market

Repository dossier

The marketplace — listings, tiers, domain registration

At risk

Branch: master
Commit: 5c02958d9e8f7dfde04e4145b7722792f7602cad
Worktree: Clean
SDK: @frauthy/market-ui 1.1.0-next.0 source; 1.0.0-next.0 published and Brand-admitted

stack

Bun · Hono · Astro + Solid web

green (exact-head Market CI run 29755782538: backend, UI/web, container health, coverage, and reusable dispatch caller)

deploy

Marketplace links use the canonical Site origin while image publication and runtime rollout remain gated; no image or provider resource was published

coverage

63.19% remote measurement; 61.19% upward-only floor; 80% target

What it is. The marketplace — publish and discover modules, schemas, and identity domains, with the four visibility tiers (public · private · permissioned · unlisted) each resolving the same listing#discover permission through Frauthy’s own ReBAC graph, plus the domain-registration UX.

What’s proven. The tier model is real: full Zanzibar semantics in the MemStore (direct, wildcard, arrow), a genuine SpiceDB HTTP adapter, and every listing route gated by actual check()/lookupResources() calls. The registrar’s verify state machine and ~2,900 lines of tests hold up.

Where it falls short. The front door is open: authentication is a trusted X-User-Id header — no OIDC, no sessions, nothing. The default context is in-memory (the finished PgRepo is only exercised by a live test), domain verification is a StubVerifier that always answers yes, module “distribution” returns a hardcoded S3 URL string with no storage behind it, the web UI renders hardcoded sample data, and the service emits zero traces.

The plan. market/specs/GAP-CLOSURE-2026-07-12.md (MKT-1 … MKT-11): authentication first — and it’s the flagship internal dogfood, frauthy.session(req) via @frauthy/sdk-ts protecting Frauthy’s own marketplace — then Postgres wiring, real verifiers (well-known / DNS TXT / connect-OIDC), artifact storage with a local-filesystem dev driver, OTLP, and the live-API web UI.

full spec: market/specs/GAP-CLOSURE-2026-07-12.md · port :41016

Gap ledger

0 open · 11 closed

Severity

Include closed gaps

11 results

11 gap records
Evidence ID	Gap	Severity	Effort	Status
`MKT-1`	No real authentication — X-User-Id header only, every route open	Critical	`L`	Closed in v25
`MKT-2`	In-memory default persistence; PgRepo implemented but never wired	Critical	`M`	Closed in v25
`MKT-3`	No artifact storage — hardcoded S3 URL template, no multipart upload	Critical	`L`	Closed in v24
`MKT-4`	No real domain verification (StubVerifier only; no well-known/DNS/OIDC)	High	`M`	Closed in v3
`MKT-5`	No deploy pipeline / DockerfileHuman gate	High	`M`	Closed in v29
`MKT-6`	Zero OTLP instrumentation	High	`S`	Closed in v24
`MKT-7`	No coverage enforcement (spec requires 80%)	High	`S`	Closed in v9
`MKT-8`	Missing routes: /me/adoptions, /me/keys CRUD, org member POST/DELETE	High	`S`	Closed in v3
`MKT-9`	Web UI imports hardcoded sample data instead of the live API	Medium	`S`	Closed in v30
`MKT-10`	CloudClient exists but is wired into nothing	Medium	`S`	Closed in v24
`MKT-11`	Drizzle (spec) vs raw postgres.js (impl) divergence	Medium	`S`	Closed in v24

Change history

v37 · 2026-07-28
canonical Dagger remote-delivery foundation
Root, Protocol, Research, Market, Sandbox, Cloud, Admin, SDK, Site, and Infrastructure produced green hosted evidence during this migration. Brand's replacement canonical-action run remained non-terminal when polling stopped; no success is claimed for it.
This burst performed no Cloudflare, Neon, DNS, Terraform apply, package publication, GitHub environment mutation, or 1Password write. Site and Infrastructure production changes remain review- and evidence-gated.
v36 · 2026-07-20
Authenticated Admin and evidence-bound CI mesh
Every sibling caller is pinned to reviewed DevOps dispatch workflow commit `d39572723b2815bd1175546210325959883c3200`, waits for its real terminal CI DAG, and removes the legacy inline `FRAUTHY_CI_TOKEN` / `peter-evans` sender.
No secret was created, copied, printed, or persisted. No Cloudflare or Neon account was assumed to exist; no Terraform apply, DNS change, deployment, image publication, or SDK/UI package publication occurred.
All implementation used isolated worktrees. Active UI and product checkouts, including untracked Project Management UI work, were preserved.
v35 · 2026-07-20
Terraform-owned topology and Dagger master delivery
No Cloudflare or Neon account was assumed to exist. No Terraform apply, DNS mutation, Pages deployment, database creation, secret write, container publication, or SDK/UI package publication occurred.
Active product and UI worktrees were preserved. This program used isolated worktrees and exact-master ancestry checks so concurrent work was not overwritten.
v34 · 2026-07-19
Infrastructure-owned Site Pages contract
No live Cloudflare API mutation, Terraform apply, Pages deployment, GitHub secret write, DNS change, or cache pruning occurred in this version.
v33 · 2026-07-19
Authenticated workspace installs and gated Site delivery
Active Root, Site, and Project Management UI checkouts were preserved. The untracked `research/packages/ui/ui` tree and all product UI SDK surfaces were untouched.
v32 · 2026-07-16
Site typed content architecture
No public UI SDK package changed or was published. The active Site, Brand, and Research UI checkouts were not modified; implementation and ledger ingestion used isolated latest-master worktrees.
v31 · 2026-07-16
Site production quality gates and interactive GP.Family lab
No package was published, no production deployment occurred, and no active Brand or Research UI checkout was modified. Work was performed in isolated latest-master worktrees to preserve concurrent frontend changes.
v30 · 2026-07-16
Portal quality program assessment
The trust registry reads the live marketplace API; synthetic catalog data is isolated and labeled as fixture evidence.
v29 · 2026-07-15
CI mesh completion and Market container contract
Market master 3e65b31 adds a pinned non-root Bun image around a compiled Linux-musl executable with embedded Postgres and SpiceDB schemas, a credential-free Docker context, `/health` probe, SBOM/provenance publication, and reusable GitHub Actions cache.
The deploy workflow publishes `ghcr.io/frauthy/market:<immutable-tag>` only when manually dispatched. It contains no Cloudflare, Wrangler, or Terraform apply and this burst created no runtime resources.
Local Docker verification was blocked by the host's critically low free space and a BuildKit metadata I/O error; no shared Docker data was pruned or restarted. The compiled executable passed a local loopback health probe, while hosted Actions supplied the authoritative clean image-build and container-health evidence.
This burst stayed outside the concurrent frontend program's ownership: no Brand, Site UI, Admin web, Cloud web, Market web, DevOps Portal, Research UI, or product `packages/ui` implementation was changed.
v25 · 2026-07-15
data-plane, authentication, and persistence burst
Production authentication now fails closed without a configured OIDC issuer and validates signed RS256 JWTs through discovery/JWKS and the Frauthy TypeScript SDK; valid, tampered, and expired paths have loopback issuer evidence. Every route and domain service now uses one awaitable repository contract, while PostgreSQL runs an idempotent compatibility migration and persists opaque application IDs across process reconstruction. Concurrently owned web paths were untouched.
v24 · 2026-07-15
deconflicted backend gap burst
Filesystem and S3/R2 artifact storage, multipart upload integrity, child spans, optional Cloud usage events, and the postgres.js migration contract are complete. Production Postgres wiring and live signed-JWT proof remain open; concurrently owned web paths were untouched.
v23 · 2026-07-15
Cloud runtime contract moved to Cloudflare
Runtime hosting decisions are now standardized on Cloudflare. Provider-specific deployment and persistence requirements should use Cloudflare primitives; prior Kubernetes/AWS/provider-selection placeholders are no longer authoritative.
v19 · 2026-07-14
Wave 14 Protocol platform and app initialization
Wave 14 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol CLI code, tests, documentation, its gap checklist, and this Research ledger event changed; no UI-owned surface, product packages/ui, Portal, registry publication, release tag, or concurrent UI branch was touched.
v18 · 2026-07-14
Wave 13 Protocol mapping completion
Wave 13 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol mapping/lifecycle code, tests, dependency metadata, its gap checklist, and this Research ledger event changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v17 · 2026-07-14
Frontend SDK federation prerelease gate
Product UI PR 1 was reconciled with the concurrent backend lane, revalidated, and merged as 1bd4846. The published @frauthy/market-ui@1.0.0-next.0 tag tree is byte-identical to merged master under packages/ui.
