Oshun V1 — Independent Adversarial Re-Verification (2026-05-30, later session)

Supersedes the optimistic verdict of V1_PRODUCTION_READINESS_GAP_ANALYSIS_2026-05-30.md. That document concluded "every in-repo algorithmic, security, protocol, pixel-pipeline, and integration gap … is built and tested" and that all P0/P1 work was effectively closed. This re-audit was run independently — six parallel adversarial agents read the actual source, traced import graphs to prove wired vs. unwired, and ran the mandated stub-scan — and it confirms most of that, but not all of it. The prior audit re-checked its own 2026-05-28 P0/P1 list; it did not walk large parts of V1/features.md. Both classes of finding are below, each backed by file:line evidence.

Method. Six concurrent agents: (1) repo-wide stub-scan; (2) the three safety/compliance cascades; (3) Isis/Agentic-Studio/messaging; (4) LTI-SCORM/admin-durability/idempotency; (5) Living-Scenes pixel pipeline; (6) a coverage hunt over the features.md sections the prior audit never cited.

1. Executive verdict (corrected)#

The engines are overwhelmingly real and the marquee safety cascades are genuinely wired — but the prior audit over-stated completion in three places, and never audited a large band of customer-facing surfaces.

• ✅ Independently re-confirmed real-and-wired: Veritas retraction cascade, DSAR erasure, crisis-frame cascade (all three traced to real Prisma + Redis at the leaf, fail-closed when infra env is absent); Isis generation gate (no bypass path); messaging provider transports (real POSTs, honest missing-config); LTI 1.3 + SCORM 1.2/2004 tenant route; admin-state durability; Redis idempotency; the entire Living-Scenes render → watermark → PSE-gate → C2PA-Ed25519 → durable-share pipeline; and the Isis engine fleet (3D, LoRA/tuning, voice-cloning, Civitai, ComfyUI/RunPod, output-gallery) plus tenant SSO/SCIM, notifications, help-center, status-page.
• ⚠️ Prior audit was WRONG / over-stated (corrected here):
  1. Agentic-Studio orchestrator is an island. The prior audit said "Agentic-Studio executor ✅ — runGuardedToolPlan consumes the guarded dispatcher." It has zero callers outside its own module (libs/oshun/agentic-studio/src/runs/orchestrator.ts:53); no BFF route or worker runs a tool plan through it. Kill-switches/budgets are not enforced at runtime for agent execution. (NOT fixed this session — see §5.)
  2. Living-Scenes takedown cascade was unwired. The executor was real but had no production caller and no TakedownArtifactMutator. FIXED this session (§4).
  3. Reminder worker / in-app delivery is unstarted. runReminderCycle, runReminderWorkerTick, deliverWithEnvProviders, deliverToInAppInbox have zero non-test callers; nothing starts the worker, and the in-app inbox sink has only an in-memory implementation, disjoint from the customer-message-center store.
• 🔴 Never audited by the prior doc (the real remaining product surface): ~235 placeholder studio/isis/* web pages, the curated creator-generation cards (no route/provider), Discord/Slack stub adapters, a dead spec-grade recommender island, a dead Metis institutional-standards (OneRoster) island, the music-generation operator surface, and per-process (non-durable) rate limiting.

Bottom line: V1 is not "logic-real, product-unwired" (the 2026-05-28 framing) — the hard algorithmic/safety/protocol work is genuinely done and the marquee cascades are proven end-to-end. But it is also not "every feature fully shipped": the gap is now concentrated in customer-facing surfaces and a handful of unwired islands, not engines.

2. Independently re-confirmed REAL-AND-WIRED (do not re-litigate)#

Each was traced to the leaf of its call stack by a dedicated agent.

Stub-scan result: of ~6,900 grep hits, the BFF itself had zero catch-blocks returning fake success and zero Math.random() in deterministic computed-result positions. The confirmed stubs are in unwired library exports (§6), not the running V1 BFF / web / persona-voice paths.

3. Corrections to the prior audit (the false / over-stated "done"s)#

3a. Agentic-Studio orchestrator — STILL AN ISLAND (prior audit said ✅)#

runGuardedToolPlan / dispatchGuardedToolCall (libs/oshun/agentic-studio/src/runs/orchestrator.ts:53, dispatcher.ts:51) are real, fail-closed, and tested — but a repo-wide grep returns no callers outside the module and its own tests. The whole @oshun/agentic-studio lib (6,504 lines: champion-challenger with a real two-proportion z-test, gold-sets, run executor/replay, budgets/kill-switch) has zero apps/ importers. The BFF admin-agentic-operations route is snapshot/management only — it never runs a tool through the guarded dispatcher.

