root

Repository dossier

Workspace meta-repo — specs, ports, the global CLI

At risk

Branch: master
Commit: db9b7fe3a666780e057f7e2498acccdc6b070199
Worktree: Clean
SDK: workspace CLI contract

stack

Bun/TS zero-dependency CLI · markdown specs

green (exact-head Root CI run 29741431633: 27 tests, 103 assertions, CLI bundle, lifecycle dry-runs, numbered-spec contract, and port-registry gate)

deploy

not applicable

coverage

not applicable

What it is. The workspace meta-repo: the master spec and its siblings (orchestration, run-CLI conventions, repo topology, port registry), the golden discovery doc, RELEASE-NOTES.md, ports.json (single source of truth for the 41xxx block), and the global frauthy dev CLI that drives every repo.

What’s proven. The CLI core is solid — doctor, status, ports (list/check/write-env), install, regen-runners, per-repo delegation, and a parallel engine with multiplexed prefixed logs. The port registry migration landed across all repos and was live-verified.

Where it falls short. The headline DX features of spec 05 are unbuilt: no frauthy tui live dashboard (explicitly modeled on ~/Code/cuitty/cui), no up/down/logs presets, no check preset, no ports --claim. The docs still say “eight repos” in five places while the workspace holds eleven. Root itself has zero CI — nothing lints the port registry or the spec index. A stray portal/ directory sits unregistered at the workspace top level.

The plan. root/specs/GAP-CLOSURE-2026-07-12.md (ROOT-1 … ROOT-13): the tui (View-abstraction port of cui’s interaction grammar to zero-dependency Bun/TS), the presets, the doc-drift sweep, root CI, and the program-level definition of the FRAUTHY-DOGFOOD-CUITTY initiative with its BetterAuth-adapter prerequisite in protocol.

full spec: root/specs/GAP-CLOSURE-2026-07-12.md

Gap ledger

4 open · 9 closed

Severity

Include closed gaps

13 results

13 gap records
Evidence ID	Gap	Severity	Effort	Status
`ROOT-1`	`frauthy tui` live dashboard unbuilt (spec 05 B.4 headline; cui-modeled)	High	`L`	Open
`ROOT-2`	up/down/logs presets unbuilt	High	`M`	Closed in v28
`ROOT-3`	'8 repos' doc drift across README/CLAUDE.md/specs 01+03	Medium	`S`	Closed in v27
`ROOT-4`	Root has zero CI	High	`M`	Closed in v27
`ROOT-5`	Spec numbering gap (no 04-*) undocumented	Medium	`S`	Closed in v27
`ROOT-6`	ports --claim unimplemented; --migrate not documented as done	High	`S`	Closed in v27
`ROOT-7`	--format table\|json alias missing	Medium	`S`	Closed in v27
`ROOT-8`	Stray ~/Code/frauthy/portal dir unregistered — register-or-remove decisionHuman gate	Medium	`S`	Open
`ROOT-9`	RELEASE-NOTES.md stale (missing 2026-07 milestones)	Medium	`S`	Closed in v27
`ROOT-10`	`frauthy check` pre-push preset missing	High	`S`	Closed in v27
`ROOT-11`	Register the research status site (port 41026) in ports.json + ORDER	High	`S`	Closed in v2
`ROOT-12`	Cuitty integration documentation (Registry, OTLP, Safe wiring options)	Medium	`M`	Open
`ROOT-13`	FRAUTHY-DOGFOOD-CUITTY initiative definition at program level	Medium	`M`	Open

