Independent release end-state audit — 2026-09-10

Reviewer: Codex /root/release_audit. Base HEAD 1797516f460ce27f7bc92e50ea2478ec51dd49b9; concurrent palette/integration work is excluded from acceptance. Read PROJECT_GOAL.md, the supplied request, AGENTS.md, Gitea issue #1/comments, Wiki Home and the empty open-PR inventory before auditing. Coordination is recorded in issue #1.

Verdict: first-release completion is not supported yet. Current source supplies substantial OA/SA semantics and shared source/GUI/REST infrastructure. The earlier missing communication means, selective views, coverage diagnostics, contextual assembly and operation identity are implemented; historical absence findings must not be repeated as current defects. A concrete trace-inspector defect remains below, and current native/platform/package acceptance is still incomplete.

This was read-only implementation/specification inspection. No Cargo, native automation, deployment or runtime test ran. Test names below identify evaluators that exist, not fresh passing results. Root owns current builds/runtime and the separate behavior audit owns process/scenario ergonomics.

Requirements matrix

User outcome	Current source evidence	Acceptance assessment
Rust/Iced desktop on Windows and Linux	Three Rust crates; desktop Cargo.toml selects Iced 0.14, WGPU, X11 and Wayland. README gives native build paths.	Implemented architecture; current Windows palette rebuild/native acceptance and current Linux runtime remain gates. An ELF cross-build is not a Linux GUI trial.
Useful OA and SA engineering semantics	model.rs has operational roles/activities/missions/processes, system boundary/functions/chains, typed data/interfaces/ports, states, scenarios, constraints and 25 relation kinds. validation.rs, ports.rs and data.rs enforce common rules.	No new fundamental absence established outside the separate behavior audit. Do not infer full Capella conformance. LA/PA and execution remain outside the user's current layer scope.
Equivalent persistent graphical/text models	Project, validated Command boundary, source_project updater and desktop Document couple accepted source to the same model. forms.rs exposes typed records; dedicated workflows handle richer constructs.	Strong implementation coverage; F1 exposes a broken typed-history inspector path. `every_demo_record_has_a_lossless_graphical_draft` checks existing demo values, not every exposed constructor/add operation.
Strict, unambiguous reST contract	docs/language.rst defines grammar, identity, invariants, lifecycle, migration and graphical obligations; docs/api.rst specifies REST.	Substantial contract; F2 catalog inconsistencies need correction. Source/header and package documentation should agree at final freeze.
Human/AI/Git-friendly source with highlighting and lint	Modular includes, nested declarations, stable aliases/UUIDs, source-preserving updates and exact source history; highlight.rs adapts core tokenizer; source_workspace/source_navigation retain and locate drafts.	Implemented, with source7 source/lifecycle tests. No new text-loss counterexample found in this bounded audit. LSP, completion and semantic Git merge were not explicit requirements.
Easy bidirectional OA/SA transition	transitions.rs maps dependencies/counterparts in either direction; semantic review supports scalar, constructor, keyed/ordered, attached and artifact decisions. Communication boundary ports and technical-operation omission are explicit.	Core/API paths and tests exist; actual complete engineering transition and revision/history workflows still require their remaining native cases. F2 help wording misstates Manual-trace behavior.
Trace arbitrary development artifacts	ArtifactLink stores owner/relation/URI/revision/fragment; shared identity/reference maintenance, forms and searchable traceability inventory; server artifact/trace queries plus ordinary transactions.	Required reference model is present. No artifact fetching, executable adapter or plugin ABI is necessary to establish this requirement. Native final-tree evidence must include save/reopen and a cross-tool REST edit.
Deployable service and clear REST for automation	routes.rs exposes project/model/source-bundle, lists/query/validation, commands, transitions and semantic review; store persists coupled representations with ETags. Dockerfile and systemd recipe exist.	Source7 HTTP test explicitly exercises instance/operation edits, parity and restart. Current Linux server suite and exact release build/deployment verification remain outstanding; recipes do not prove deployed execution.
Intuitive nested diagrams and consistent editing	Distinct semantic ownership, allocation and placement; independent saved views, ports/routes, filters and duplication; current compact palette under repair.	Cannot accept from source. Root's native authoring evidence and separate behavior audit must cover selection, draft/cancel/history and wide/minimum size.
Built-in concise navigable guide	guide.rs has searchable topics, related links, destination links and worked source7/transition/evidence material; bundled teaching source exists.	Implemented; guide still contains older control wording. Remaining complete teaching workflow and current control-label/native checks must close.

