diff --git a/reference/core/control-center/gaps/gap-reference-catalog.es.md b/reference/core/control-center/gaps/gap-reference-catalog.es.md index 8813dab1..1cbd6713 100644 --- a/reference/core/control-center/gaps/gap-reference-catalog.es.md +++ b/reference/core/control-center/gaps/gap-reference-catalog.es.md @@ -7815,3 +7815,16 @@ Serie histórica de gaps registrada en el antiguo `gap-analysis-core.es.md`, pre - [ ] `gh pr checks` sobre un PR nuevo no muestra ningún check `CodeQL` reportando "configuration not found". - [ ] Las únicas claves de análisis en `refs/heads/main` son las dos que produce `sdk-cli-ci.yml`. - [ ] `CodeQL SAST` sigue pasando y sigue siendo check requerido — la limpieza no debe tocar el escaneo que funciona. + +#### GT-623 + +**Título:** La convención de commits se exige en tres sitios, no la aplica nada, y de ella se derivan las versiones de release + +- **Propósito:** Que la convención de commits que el repositorio exige y de la que deriva sus versiones esté realmente aplicada, o deje de reclamarse. +- **Evidencia:** **El hook existe, está cableado, y no puede aplicar nada.** `.husky/commit-msg` ejecuta `npx --no -- commitlint --version`; cuando falla imprime `commitlint is not installed — skipping commit message lint` y sale con **éxito**. Verificado: `commitlint` no aparece ni en `dependencies` ni en `devDependencies` del `package.json` raíz, no hay `commitlint.config.*` ni `.commitlintrc*`, y no existe clave `commitlint` en `package.json`. Así que la rama `else` es la única que se ejecuta, en cada commit. Observado en vivo el 2026-07-27 al mergear `develop` en una rama de trabajo. **Qué depende de la convención que no aplica:** `CONTRIBUTING.md` y `.github/pull_request_template.md` exigen Conventional Commits en tres sitios, y —la parte que cuesta dinero— **release-please deriva los saltos de versión de los mensajes de commit**, cableado en `sdk-cli-release.yml` y `sdk-cli-ci.yml`. **Ya está derivando, y con consecuencia:** 2 de los últimos 60 commits no-merge usan el tipo `security(...)` (`security(fase-7): add Docker/K8s hardening checklist`, `security(fase-6): add executable security rulesets`), que no es un tipo de Conventional Commits. release-please no lo reconoce, así que **un commit que se anuncia como cambio de seguridad no aporta nada al salto de versión** — el mismo modo de fallo que [`GT-570`](./gap-reference-catalog.es.md#gt-570), donde una ola de seguridad sigue sin publicarse. Fix: instalar y configurar commitlint para que el hook tome su rama real, o borrar el hook y dejar de reclamar la convención. Fallar abierto es la peor de las tres opciones, porque produce la apariencia de enforcement. Si se quiere el tipo `security`, declararlo en la config y mapearlo a un bump — no dejarlo a un linter que nunca corre. +- **Componente:** `Governance` · **Criticidad:** P2 · **Complejidad:** S +- **Procedencia:** Observado en vivo el 2026-07-27: el hook imprimió su mensaje de "skipping" al mergear `develop` en una rama de trabajo. Estaba nombrado dentro del cuadro de proceso de `GT-574`; se saca a fila propia porque tiene una consecuencia concreta y medible sobre el versionado. +- **Criterios de aceptación:** + - [ ] Un commit con mensaje malformado se rechaza en local, demostrado intentándolo. + - [ ] El tipo `security` está declarado en la config de commitlint con un mapeo explícito de salto de versión, o se deja de usar. + - [ ] Ningún hook de `.husky/` imprime un mensaje de "skipping" y sale con cero — un hook que no puede correr se borra, no se silencia. diff --git a/reference/core/control-center/gaps/gap-reference-catalog.md b/reference/core/control-center/gaps/gap-reference-catalog.md index 47857b47..cee0769c 100644 --- a/reference/core/control-center/gaps/gap-reference-catalog.md +++ b/reference/core/control-center/gaps/gap-reference-catalog.md @@ -7910,3 +7910,16 @@ Historical gap series tracked in the former `gap-analysis-core.md`, preserved fo - [ ] `gh pr checks` on a fresh PR shows no `CodeQL` check reporting "configuration not found". - [ ] The only analysis keys on `refs/heads/main` are the two produced by `sdk-cli-ci.yml`. - [ ] `CodeQL SAST` still passes and is still a required check — the cleanup must not touch the scanning that works. + +#### GT-623 + +**Title:** The commit convention is mandated in three places, enforced by nothing, and release versions are derived from it + +- **Purpose:** Make the commit convention the repository mandates — and derives its versions from — actually enforced, or stop claiming it. +- **Evidence:** **The hook exists, is wired, and cannot enforce anything.