ahcarpenter
diff --git a/‎.planning/workstreams/gks-refactor/v1.0-MILESTONE-AUDIT.md‎
Lines changed: 182 additions & 0 deletions b/‎.planning/workstreams/gks-refactor/v1.0-MILESTONE-AUDIT.md‎
Lines changed: 182 additions & 0 deletions
@@ -0,0 +1,182 @@
+---
+milestone: v1.0
+workstream: gks-refactor
+audited: 2026-04-11T21:15:08Z
+status: gaps_found
+scores:
+  requirements: 34/40
+  phases: 6/7
+  integration: 6/6
+  flows: 0/0
+gaps:
+  phases_not_started:
+    - phase: "06-infra-best-practice-audit-and-edge-case-hardening"
+      reason: "4 PLAN.md files exist, zero SUMMARY.md files, no implementation. Defines protect flags, network policies, Temporal ESO migration, and PodDisruptionBudgets — production-hardening gap-closure for phases 1–5."
+  phases_unverified:
+    - phase: "01-gke-cluster-and-networking-baseline"
+      reason: "Functionally complete per 4 SUMMARY.md files; no formal VERIFICATION.md artifact was ever produced."
+      evidence: "All 4 plan SUMMARYs present (01-01 through 01-04). Live cluster (vici-dev) provisioned and confirmed during phase 01-04 execution. Missing formal VERIFICATION.md doc."
+    - phase: "03-temporal-in-cluster"
+      reason: "Functionally complete per 3 SUMMARY.md files; no formal VERIFICATION.md artifact. 03-03 SUMMARY documents successful live deployment and pulumi up of Temporal Helm release, but the formal verification gate was never run."
+      evidence: "All 3 plan SUMMARYs present. Live Temporal pods Running in cluster (confirmed by prior session pulumi stack inspection)."
+  requirements_human_needed:
+    - id: "DB-01,DB-02,DB-03,DB-04,DB-05"
+      phase: "02-database-and-secrets-infrastructure"
+      status: "partial"
+      verification_status: "human_needed"
+      evidence: "Static verification passed (12/12 code-level truths). Live cluster verification (Cloud SQL reachability via Auth Proxy socket, cross-namespace socket access, ExternalSecret ready state, Alembic migration Job success) requires an applied dev stack."
+    - id: "SECRETS-01,SECRETS-02,SECRETS-03,SECRETS-04,SECRETS-05"
+      phase: "02-database-and-secrets-infrastructure"
+      status: "partial"
+      verification_status: "human_needed"
+      evidence: "Same as DB-*: static verified, runtime pending live ExternalSecret sync confirmation."
+    - id: "OBS-02,OBS-03,OBS-04,OBS-05"
+      phase: "04-observability-stack"
+      status: "partial"
+      verification_status: "human_needed"
+      evidence: "Jaeger trace collection, Prometheus ServiceMonitor scrape success, Grafana dashboard provisioning, OTEL endpoint ExternalSecret sync — all require live Phase 5 app to be deployed and emitting telemetry."
+    - id: "OBS-01"
+      phase: "04-observability-stack"
+      status: "mapping-error"
+      verification_status: "delivered_by_phase_3"
+      evidence: "REQUIREMENTS.md traceability table incorrectly maps OBS-01 to Phase 4. OpenSearch is actually deployed in Phase 3 (opensearch.py). Phase 4 VERIFICATION.md flags this as a traceability table error. Functionally satisfied; traceability needs correction."
+    - id: "APP-05"
+      phase: "05-application-deployment-and-ci-cd"
+      status: "partial"
+      verification_status: "human_needed"
+      evidence: "GET /health returns HTTP 200 from public hostname requires live DNS (Squarespace cutover) + cert-manager ACME challenge success. Code path is complete; runtime validation pending."
+    - id: "APP-02"
+      phase: "05-application-deployment-and-ci-cd"
+      status: "partial"
+      verification_status: "human_needed"
+      evidence: "Temporal worker connectivity to in-cluster server requires Phase 2 + Phase 3 applied. Lifespan wiring is complete; runtime validation pending."
+tech_debt:
+  - phase: "04-observability-stack"
+    items:
+      - "Temporal dashboard not pre-cached (grafana/provisioning/dashboards/temporal.json). Downloaded at pulumi up time; placeholder fallback activates if grafana.com unreachable at deploy time. Accepted by plan design but should be confirmed post-first-deploy."