Material findings

F1 — P2: the trace-history inspector offers an Add action that cannot create a valid fact

The generic trace inspector recursively displays baseline.semantic.facets. Its array control always offers + Add (crates/oa-desktop/src/forms.rs:1916–1930). Message::FieldArray forwards directly to Draft::array (app.rs:1720). edit_array has special constructors for bindings, values, routes, waypoints and port anchors, but none for facets: its fallback appends the nil UUID string (forms.rs:622–650). SemanticBaseline.facets instead requires Vec<FacetReview> (crates/oa-core/src/semantic/types.rs:258), a closed typed enum. Draft::command deserializes the trace as-is (forms.rs:600). The generated draft therefore cannot become a valid EditTrace.

Small reproduction for root's serialized test gate: select a trace with baseline.semantic = Some(SemanticBaseline::default()), call Draft::from_project, then array("/baseline/semantic/facets", None, 0) and command(). The Add produces a UUID rather than a facet; command must reject. Removing the bad row or reverting recovers the draft, so this is not an established stored-data corruption finding.

The specialized semantic-review workflow can create reviewed current observations and reset exact history; that does not make this separate advertised Add control valid. Optional semantic history is also omitted when absent, so the ordinary inspector cannot initialize it through that path. The normative obligation explicitly includes typed trace baselines (docs/language.rst:1959–1963).

Next action: choose one coherent history-editing surface. Replace the generic invalid constructors with an intentional typed workflow, or route the inspector to the existing review/reset tools while defining which history operations they support. Verify all displayed history controls against absent, empty and nonempty histories, including historical references whose live objects were deleted. Do not claim that a generic recursive form proves full constructor parity.

F2 — P2: the normative catalogs and guide give inconsistent transition information

docs/language.rst:1192–1193 lists Exchange traces only as Interaction → FunctionalExchange, although its communication section (:341) and transitions.rs::exchange_counterparts admit CommunicationMean → BoundaryExchange. The reference table should describe both admitted pairs.
The same document's element catalog (:94–145) omits ExchangeCategory, and the relation catalog (:232–303) omits ContextualLink. Both have detailed definitions later, so their semantics are implemented/documented rather than absent; the purported catalogs are incomplete entry points for an independent implementation.
guide.rs:658 says a Manual trace records correspondence “without propagating properties.” Existing-counterpart transition logic finds any endpoint-matching trace and applies reviewed name/description changes without a Manual-kind exemption (transitions.rs:1055–1153). Explicit Capability ↔ Mission Manual mappings are deliberately supported (language.rst:1218). Clarify that ordinary edits never synchronize automatically, while an explicit supported review can propagate selected properties; do not imply Manual is a no-update policy.
docs/scope.md:16 still labels the implemented source profile arcadia 6; core/schema and the normative contract are version 7. README also retains older review labels and pending claims that newer scoped STATE evidence supersedes. Existing guide Activity/Function steps (guide.rs:265) describe the older Create-toolbar workflow while palette work is actively changing that surface.

Next action: synchronize the tables, scope and task instructions against the accepted controls; regenerate the checked-in HTML from corrected reST and rerun the existing strict documentation/OpenAPI checks. Do not change transition semantics merely to match stale wording.