Change history

v37 · 2026-07-28
canonical Dagger remote-delivery foundation
Root, Protocol, Research, Market, Sandbox, Cloud, Admin, SDK, Site, and Infrastructure produced green hosted evidence during this migration. Brand's replacement canonical-action run remained non-terminal when polling stopped; no success is claimed for it.
This burst performed no Cloudflare, Neon, DNS, Terraform apply, package publication, GitHub environment mutation, or 1Password write. Site and Infrastructure production changes remain review- and evidence-gated.
v36 · 2026-07-20
Authenticated Admin and evidence-bound CI mesh
Every sibling caller is pinned to reviewed DevOps dispatch workflow commit `d39572723b2815bd1175546210325959883c3200`, waits for its real terminal CI DAG, and removes the legacy inline `FRAUTHY_CI_TOKEN` / `peter-evans` sender.
No secret was created, copied, printed, or persisted. No Cloudflare or Neon account was assumed to exist; no Terraform apply, DNS change, deployment, image publication, or SDK/UI package publication occurred.
All implementation used isolated worktrees. Active UI and product checkouts, including untracked Project Management UI work, were preserved.
v35 · 2026-07-20
Terraform-owned topology and Dagger master delivery
Root now defines the canonical `frauthy.com` public origin, intentional service subdomains, Terraform ownership boundary, hermetic Dagger registry location, `master` trunk semantics, deployment states, human bootstrap gates, and rollback/admission invariants.
`frauthy.dev` was an earlier placeholder origin, not an approved production domain. Current delivery contracts reject it for the public Site; intentional service endpoints remain beneath `frauthy.com`.
No Cloudflare or Neon account was assumed to exist. No Terraform apply, DNS mutation, Pages deployment, database creation, secret write, container publication, or SDK/UI package publication occurred.
Active product and UI worktrees were preserved. This program used isolated worktrees and exact-master ancestry checks so concurrent work was not overwritten.
v34 · 2026-07-19
Infrastructure-owned Site Pages contract
No live Cloudflare API mutation, Terraform apply, Pages deployment, GitHub secret write, DNS change, or cache pruning occurred in this version.
v33 · 2026-07-19
Authenticated workspace installs and gated Site delivery
Root master 7818e29 makes `frauthy deps` inspect selected repo npm credentials, preserve explicit `NODE_AUTH_TOKEN`/`GITHUB_TOKEN`, derive one ephemeral fallback from the authenticated GitHub CLI, and fail before the first repo mutates when credentials are unavailable.
Sequential and parallel repo runners now own detached process groups. SIGINT/SIGTERM reaps the runner and descendant installers/watchers with a bounded forced fallback; regression evidence includes token non-disclosure, fail-before-runner, and a synthetic descendant-reaping test.
This hardening does not close a numbered Root gap; ROOT-1, ROOT-8, ROOT-12, and ROOT-13 remain open.
Active Root, Site, and Project Management UI checkouts were preserved. The untracked `research/packages/ui/ui` tree and all product UI SDK surfaces were untouched.
v32 · 2026-07-16
Site typed content architecture
No public UI SDK package changed or was published. The active Site, Brand, and Research UI checkouts were not modified; implementation and ledger ingestion used isolated latest-master worktrees.
v31 · 2026-07-16
Site production quality gates and interactive GP.Family lab
No package was published, no production deployment occurred, and no active Brand or Research UI checkout was modified. Work was performed in isolated latest-master worktrees to preserve concurrent frontend changes.
v30 · 2026-07-16
Portal quality program assessment
ROOT-1, ROOT-8, ROOT-12, and ROOT-13 remain open for the live TUI, portal-path decision, and Cuitty documentation/initiative.
Infrastructure remains opt-in in the development selector and stack lifecycle commands were not invoked during assessment.
v29 · 2026-07-15
CI mesh completion and Market container contract
This burst stayed outside the concurrent frontend program's ownership: no Brand, Site UI, Admin web, Cloud web, Market web, DevOps Portal, Research UI, or product `packages/ui` implementation was changed.
v28 · 2026-07-15
Root shared-stack lifecycle presets
Root master d9d22fc adds profile-aware `frauthy up` and idempotent `down`, registry-derived HTTP readiness probes, Compose-service aliases, color-prefixed or NDJSON `logs`, running-service discovery, and SIGINT/SIGTERM child reaping with forced fallback. The implementation maps the documented default UX to Infrastructure's authoritative SpiceDB profile and supports Keto, ClickHouse, and full profiles. Compose configuration was validated read-only; no active stack was started or stopped while the frontend session was running.
v27 · 2026-07-15
Root platform CLI and CI burst
Root master e1b90f9 adds atomic and dry-run-safe port claims, table/JSON output aliases, a doctor + ports + lint pre-push preset, six Bun regression tests, and the first root-only GitHub Actions gate. Repository topology, release notes, clone instructions, and the reserved spec 04 slot are current. Concurrent frontend-owned paths and active UI branches were untouched.
v23 · 2026-07-15
Cloud runtime contract moved to Cloudflare
Runtime hosting decisions are now standardized on Cloudflare. Provider-specific deployment and persistence requirements should use Cloudflare primitives; prior Kubernetes/AWS/provider-selection placeholders are no longer authoritative.
v19 · 2026-07-14
Wave 14 Protocol platform and app initialization
Wave 14 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol CLI code, tests, documentation, its gap checklist, and this Research ledger event changed; no UI-owned surface, product packages/ui, Portal, registry publication, release tag, or concurrent UI branch was touched.
