Pre-UAT → Production · Command view
Built from a forensic mine of Codex session 019f25cc (63,894 events, July 2–6) cross-checked against origin/main@734eff41 by five independent repo audits. The one-sentence verdict: the code is largely done and merged; almost nothing is proven where users can see it — and every remaining blocker is either a single bug or a one-word operator decision, not a project.
| Gate | What it is | Owner move | Workbook item |
|---|---|---|---|
DEPLOY | Staging+beta serve 0d5cbb6a; main is 45 commits ahead incl. all Runs/Workflows UX fixes | Run the deploy, capture receipts | DEP-1 |
STAGING-AUTH | Staging jobs spawn but the runner dies at “Not logged in · /login” — per-env Claude credential isolation bug (same class #597 fixed for controller state) | One fix slice | DEP-2 |
MINT | No named hosted-validation browser profile → no hosted proof rows can exist | Mint the profile, name it in the ledger | gate |
DM-PROOF | Live Slack DM→job proof for #537, never captured (blocked by DEPLOY) | Send one DM post-deploy, screenshot | SLK-8 |
SIGNOFF | Deploy Design A: written, twice-reviewed, zero code — also the prerequisite for any cloud deploy trigger | One word | DEP-4 |
AUTHOR/RATIFY | Spec 104 “windx” ADR — cited by launch gates, exists on no branch. Found during this audit: a complete 285-line draft + ratification package sit uncommitted in the dirty coordinator checkout (/workspace/win/docs/specs/104-surface-unification-windx.md) | Commit the draft, then ratify or accept-gap | SPN-7 |
| # | Risk | Evidence | Disproven / retired when |
|---|---|---|---|
| R1 | “Landed” read as “done.” Every UI/UX claim in the session is merged-only; the session’s own completion audit concluded “not UAT-ready; every MET-WHEN box unproven.” | Runtime drift 45 commits; OBS-U0..U9 all “blocked/not started” | Deploy + hosted rows land in the testing ledger |
| R2 | Suggestion-card flash — deterministic ~400ms “quiet” card on every warm prompt commit; a unit test actively asserts the wrong behavior | IntentSuggestion.tsx:135–137, debounce at useComposerSuggestion.ts:962–968, test lock-in at IntentSuggestion.test.tsx:73–79 | RUX-1 merged + hosted trace shows pending→suggested with no quiet flash |
| R3 | MCP reports cancelled/errored jobs as “completed” — any agent driving WIN over MCP is misinformed; package has zero tests | mcp-server/src/tools/run.ts:53–88, no @win/contracts dep | SPN-1 merged |
| R4 | Slack env coupling — one Slack app, one Request URL: staging and beta inbound are mutually exclusive; no manifest in repo; dead “Retry in Slack” button on every failure card | Audit of slack-events/interactive + SLACK-BOT-SETUP runbook | SLK-1/SLK-2 merged; parallel QA demonstrated |
| R5 | Session self-attestation drift — e.g. PR #655’s completion message claims “Monitor run” + command rail; neither string exists in the code. Completion messages are claims, not evidence | Grep of packages/ui vs task-complete text | Each claim re-verified before being cited (this workbook did the first pass) |
| R6 | Unmerged value + one landmine — #519 fix (both bugs still live), Program-3 plan docs unmerged; PR #102 would delete CLAUDE.md/AGENTS.md if swept into a merge | Branch audit of 727 remotes | ORP-1/5/6 done |
| R7 | Employee-role blank page — non-admin login broken; UAT’s actual audience can’t use the app | docs/followups/2026-06-13-my-dashboard-routing-gap.md | ORP-2 merged + hosted check as employee |
| R8 | Docs-treadmill relapse — dozens of session PRs were SHA-refresh churn; partially fixed by making launch:packet the action-time authority (#615/#617) | PR train #569–#620 pattern | Agents re-ground via bun run launch:packet, never via committed SHAs |
| R9 | Production has no infra story yet — zero IaC, plaintext env secrets, EC2-vs-ECS specs unreconciled, deploys rebuild from source instead of promoting CI images | Deploy audit; specs 019/048/032 | DEP-5/8/9 landed |
| R10 | React #185 recurrence pattern — five point-fixes, no generic guard; poll-fed effect deps remain a standing trap. The #631 fix’s hosted proof is a single clean run, not a reproduction of the original failure conditions | Five commits + scar-tissue comments in canvas hooks | RUX-4 guard exists and fails on the historical repro |
| R11 | Beta jobs.running counter disagrees with per-job status (reports running=1 after the job is cancelled/awaiting_review) — recurred three times in the session, never root-caused. Would mask real problems during a production watch | Session chunks 46–48 (jobs 892fdc3f, 9b377a5a, 4fa781ee) | Deliberate repro + regression test on the health aggregation path |
| R12 | Systemic Bun test-mock leakage — process-wide mock pollution caused CI failures in 3 separate incidents, each fixed ad hoc; no shared isolation helper or lint guard exists | Session chunks 12, 20, 29 (CLI parser spies, useComposerSuggestion cross-file races) | Repo-wide mock-scoping helper/lint landed |
| R13 | Nothing was ever verified in a real browser — the in-app browser’s file:// policy blocked every visual QA attempt for 53 chunks; all “worksheet works” claims are static-DOM/Happy-DOM simulations. Mobile/PWA feel was never once observed on a phone-sized viewport | Session chunks 31, 37, 43–44, 50 | MINT profile + one real hosted browser pass with screenshots (pairs with DEP-7 / INS-6) |
| R14 | Worktree fragility — two near-losses of plan artifacts salvaged from stale worktrees; .wrkts/win-slice-3d-pr-template held the local main checkout all session, breaking gh pr merge 40+ times (worked around, never fixed); Spec 104 + Program-3 STATUS/HANDOFF docs still live only uncommitted in the coordinator checkout | Session chunks 6, 34–35, 42–44; git status of /workspace/win | ORP-5/ORP-8 — commit the strays, prune the worktrees |
bun run launch:packet the action-time authority — committed SHAs in docs are snapshot context only.Each tab is a self-contained implementation & QA notes page: verified state with evidence, a persistent worksheet (checkboxes + evidence notes stored in your browser), and copy-ready handoff prompts for delegating slices to agents. Hand an agent one prompt, require the evidence field to be a PR link or ledger row, and check the box only when the repo’s own standard is met: landed → deployed → validated → proven.