Frontend SDK Federation automated prerelease gate complete: seven Internal @frauthy/*-ui packages at 1.0.0-next.0, exact immutable tags and registry versions, seven verified Brand Portal libraries, 240 public components, and 634 catalog previews. Stable 1.0.0 promotion remains blocked only on the planned manual VoiceOver, NVDA, and TalkBack/touch-AT evidence.
v16 · 2026-07-14
Wave 12 Protocol LSP completion
Wave 12 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol LSP code/tests/documentation and the Research ledger changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v15 · 2026-07-14
Wave 11 Protocol async contracts
Wave 11 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol core/backend contracts, Protocol tests/documentation, and the Research ledger changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v14 · 2026-07-14
Wave 10 Protocol dev runner
Wave 10 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol CLI, Protocol documentation, and the Research ledger changed; no UI-owned, package publication, registry, or tag path was touched.
v13 · 2026-07-14
Wave 9 Protocol-SDK type contract
Wave 9 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol and core SDK are wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, product UI, registry publication, or tag path changed.
v12 · 2026-07-14
Wave 8 Protocol release readiness
Wave 8 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol is wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, or product UI path changed.
v11 · 2026-07-14
Wave 7 branch protection
Wave 7 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, packages/ui, frontend composition, DevOps Portal, Research UI, or Sandbox UI path changed.
v10 · 2026-07-14
Wave 6 Protocol and SDK coverage gates
Wave 6 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, packages/ui, frontend composition, DevOps Portal, Research UI, or Sandbox UI path changed.
GitHub Actions billing is restored; all Protocol, SDK, and DevOps master workflows in this wave received runners and completed successfully.
v9 · 2026-07-14
Wave 5 coverage producers verified
Actions run 29337452473 passed with 1,888 of 2,988 instrumented lines covered. The retained gate artifact records the floor, target, measurement, and passing decision.
GitHub Packages authentication was verified through the local gh credential. Brand packages are available at 1.0.0-next.1 and all seven product UI packages at 1.0.0-next.0 with internal visibility.
Verification remained inside the ownership boundary in root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md; no Brand, packages/ui, web composition, Portal, Research UI, or Sandbox UI path changed.
v8 · 2026-07-14
Wave 5 Cloud and Market coverage producers
Master now emits coverage/lcov.info, uploads coverage-market, and requires the shared DevOps ratchet. MKT-7 remains open until the mandatory remote job can execute successfully.
Local gates passed: Cloud 208 tests with 30 live-service tests gated, Market 176 tests with 29 live-service tests gated, and DevOps 132 tests; all three typechecks passed.
GitHub marked the DevOps, Cloud, and Market jobs failed without starting a runner because recent account payments failed or the spending limit must be increased. This is recorded as a human-gated infrastructure blocker, not as code verification.
Wave 5 remained inside the ownership boundary in root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md; no Brand, packages/ui, web composition, Portal, Research UI, or Sandbox UI path changed.
v7 · 2026-07-13
Wave 4 Rust telemetry and real CI enforcement
Wave 4 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, product packages/ui, web composition, DevOps Portal, Research UI, or Sandbox UI path was changed.
GitHub Packages publication and UI release coordination remain owned by the concurrent Frontend SDK Federation.
v6 · 2026-07-13
Wave 3 cross-backend verification and observability
Wave 3 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Brand, Site, product packages/ui, Cloud/Market web migration, Admin editor composition, DevOps Portal, Research UI, and Sandbox UI were intentionally untouched.
GitHub Packages publication remains blocked on a registry-compatible PAT in the concurrent federation session; no package publication is claimed here.
v5 · 2026-07-12
Wave 2 deconflicted backend and CI mesh
Market's single-repository CI no longer depends on a sibling checkout. Web migration remains owned by the concurrent Frontend SDK Federation.
Wave 2 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Brand, Site, product packages/ui, Cloud/Market web migration, Admin editor composition, DevOps Portal, Research UI, and Sandbox UI were intentionally untouched.
GitHub Packages publication remains blocked on a registry-compatible PAT in the concurrent federation session; no package publication is claimed here.
v4 · 2026-07-12
Wave 1 remote CI gate
Remote gate complete: SDK CI, infrastructure CI/image build, sandbox tokenless integration, and the manually-dispatched SDK staleness workflow are green.
v3 · 2026-07-12
Wave 1 deconflicted backend lanes
Domain verification now supports well-known, DNS TXT, and connected OIDC proofs; the missing adoption, API-key, and organization-member routes are implemented across memory and Postgres repositories.
Frauthy-backed OIDC authentication, Postgres/ReBAC runtime selection, and OTLP tracing landed but retain open live-integration acceptance items.
Wave 1 was deconflicted from the concurrent Frontend SDK Federation. Brand, site, root, research UI, and all owned web/portal surfaces were intentionally untouched.
v1 · 2026-07-12
Baseline — workspace-wide gap audit
Seeded from the 2026-07-12 twelve-agent audit of all eleven repos plus the Cuitty capability catalog. Eleven gap-closure specs written; orchestration plan at root/specs/06-GAP-CLOSURE-ORCHESTRATION.md.