raw-memory-content payload guard; `memory-edit-pause-forget` now covers Step 2 filters + detail-pane provenance/recalls/reference metadata, Step 4 same-origin two-tab edit conflict with stale-draft preservation, keep-remote and overwrite resolution, and both conflict telemetry events, real Iris BFF review/consent hydration, synced export receipt through `/v1/iris/adapter/export`, pause-banner resume, tenant-scope rejection, persisted profile pause writes through `/v1/iris/adapter/pause` with `memory_pause_toggled` `persisted: "bff"`, assistant dock memory-off handoff/disclosure, collapsed dock memory-off summary, cross-device pause/resume propagation into a second browser context sharing the same real BFF session, synced profile-memory hard-delete through `DELETE /v1/iris/adapter/memory/:memoryId`, transient Iris review retry, anonymous/offline route failure modes, and the server-authoritative no-write gate (`409 iris_memory_paused` with review absence until resume). Remaining gap: full-clear cron execution and DSAR export-request persistence. | | nisaba-notebook-capture-and-cite | partial | partial | authenticated browser notebook-create form now covers CSRF-backed real BFF create/readback, visibility radio semantics, mobile containment, and text-safe submit/success telemetry; real BFF notebook CRUD/capture, live notebook-backed study-note telemetry, live notebook-backed Nisaba→Metis source-backed tutoring handoff, authenticated-shell split-view notebook note/citation/annotation/collection/study-plan/mobile-lineage flows over real BFF notebook+annotation seeds, authenticated-shell reading-compare-annotate annotation update/archive over a real BFF-seeded annotation, and the dedicated authenticated-shell capture/citation surface over the live Dhammapada passage are now covered; remaining gaps are the inline highlight→notebook browser gesture, Sophia stable-ID round-trip, export downloads/integrity manifests, and display-only/edit conflict failure modes | | atelier-image-to-library | partial | partial | 2026-06-27 update: editable prompt, specimen tap-to-select, aspect/style controls, Lock seed, Compare side-by-side, step-rail advancement after select/save, Cast, Refine, Save, save→saved-items BFF read-back→clean-device `/library`, and 390 px index/image stacking are browser-driven; Cast/Refine POST the browser-entered prompt, selected specimen, aspect, style, and seed-lock state to the real fail-closed `/v1/atelier/cast` seam. 2026-06-28 update: Save now carries `trustState.provenanceState='partial'` through real saved-items BFF metadata and renders the Library provenance badge + lineage note on first and clean second-device `/library?kind=generated-artifact` loads. Remaining gaps are plate-specific library resume/variant lineage, telemetry/crisis/AAA handoff, and provider-credentialed image-success path | | nisaba-scholarly-read | partial | partial | dashboard overview, study shelf, shared concept graph, Metis objective bridge, ranked domain recommendations, desktop reading-compare-annotate passage/workflow/compare/annotation paths, route-level reading accessibility, deeper split-view navigation/editing paths, and cross-domain readability checks now run through the authenticated shell without workspace route stubs; compact reading-desk now swaps Pali / English / Both bodies through real language buttons backed by the live `passageBodies` payload; split-view seeds/reads real BFF notebook+annotation records and waits for live daily/detail BFF responses across compare, grounded, manuscript, annotation update/archive, notebook note, citation/export, scholar, notebook, concept, lexicon, timeline, influence, collections, study-plan, mobile lineage, and mobile note routes; `domain-readability` now seeds/reads a real BFF notebook and proves live Dhammapada 62ch study-lane/readability posture for passage, compare, grounded evidence, and note routes; headword/folio/notebook-editor/plan-complete/scholar-apparatus interactions remain display-only or unwired | | persona-voice-avatar-approval-workflow | partial | partial | full registry lifecycle state-machine, deprecate/retire/recovery, signoff failure modes; consumer picker page-DOM + BFF round-trip now covered | | search-explore-deep-read-library-save | partial | partial | real BFF Nisaba `nisaba-passage-speech` result click now proves destination enters the parameterized passage-mode workspace and renders exact passage id/reference/source/title/body plus compare/support/workflow rails; real BFF Veritas claim result click now proves the claim-detail evidence workspace renders from search; real BFF Veritas story result click now proves the story timeline workspace renders from search; real BFF Tara practice result click now proves the immersive session player renders from search; real BFF Nyx sky-event result click now proves the canonical event-detail workspace renders from search after correcting the live seed target to `/events/quadrantid-meteor-shower-peak`; real BFF Metis course result click now proves the active study destination preview renders from search; real search-result save→saved-items BFF→Nisaba in-domain unsave/resave de-dupe→cache-free Library hydrate→Nisaba resume URL now also proves the resumed exact passage workspace; real search-result saves now also prove cache-free Library hydrate/resume for Veritas claim/story, Tara practice-as-meditation, Nyx sky-event, and Metis course object templates; 2026-06-29 update: live Explore-dashboard `nisaba-passage-speech` result save now proves Explore `source=explore`/`surface=dashboard` saved-items BFF metadata read-back and clean-device Library hydrate; live-BFF `403 domain_scope_missing` now proves the visible search fetch-failure error state clears stale result rows and same-query Retry reissues the live request; long-list Browser Back now restores the `/search?q=a` scroll position after opening the Nisaba deep-read; remaining gaps are broader non-search save-producer sync and object-template permutations outside the seeded search-result matrix | | veritas-evidence-trail | partial | partial | BFF-backed grounded lead, wrong-scope and downstream-503 no-lead browser renders, claim underline → rail update, source-id drill, and 2026-06-29 direct `/veritas` Save to notebook → saved-items BFF metadata read-back → clean-device Library hydrate are deterministic in Playwright; `/veritas/topic` now has row/cell-level masthead, settled/open, reading-history, primary-source, gaps, and static-follow coverage, and claim/source/counterclaim citation-band/provenance/reviewer/hash consistency is asserted; story SVG, dynamic topic follow toggle behavior, and retraction trigger depth remain | | citation-drift-resolution | partial | partial | hash-chain + 16-field bundle now run under Playwright harness; 2026-06-30 update adds BFF-backed terminal recheck/re-render/retract controls, rationale validation, per-operator resolution read-back, `drift.*` audit-log read-back, and broken-ledger disabled-action coverage. 2026-07-01 adds BFF-backed per-source drift classification UI, short-rationale blocking, classification read-back, and `drift.source_classified` audit-log verification for all three drift sources. The latest lifecycle follow-up now resolves shared `INC-2041` through the real operator incident store after a chosen terminal drift decision, reads the incident back with created→resolved history, and verifies the linked `incident.resolved` audit payload. Remaining gaps are background Sophia cascade, downstream Isis re-render append/publication gates/customer retraction cascade/cache purge, explicit `incident.created` admin-audit emission, and stale operator.tsx file:line citations | | messages-quiet-hours-and-channel-binding | partial | partial | message-center after-window quiet-hours replay now delivers queued rows with `sent`/`delivered` receipts; browser notification preferences now expose quiet-hours weekday pressed state, narrow Sun/Sat out through real BFF PATCHes, and reload with the persisted start time/active-day mask. The notifications-preferences API now proves the shipped preference matrix across every launch domain (`tara`, `veritas`, `nyx`, `arete`, `nisaba`, `metis`), every persisted delivery modality (`inApp`, `push`, `emailDigest`), and every category kind (`reminder`, `update`, `event`, `insight`) through real PATCH→GET top-level + nested `preferences.domains` read-back with no cross-domain bleed. The local BFF dispatch seam now also activates a real crisis frame, reads the member projection back, suppresses a non-essential `reengagement` message with `202 dispatch.suppressed.crisis_frame`, writes no inbox row, and still delivers a critical `incident` bypass. External provider handoff beyond the message-center receipt seam, provider-level WhatsApp/SMS/email category binding, Lilith tone-band persona-policy, and real deploy-bound OTP/magic-link delivery remain uncovered | | nyx-event-calendar-sync-reminder | partial | partial | ICS UID namespacing, event-linked observation creation/BFF read-back, and real `/v1/nyx/event-actions` reminder-state contract are now covered, including invalid body, event-id mismatch, missing reminder-time 400s, no snapshot mutation, and route reconstruction from cadence+channels. The admin calendar-connector runtime is also now covered over the real BFF: seeded env connector roster, unsupported Apple descriptor retention, secret-free summaries, import failed-run no-refresh-token issue, malformed export 400, and provider export 502 fail-closed. Remaining gaps are external two-way provider OAuth/webhook reconciliation, actual reminder dispatch/delivery/notification cold-start, quiet-hours dispatch deferral, richer event-metadata prefill, and explicit observation-to-event back-link control | | psyche-tutor-live-session-to-graded-record | partial | partial | live-voice envelope, library write, full mastery adaptive-loop, operator review lane (all unbuilt surfaces) | | sign-up-and-pay-crypto | partial | partial | rendered CryptoPaywall now covered for BFF-issued BTC and USDC/Base invoices, including anonymous `/billing/crypto` redirect, pending/sanitization gate, asset/network controls, trust-tier badge, address/QR/copy, issued-paywall support action in BTC address-visible, USDC disclosure-gated, and USDC post-ack states, and disclosure ack; 2026-06-27 settlement addendum now posts a signed HMAC webhook to the real BFF settlement receiver, verifies invoice `confirmed`, purchaser `/v1/profile` plan `free`→`pro`, purchaser-scoped invoice ledger `txId`, by-id `status: "confirmed"`, stale browser address hidden on reload, and idempotent webhook re-delivery. Remaining gaps are sign-up funnel, deploy-bound chain watcher/provider leg, rate-lock oracle provenance, receipt download, explicit success/Continue CTA telemetry, and return-to-gated handoff | | tenant-bulk-member-invite-scim | partial | partial | CSV bulk (unwired), IdP callback, outbound invite email, full SSO/MFA/onboarding first-login, operator-table refresh from IdP-created rows, downstream role/callback/first-login audit reconciliation; SCIM bearer/tenant gates + live Postgres Users POST→GET→PATCH→DELETE→revive lifecycle, canonical mirror, SCIM Groups create/list/read/patch/delete membership sync, SCIM Bulk ordered create/group-sync/patch/delete sequencing, SCIM `tenant.scim_provision.*` audit-log read-back, and the signed-in `/tenant/invite` accept-page spot-check are now covered | | tenant-bulk-operations-export | partial | partial | Dedicated V1 admin bulk operations/export journey added. Real-BFF coverage now proves platform-only operation/export scope gates, clean users bulk operation draft→validate→dry-run→stage→commit, row-level commit outcomes through the real users executor, entitlements bulk operation commit into `/v1/profile` plan read-back, rosters bulk operation commit into `/v1/admin/lms/oneroster` commit/tenant totals read-back, persona-assignments bulk operation commit into `/v1/personas/active` read-back, unsupported content commit failure with terminal `failed` and null `committedAt`, duplicate commit 409, validation-error dry-run blocking, per-operator isolation, content JSON export manifest creation/read/verify, approval-gated raw file download with retention/hash/residency headers, unsupported export matrix 400, mismatched record-kind 422, per-record residency metadata violation 422, release/download audit payloads, and audit-search read-back. Remaining gaps are tenant/operator upload-preview UI, CSV parsing/resumable upload, browser-visible release/download controls or future multi-actor approval separation, and real commit executors for content/taxonomy beyond the loud-failure contract | | tenant-integrations-api-keys-webhooks | partial | partial | Dedicated V1 section 20.6 tenant integrations journey added. Real-BFF coverage now proves platform-admin snapshot scope gates, API key create/rotate/revoke with raw-token non-leakage, downstream `x-oshun-api-key` tenant-resource auth with tenant/scope/IP/revoked boundaries and `lastUsedAt` read-back, duplicate revoke 409, malformed create 400, webhook create with signing-secret non-leakage, signed sandbox simulator delivery, inactive simulator failure without signed request, non-sandbox simulator 409, outbound dispatch handoff with signed canonical request, partner receipt retry/backoff, dead-letter exhaustion, success receipt, connector upgrade, real connector health probes, and audit-search/audit-log taxonomy read-back. Remaining gaps are tenant-admin UI controls and autonomous outbound retry/replay workers | | tenant-oneroster-roster-sync | deep | **deep** | Dedicated OneRoster journey added from the V1 tenant spine. Real-BFF coverage now proves tenant-console-scoped dry-run, clean/conflict reports, apply commit, list read-back, `tenant.oneroster.commit.applied` audit-log read-back, periodic SIS pull reconciliation with a derived tenant-scoped pull commit, duplicate pull 409 without extra success audit, pull conflict 422 with no roster mutation plus `tenant.oneroster.pull.conflicts_detected` audit read-back, duplicate commit 409 without extra audit emission, malformed payload rejection, conflict apply no-mutation/no-audit, Metis roster-card refresh, and the dedicated `/operator/lms` diff preview table. The operator table is seeded through real `/v1/admin/lms/oneroster/apply`, driven through browser `/v1/admin/lms/oneroster/preview`, renders clean user-create/user-update/enrollment-create rows plus blocked conflict rows, and reads the roster back to prove preview has no mutation side effect. Production scheduler ownership remains an external deployment-policy question, not a local walkthrough/test gap. | | arete-create-habit | partial | partial | wizard create now POSTs real BFF, includes the selected identity line