Known Gaps

Honest current-state disclosure from KNOWN-GAPS.md and the local code review.

No Fake Completion

These gaps are not hidden behind optimistic UI states. A stage or integration is labeled implemented, protected_required, manual_required, unconfigured, or planned based on real code and available configuration.

Consolidated findings.jsonl

partially implemented

The spec describes a consolidated findings file. Current reliable output is per-task JSONL plus per-model reports; the UI does not pretend a fused artifact exists unless the run produced one.

Comparative scorecard rubric

supervised manual

lib/scoring.js implements vulnerability priority scoring. The spec's model-comparison rubric remains a supervised Opus 4.8 scorecard prompt and is surfaced as a manual-required stage.

LLM router in runner loop

supervised manual

llm-router.route() can make provider calls, but the CLI runner scaffolds prompts and pauses for human/agent operator invocation.

Trust boundary enforcement

partially implemented

Config trust boundaries are loaded and warned on in preflight. Active network enforcement belongs to sandbox/job policy and explicit operator scope review.

Docs, Sheets, Files publishing

protected required

Routes expose protected integration actions and never claim a publish/export/upload occurred without a protected confirmation path.

Real-run automation

manual required

Real run creation is gated by PLATPHORM_API_KEY, responsible-use acceptance, scope validation, and typed AUTHORIZED confirmation. Manual stages remain first-class.