F3 — P1 release gate: current platform, deployment and full-workflow evidence is incomplete

harness/STATE.md explicitly records a frozen Linux GUI cross-build with no actual Linux GUI runtime (:57), an earlier Linux server HTTP 50/51 result with a subsequently corrected evaluator (:44), and pending native purpose/teaching/hosted/compact cases. The Windows development preview (:46) predates current palette changes and is not the optimized final release. README correctly calls final suites, optimized/MSRV builds and current packages outstanding (:156). Root's new checks may supersede particular rows after this audit.

This is missing release evidence, not proof that Linux, REST or the implemented workflows are broken. It still prevents meeting the user's explicit build/launch, real-workflow, current-platform and final-review criteria. The Docker builder pins Rust 1.90 while normal rust-toolchain.toml selects stable; final compatibility must be checked against the actual locked tree and intended package, rather than inferred from a different frozen snapshot.

Next action: finish the current Windows authoring slice, then freeze one candidate revision for appropriate complete tests, strict checks, optimized desktop/server builds, current Linux runtime and representative cross-representation/REST restart cases. Assemble packages from that accepted tree and verify examples, reST/HTML/OpenAPI, notices, runtime dependencies, clean launch and checksums. Respect prior runtime/approval boundaries; a stopped guest or denied workaround is not successful acceptance.

Highest-value completion sequence

Reproduce and correct F1; retain focused failure/repair evidence. Finish root's current palette compile/native gate and address the separate behavior audit's verified findings.
Close the already documented complete teaching story: OA responsibility/communication → reviewed SA contribution and interfaces → behavior/degraded state → artifact evidence → source edit → conditional REST edit/reload and stale-write rejection → save/reopen/history. Use exact whole-model and authored-source comparisons, not screen appearance alone.
Correct F2 and prune misleading current-status wording without deleting historical evidence. Keep the normative contract explicit about intentional asymmetry: semantic ownership versus allocation, OA abstraction versus SA technical ports, and reviewed counterpart differences.
Complete F3 on a frozen candidate and obtain fresh independent runtime/UX plus final requirements review. No additional broad metamodel subsystem is justified by this audit alone.

At the end of the initial audit, only this report had been written. The subsequently authorized F1 implementation is recorded below; no fresh runtime/test pass is claimed here.

Bounded F1 remediation recommendation

Root requested a decision on generated review history versus arbitrary facet constructors after receiving this audit.

Use the existing semantic-review/history surface, with a distinct typed stored-observation editor. Removing generic Add and routing to inspection/reset safely removes the immediate trap, but inspection/reset alone does not discharge the current parity contract. Section 5.1 deliberately admits historical observations independently of current object applicability, including references whose live objects are gone; section 8 explicitly requires graphical editing of trace baselines. A workflow that can only acknowledge current live facts cannot express every admitted source-authored historical value. Changing the spec to declare those properties uneditable would narrow the requested equivalence.

The bounded implementation need not build another reconciliation engine:

Choose a closed facet selector and its exact typed row keys, using the existing shared catalog. Never append an arbitrary default FacetReview.
Edit canonical OA and SA Observed branches with their selector-specific types. NotApplicable, Value(none), and absence of the facet remain distinct. Current observations can be presented as a deliberate starting choice, not silently acknowledged on Add.
Keep stored-observation editing separate from Keep/Take/live candidate edits. It changes the trace history only and must say so. Existing inspect/reset remains the ordinary workflow.
Historical UUID input must retain deleted identities and allow syntactically valid exact keys; live-object-only pickers are insufficient. Use the existing historical validator, not live-reference applicability, for historical admission.
Stage a complete typed candidate; validate and apply one EditTrace through the existing Document/source/history boundary. An incomplete selector, key or observation keeps Apply disabled or fails with a located editable draft. Source writeback and Undo/Redo remain shared.

Acceptance should cover absent history, an empty facet list, one scalar, one optional value, NotApplicable, a keyed attachment/artifact observation with deleted UUIDs, changing an observation's constructor, duplicate/overlapping-invalid history, and exact source/JSON Save/Undo/Redo. Prove the original nil-UUID Add cannot occur. This is a finite history-authoring slice over existing types, not a new metamodel or automatic synchronization feature.