in `whyItMatters`, keeps BFF id locally, persists a selected identity id locally with IdentityPanel read-back, records first check-in through real BFF, reads back on Home + polished `/arete`, proves second-device `/arete` read-back without local Arete state, asserts live Home footing practice-streak pending-local increment, asserts seeded sample-habit toggles are local-only/no-BFF-write boundaries, and asserts `/arete/streak` reads the live BFF zero/first-check-in count with a 42-cell heatmap that has exactly one accessible today marker | | crisis-aware-tone-policy | partial | partial | web cascade from a REAL signal (localStorage-seeded clock only), anonymous public safety surface, re-frame protection; 2026-06-30 update: `/profile/safety` resource rows now expose actionable `us-988` / audit links and emit `lilith_safety_resource_opened` telemetry from the live frame record | | library-save-collection-share | partial | partial | 2026-06-27 update: `collection-share.spec.ts` drives the visible named-users grant controls and public-profile slug/tier controls through the collection editor, then reads back the live BFF policy; `library-shared-web-view.spec.ts` opens a generated `/share/:token` URL as a separate signed-in recipient, renders the real BFF granted tier/via state, proves no same-id recipient local collection fallback, and renders a real `insufficient-permission` denial; `library-save-collection-share.spec.ts` now carries a guest saved item through real `/welcome` sign-in, the pending-auth `/v1/library/saved-items/sync` replay, BFF read-back, and a clean second-device `/library` hydrate; `library-collection-management.spec.ts` now covers legacy `oshun.library.collections.v1` `version:0` migration to current `version:1` with duplicate/stale item sanitization on a direct collection link; `atelier-plate-actions.spec.ts` now covers a non-search Atelier generated-artifact save through saved-items BFF metadata read-back and clean second-device Library hydrate. 2026-06-28 update: `library-save-collection-share.spec.ts` now also drives a direct non-search Nisaba passage save from `/domains/nisaba?path=/library/passage/...`, waits for the real saved-items POST, asserts persisted passage metadata, and hydrates the saved row on a clean second device. 2026-06-29 update: `veritas-evidence-trail.spec.ts` now drives direct `/veritas` Save to notebook through the real saved-items POST, asserts persisted Veritas passage metadata, and hydrates the saved row on a clean second device. The same 2026-06-29 slice adds `explore-real-search-continuity.spec.ts` for live Explore-dashboard result save → real saved-items POST → Explore-specific metadata → clean second-device Library hydrate, and strengthens `sophia-grounded-answer-page.spec.ts` for direct `/sophia` grounded-answer save → real saved-items query/primary-witness/trust metadata → clean second-device Library hydrate. The earlier tokenized invite/referral link, revoke, private, saved-items seed/readback, paywall, and cross-device sync coverage still stand. Remaining gaps are other non-search save producers beyond Atelier/Nisaba/Veritas/Sophia and broader per-domain save-toggle permutations outside the seeded Search/Explore/Sophia matrix. | | nyx-to-tara-bridge | partial | partial | Tara event-detail card now covers multi-event recommendation semantics across awe/moon/meteor/seasonal/cosmic mappings, destination copy/telemetry, `origin=explore&stack=nyx`, Tara player start telemetry, completion reciprocal Nyx continuity card, and the `/nyx` "From Nisaba" canon link into Nisaba. Remaining gaps are crisis-frame suppression, cadence deferral, offline PWA cold-start/back-stack preservation, Iris memory capture/future re-surface, comparative-persona gating for cross-tradition canon, tone-band honor beyond telemetry, and the domain-only `sleep_hygiene_to_sleep_descent` relationship path not currently reachable from seeded event detail | | sophia-grounded-answer | partial | partial | real BFF grounded-with-citations + `/sophia` render now driven, including normalized passage citation links, a live handoff into the Nisaba reading frame, real saved-items query/primary-witness/surface/trust metadata read-back plus clean-device Library readback, cited-locator highlighting, browser-back restoration for the grounded answer, and a typed `/search` UI query to live `/v1/search` with grounded preview evidence context; contradiction loop, synthetic/retracted/cross-tenant FMs, and non-retrieved label paths remain | | tenant-onboard | partial | partial | `tenant-member-actions` now covers the real-HTTP invite acceptance lifecycle: pending invite → signed-in `/tenant/invite` browser accept page → tenant-console cockpit read-back, plus direct BFF accept, reuse, and wrong-token failures; remaining gaps are branded outbound email/root-link handoff, invite-link SSO/MFA, OnboardingWizard/first action/audit-chain continuity, elevated-permission gate UI, CSV import, and token-lifecycle UI copy | | veritas-to-nisaba-deeper | partial | partial | handoff now covers landed Nisaba citation marker → matching source inspector, counterclaim tab inspection telemetry → `open-nisaba-counterclaim-lineage` → real Nisaba source-lineage landing, saved-claim state after browser-back, backend retraction fan-out, and 2026-06-29 `claim-ai-governance-adoption` retracted-source confidence band → soft-correction href → real `/nisaba/notebook` correction notice → `/nisaba/compare` edition-update diff → corrected Veritas source; remaining gaps are exhaustive step-6 citation integrity on every landed passage claim, AAA-gate bounce, and broader tenant/source-scope failure modes | | arete-living-offering-create | partial | partial | 2026-06-27 update: intention capture is now a real `/arete/offering` textarea that feeds the scene preview copy, score selection clicks update the active score, selected material swatches can move earlier/later and drag/drop locally, recipient/occasion sharing edits update both the masthead summary and send target, those selected values persist through the live BFF + `/arete/offerings` gallery read-back, keep/send first pre-screen the browser-entered intention through the real Lilith safety-assessment BFF route, block a crisis-like intention with 988 resources + no keep write, fail closed on a safety-assessment 503 before any keep write, carry clean intention into the live BFF as a private member-scoped preview, and the cue-privacy controls now open the full promise plus a real `/v1/arete/offerings/receipt` envelope with C2PA/cue-privacy/private-intent hashes and no raw intent rendering. Both Save draft and Send now also cover a forced 503 with visible alert, enabled retry, and live BFF `draft-kept` / `delivered` recovery. Direct `/domains/arete/coach` browser submit now reaches the real coach BFF and covers forced-503 honest fallback. Remaining gaps are adjacent/below-threshold tone-band handling, pre-submit score-preview safety gating, Arete binary media signing beyond the receipt envelope, and wiring `/arete/offering` itself into coach scoring/composition | | editorial-review-approval | partial | partial | author submit-for-review, publish leg + Isis ProvenanceBundle, audit reconstruction; spec actually drives the INC decision panel (wrong surface) | | nyx-tonight-observation | partial | partial | observation-log local persistence + eventId History row + real `/v1/nyx/observations` POST/GET + local-cleared reload + Home Nyx support-card read-back + Home footing current-week KPI now covered; event-detail Veritas/Tara/Metis cross-domain target click-throughs now covered; 2026-06-25 update: Nyx→Nisaba overlay and concept-graph links no longer use `stubNisabaWorkspaceApi`, block service workers, clear stale Nisaba offline snapshots, seed/read a real `/v1/nisaba/notebooks` record, and wait for live daily/notebook BFF hydration before asserting the landed workspace view; event-calendar direct/hydrated close routing now covered; residual documentation-only Nyx gaps remain | | weekly-review-arete | partial | partial | close/save footer + `arete_weekly_review_closed` browser telemetry + step-9 `/arete` continuity read-back now covered; mood-thread caption and margin suggestion are now data-backed; per-act completion state, richer plan-adjustment read-back, crisis-supersedes, and Sunday push remain | | arete-streak-recovery | partial | partial | primary recovery offer + Begin click through to Tara, recovery-origin Tara partial completion -> Arete engagement read-back, written one-sentence return -> `/v1/arete/recovery/journal` partial engagement read-back, real `/v1/arete/streak` trigger-engine timing now proves two missed windows stay `grace_window`/`intact` and the third missed window crosses to `freeze_window`/`protected`, heatmap a11y, coach-card Approve/Not-this-week BFF read-back, approved coach adjustment propagation into `/arete/plan` invitation + next intention row, and `/arete/streak` Adjust/Begin navigation-only no-mutation guard are now covered; durable Tara session-start write, browser-visible route/notification gating from the trigger engine, and crisis-supersedes remain | | lms-connectors-operator | partial | deep | `/operator/lms` page DOM, seeded valid+invalid roster, dry-run validate gates/results, and LTI login→launch JWKS fail-closed are now covered over real dev infra; in-app connector CRUD remains deferred | | scene-keep-and-share | partial | partial | public share → viewer, share-settings iframe/oEmbed copy, oEmbed JSON, playable embed, revoke/delete tombstones, password-protected share/gate/embed break-out, explicit-consent BFF enforcement, APNG download-grant integrity, operator takedown cascade over two public shares + embed denial + existing grant 410 + tenant audit, Lilith pre-share re-check 422, tenant-policy gates, mass-share/rate-limit, stored-policy override-off, idempotent retry; persisted customer share/revoke management UI remains unshipped/browser-undriven | | themis-assessment-appeal | partial | **deep** | teacher override, uphold, teacher-cleared `appealAllowed=false`, learner assessment submit→detection→Themis adjudication→audit/appeal-link handoff, learner-safe audit rationale/evidence/classifier read-back, `/operator/metis` live appeal queue/read/outcome-decision UI, uphold-without-client-`teacherOverride`, dedicated verdict controls, terminal gradebook correction/read-back, and `/messages` decision notification read/follow/mark-read are now covered over real BFF HTTP/browser flows; no current gaps remain tracked for this journey | | account-deletion-and-dsar ⬆ | partial | **deep** | Redis fan-out signed receipt now covered for voice_profile; 2026-06-26 browser `/profile?path=data-rights` coverage also seeds real Isis `generated_outputs`, renders the signed generated_artifact receipt, and verifies hard-delete; full six-service RPC/audit-platform fan-out and anon email-link verification remain | | incident-triage ⬆ | partial | **deep** | /operator/incidents queue render-only, server-side audit durability (no GET-rehydrate), cross-surface audit correlation; threshold desync (20 vs 50 char) | | scene-public-viewer-anonymous ⬆ | partial | **deep** | doc UNDERSELLS its own coverage (reduced-motion + tenant-auth ARE driven); download-grant APNG redemption/media integrity and expired unlock-token cookie fallback are now covered; only PWA cold-launch remains genuinely uncovered | | lilith-studio-tara-scene-publish ⬆ | partial | **deep** | genuinely deep at authoring layer (state transitions, a11y-blocked publish, revert, release-stream 201/401/403/400); only cross-surface steps 11-12 deduct | | metis-byom-ingest-to-course ⬆ | shallow | **partial** | browser-backed `/metis/ingest` text source now posts to the real BFF and renders the returned outline; browser-backed `/metis/courses/new` now posts with bearer+CSRF, receives `awaiting-syllabus-review`, and hydrates the same learner's drafted course on `/metis`; metis-ingest-bff + metis-byom-decision still carry the contract/operator depth; approved bundle→Sophia/KG→published CourseBuild pipeline remains uncovered | | aaa-upgrade-entitlement-bounce | deep | deep | CTA hrefs, view telemetry, and both CTA click telemetry events are now browser-covered; in-place AaaGate AaaBlockedCard remains represented by the fail-closed legacy hub 404 before embed. Remaining observability gap is proxy-side structured access-log telemetry for redirect / 404 boundary decisions beyond the existing `X-Studio-Boundary` response header. | | first-time-anonymous-visitor | deep | deep | Mailpit verify-link `?next=` auto-handoff now covers both the signup browser and a fresh browser context with newly minted HttpOnly cookies; OG/Twitter image handlers, ?reauth=1, onboarding-abandon banner remain | | onboarding-ten-steps | deep | deep | Step 4 sensitive-context opt-ins now mirror into the Memory step and real preferences patch. First-run target weighting is covered by unit helper checks plus browser no-redirect Finish branches for structured-learning → Metis and Tara-only general practice → Tara. Offline Finish is now covered by `onboarding-lifecycle.spec.ts` over real dev infra: browser-offline Finish queues `PATCH /v1/preferences` in the shipped service-worker IndexedDB queue, Chromium Background Sync replays it, BFF preferences read-back proves persistence, and the queue drains. | | telegram-bot-assistant-delivery | deep | deep | route-level rate-limit trigger, fail-closed grounder throw paths, fail-closed voice STT, successful voice-transcript crisis interrupt, Postgres-backed audit-sink persistence, and `/profile/telegram` expired deep-link disablement with refresh recovery are now covered over the real BFF/browser stack; remaining gaps are outbound Telegram delivery / TTS-back and external STT credentials path | | user-flag-to-review | deep | deep | flag affordance, `/api/trust-safety/flags` → `POST /v1/user-reports`, and live admin moderation workspace read-back are covered for the Nisaba submission; Metis lesson/tutor now mount `TrustSafetyFlagButton` with verified target kind/id/label metadata and dialog controls; real-BFF operator decision now updates a live customer report, emits `trust_safety.user_report.decided` audit-search evidence, reads the reporter-scoped `/v1/user-reports/mine` receipt back with cross-reporter isolation, opens `/profile/safety` to prove the submitted-report browser receipt renders as actioned/content_removed, then opens `/messages` to prove the in-app report-decision notification row, delivery receipts, Safety Center deep-link follow, and clicked receipt. Remaining gaps are actor suspension / second-reviewer signoff, external push/email delivery + appeal, crisis/severity classification, brigade rate-limits, and origin surfaces outside Veritas / Nisaba / Tara / Metis | | messages-center-deliver-and-unsubscribe | deep | deep | 2026-06-26 live browser `/messages` path now seeds the real BFF through admin dispatch to the browser access-token subject, renders real `/api/messages/inbox` rows/receipts, follows through the Next proxy, mark-read/archive/unsubscribe/resubscribe through live `/api/messages/*`, proves same channel+category re-dispatch is `422 suppressed`, then proves restored dispatch renders after reload; remaining gaps are external transport provider delivery beyond the receipt seam and broader multi-stage channel receipt permutations | | tenant-audit-log-investigation | deep | deep | bookmark/share UI (BFF-only), feed CONTENT narrowing, chain-of-custody hash (product gap), optimistic concurrency | | agentic-pipeline-customer-invocation | deep | deep | push/cron triggers, tone-reviewer pre-check, tool DAG (creds-bound), review-gate variants, failure modes | | install-as-pwa | deep | deep | iOS A2HS, offline write-queue→sync flush, push notificationclick, sign-out wipe, manifest-404 FM | | public-scene-abuse-report | deep | deep | report form, operator S1 inbox, resolve/dismiss write verbs, revoked-share/rate-limit edges, and real-BFF takedown-cascade reconciliation are covered; remaining gaps are the public-report operator-detail cascade UI, actor restriction branch, rationale modal UX, brigade clustering, and signed-in reporter status surface | | metis-lesson-completion | deep | deep | assessment submit now posts to real BFF and renders Themis read-back/appeal handoff; save-excerpt→/library (product gap), per-course detail nav, tutor-nudge click, and draft auto-save BFF remain | | multi-device-workspace-handoff | deep | deep | 2026-06-28 update: mobile deep-link restore now proves active evidence-source equality with desktop, Home continuity now proves syncing, exact "Sync delayed" copy, retry, and healthy sync states, and Iris failure-mode coverage now proves failed writes leave no false success or storage receipt while post-eviction mobile handoff payloads recompute against the active tab; desktop reload still proves URL-restored side-panel kind + real-BFF Nisaba reading-anchor equality; remaining gaps are post-mobile desktop reload side-effects | | tara-daily-ritual | deep | deep | streak-increment write (Arete fixture), return-to-hub no-double-count, cross-domain streak consistency (unit-only) | | first-tara-sit | deep | deep | captions/vibration a11y, first-sit cross-domain bridges, audio-fail retry on `/tara/sit/`, streak increment | | tara-to-nisaba-handoff | deep | deep | destination citation-trail payoff now opens the authenticated Nisaba shell with no workspace route mock, carries an exact Sophia-style locator into the Nisaba URL, proves the reading frame highlights that paragraph-1 sentence, and asserts the primary source-trail step exposes `Canonical source` plus the chapter/paragraph/sentence locator; browser-back from the Nisaba handoff now restores `/domains/tara?...&taraSessionState=complete` with the Tara completion surface and companion card; remaining gaps are cadence-decay, crisis suppression, and citation-404 edition-update | --- ## 4. Stale-Spec Risks (deduped — likely RED when run / silent-drift hazards) These are line-anchor drift, fixture-coupling, or stub/tautology hazards flagged across the journey specs. Ordered roughly by severity (skip/tautology first, then fixture-coupling, then line-anchor drift). **Test-skip / tautology / silent-degrade (highest):** 1. ~~`veritas-evidence-trail.spec.ts:351-354` — step-9 Save→/library (the only deep candidate) is `test.skip` when `data-veritas-article-actions` count===0 ("veritas downstream offline").~~ Closed 2026-06-23: Playwright boots the BFF with `OSHUN_VERITAS_ADAPTER=mock`; Save→/library, Save toggle, and Report now assert the seeded grounded lead without conditional skips. 2. `sophia-grounded-deepening.spec.ts` — runs on `VeritasRAG DEMO_RESPONSES['renewable']` (3s setTimeout canned reply, hard-coded IEA/BloombergNEF/IRENA citations, `skipAxe`): a **tautology** for the grounding pipeline — must not be read as covering grounding. Closed 2026-06-23 for the real-BFF grounded-WITH-citations requirement and extended 2026-06-24 for the real-BFF cautious/partial branch: `sophia-answer-bff.spec.ts` now asserts the live BFF cited branch and limited-support partial branch; `sophia-grounded-answer-page.spec.ts` renders both through `/sophia`, follows a normalized passage citation into the Nisaba reading frame, verifies the cited locator highlight/back restore leg, and verifies the grounded answer persists through real saved-items Library readback. The VeritasRAG spec remains intentionally scoped to canned citation drill-down and pin UI behavior. 3. ~~`citation-drift-resolution.spec.ts` — steps 5-6 hash-chain + 16-field bundle assertions run only with a seeded Isis ledger; default e2e env skips them (`test.skip`).~~ Closed 2026-06-23: Playwright now starts Next with a harness-only Isis fixture ledger, and the spec asserts clean, broken, unavailable, empty-tenant, and 16-field detail branches without skips. 4. ~~`account-deletion-dsar` (`profile-customer-data-deletion.spec.ts:105-171`) — hand-builds the deletion-snapshot wire shape inline (`receiptSignatureHex/auditKeyId/rowsRemoved`); if `state.ts:393` emitted shape changes, the mock silently diverges from production without failing.~~ Closed 2026-06-26: the positive generated_artifact browser receipt now runs against the live BFF and Isis `generated_outputs` table; the inline snapshot remains only for the unattested tombstone negative-render guard. **Fixture-string coupling (medium — breaks many assertions on a fixture edit):** 5. **Closed 2026-06-25** — `nisaba-notebook-capture-cite.spec.ts` now runs through the authenticated shell without `stubNisabaWorkspaceApi`, waits for the live `/v1/nisaba/passages/nisaba-passage-attention` response, and asserts the live Dhammapada source/provenance trail instead of the removed "Practice Commentary Reader" fixture. A related 2026-06-25 closure removed `stubNisabaWorkspaceApi` from the Nisaba compare breakpoint leg in `viewport-fit.spec.ts`; it now opens `/domains/nisaba?origin=explore&path=%2Fcompare` through the authenticated shell, clears stale Nisaba offline snapshots only for that live route, waits for `/v1/nisaba/passages/daily`, and asserts the compare layout plus evidence/notebook inspector posture across audited breakpoints. A further 2026-06-25 closure removed the same fixture from `shell-route-signoff.spec.ts`; the shell signoff path now seeds and reads back a real `/v1/nisaba/notebooks` record, clears stale Nisaba offline snapshots, waits for live `/v1/nisaba/passages/daily` or `/v1/nisaba/passages/:id` hydration, and captures compare/passage signoff evidence from the authenticated shell. A further 2026-06-25 closure removed the fixture from `redesigned-surface-breakpoints.spec.ts`; it now seeds and reads back a real `/v1/nisaba/notebooks` record, clears stale Nisaba offline snapshots, and waits for live daily/detail BFF hydration while asserting compare, passage, and notebook split/stacked breakpoint posture through the authenticated Nisaba shell. A further 2026-06-25 closure removed the fixture from `visual-regression-pages.spec.ts`; the Nisaba passage, compare, notebook, evidence, note, mobile lineage, and mobile note snapshots now seed/read a real `/v1/nisaba/notebooks` record, clear stale offline snapshots, and wait for live daily/detail BFF hydration before capture. 6. `atelier-image-to-library.spec.ts` — pinned to exact `atelier-depth.ts` strings ("Specimen 047", "Seed - 0x4f2a - locked", "p.07"); ~10 render assertions break on any fixture wording change. Also internally inconsistent: line 8 calls "Cast twelve more" unwired, line 233 treats it wired. 7. `veritas-retraction-cascade.spec.ts` / `veritas.tsx:1774-1937` — page content still pins the seeded Renata notice (38%/41%, "16 January", promise list), but the route now loads it through the authenticated BFF personal-letter endpoint and asserts a second reader receives 404/no letter. 8. `veritas-to-nisaba-bridge.spec.ts` — hard-codes `CANONICAL_CLAIMS['claim-renewables-capacity']` text + `source-iea`; also pins URL fragments from `buildHydratedWebDomainRoutePath` (encoding-coupled). 9. `tenant-audit-log-investigation.spec.ts` — pins `AUDIT_FIXTURE` rows ("eli@oshun.app", "incident.acknowledge", "tenant:tenant-oxbow"; `domain-stubs.ts:479-515`) → fixture edit breaks 6 assertions. 10. `incident-triage.spec.ts` — pins "6 open · 1 critical" (line 140) + INC-2036..INC-2041 with fixed category→filter mapping (`operator-depth.ts:280-326`); also **threshold desync**: UI rationale floor 20 chars (line 292) vs BFF escalate/resolve floor 50 chars (445-465). 11. `tenant-onboard.spec.ts` / `tenant-member-invite-scim.spec.ts` — hard-code `EXPECTED_KPI` ('247'…'0.9% monthly churn') + row IDs L-00041..L-00048 (`operator-depth.ts:127-193`); high brittleness, low correctness-risk. 12. `lilith-saraswati-persona-dossier-smoke.spec.ts:40-41` — pins `data-required-field-count='17'`; computed from `editorState.validation`, so adding/removing a required dossier field silently breaks it. Also `persona-rehearsal-bff.spec.ts:219` seeds `persona-zen-guide` (404s if the workspace seed renames it). 13. **Closed 2026-06-24** — `arete-streak-recovery.spec.ts` now clicks the primary recovery offer and `Begin · 6 min` through to the exact Tara sit URL, so the former loose href regex cannot mask a target/order change for the primary return path. 14. `search-saved-and-recent.spec.ts:156,277` — hardcoded 2-item `SEARCH_RESULTS`; recent-row label "compassion in Nisaba" depends on client ` in ` build; `source==='recent'` tag coupled to `search-suggestions.ts`. 15. `metis-lesson-completion` — tutor header "session 14 · 11 turns · saved to library" is a **fixture string**; no spec verifies a real library write (product gap masked by fixture). **Line-anchor drift (lower — selectors resolve, cited line numbers stale):** 16. `citation-drift-resolution.spec.ts` header — cites `operator.tsx:514/543-546/618-619` + `operator-depth.ts:206-213` but selectors actually live in `AdminInboxConsole.tsx:36/49/109`; every file:line citation drifted. 17. `first-time-visitor-deepening.spec.ts` — pins `MarketingLanding.tsx:244`, `WelcomeAuthPanel.tsx:828-831/862-919`. 18. `memory-edit-pause-forget` specs — pin many `ProfileMemoryControls.tsx` anchors (:508/:525-550/:604/:641-669/:709/:719/:1127-1130); also localStorage key `oshun-profile-memory-controls-v1` hardcoded (`memory-state.ts:18`) — a key bump silently breaks seeding. 19. `nisaba-notebook-capture-cite.spec.ts` — pins ~dozen `NisabaSurface.tsx` anchors (10302/10419/10433/10459/10484/5280-5281/12631-12670) in a ~13k-line component + `NisabaCitationTrailPanel.tsx:577`. 20. `onboarding-deepening.spec.ts` — pins `OnboardingWizard.tsx` (542-565/1170/1456/2168/307-380/901-913/1199/3557); button-label literals ("Get started"/"Continue") asserted by accessible name. 21. `account-deletion-dsar.spec.ts` — drifted anchors: grace-banner :553-577→:574, dsar-input :1223→:1240, button-text :1226→:1245. 22. `sophia-grounded-deepening.spec.ts` — line-number comments at `GroundedAnswerEvidenceSidebar.tsx:153/187/263/264` + `VeritasRAG.tsx:817/872`; abstention assert coupled to `answer-composer.ts` copy. 23. `nisaba-scholarly-read.spec.ts` — pins scholar fixture strings ("Marcus Aurelius...IV.viii-xii", "4 witnesses · 6 editions · 11 translations", "Edition: Farquharson 1944"; `nisaba.tsx:195-221`); two different scholar surfaces (`/nisaba/scholar` vs `data-nisaba-scholar-mode-toggle`) — maintenance hazard. 24. `pwa-lifecycle-deepening.spec.ts` — `PwaUpdatePrompt.tsx:250→267`, `PwaBootstrap.tsx:240-242→242`. 25. `multi-device-handoff-deepening.spec.ts` — `MultiPanelWorkspace.tsx:1300-1306→1402`; hard-codes notebook slug `nisaba-notebook-1` + `tab=study-evidence`. 26. `nyx-tonight-observation.spec.ts` — `rooms.tsx:814-817→891-893`, canon Link 1028-1058→1135-1136. 27. `arete-streak-recovery.spec.ts` — `arete.tsx:341-345`→ masthead :201, eyebrows :370/:423/:440. 28. **Closed 2026-06-25** — `tara-to-nisaba-handoff-destination.spec.ts` now opens the live authenticated Nisaba destination without `stubNisabaWorkspaceApi` and asserts the real citation-trail panel/status/derivation step over the live passage. 29. `assistant-handoff-deepening.spec.ts:64` — test NAME says `outcome=success` but body correctly asserts `...outcome='applied'` (cosmetic title drift). **Stale doc-claim baked into a spec (will mislead a maintainer):** 30. **Closed 2026-06-24** — `tenant-sso-config.spec.ts` now consistently says `/operator/sso` renders the live `ssoConnectionStore` after real `POST /v1/admin/sso` seeds; the contradictory retired-`SSO_FIXTURE` wording is gone. 31. **Closed 2026-06-23** — `arete-living-offering-create.spec.ts` and `arete-living-offering-create.md` now describe Save-draft/Send as wired through `AreteOfferingActions` and `/v1/arete/offerings/keep`; residual gaps are draft gallery read-back, crisis pre-screen, and C2PA/receipt. 32. **Closed 2026-06-23** — `arete-weekly-review.spec.ts` and `weekly-review-arete.md` now describe Save-as-private-letter/Close-the-week as wired through `AreteReviewClose` and `/v1/arete/review/close`, with `/arete` read-back now asserted through `/v1/arete/room`; the data-backed margin suggestion reveal is also now covered in `arete-weekly-review.spec.ts`. Residual gaps are Sunday push, per-act completion, and richer plan-adjustment propagation. 33. **Closed 2026-06-24** — the `arete-streak-recovery` session-completion → streak-engagement gap is now covered. A recovery-origin Tara sitting completion posts to `/v1/tara/sittings/:id/complete`, returns `areteRecoveryEngagement`, writes a member-scoped `Tara recovery return` Arete `partial` / `done` check-in, and reads it back through `/v1/arete/room` plus the `/arete` hub. **2026-06-29 update:** `/v1/arete/streak` trigger-engine timing now proves the two-missed-window grace boundary vs third-missed-window recovery threshold. Durable session-start, browser-visible route/notification gating from that engine state, and crisis supersession remain open. 34. **Closed 2026-06-26** — the `arete-streak-recovery` approved coach re-scope now reads the durable `/v1/arete/coach/decision` state into `/arete/plan?intent=adjust` and asserts the plan invitation plus next intention row carry the same offered action. 35. `editorial-review-approval` — `operator-editorial-review-approval.spec.ts` actually drives the INCIDENT decision panel (`INC-2041`, shared with incident-triage), NOT the editorial artifact lifecycle; the journey's substance is not what the spec drives. --- ## 5. Walkthrough Staleness Drift (high-severity first) | file | issue | severity | | ------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | WALKTHROUGH/studio/domain-bridges/neith/studio-neith-inverse-modeling.md | **Closed 2026-06-23.