v18 · 2026-07-14
Wave 13 Protocol mapping completion
Wave 13 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol mapping/lifecycle code, tests, dependency metadata, its gap checklist, and this Research ledger event changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v17 · 2026-07-14
Frontend SDK federation prerelease gate
Frontend SDK Federation automated prerelease gate complete: seven Internal @frauthy/*-ui packages at 1.0.0-next.0, exact immutable tags and registry versions, seven verified Brand Portal libraries, 240 public components, and 634 catalog previews. Stable 1.0.0 promotion remains blocked only on the planned manual VoiceOver, NVDA, and TalkBack/touch-AT evidence.
v16 · 2026-07-14
Wave 12 Protocol LSP completion
Wave 12 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol LSP code/tests/documentation and the Research ledger changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v15 · 2026-07-14
Wave 11 Protocol async contracts
Wave 11 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol core/backend contracts, Protocol tests/documentation, and the Research ledger changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v14 · 2026-07-14
Wave 10 Protocol dev runner
Wave 10 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol CLI, Protocol documentation, and the Research ledger changed; no UI-owned, package publication, registry, or tag path was touched.
v13 · 2026-07-14
Wave 9 Protocol-SDK type contract
Wave 9 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol and core SDK are wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, product UI, registry publication, or tag path changed.
v12 · 2026-07-14
Wave 8 Protocol release readiness
Wave 8 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol is wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, or product UI path changed.
v11 · 2026-07-14
Wave 7 branch protection
Wave 7 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, packages/ui, frontend composition, DevOps Portal, Research UI, or Sandbox UI path changed.
v10 · 2026-07-14
Wave 6 Protocol and SDK coverage gates
Wave 6 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, packages/ui, frontend composition, DevOps Portal, Research UI, or Sandbox UI path changed.
GitHub Actions billing is restored; all Protocol, SDK, and DevOps master workflows in this wave received runners and completed successfully.
v9 · 2026-07-14
Wave 5 coverage producers verified
GitHub Packages authentication was verified through the local gh credential. Brand packages are available at 1.0.0-next.1 and all seven product UI packages at 1.0.0-next.0 with internal visibility.
Verification remained inside the ownership boundary in root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md; no Brand, packages/ui, web composition, Portal, Research UI, or Sandbox UI path changed.
v8 · 2026-07-14
Wave 5 Cloud and Market coverage producers
Local gates passed: Cloud 208 tests with 30 live-service tests gated, Market 176 tests with 29 live-service tests gated, and DevOps 132 tests; all three typechecks passed.
GitHub marked the DevOps, Cloud, and Market jobs failed without starting a runner because recent account payments failed or the spending limit must be increased. This is recorded as a human-gated infrastructure blocker, not as code verification.
Wave 5 remained inside the ownership boundary in root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md; no Brand, packages/ui, web composition, Portal, Research UI, or Sandbox UI path changed.
v7 · 2026-07-13
Wave 4 Rust telemetry and real CI enforcement
Wave 4 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, product packages/ui, web composition, DevOps Portal, Research UI, or Sandbox UI path was changed.
GitHub Packages publication and UI release coordination remain owned by the concurrent Frontend SDK Federation.
v6 · 2026-07-13
Wave 3 cross-backend verification and observability
Wave 3 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Brand, Site, product packages/ui, Cloud/Market web migration, Admin editor composition, DevOps Portal, Research UI, and Sandbox UI were intentionally untouched.
GitHub Packages publication remains blocked on a registry-compatible PAT in the concurrent federation session; no package publication is claimed here.
v5 · 2026-07-12
Wave 2 deconflicted backend and CI mesh
Wave 2 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Brand, Site, product packages/ui, Cloud/Market web migration, Admin editor composition, DevOps Portal, Research UI, and Sandbox UI were intentionally untouched.
GitHub Packages publication remains blocked on a registry-compatible PAT in the concurrent federation session; no package publication is claimed here.
v4 · 2026-07-12
Wave 1 remote CI gate
Remote gate complete: SDK CI, infrastructure CI/image build, sandbox tokenless integration, and the manually-dispatched SDK staleness workflow are green.
v3 · 2026-07-12
Wave 1 deconflicted backend lanes
Wave 1 was deconflicted from the concurrent Frontend SDK Federation. Brand, site, root, research UI, and all owned web/portal surfaces were intentionally untouched.
v2 · 2026-07-12
research registered in the workspace CLI
research added to the frauthy CLI ORDER (before devops, restoring the capstone-last rule) and to gen-runners; ports.json already carried research = 41026. ORDER previously listed brand after devops — fixed.
v1 · 2026-07-12
Baseline — workspace-wide gap audit
Seeded from the 2026-07-12 twelve-agent audit of all eleven repos plus the Cuitty capability catalog. Eleven gap-closure specs written; orchestration plan at root/specs/06-GAP-CLOSURE-ORCHESTRATION.md.