Gap register
Manual home · Coverage · Role guides
These are observed source limitations or explicitly unverified boundaries, not implemented fixes or speculative feature proposals. Each entry identifies affected workflows, evidence and practical impact. No application changes are included in this manual.
GAP-01 — Agent/assigned-coach coaching UI handoff
Status: Incomplete. Affected workflows: LRN-05, LRN-06, LRN-07.
Observed limitation: The coaching API permits scoped coach/agent reads, assigned-coach updates and assigned-agent milestone completion. The local app places /coaching in intelligenceOnlyPaths, while local agents/reviewers lack alerts:read.
User impact: Assigned users can be blocked by the web route, including notification links. The manual does not claim a complete agent milestone UI.
Current handling / verification needed: Use an authorised manager to inspect status; record the limitation. A future product change must reconcile route access with server ownership without granting unrelated intelligence access.
Evidence: services/api/src/coaching-plans/routes.ts; services/api/src/identity/authenticator.ts; apps/web/src/app.tsx.
GAP-02 — Agent live-assist UI handoff
Status: Incomplete. Affected workflows: ASK-06.
Observed limitation: Live-assist APIs require qms:read plus session ownership, but local /live-assist is also inside the alerts:read-based intelligence route gate.
User impact: Local agents cannot reach the intended page despite holding qms:read. External desktop/telephony integration was not exercised.
Current handling / verification needed: Document API capability and gate mismatch separately; do not advise switching identities or bypassing web/server access checks.
Evidence: services/api/src/live-assist/routes.ts; apps/web/src/app.tsx; services/api/src/identity/authenticator.ts.
GAP-03 — Scheduled-report execution and delivery
Status: Incomplete. Affected workflows: OPS-13, INS-02.
Observed limitation: Generic report-schedule/report-run contracts and CRUD exist, including next-run/timezone defaults. No schedule execution/delivery worker was found in the inspected API/AI worker composition; the tenant route array has no dedicated schedule/run page.
User impact: Creating a schedule record does not establish that a report will run, export or be delivered.
Current handling / verification needed: Use supported report filters/CSV export for current needs. Treat schedule execution/delivery as missing product work rather than an operating instruction.
Evidence: services/api/src/workspace/routes.ts; services/api/src/server.ts; services/api/src/jobs/internal-worker.ts; apps/web/src/app.tsx.
GAP-04 — External transcription service internals
Status: Unverified. Affected workflows: INT-02, INT-07, INT-08, OPS-09, OPS-10.
Observed limitation: services/ai-transcript is a separately released Git submodule. This audit inspected Sentinel upload/gateway/settings/callback/result code, not the external repository implementation or deployed model pipeline.
User impact: Worker-internal transcription quality, retry behaviour and actual provider redaction guarantees cannot be certified by this manual.
Current handling / verification needed: Verify the pinned external revision and its runbook/tests independently before operational acceptance; keep this manual at the integration boundary.
Evidence: .gitmodules; services/api/src/transcription-jobs/client.ts; services/api/src/transcription-jobs/result-lifecycle.ts.
GAP-05 — Runtime and environment acceptance
Status: Unverified. Affected workflows: XFN-01, XFN-02, OPS-10.
Observed limitation: Source and related test text were inspected; application suites, Mongo integration, browser journeys, live provider calls and production conditions were not executed.
User impact: Implemented status describes source capability, not a deployment certification or test-pass claim.
Current handling / verification needed: Run the applicable existing suites and non-production role journeys when operational verification is authorised/configured. Record exact environment, commit, observed results and failures separately.
Evidence: package.json; .github/workflows/ci.yml; services/api/tests/integration/mongo.integration.ts.
GAP-06 — Production invitation/reset delivery
Status: Incomplete. Affected workflows: ACC-02, ACC-03, ACC-06.
Observed limitation: Account flows create hashed single-use tokens and support acceptance/completion. Routes expose development-only token values/headers; no invitation/password-reset mail-delivery path was found in the inspected identity flow. Knowledge announcement mail is a separate feature.
User impact: An accepted request does not prove the recipient received a usable production link. A production invitation/reset can remain operationally undeliverable.
Current handling / verification needed: Have the deployment owner confirm/provide an approved delivery implementation; do not retrieve or publish stored token hashes or treat development token exposure as a production procedure.
Evidence: services/api/src/identity/routes.ts; services/api/src/identity/member-routes.ts; services/api/src/identity/account-flows.ts.
GAP-07 — Other local UI/API permission differences
Status: Implemented with access limitation. Affected workflows: INS-02, JNY-04, OPS-06, OPS-01.
Observed limitation: Local intelligence and owner-only page gates are narrower than some backing API read permissions. Integration settings admits integration managers, while connector actions can still be owner-only.
User impact: A valid API permission does not guarantee the corresponding page/action is available; role-based training must reflect both checks.
Current handling / verification needed: Use roles.md and the individual workflow access notes. This documentation does not broaden access or infer role equivalence for Auth0 tokens.
Evidence: apps/web/src/app.tsx; services/api/src/connectors/routes.ts; services/api/src/llm-usage/routes.ts; services/api/src/reports/routes.ts.
GAP-08 — Legacy generic aliases and route shadowing
Status: Implemented with routing limitation. Affected workflows: JNY-01, JNY-03, JNY-04, OPS-13.
Observed limitation: The generic workspace router is mounted after dedicated handlers, accepts finite resource kinds, and includes the singular action-catalog alias. Some exact generic method/path registrations are shadowed; others maintain raw storage records.
User impact: Counting registrations can overstate available operations. Raw record CRUD is not a substitute for dedicated publication, candidate review or calculated journey workflows.
Current handling / verification needed: Use dedicated editor/lifecycle routes in normal operation. coverage.md identifies exact shadowed/unsupported generic entries and legacy storage paths.
Evidence: services/api/src/app.ts; services/api/src/workspace/routes.ts; services/api/src/journey-config/routes.ts.
GAP-09 — Survey collection and preview workspaces
Status: Incomplete. Affected workflows: JNY-08, OPS-13.
Observed limitation: Survey schemas/storage and preview lists exist, as do template/health records. No complete survey designer/public collector/distribution workflow is exposed by the reviewed UI routes.
User impact: Stored responses may support metrics, but the product must not be described as an end-to-end survey collection platform.
Current handling / verification needed: Use only verified integration/API ingestion and label previews. Confirm trusted correlation before interpreting survey-linked metrics.
Evidence: packages/contracts/src/operations.ts; services/api/src/workspace/routes.ts; apps/web/src/features/operations/operations.tsx; apps/web/src/app.tsx.
GAP-10 — Demo data and historical documentation drift
Status: Demonstrative / environment-dependent. Affected workflows: INS-01, XFN-02.
Observed limitation: The README describes the Command Centre data as demonstrative, while the current command-centre handler builds from repositories. Development seeding populates realistic-looking records.
User impact: A populated screen or an old completion checkbox cannot prove live ingestion, production data quality or current acceptance.
Current handling / verification needed: Inspect dataset provenance and current implementation. Treat seeded environments as demonstrative and use pinned code/evidence when historical prose differs.
Evidence: README.md; services/api/src/command-centre.ts; services/api/src/demo-seed.ts; services/api/src/app.ts.