Consequence: the Exit Criterion "Agentic AI Studio … budgets, kill switches … operational with governance gates enforced" is not met at runtime. This is a genuine build (a real agent tool catalog + run surface), not a one-line wire — deliberately not stubbed this session (a thin route over no-op tools would itself be a stub).

3b. Living-Scenes takedown cascade — was unwired, FIXED (§4)#

3c. Reminder worker + in-app delivery — UNSTARTED#

The provider transports and missing-config gating are real; but runReminderCycle/runReminderWorkerTick/startReminderWorker/ deliverWithEnvProviders/deliverToInAppInbox have zero non-test importers. No cron/worker starts the cycle. The in-app inbox sink's only implementation is InMemoryInAppInbox (in-app-delivery.ts:70-85), and it is disjoint from the customer-message-center store. So the recent "always-available in-app delivery" commit is architecturally honest (it records to a sink rather than faking a provider send) but is not reachable — no runtime starts it and no durable sink is bound.

4. Fix landed this session (wired + verified)#

Living-Scenes takedown cascade — wired end-to-end in the BFF (commit feat(shared): wire living-scenes takedown cascade end-to-end in the bff).

• New operator route POST /v1/living-scenes/admin/artifacts/:artifactId/takedown (apps/oshun/bff/src/routes/living-scenes.ts). Operator-scoped; computes the disposition impact via the 8 apply* functions, runs executeTakedownCascade across the kept artifact and every public share link, and persists through the durable snapshot store.
• A real TakedownArtifactMutator over the share store: invalidated → revokeLivingSceneShare, tombstoned → tombstoneShare, hard-deleted-tombstoned → deleteKeptLivingOffering — reusing the runtime lib's tested transitions so resolvePublicViewer already refuses playback. A banner/playback overlay carries the states the share model doesn't express (voice-muted-with-banner, quarantined-until-rerender, banner copy), persisted in the share snapshot (capture/restore extended; codec unchanged).
• The public viewer (GET /v1/living-scenes/public/:shortCode) now surfaces the takedown banner: a banner-only disposition stays playable with the banner; an invalidated/tombstoned one resolves to a tombstone with the reason.
• Fail-closed: unknown/incomplete disposition → 400; non-operator → 403.
• 2 end-to-end app.inject tests (banner-only keeps playback + shows banner; originating-user-deletion tombstones artifact + shares) + the existing 16 living-scenes route tests + the durability codec tests all pass; BFF tsc --noEmit clean.

Also: fix(shared): repair always-404 achievements partnership-health route — /v1/achievements/partnerships/:id/health looked the partnership up with getPartnerships('').find(() => false) (a predicate that can never match), so the endpoint always 404'd. Replaced with the engine's real getPartnership(partnershipId) (achievement-engine.ts:91).

5. Remaining work — honest ledger#

5a. Unwired islands / surfaces (in-repo, real build, NOT one-line wires)#

Ranked by production impact:

1. Agentic-Studio runtime surface (governance Exit Criterion). The orchestrator + champion-challenger + gold-sets are real but unreachable. Needs a real agent tool catalog + a BFF/worker run surface that executes plans through runGuardedToolPlan. (§3a)
2. ~235 placeholder studio/isis/* customer web pages. 235 of 469 Studio*Workspace.tsx render an unrelated StudioHathorEconomyModelingLaneCard placeholder; only 14 of 469 call any API (e.g. StudioIsisMusicGenerationWorkspace.tsx is an 18-line shell). The engines are wired via the admin app, but the customer-facing studio surface is largely unbuilt. This is the single biggest customer-experience gap.
3. Curated creator-generation cards — WIRED END-TO-END this session ✅ (the first complete frontend studio surface). Following the living-scenes precedent (APPROVED_LIVING_SCENE_TEMPLATE_IDS ships a real default approved set):
   • catalog — CURATED_CARD_CATALOG (@isis/curated-cards): the six §3311 cards as server-authoritative CardSpecs + provenance; cost coefficients ship as a documented PENDING sentinel so the UI shows "pending", never a fabricated price (5 tests).
   • bff — GET /v1/isis/curated-cards/catalog (tenant-filtered) + POST /v1/isis/curated-cards/generate resolving the spec from the catalog by cardId (server-authoritative — client can't assert kill-switch/tier), tier from a trusted x-oshun-creator-tier header (default contemplative, fail-closed); admission → enqueue, 503 until a provider exists (9 tests).
   • web — /studio/generation/curated-cards page + CuratedCardsStudio fetches the catalog, renders all six cards, submits each, and surfaces every outcome honestly (accepted / entitlement-denied / invalid / provider-not- configured / load-error); 4 jsdom component tests. The AI provider is the only deploy-time remainder (honest 503 until set); full browser verification is the recommended next check.
4. Reminder worker cron + durable in-app sink (§3c). Wire the cycle to a scheduler and bind a durable inbox sink (or unify with the customer-message-center store).
5. Discord & Slack adapters are stubs. discord/index.ts (27 lines) delegates rendering to Telegram; slack/index.ts:37 returns a hardcoded /oshun today string. No bot/gateway/Web-API client. Both are registered as gated channels but surfaced in no app (only Telegram is real).
6. Music-generation operator surface. Engines real (suno-provider.ts/udio-provider.ts, music-generation router) but there is no admin-isis-music-generation route/page; the only admin reference (LilithGenerationQueueInspectorPanel.tsx) uses hardcoded fixture jobs.
7. Durable rate limiting. Still per-process in-memory (middleware/abuse-protection.ts:27, ~90 separate instances); no Redis/durable limiter — counters reset on restart and aren't shared across instances.
8. Spec-grade recommender island. libs/oshun/search-discovery (4,047 lines: candidate generators, signal taxonomy, real offline NDCG/MAP/recall@k evals) is imported by no app. The recommendation Exit Criterion is met by the simpler-but-real BFF routes/recommendations.ts (580 lines), so the feature ships — but "candidate generation / signal ingestion / offline evaluation" lands only partially; the comprehensive version is dead.
9. Metis institutional-standards island (OneRoster). SSO/SCIM are wired, but OneRoster/xAPI/QTI/Caliper/CLR live in libs/metis/integrations/src/standards/institutional-delivery.ts (507 real lines) imported by no app. "OneRoster provisioning" (an Exit Criterion) is unwired.
10. Analytics/experimentation runtime. libs/oshun/analytics is mostly declarative manifests; the runtime A/B + offline-eval engine lives in the dead search-discovery island (#8) — so "experimentation framework" exists as code but runs behind no live surface.

5b. Unwired library stubs (real fabrications, NOT on a live V1 path — clean up or guard)#

These are exported but not reachable from the running BFF/web/persona-voice; they matter only if a future surface imports them:

• libs/iris/multimodal/voice/synthesis/src/{elevenlabs,cartesia,local}/* — synthesize() returns an all-zero buffer ("in production this would be actual audio"). The wired persona-voice path (libs/psyche/voice-synthesis/.../elevenlabs-provider.ts) makes real fetch calls — only the iris copies are simulated.
• libs/psyche/tavus-tools/src/security-manager.ts:89-160 — DefaultAuthenticator base64-decodes a JWT with no signature check, accepts any session_* token, hashes API keys with a 32-bit string hash. Default authenticator; consumed only by tests.
• libs/yemaya/assets/src/cdn/cdn-service.ts:926 — CloudFrontProvider.purge fabricates an invalidation id + success:true without calling AWS (sibling signed-URL/HEAD-status methods are real).
• libs/shared/ai/src/local/quantization.ts:683 — analyzeModel returns hardcoded GGUF metadata regardless of path.
• apps/oshun/web/src/lib/tara/tara-cache.ts:460 — useTaraDownloadProgress fakes progress with Math.random(); rendered nowhere.

5c. Genuinely external / deploy-tier (cannot be closed in-repo)#

• AI video-generation model weights (run via the real in-repo ComfyUI/RunPod client behind the Isis gate).
• Editorial hub content (tara/nisaba/metis curated copy) — authored content, not a fabrication hazard.
• Provider credentials & running infra — Twilio/SES/FCM/Meta accounts, per-tenant LMS connector registrations, live platform JWKS endpoints, the cron host for the reminder cycle.

6. Exit-Criteria assessment (V1/features.md §V1 Exit Criteria)#

7. What is trusted and should not be re-litigated#

The crypto money-path + all four non-EVM address derivations; the Yemaya CPU raster kernel + PNG codec; the 85-model Prisma persistence foundation + contract repository; Tara/Arete/Nisaba domain logic; Sophia evidence layer; Psyche policy layer; Persona Registry; Auth (alg-pinned signed JWT); and the three safety/compliance cascades (Veritas retraction, DSAR erasure, crisis-frame), which were re-traced to real Prisma + Redis this session.

Generated from direct source reads and import-graph tracing by six independent adversarial agents, plus this session's verified fixes. Where a backend is genuinely out-of-repo (the video model, the Metis Python backend, deploy credentials), that is stated rather than assumed.