F1 implementation candidate — Codex-956atf /root/release_audit

Root authorized the bounded implementation in crates/oa-desktop/src/forms.rs, forms/history_fields.rs, and forms/history_fields/tests.rs. No core API or app handler was changed. The trace inspector replaces its recursive baseline form with a collapsed Edit stored history (advanced) surface. It initializes absent prose/semantic baselines, chooses a facet family and leaf explicitly, edits keyed selectors and both typed observations, and removes/reorders rows. Optional values, NotApplicable, booleans, integers/reals, enum and compound constructors, exact strings and historical UUIDs are separate controls. Current counterpart observations are an explicit opt-in action using capture_facet; the editor changes no counterpart.

Design decision: reuse the existing checked-in OpenAPI TraceBaseline/FacetReview descriptor as finite historical field-shape metadata, cached once. This already documents the admitted serialized constructors, so using it here avoids a second manually maintained semantic catalog or new core metadata API. This is not an all-product REST-schema form generator. The supported local refs, oneOf/anyOf, fixed objects, arrays and primitive shapes are bounded by depth 32; list rendering pages 12 rows. Unsupported metadata produces a visible unavailable-field message. The real Rust types and validate_semantic_baseline remain authoritative for admission; the descriptor supplies no replacement validator.

Deliberate draft behavior: a newly chosen facet has both observations NotApplicable and cannot be committed until the engineer supplies an admitted observation. New UUID slots are empty, never a made-up nil identity. Historical typed Add replaces the generic UUID-array fallback. Scoped shape/list events preserve unrelated incomplete inputs. Constructor caches follow row movement/removal and recovery; exact-string mode also converts inactive textual buffers transactionally. Replacing or clearing a whole history subtree discards its inactive constructor buffers so later new facts cannot revive old data. Ordinary Apply remains the existing EditTrace/Document/source transaction.

Ten targeted tests are present. They cover absent/empty/existing history; descriptor-derived complete witnesses for every offered scalar/keyed fact against actual FacetReview deserialization and historical validation; rejected NA/NA and duplicates with unchanged Document snapshots; deleted UUID keys/observations; numeric limits and invalid raw repair; compound values and constructor switching; TypeRef's nested primitive picker; exact Unicode/quoted strings and literal keys; cache relocation/recovery; clear/recreate isolation; source/JSON round-trip and exact one-step Undo/Redo including retained source comments.

Verification status: git diff --check passes for the candidate (an unrelated generated HTML line-ending warning is present). No Cargo, rustfmt, native GUI or integration suite was run by this worker; root owns the serialized build/toolchain lease. F1 is therefore a ready source candidate, not an accepted fix yet. Root should run targeted history tests, the relevant desktop suite and strict lint, then exercise expanded history controls at normal/minimum width, typed Add/repair, paging, apply/reopen and Undo in the actual desktop. F2 and shared decision/wiki synthesis remain root-owned. F3 remains open.

Independent-review follow-up: behavior_audit found a real defect in snapshot 01bb52a: the reused constructor-cache key mapped null, numbers, booleans and arrays to the same empty tag, also colliding with empty UUID input. The nested optional picker consequently restored the old branch immediately instead of switching; earlier tests that injected complete Observed values skipped that event. The bounded follow-up adds history-only typed constructor identities (including distinct enum and tagged-object variants) while retaining other property-editor behavior. Two additional tests derive the visible nested picker choices and dispatch their actual FieldShape events: absent/present integer with invalid raw recovery and exact Value(None); empty UUID/absence with deleted identity; optional list/absence with nested Integer/String constructor retention and recovery. The resulting accepted models still receive exact Document/source/Undo checks. Twelve history tests are now present. Whitespace check passes; compilation, execution and native acceptance remain pending with root.

19 KiB Raw Blame History Unescape Escape