Living Program Ledger
Gap-closure program · 2026-07 · v37
Next safe actions
The vertical is proven live — GP.Family ALLOW on real SpiceDB and Ory Keto through all four SDKs, full observe-loop, security review clean. This program closes what the 2026-07-12 audit found: stubbed seams, CI that never runs, zero deployments, one-language observability, and unbuilt DX tooling.
Workstream 07
The `frauthy tui` live dashboard plus up/down/logs presets (modeled on ~/Code/cuitty/cui), and this versioned status site with its markdown ingestion pipeline.
Next safe action`frauthy tui` live dashboard unbuilt (spec 05 B.4 headline; cui-modeled)
| Repository | Health | CI | Coverage | Release / deploy | Open |
|---|---|---|---|---|---|
| protocolRust (7 crates) · Bun/TS CLI | On track | green (exact-head Protocol CI run 29756434292: Rust, CLI, type contract, integrations, coverage gates, and reusable dispatch caller) | Rust 75.07% remote / 69.72% floor; TypeScript CLI 47.65% remote / 21.51% floor | publication dry-run passed; credential-gated release not executed | 0 |
| sdkTypeScript · Rust · Go · Python | On track | green (exact-head SDK CI run 29755780234: four-language tests and coverage, type contract, conformance, and reusable dispatch caller) | TypeScript 76.07%; Rust 76.06%; Go 71.51%; Python 83.81%; all upward-only ratchets pass | Dagger change-graph documentation now targets master-triggered multi-language SDK packaging; no package was published | 0 |
| cloudBun · Hono · DuckDB/ClickHouse · Astro web | At risk | green (exact-head Cloud CI run 29755777452: TypeScript, OTLP gRPC, container/Cloudflare contract, coverage, and reusable dispatch caller) | 63.28% remote measurement; 61.28% upward-only floor; 70% target | cloud-ui source is ahead of the published and Brand-admitted artifact; no package publication performed | 0 |
| marketBun · Hono · Astro + Solid web | At risk | green (exact-head Market CI run 29755782538: backend, UI/web, container health, coverage, and reusable dispatch caller) | 63.19% remote measurement; 61.19% upward-only floor; 80% target | market-ui source is ahead of published and Brand-admitted artifact; immutable GHCR workflow is manual and was not dispatched | 0 |
| adminSolidJS · Bun + Ink TUI · shared client lib | At risk | green (exact-head Admin CI run 29756414021: typecheck, coverage, client and UI SDK builds, packed-consumer verification, production authentication boundary, Monaco route, accessibility, and reusable dispatch caller) | client 76%, web 100%, and TUI 23% floors pass; the repository coverage ratchet remains enforced | admin-ui source is ahead of the published and Brand-admitted artifact; no package publication performed | 0 |
| siteAstro 7 · SolidJS · Tailwind 4 | On track | green (exact-head Site CI run 29755779630 and Dagger Delivery run 29755778865) | 87.00% on the expanded current master instrumented surface (348/400 lines), above the enforced 50% floor; v35's 97.06% remains immutable historical evidence from the earlier narrower scope | site-ui source is ahead of the published and Brand-admitted artifact; no package publication performed | 0 |
| infrastructureDocker Compose · Terraform ≥1.9 | At risk | green (exact-head Infrastructure CI run 29755777669: Terraform validation/plans, topology and lifecycle tests, Compose validation, coverage contract, and reusable dispatch caller) | not applicable; quality is enforced by validation, tests, plans, and lint | infrastructure modules are source controlled; no artifact publication performed | 0 |
| devopsBun · Astro + Solid portal · GitHub Actions | At risk | green (exact-head DevOps CI run 29756288185, E2E Smoke run 29756286932, and Delivery Foundation run 29756288087) | complete historical master evidence covers all 11 configured producers at 19,327/27,752 lines (69.64%); automated complete-set enforcement remains credential-gated | devops-ui source is ahead of the published and Brand-admitted artifact; no package publication performed | 2 |
| sandboxTS · Go · Python · Rust | On track | green (exact-head Integration run 29448176119) | live conformance evidence 9/9 and 100/100 | sandbox-ui is aligned across source, GitHub Packages, and Brand admission | 0 |
| brandBun workspaces · Solid · Astro · Tailwind 4 | At risk | unknown for exact assessed head; older CI receipts are not promoted to current evidence | Brand Solid package has coverage; broader portal, web-component, and Lighthouse gaps remain open | Brand packages are 1.0.0-next.1; six product source catalogs at 1.1.0-next.0 remain unpublished and unadmitted | 9 |
| rootBun/TS zero-dependency CLI · markdown specs | At risk | green (exact-head Root CI run 29741431633: 27 tests, 103 assertions, CLI bundle, lifecycle dry-runs, numbered-spec contract, and port-registry gate) | not applicable | source-controlled workspace CLI; no artifact publication performed | 4 |
| researchBun · Astro 7 · SolidJS · Tailwind 4 (Vite) | On track | green (exact-head Research CI run 29740877330 for canonical Site-link adoption) | versioned ingestion, package verification, browser/axe, and visual evidence; no synthetic aggregate percentage claimed | research-ui source is ahead of the published and Brand-admitted artifact; no package publication performed | 0 |
The ledger stays read-only. Human-gated release, infrastructure apply, and production traffic decisions remain named and visible in the risk ledger.
Current registry evidence was observed . Review automated and inferred receipts before advancing dependent work.