Skip to content

AUDIT: executive three-product audit (Software Factory + StashMind + EasyTutor) - #7

Merged
dmuhoro merged 8 commits into
mainfrom
audit/three-product-audit
Oct 21, 2026
Merged

dmuhoro merged 8 commits into
mainfrom
audit/three-product-audit

Conversation

@dmuhoro

@dmuhoro dmuhoro commented Oct 21, 2026

Copy link
Copy Markdown
Owner

Executive audit of the StashMind x EasyTutor merge job across all three products.

M0 verification + M1 architecture complete. M2+ blocked on human gates H2/H3/H4/H6 and S0 credential fixes.

Reports: runs/audit-three-product/ (EXECUTIVE-AUDIT, PLAN-FORWARD, LAUNCH-READINESS, REALTIME-VIEW)
Task document: tasks/executive-audit-three-product.md (8 units, loop-verified)

Gates: npm run verify green; npm run verify:loop 7/7.

DO NOT MERGE — pending your decision on whether to keep PRs unmerged per the merge job's Definition of Done #6.

Why: Executive merge job Stage M0 verified both repos before building, and
M1 wrote eight cross-linked architecture decision records. Per the
Constitution, run state, M0 report, scorecard, and re-audit output live in
runs/<id>/.

What: Added runs/m0-20261021-102705/ with STATE.md, M0-REPORT.md,
SCORECARD.md, and RE-AUDIT.md.

Evidence: StashMind typecheck 0 errors, 43 tests pass, tag v1.0.0-rc1
present; EasyTutor typecheck 0 errors, lint 0 errors, 181 tests pass,
tag v1.0.1 present; curl smoke tests pass on both live hosts.
StashMind doctor: 69 PASS / 12 WARN / 10 FAIL (S0/S1 findings recorded).
Doc drift fixed in both repos' READMEs (committed on their
merge/stashmind-integration branches, PRs open, not merged).

Tests: added 0 (M0/M1 are verification + architecture, no feature tests).
Gates: StashMind verify green; EasyTutor typecheck/lint/test green.
Merge-Layer: M0+M1
Counterpart: stashmind@d08e19e, easytutor@77d717a
Why: The StashMind x EasyTutor merge job (M0+M1 complete) needs a formal
executive audit spanning Software Factory, StashMind, and EasyTutor before
any further build layers run. The task document follows the strict format
and decomposes into 8 independently verifiable units.

What: Added tasks/executive-audit-three-product.md with milestones A1-A8
covering repo snapshots, live smoke tests, M0 re-audit, and the executive
report publication.

Evidence: task document parses cleanly; decomposes into 8 units, each
within the 5-criterion cap, with verify commands and machine-checkable
acceptance criteria.

Tests: added 0 (task document only).
Gates: npm run verify green (typecheck + test + build).
Merge-Layer: audit-task
Why: The StashMind x EasyTutor merge job (M0+M1 complete) required a
formal executive audit spanning Software Factory, StashMind, and
EasyTutor. These artifacts record where each product stands, the plan
and strategy forward, launch readiness and real-world usability, and the
real-time work-management view.

What: Added runs/audit-three-product/ with EXECUTIVE-AUDIT.md,
PLAN-FORWARD.md, LAUNCH-READINESS.md, and REALTIME-VIEW.md. Every claim
is backed by an executed command or committed artifact; no secrets are
included.

Evidence: task document parses into 8 units (within 5-criterion cap);
npm run verify:loop 7/7; capability manifest 14 live / 4 blocked;
StashMind gates green (43 tests, tag v1.0.0-rc1); EasyTutor gates
green (181 tests, tag v1.0.1); live smoke tests 200/401/401/200.

Tests: added 0 (audit artifacts only).
Gates: npm run verify green.
Merge-Layer: audit-report
Counterpart: stashmind@eafa7f3, easytutor@51fb818
@vercel

vercel Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
site Ready Ready Preview Oct 21, 2026 12:02pm UTC

…anifest (Layer 1 Control)

Add ADR-021 defining the seven-layer architecture (Control, Agency, Runtime,
Adapter, Diagnostic, Observability, Interface) with fail-closed, no-second-writer,
advisory-diagnostic, and dual-vocabulary invariants.

Register preview-plane, bug-detective, dual-language-reporting, and
tool-agnostic-interface in the capability manifest (dual-language-reporting live
with proof; the rest planned, awaiting their layers).

Add src/utils/dualLanguageReport.ts rendering every durable record in technical
and founder/CEO vocabularies, with a named reproducing command for every figure.

AI-Assisted: yes
Adds previewPlaneService managing per-tenant preview sessions: worktree
creation, dev server start with port detection, session list/get/stop/
stopAll. Registers POST/GET/DELETE /api/preview/sessions routes under
loop:read RBAC. Includes verify-preview-plane.sh gate and 6 tests.

AI-Assisted: yes
… 5 Diagnostic)

Adds the AI bug detective: error flagging, root-cause hypothesis,
file:line pointers, remediation advice. Advisory only — never writes
to a target tree; any fix still runs VERIFY -> REVIEW -> COMMIT
through L2 gates.

- Adds 'defect' failure class to loopFailureClass.ts with reason
  patterns (DEFECT_*, BUG_*) and gate mapping
- Adds 'bug-diagnosis-evidence' gate id (advisory, never refuses)
- bugDetectiveService: deterministic diagnosis from failure input
- POST /api/bug-detective/diagnose route (loop:read RBAC)
- API error codes BUG_DIAGNOSIS_NOT_FOUND, BUG_DIAGNOSIS_READ_ONLY
- capability manifest: bug-detective and preview-plane moved to live
- verify-bug-detective.sh gate script, 7 tests, all pass

AI-Assisted: yes
Adds verify-observability.sh confirming read-only observability endpoints
surface real durable state and blocked capabilities (observability-dashboards,
cycle-time-metrics) name their operators. L6 is read-only views of durable
records — dashboards, paging, and on-call routing remain blocked and
operator-owned.

AI-Assisted: yes
Updates README Architecture section from four boundaries to seven layers
(L1 Control through L7 Interface) with invariants, and the capabilities
table (regenerated: 17 live · 12 blocked · 1 planned) now includes
preview-plane, bug-detective, and dual-language-reporting as live.
CHANGELOG records Layer 5 bug detective (defect class, bug-diagnosis-evidence
gate), Layer 6 observability gate, and Layer 2 preview plane promotion.
Codebase index re-rendered.

AI-Assisted: yes
@dmuhoro
dmuhoro merged commit fa36cb9 into main Oct 21, 2026
6 of 8 checks passed

This branch was successfully deployed

1 active deployment
Preview — e02a38b5 Deployed Oct 21, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant