# Oshun V1 — Independent Adversarial Re-Verification (2026-05-30, later session) **Supersedes the optimistic verdict of** `V1_PRODUCTION_READINESS_GAP_ANALYSIS_2026-05-30.md`. That document concluded "every in-repo algorithmic, security, protocol, pixel-pipeline, and integration gap … is built and tested" and that all P0/P1 work was effectively closed. This re-audit was run **independently** — six parallel adversarial agents read the actual source, traced import graphs to prove _wired vs. unwired_, and ran the mandated stub-scan — and it **confirms most of that, but not all of it.** The prior audit re-checked its own 2026-05-28 P0/P1 list; it did **not** walk large parts of `V1/features.md`. Both classes of finding are below, each backed by `file:line` evidence. **Method.** Six concurrent agents: (1) repo-wide stub-scan; (2) the three safety/compliance cascades; (3) Isis/Agentic-Studio/messaging; (4) LTI-SCORM/admin-durability/idempotency; (5) Living-Scenes pixel pipeline; (6) a coverage hunt over the `features.md` sections the prior audit never cited. --- ## 1. Executive verdict (corrected) **The engines are overwhelmingly real and the marquee safety cascades are genuinely wired — but the prior audit over-stated completion in three places, and never audited a large band of customer-facing surfaces.** - ✅ **Independently re-confirmed real-and-wired:** Veritas retraction cascade, DSAR erasure, crisis-frame cascade (all three traced to real Prisma + Redis at the leaf, fail-closed when infra env is absent); Isis generation gate (no bypass path); messaging provider transports (real POSTs, honest `missing-config`); LTI 1.3 + SCORM 1.2/2004 tenant route; admin-state durability; Redis idempotency; the entire Living-Scenes render → watermark → PSE-gate → C2PA-Ed25519 → durable-share pipeline; and the Isis engine fleet (3D, LoRA/tuning, voice-cloning, Civitai, ComfyUI/RunPod, output-gallery) plus tenant SSO/SCIM, notifications, help-center, status-page. - ⚠️ **Prior audit was WRONG / over-stated (corrected here):** 1. **Agentic-Studio orchestrator is an island.** The prior audit said "Agentic-Studio executor ✅ — `runGuardedToolPlan` consumes the guarded dispatcher." It has **zero callers** outside its own module (`libs/oshun/agentic-studio/src/runs/orchestrator.ts:53`); no BFF route or worker runs a tool plan through it. Kill-switches/budgets are **not enforced at runtime** for agent execution. (NOT fixed this session — see §5.) 2. **Living-Scenes takedown cascade was unwired.** The executor was real but had no production caller and no `TakedownArtifactMutator`. **FIXED this session** (§4). 3. **Reminder worker / in-app delivery is unstarted.** `runReminderCycle`, `runReminderWorkerTick`, `deliverWithEnvProviders`, `deliverToInAppInbox` have **zero non-test callers**; nothing starts the worker, and the in-app inbox sink has only an in-memory implementation, disjoint from the customer-message-center store. - 🔴 **Never audited by the prior doc (the real remaining product surface):** ~235 placeholder `studio/isis/*` web pages, the curated creator-generation cards (no route/provider), Discord/Slack stub adapters, a dead spec-grade recommender island, a dead Metis institutional-standards (OneRoster) island, the music-generation operator surface, and per-process (non-durable) rate limiting. **Bottom line:** V1 is **not** "logic-real, product-unwired" (the 2026-05-28 framing) — the hard algorithmic/safety/protocol work is genuinely done and the marquee cascades are proven end-to-end. But it is also **not** "every feature fully shipped": the gap is now concentrated in **customer-facing surfaces and a handful of unwired islands**, not engines. --- ## 2. Independently re-confirmed REAL-AND-WIRED (do not re-litigate) Each was traced to the leaf of its call stack by a dedicated agent. | Subsystem | Evidence (file:line) | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Veritas retraction cascade | route `veritas/retraction-cascade-runtime.ts:68`; boot `server.ts:159` (gated on db+redis); real Prisma upsert `contract-record-repository.ts:153` → table `schema.prisma:1208`; persistence-backed re-grounders `persistence-regrounders.ts:60/122` | | DSAR erasure | route `privacy/dsar-erasure-route.ts:35`; boot `server.ts:177`; real `deleteMany` `contract-record-repository.ts:225`; grace-window 409 `dsar-erasure-runtime.ts:72-81` | | Crisis-frame cascade | route `safety/crisis-frame-runtime.ts:81`; boot `server.ts:209`; non-overridable `haltSynthesis`/`suspendMemoryWrites` `crisis-frame-cascade.ts:97-98`; 5 surfaces `:23`; persistence-backed projectors | | Isis generation gate | route `isis/generation-route.ts:38` → `dispatchGuardedGeneration`; fail-closed `dispatch-guard.ts:57-85`; **no bypass** (admin-isis routes are CRUD only; living-scenes uses in-repo compositor) | | Messaging transports | real provider POSTs `transports.ts:76/112/142/178` (SendGrid/Twilio/FCM/Meta); honest `missing-config` before transport call `delivery.ts:82/95/110/124` | | LTI 1.3 + SCORM route | boot `server.ts:192-193`; real JWS verify `lti-verification.ts:168-173`; `alg:none`/HS256 hard-refused `:145-152`; SCORM 1.2 + 2004 RTEs real state machines | | Admin durability | boot `server.ts:102` `wireDurableAdminWorkspaceState`; write-through `state.ts:18953`; real Prisma `durable-snapshot-store.ts:98-109`; in-memory fallback gated `server.ts:91` (+ warns) | | Redis idempotency | boot `server.ts:84-89/131`; global pre-handler `app.ts:158`; atomic Lua reserve `redis-idempotency-store.ts:41-58`; in-memory fallback gated (+ warns) | | Living-Scenes pipeline | render `living-scene-render.ts:118`; PNG codec `png-codec.ts:86`; watermark `watermark-embed.ts:72`; PSE hard-gate `render-route.ts:66` (422); Ed25519 `ed25519-signer.ts:44`, prod fail-closed `living-scenes.ts:1061-1065`; durable shares `server.ts:124` | | Isis engine fleet | 3D `meshy-provider.ts:75`; LoRA `lora-training-surface/src/training-run.ts`; voice-cloning `voice-watermarking.ts`; Civitai `civitai-provider.ts:878`; RunPod `runpod-adapter.ts`; output-gallery lineage `output-gallery/src/lineage.ts` — all wired through **admin** app + `admin-isis-*` BFF routes | | Tenant identity | SAML2+OIDC `tenant-console/src/identity/sso.ts:25`; SCIM 2.0 `identity/scim.ts`; wired `tenant-admin/.../identity/page.tsx` | **Stub-scan result:** of ~6,900 grep hits, the BFF itself had **zero** catch-blocks returning fake success and **zero** `Math.random()` in deterministic computed-result positions. The confirmed stubs are in **unwired library exports** (§6), not the running V1 BFF / web / persona-voice paths. --- ## 3. Corrections to the prior audit (the false / over-stated "done"s) ### 3a. Agentic-Studio orchestrator — **STILL AN ISLAND** (prior audit said ✅) `runGuardedToolPlan` / `dispatchGuardedToolCall` (`libs/oshun/agentic-studio/src/runs/orchestrator.ts:53`, `dispatcher.ts:51`) are real, fail-closed, and tested — but a repo-wide grep returns **no callers** outside the module and its own tests. The whole `@oshun/agentic-studio` lib (6,504 lines: champion-challenger with a real two-proportion z-test, gold-sets, run executor/replay, budgets/kill-switch) has **zero `apps/` importers**. The BFF `admin-agentic-operations` route is snapshot/management only — it never runs a tool through the guarded dispatcher. **Consequence:** the Exit Criterion "Agentic AI Studio … budgets, kill switches … operational with governance gates enforced" is **not met at runtime.** This is a genuine build (a real agent tool catalog + run surface), not a one-line wire — deliberately **not** stubbed this session (a thin route over no-op tools would itself be a stub). ### 3b. Living-Scenes takedown cascade — was unwired, **FIXED** (§4) ### 3c. Reminder worker + in-app delivery — **UNSTARTED** The provider transports and `missing-config` gating are real; but `runReminderCycle`/`runReminderWorkerTick`/`startReminderWorker`/ `deliverWithEnvProviders`/`deliverToInAppInbox` have **zero non-test importers**. No cron/worker starts the cycle. The in-app inbox sink's only implementation is `InMemoryInAppInbox` (`in-app-delivery.ts:70-85`), and it is **disjoint** from the customer-message-center store. So the recent "always-available in-app delivery" commit is architecturally honest (it records to a sink rather than faking a provider send) but is **not reachable** — no runtime starts it and no durable sink is bound. --- ## 4. Fix landed this session (wired + verified) **Living-Scenes takedown cascade — wired end-to-end in the BFF** (commit `feat(shared): wire living-scenes takedown cascade end-to-end in the bff`). - New operator route `POST /v1/living-scenes/admin/artifacts/:artifactId/takedown` (`apps/oshun/bff/src/routes/living-scenes.ts`). Operator-scoped; computes the disposition impact via the 8 `apply*` functions, runs `executeTakedownCascade` across the kept artifact **and every public share link**, and persists through the durable snapshot store. - A real `TakedownArtifactMutator` over the share store: `invalidated` → `revokeLivingSceneShare`, `tombstoned` → `tombstoneShare`, `hard-deleted-tombstoned` → `deleteKeptLivingOffering` — reusing the runtime lib's tested transitions so `resolvePublicViewer` already refuses playback. A banner/playback overlay carries the states the share model doesn't express (`voice-muted-with-banner`, `quarantined-until-rerender`, banner copy), persisted in the share snapshot (capture/restore extended; codec unchanged). - The public viewer (`GET /v1/living-scenes/public/:shortCode`) now surfaces the takedown banner: a `banner-only` disposition stays playable **with** the banner; an `invalidated`/`tombstoned` one resolves to a tombstone with the reason. - Fail-closed: unknown/incomplete disposition → 400; non-operator → 403. - **2 end-to-end `app.inject` tests** (banner-only keeps playback + shows banner; originating-user-deletion tombstones artifact + shares) + the existing 16 living-scenes route tests + the durability codec tests all pass; BFF `tsc --noEmit` clean. **Also:** `fix(shared): repair always-404 achievements partnership-health route` — `/v1/achievements/partnerships/:id/health` looked the partnership up with `getPartnerships('').find(() => false)` (a predicate that can never match), so the endpoint **always 404'd**. Replaced with the engine's real `getPartnership(partnershipId)` (`achievement-engine.ts:91`). --- ## 5. Remaining work — honest ledger ### 5a. Unwired islands / surfaces (in-repo, real build, NOT one-line wires) Ranked by production impact: 1. **Agentic-Studio runtime surface** (governance Exit Criterion). The orchestrator + champion-challenger + gold-sets are real but unreachable. Needs a real agent tool catalog + a BFF/worker run surface that executes plans through `runGuardedToolPlan`. (§3a) 2. **~235 placeholder `studio/isis/*` customer web pages.** 235 of 469 `Studio*Workspace.tsx` render an unrelated `StudioHathorEconomyModelingLaneCard` placeholder; only 14 of 469 call any API (e.g. `StudioIsisMusicGenerationWorkspace.tsx` is an 18-line shell). The **engines are wired via the admin app**, but the customer-facing studio surface is largely unbuilt. This is the single biggest customer-experience gap. 3. **Curated creator-generation cards — WIRED END-TO-END this session ✅** (the first complete frontend studio surface). Following the living-scenes precedent (`APPROVED_LIVING_SCENE_TEMPLATE_IDS` ships a real default approved set): - **catalog** — `CURATED_CARD_CATALOG` (`@isis/curated-cards`): the six §3311 cards as server-authoritative `CardSpec`s + provenance; cost coefficients ship as a documented `PENDING` sentinel so the UI shows "pending", never a fabricated price (5 tests). - **bff** — `GET /v1/isis/curated-cards/catalog` (tenant-filtered) + `POST /v1/isis/curated-cards/generate` resolving the spec from the catalog by `cardId` (server-authoritative — client can't assert kill-switch/tier), tier from a trusted `x-oshun-creator-tier` header (default contemplative, fail-closed); admission → enqueue, 503 until a provider exists (9 tests). - **web** — `/studio/generation/curated-cards` page + `CuratedCardsStudio` fetches the catalog, renders all six cards, submits each, and surfaces every outcome honestly (accepted / entitlement-denied / invalid / provider-not- configured / load-error); 4 jsdom component tests. The AI provider is the only deploy-time remainder (honest 503 until set); full browser verification is the recommended next check. 4. **Reminder worker cron + durable in-app sink** (§3c). Wire the cycle to a scheduler and bind a durable inbox sink (or unify with the customer-message-center store). 5. **Discord & Slack adapters are stubs.** `discord/index.ts` (27 lines) delegates rendering to Telegram; `slack/index.ts:37` returns a **hardcoded** `/oshun today` string. No bot/gateway/Web-API client. Both are registered as gated channels but surfaced in no app (only Telegram is real). 6. **Music-generation operator surface.** Engines real (`suno-provider.ts`/`udio-provider.ts`, `music-generation` router) but there is **no `admin-isis-music-generation` route/page**; the only admin reference (`LilithGenerationQueueInspectorPanel.tsx`) uses **hardcoded fixture jobs**. 7. **Durable rate limiting.** Still per-process in-memory (`middleware/abuse-protection.ts:27`, ~90 separate instances); no Redis/durable limiter — counters reset on restart and aren't shared across instances. 8. **Spec-grade recommender island.** `libs/oshun/search-discovery` (4,047 lines: candidate generators, signal taxonomy, real offline NDCG/MAP/recall@k evals) is imported by **no app**. The recommendation Exit Criterion is met by the **simpler-but-real** BFF `routes/recommendations.ts` (580 lines), so the feature ships — but "candidate generation / signal ingestion / offline evaluation" lands only partially; the comprehensive version is dead. 9. **Metis institutional-standards island (OneRoster).** SSO/SCIM are wired, but OneRoster/xAPI/QTI/Caliper/CLR live in `libs/metis/integrations/src/standards/institutional-delivery.ts` (507 real lines) imported by **no app**. "OneRoster provisioning" (an Exit Criterion) is unwired. 10. **Analytics/experimentation runtime.** `libs/oshun/analytics` is mostly declarative manifests; the runtime A/B + offline-eval engine lives in the dead `search-discovery` island (#8) — so "experimentation framework" exists as code but runs behind no live surface. ### 5b. Unwired library stubs (real fabrications, NOT on a live V1 path — clean up or guard) These are exported but not reachable from the running BFF/web/persona-voice; they matter only if a future surface imports them: - `libs/iris/multimodal/voice/synthesis/src/{elevenlabs,cartesia,local}/*` — `synthesize()` returns an all-zero buffer ("in production this would be actual audio"). The **wired** persona-voice path (`libs/psyche/voice-synthesis/.../elevenlabs-provider.ts`) makes **real** `fetch` calls — only the iris copies are simulated. - `libs/psyche/tavus-tools/src/security-manager.ts:89-160` — `DefaultAuthenticator` base64-decodes a JWT with **no signature check**, accepts any `session_*` token, hashes API keys with a 32-bit string hash. Default authenticator; consumed only by tests. - `libs/yemaya/assets/src/cdn/cdn-service.ts:926` — `CloudFrontProvider.purge` fabricates an invalidation id + `success:true` without calling AWS (sibling signed-URL/HEAD-status methods are real). - `libs/shared/ai/src/local/quantization.ts:683` — `analyzeModel` returns hardcoded GGUF metadata regardless of path. - `apps/oshun/web/src/lib/tara/tara-cache.ts:460` — `useTaraDownloadProgress` fakes progress with `Math.random()`; **rendered nowhere**. ### 5c. Genuinely external / deploy-tier (cannot be closed in-repo) - AI **video-generation model** weights (run via the real in-repo ComfyUI/RunPod client behind the Isis gate). - **Editorial hub content** (tara/nisaba/metis curated copy) — authored content, not a fabrication hazard. - **Provider credentials & running infra** — Twilio/SES/FCM/Meta accounts, per-tenant LMS connector registrations, live platform JWKS endpoints, the cron host for the reminder cycle. --- ## 6. Exit-Criteria assessment (`V1/features.md` §V1 Exit Criteria) | Exit criterion | Status | | --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | | Customer web/mobile feel like one product (Tara center) | ⚠️ partial — domain hubs wired, but customer **studio** surface is mostly placeholder (§5a-2/3) | | Nisaba/Metis fully integrated | ⚠️ engines real; OneRoster + some Metis surfaces unwired (§5a-9) | | Sophia grounding visible where evidence matters | ✅ | | Admin web/mobile operate all governance workflows | ✅ (admin app + `admin-isis-*` routes) **except** agentic-AI run governance (§3a) | | Oshun Studio authoring/calendar/asset/… with release-gate enforcement | ⚠️ Metis 7-gate real; authoring workspace real; customer studio pages placeholder | | Agentic AI Studio … budgets/kill-switches/invocation operational | 🔴 **not at runtime** (§3a) | | Tenant Console SSO/SCIM/OneRoster, audit, webhooks, status | ⚠️ SSO/SCIM/audit/status ✅; **OneRoster unwired** | | External model sources cannot bypass Isis/safety gates | ✅ (no bypass found; §2) | | Metis high-stakes outputs pass grounding/safety/integrity gates | ✅ 7-gate orchestrator real (needs a publish route to call it) | | Recommendation candidate generation / signal ingestion / offline eval | ⚠️ partial via BFF; spec-grade engine dead (§5a-8) | | Risk-tiered automated verification across critical workflows | ✅ broad; the unwired islands lack runtime coverage by construction | | Takedown cascade across kept + shared artifacts | ✅ **wired this session** (§4) | | Accessibility/perf/security/resilience/observability launch gates | ⚠️ rate-limiting not durable (§5a-7); otherwise broadly met | --- ## 7. What is trusted and should not be re-litigated The crypto money-path + all four non-EVM address derivations; the Yemaya CPU raster kernel + PNG codec; the 85-model Prisma persistence foundation + contract repository; Tara/Arete/Nisaba domain logic; Sophia evidence layer; Psyche policy layer; Persona Registry; Auth (alg-pinned signed JWT); and the three safety/compliance cascades (Veritas retraction, DSAR erasure, crisis-frame), which were re-traced to real Prisma + Redis this session. --- _Generated from direct source reads and import-graph tracing by six independent adversarial agents, plus this session's verified fixes. Where a backend is genuinely out-of-repo (the video model, the Metis Python backend, deploy credentials), that is stated rather than assumed._