** The walkthrough now documents the current JSON-payload fit-quality lane (`data-fq-*` selectors, `/v1/admin/studio/fit-quality` catalog + evaluate POST, fail-closed admin scope) instead of the removed reference-image UI. `studio-neith-inverse-modeling.spec.ts` adds direct page-DOM coverage against the live BFF evaluator plus non-admin and invalid-input branches. | closed | | WALKTHROUGH/operator/operator-admin.md | Cites `AdminInboxDecisionPanel` at `operator.tsx:657`, but operator.tsx is 531 lines and the component is no longer rendered directly there. Still reachable (AdminInbox → AdminInboxConsole → AdminInboxDecisionPanel at `AdminInboxConsole.tsx:140`). Stale line/location citation only; component + three-verdict picker still present. | low | | WALKTHROUGH/operator/operator-overview.md | Line 46 claims `LOperatorBar` rendered with `product="Lilith"`, but `app/operator/page.tsx:27` passes `product="OSHUN"`. Component present; only the cited prop value drifted. | low | --- ## 6. Prioritized Closure Backlog (highest leverage first) ### A. Fix over-claimed matrix grades (de-fabricate; do first — cheapest, restores trust) 1. **pwa-update-flow** → **closed 2026-06-24 for stale-cache purge evidence**; later 2026-06-24 coverage also closes reading-mode mid-passage scroll restore and the multi-tab `controllerchange` reload sequence; the cold-start no-prompt path and in-flight BFF write/read-back path are also now browser-driven; later coverage also drives the raw service-worker queue/replay substrate; 2026-06-26 coverage also renders the real queued service-worker write count in the update prompt and asserts `pwa_update_applied` / `pwa_sync_queued` telemetry. The current matrix is **deep** for this journey. 2. **tenant-sso-config-saml-oidc-claim-mapping** → regrade deep→**partial**; live callback transform semantics are now covered for `lowercase` + `first-only`, with callback failures for missing mapped email and JIT-disabled unknown users; BFF OIDC test-connection has both successful and fail-closed real-HTTP coverage; SAML/OIDC metadata import now has real-HTTP coverage; `/operator/sso` now persists metadata/discovery imports, all seven claim slots, and all four transform options through the live BFF; tenant-admin `/identity` now has real-infra browser coverage for anonymous gating, tenant-scoped SSO roster read-back, read-only sample identity-engine evidence, and axe. The remaining uncovered spine is tenant-admin import/upload controls, auth-policy edit panel, sandbox-probe UI verdicts, and enable state. The contradictory `SSO_FIXTURE` comment (#30) is closed. 3. **offline-first-time-use** → regrade deep→**partial**; the /healthz probe, deep-route fallback controls, local offline library edit, and raw service-worker queue/replay substrate now meet the browser bar. The auth/session network-only cache-denial transport and uncached deep-route document fall-through with service-worker fallback controls are now also real-SW covered. Search-result offline-save local persistence and visible sync feedback plus Tara reflection offline queue UI are now driven, and the profile Active devices refresh path shows the exact network-only denial copy; the Nisaba 24h cache window now has real-service-worker fresh/expired BFF response coverage plus component-level expired-cache workspace copy. The uncached Nisaba lexicon/morphology offline hint is now covered by `nisaba-split-view` against a live hydrated passage. Natural sync scheduling for those writes is still undriven. ### B. New page-DOM specs for the 3 spec-less routes (this pass's direct gap) 4. **Closed 2026-06-23** — `apps/oshun/web/e2e/operator-personas-console.spec.ts` covers roster auto-select/detail, empty fail-soft, approve-for-release field rendering, 409 inline error/no optimistic mutation, and now a real browser `submit-for-review` success path with status/audit repaint and BFF read-back. 5. **Closed 2026-06-23** — `apps/oshun/web/e2e/operator-lms.spec.ts` covers seeded roster + invalid-panel skip ordering, wrong-scope empty state, malformed-JSON client reject with no POST, real-BFF validate verdicts, and 503 failure copy. 6. **Closed 2026-06-23** — `apps/oshun/web/e2e/personas-picker.spec.ts` now covers the `/personas` page DOM, real BFF blocked roster rendering, voice consent unlock, select→active persistence, reload read-back, clear persistence, and deterministic 401/500 UI failure branches. 7. Reconciled `apps/oshun/web/e2e/notifications-route.spec.ts`: the route now has direct deep coverage plus live BFF write persistence, retry recovery, and normalized browser telemetry for open/filter/reset/read/dismiss/mark-all interactions. A follow-up update added BFF cursor-backed load-more coverage for 50+ notification feeds. Remaining route question is first-class nav intent. ### C. Walkthrough doc fixes (drift) 8. **Closed 2026-06-23** — `studio-neith-inverse-modeling.md` now matches the current JSON-payload form workspace, and `studio-neith-inverse-modeling.spec.ts` covers the live lane. 9. Fix `operator-admin.md` line citation (`operator.tsx:657` → `AdminInboxConsole.tsx:140`). 10. Fix `operator-overview.md` `LOperatorBar product` value (Lilith → OSHUN, `page.tsx:27`). ### D. Spec de-fabrication / stale-comment fixes (RED-when-run + misleading) 11. Reconcile `scene-public-viewer-anonymous` doc Uncovered list — it undersells coverage (reduced-motion + tenant-auth ARE driven) — and grade matrix partial→**deep**. 12. Reconcile `lilith-studio-tara-scene-publish` (partial→**deep**), `account-deletion-and-dsar` (partial→**deep**), `incident-triage` (partial→**deep**), `metis-byom-ingest-to-course` (shallow→**partial**) matrix grades. 13. **Closed 2026-06-23** — deleted/reconciled the false "unwired / DO NOT click" claims in the Arete living-offering and weekly-review specs and journey docs; both now point at the wired AreteOfferingActions / AreteReviewClose BFF paths. 14. **Closed 2026-06-24** — updated `telegram-bot-assistant-delivery` evidence: voice STT is documented as real fail-closed (`resolveSttVoiceProvider`, "could not transcribe"), and the focused real-BFF spec now also proves the route-level 13th-message rate-limit trigger instead of leaving it as unit-only. 15. **Closed 2026-06-24** — wired the Telegram webhook response audit envelope into the BFF admin audit-events sink and proved the real local Postgres-backed `admin_audit_event` row from `telegram-webhook-delivery`. The remaining Telegram gaps are outbound delivery/TTS-back and external STT credentials. The grounder throw paths were closed on 2026-06-26 as fail-closed abstention coverage instead of 500 behavior. 16. **Closed 2026-06-24** — updated `user-flag-to-review` docs and browser E2E evidence for the shipped `TrustSafetyFlagButton` + `POST /v1/user-reports` path; the focused spec now reads the real admin moderation workspace back and asserts the submitted live `cust-ur-*` report is queued. 