+  - phase: "05.1-github-actions-ci-cd"
+    items:
+      - "IN-02 deferred: config-map JSON injection resistance. Attempted YAML block form caused GitHub Actions startup_failure (intertwined with IN-01 change). Reverted to JSON; fragility remains theoretical until image tag source broadens beyond [0-9a-f]{7}."
+      - "UAT item 4 pending: prod approval gate runtime validation. Requires a manual workflow_dispatch against cd-prod.yml + human reviewer approval to observe the gate fire."
+  - phase: "REQUIREMENTS.md (milestone-level)"
+    items:
+      - "Traceability table is stale: all 40 REQ-IDs still marked 'Pending' despite phases 01–05.1 having claimed completion. Needs refresh after this audit."
+      - "OBS-01 is incorrectly mapped to Phase 4; actually delivered by Phase 3 (opensearch.py)."
+  - phase: "session-level (nyquist)"
+    items:
+      - "Phases 01, 02, 04 have no VALIDATION.md files (nyquist validation not run for these phases)."
+      - "Phases 05 and 05.1 have VALIDATION.md with nyquist_compliant: false / wave_0_complete: false. Test state is actually 52 passing; the VALIDATION.md frontmatter lags the actual test coverage."
+nyquist:
+  compliant_phases: [03]
+  partial_phases: [05, 05.1, 06]
+  missing_phases: [01, 02, 04]
+  overall: partial
+code_review:
+  reviewed_phases: [05.1]
+  findings_summary:
+    "05.1":
+      critical: 0
+      warning: 3
+      info: 6
+      status: "issues_found (all 3 warnings and 5 of 6 info-level findings closed this session; IN-02 deferred)"
+---
+
+# v1.0 Milestone Audit — gks-refactor workstream
+
+**Audited:** 2026-04-11T21:15:08Z
+**Status:** `gaps_found`
+**Phases in milestone:** 7
+**Phases with implementation:** 6 (01, 02, 03, 04, 05, 05.1)
+**Phases not started:** 1 (06)
+
+## Why `gaps_found`
+
+The milestone is **not complete**:
+
+1. **Phase 06 is not started.** Four PLAN.md files exist (protect flags, network policies, Temporal ESO migration, PodDisruptionBudgets) but no implementation. This is production-hardening gap-closure work, not nice-to-have. If phase 06 is in-scope for v1.0 (per ROADMAP.md), the milestone cannot close until it is executed.
+
+2. **Phases 01 and 03 lack formal VERIFICATION.md.** They are functionally complete (live cluster + live Temporal deployment confirmed during execution) but never had the formal verification gate run. This is a documentation debt, not a runtime blocker.
+
+3. **Six REQ-ID groups are `human_needed`.** DB-*, SECRETS-*, OBS-02..05, APP-02, APP-05, and CD-03 all pass code-level verification but require live cluster / DNS / GitHub-dashboard steps to close. These are operational gates inherent to infrastructure projects, not design gaps.
+
+Despite the `gaps_found` status, there are **no critical code-level blockers** found in this audit. Phases 02, 04, 05, and 05.1 all report `human_needed` (not `gaps_found`) at the phase level. All cross-phase wiring observations are clean.
+
+## Per-phase summary
+
+| Phase | Status | REQ-IDs Code-Verified | Human Pending | VERIFICATION.md | Notes |
+|---|---|---|---|---|---|
+| 01 | complete (informal) | INFRA-01..07 | — | ❌ missing | Live dev cluster provisioned. Documentation debt only. |
+| 02 | human_needed | DB-01..05 + SECRETS-01..05 | 4 live-cluster items | ✓ | Static 12/12 passed. |
+| 03 | complete (informal) | TEMPORAL-01..06 | — | ❌ missing | Live Temporal Helm release deployed. nyquist_compliant: true. |
+| 04 | human_needed | OBS-02..05 (OBS-01 is Phase 3) | 5 live-telemetry items | ✓ | 1 tech debt (dashboard caching). |
+| 05 | human_needed | APP-01, 03, 04, 06 + CD-01..05 | APP-02, APP-05 | ✓ | 10/11 code-level satisfied. |
+| 05.1 | human_needed | CD-01..05 | 1 item (prod gate runtime) | ✓ | This session. 3 WR + 5 IN closed, 1 IN deferred. |
+| 06 | **not started** | none | all | ❌ no plans executed | **BLOCKING GAP for milestone completion.** |
+
+## Requirements coverage
+
+| Category | Satisfied (code) | Human Pending | Total | Notes |
+|---|---|---|---|---|
+| INFRA | 7 | 0 | 7 | Phase 01, informally verified |
+| DB | 5 | 5 | 5 | All satisfied at code level; runtime verification pending |
+| SECRETS | 5 | 5 | 5 | Same as DB |
+| TEMPORAL | 6 | 0 | 6 | Phase 03, informally verified |
+| OBS | 4 | 4 | 5 | OBS-01 mapping error (delivered by Phase 3) |
+| APP | 5 | 2 | 6 | APP-02 and APP-05 runtime-pending |
+| CD | 5 | 1 | 5 | CD-03 awaits prod dispatch runtime |
+| **Total** | **37** | **17** | **39** | OBS-01 double-counted adjusted |
+
+**Effective score: 34/40** once the OBS-01 mapping error and the 5 overlapping human-pending items (DB-* are both "satisfied" at code and "pending" at runtime) are deduped.
+
+## Integration findings
+
+**Cross-phase wiring is clean.** The agent audit identified 13 verified inter-phase dependencies across phases 2–5 (database→cluster, migration→database, temporal→opensearch, jaeger→opensearch, app→secrets, ingress→certmanager, cd→identity, etc.), all correctly declared via `ResourceOptions(depends_on=[...])` or explicit imports with noqa guards. Zero broken wiring observed.
+
+**Missing wiring (expected)**: Phase 06 deliverables (NetworkPolicy CRs, temporal_eso.py, pdb.py) reference phases 1–5 but have not been implemented yet — this is the Phase 06 not-started gap above.
+
+## Tech debt summary
+
+| Phase | Item | Severity |
+|---|---|---|
+| 04 | Temporal dashboard not pre-cached — runtime download with placeholder fallback | advisory |
+| 05.1 | IN-02 deferred: config-map JSON injection resistance | low (theoretical) |
+| 05.1 | UAT item 4 pending: prod approval gate runtime validation | operational |
+| REQUIREMENTS.md | Traceability table is stale (all 40 IDs marked "Pending") | documentation |
+| REQUIREMENTS.md | OBS-01 mapped to wrong phase | documentation |
+| Nyquist | 3 phases missing VALIDATION.md (01, 02, 04) | documentation |
+| Nyquist | Phases 05 and 05.1 have VALIDATION.md with stale `wave_0_complete: false` despite 52 passing tests | documentation |
+
+## Nyquist compliance
+
+| Phase | VALIDATION.md | nyquist_compliant | wave_0_complete | Action |
+|---|---|---|---|---|
+| 01 | missing | — | — | `/gsd-validate-phase 01` |
+| 02 | missing | — | — | `/gsd-validate-phase 02` |
+| 03 | present | true | true | ✓ |
+| 04 | missing | — | — | `/gsd-validate-phase 04` |
+| 05 | present | false | false | stale — refresh or re-run |
+| 05.1 | present | false | false | stale — refresh (52 tests pass) |
+| 06 | present | false | false | expected (not started) |
+
+## Actions
+
+**Blocking (for milestone completion):**
+1. Execute **Phase 06** (`/gsd-execute-phase 06 --ws gks-refactor`) to close the production-hardening gap.
+2. **UAT item 4** for Phase 05.1 — manually dispatch `CD Prod` and observe the approval gate fire. Can be deferred if prod deploy is not in this session's scope.
+3. **Live-cluster human verification** for DB-*, SECRETS-*, OBS-*, APP-02, APP-05 — these are operational, not code issues.
+
+**Documentation debt (non-blocking):**
+1. Refresh `.planning/workstreams/gks-refactor/REQUIREMENTS.md` traceability table to match actual phase completion state.
+2. Fix OBS-01 mapping (move from Phase 4 to Phase 3 in REQUIREMENTS.md).
+3. Retroactively generate VERIFICATION.md for phases 01 and 03 (or acknowledge them as complete in ROADMAP without formal verification).
+4. Run `/gsd-validate-phase` for phases 01, 02, 04 to produce missing VALIDATION.md artifacts.
+5. Refresh VALIDATION.md for phases 05 and 05.1 to match actual test state.
+
+**Tech debt (deferrable):**
+1. Pre-cache `grafana/provisioning/dashboards/temporal.json` or accept the runtime-download pattern permanently.
+2. Re-attempt IN-02 (config-map YAML block form) with a proper GitHub Actions test harness.
+
+---
+
+_Audit produced by gsd-audit-milestone workflow on 2026-04-11._
+_This is a mid-milestone audit. Phase 06 is still pending execution; milestone cannot close until then._