17. **Closed 2026-06-26** — extended the `user-flag-to-review` origin coverage to the Metis lesson and Metis tutor headers. The focused browser spec now asserts both Metis report buttons expose stable target kind/id/label metadata and open the shared category/rationale dialog; the full live submit → moderation read-back path remains covered by the Nisaba flag in the same spec. ### E. Convert test.skip/tautology coverage into real assertions 16. `veritas-evidence-trail` — **save/report skip closed 2026-06-23**: Playwright seeds the Veritas adapter through the BFF, and the browser specs now fail if the grounded-lead action row is absent. **Browser no-lead render partially closed 2026-06-23**: `veritas-full-journey` drives a live BFF non-Veritas-scope denial through the `/veritas` RSC fallback and asserts the honest empty state plus no Save/Report actions. **Claim/source drill closed 2026-06-23**: `veritas-evidence-trail` now clicks an underlined claim, asserts the rail changes, clicks the claims table back to the peak claim, and follows the selected Statnett source row to `/veritas/source/statnett-operator-data`. **Source-id profile routing closed 2026-06-23**: the spec also renders `/veritas/source/nve-regulator-note` and asserts its non-default source profile. **Browser downstream-503 leg closed 2026-06-23**: `veritas-home-outage` boots a real outage-mode BFF and asserts the `/veritas` no-lead browser render after a live `503`. 17. `sophia-grounded-answer` — **BFF/page grounded-WITH-citations gap closed 2026-06-23; cautious/partial branch added 2026-06-24**: `sophia-answer-bff.spec.ts` drives the live BFF in-process Nisaba corpus to `groundingState='grounded'`, `groundingState='partial'`, stable-ID citations, `retrieved` claims, and citation-map invariants, while `sophia-grounded-answer-page.spec.ts` renders both cited states through `/sophia`, including a normalized passage-citation handoff into Nisaba, cited-locator highlighting/back-nav restoration, and real saved-items Library readback for the grounded answer; it also submits a typed `/search` query to live `/v1/search` and verifies grounded preview evidence context. Remaining work: contradiction loop UI, synthetic/retracted/cross-tenant failure modes, and labels beyond the current extractive `retrieved` path. 18. `citation-drift-resolution` — **seeded-ledger skip closed 2026-06-23**: steps 5-6 hash-chain assertions execute under the harness fixture ledger, and the BROKEN-ledger fixture asserts `data-verification-ok='false'`. Remaining work: wire recheck/re-render/retract actions and audit-log chain. ### F. Highest-value uncovered journey legs (real product/coverage gaps) 19. **Closed 2026-06-24 for the message-center replay seam** — `messages-quiet-hours-and-channel-binding` now proves delayed quiet-hours dispatch replays via `/v1/admin/customer-messages/replay-due` after the window closes and writes `queued → sent → delivered` receipts. **2026-06-26 update:** the local message-center dispatch seam also now proves active crisis-frame suppression for non-essential messages and safety-critical incident bypass, including a delayed quiet-hours replay that remains held with `dispatch.suppressed.crisis_frame` if a crisis frame activates before the replay boundary runs. **2026-06-29 update:** the shipped notifications-preferences BFF matrix now covers all launch domains × persisted modalities × category kinds via PATCH→GET read-back. Remaining gaps are external Telegram/WhatsApp/email/SMS provider handoff beyond that receipt seam, provider-level category binding for those real channels, Lilith tone-band persona-policy, and real OTP/magic-link ownership flows. 20. **Closed 2026-06-24 for different-device verify-link semantics** — `first-time-anonymous-visitor` now opens the real Mailpit verification link in a fresh browser context with no auth cookies, confirms the single-use BFF token through the same-origin verify-email proxy, lands in `/onboarding?redirect=/tara`, and proves the new device receives HttpOnly `oshun-session` and `oshun-access` cookies plus a verified `/api/auth/session`. 21. `account-deletion-and-dsar` — finish the residual deletion edges: full six-service fan-out with service-specific `@oshun/audit-platform` attestations and deletion identity-verification email-link round-trip. **2026-06-25 update:** local-dev Isis `generated_artifact` completion is now covered by `data-rights-dsar-bff`: the spec migrates the Isis DB, seeds `generated_outputs`, runs immediate category-select deletion over the live Redis-backed BFF fan-out, verifies a signed `erased` receipt with `rowsRemoved=1`, and confirms the row is hard-deleted. A real Redis voice_profile signed receipt also renders from live BFF data. **2026-06-26 update:** the `/profile?path=data-rights` browser flow now covers the generated_artifact Isis path too, including the signed UI receipt and post-erasure row-count check. 22. `nyx-tonight-observation` / `nyx-event-calendar-sync-reminder` — **observation persistence closed 2026-06-23 and BFF read-back deepened 2026-06-24**: `NewObservationForm` now writes local-first, carries the `eventId` back-reference, posts to `/v1/nyx/observations`, and reloads from the BFF after local Nyx storage is cleared. **2026-06-24 update:** the Home footing "Sky observations" KPI now counts the newly saved current-week row and routes back to `/domains/nyx/observation-log`. **Later 2026-06-24 update:** event-detail Nisaba/Veritas/Tara/Metis cross-domain card target click-throughs now land on hydrated shell destinations. **Later 2026-06-24 update:** event-calendar direct-route close now replaces to `/domains/nyx?origin=explore`, and hydrated-shell close removes only `path` while preserving `origin` and `stack`. 23. `arete-create-habit` — **browser wizard→BFF and polished `/arete` read-back closed 2026-06-23; first check-in same-browser continuity closed 2026-06-23**: the Cue/Routine/Reward wizard POSTs `/v1/arete/habits`, stores the returned BFF id locally, renders the dashboard row, POSTs the first check-in to `/v1/arete/habits/:habitId/check-in`, and `/arete` reads Done-today / 1-day streak / `1 / 7` back through `/v1/arete/room`; Home reads the local continuity store as `1d streak • done today`. **2026-06-24 update:** a second browser context now reads the checked-in habit back from `/v1/arete/room` with no Arete localStorage, and the wizard's selected identity is asserted in the real create request, persisted locally, and read back in `IdentityPanel`; a later pass asserts the live Home `HomeFootingSummaryStrip` practice-streak metric adds the pending same-day local Arete check-in. A later pass wires `/arete/streak` to the live `/v1/arete/streak` rollup and asserts both the fresh-member `0 days` state and the first-check-in `1 day` state with the padded 42-cell heatmap. 24. **Partially closed 2026-06-24** — `public-scene-abuse-report` artifact-side takedown cascade is now proven against the real local BFF by `scene-password-and-grants`: a tenant operator cascades an `originating-user-account-deletion` takedown across two public share links, both public viewers tombstone, embeds deny as revoked, an existing download grant returns `410`, and tenant audit records `takedown_cascaded`. Remaining work for this item is the public-report operator-detail UI connection, ≥50-char rationale modal UX, actor-side consequence branch, brigade clustering, and signed-in reporter status surface. ### G. Line-anchor hygiene (batch, lowest leverage) 25. Refresh drifted file:line citations across specs in §4 items 16-29 (selectors resolve; comments mislead). Prefer attribute selectors over line anchors; remove pinned line-number comments in long components (NisabaSurface ~13k lines especially).