** `.husky/commit-msg` runs `npx --no -- commitlint --version`; when that fails it prints `commitlint is not installed — skipping commit message lint` and exits **successfully**. Verified: `commitlint` appears in neither `dependencies` nor `devDependencies` of the root `package.json`, there is no `commitlint.config.*` or `.commitlintrc*`, and no `commitlint` key in `package.json`. So the else-branch is the only branch that ever runs, on every commit. Observed live on 2026-07-27 while merging `develop` into a feature branch. **What depends on the convention it does not enforce:** `CONTRIBUTING.md` and `.github/pull_request_template.md` mandate Conventional Commits in three places, and — the part that costs money — **release-please derives version bumps from commit messages**, wired into `sdk-cli-release.yml` and `sdk-cli-ci.yml`. **It is already drifting, with a consequence:** 2 of the last 60 non-merge commits use the type `security(...)` (`security(fase-7): add Docker/K8s hardening checklist`, `security(fase-6): add executable security rulesets`), which is not a Conventional Commits type. release-please does not recognise it, so **a commit that announces itself as a security change contributes nothing to the version bump** — which is the same failure mode as [`GT-570`](./gap-reference-catalog.md#gt-570), where a security wave sits unpublished. Fix: install and configure commitlint so the hook takes its real branch, or delete the hook and stop claiming the convention. Failing open is the worst of the three options, because it produces the appearance of enforcement. If the `security` type is wanted, declare it in the config and map it to a bump — do not leave it to a linter that never runs. +- **Component:** `Governance` · **Criticality:** P2 · **Complexity:** S +- **Provenance:** Observed live on 2026-07-27: the hook printed its "skipping" message while merging `develop` into a working branch. It was named inside the process picture of `GT-574`; it is broken out here because it has a concrete, measurable consequence for versioning. +- **Acceptance criteria:** + - [ ] A commit with a malformed message is rejected locally, demonstrated by trying one. + - [ ] The `security` type is either declared in the commitlint config with an explicit version-bump mapping, or removed from use. + - [ ] No hook in `.husky/` prints a "skipping" message and exits zero — a hook that cannot run is deleted, not silenced. diff --git a/reference/core/control-center/gaps/gap-tracking.es.md b/reference/core/control-center/gaps/gap-tracking.es.md index fabcfbbb..6d43c766 100644 --- a/reference/core/control-center/gaps/gap-tracking.es.md +++ b/reference/core/control-center/gaps/gap-tracking.es.md @@ -13,6 +13,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida | ID | Gap | Qué significa | Ejemplo | Componente | Fase | Criticidad | Complejidad | Estado | |---|---|---|---|:---:|:---:|:---:|:---:|:---:| +| [`GT-623`](./gap-reference-catalog.es.md#gt-623) | **El hook existe, está cableado, y no puede aplicar nada.** `.husky/commit-msg` ejecuta `npx --no -- commitlint --version`; cuando falla imprime `commitlint is not installed — skipping commit message lint` y sale con **éxito**. Verificado: `commitlint` no aparece ni en `dependencies` ni en `devDependencies` del `package.json` raíz, no hay `commitlint.config.*` ni `.commitlintrc*`, y no existe clave `commitlint` en `package.json`. Así que la rama `else` es la única que se ejecuta, en cada commit. Observado en vivo el 2026-07-27 al mergear `develop` en una rama de trabajo. **Qué depende de la convención que no aplica:** `CONTRIBUTING.md` y `.github/pull_request_template.md` exigen Conventional Commits en tres sitios, y —la parte que cuesta dinero— **release-please deriva los saltos de versión de los mensajes de commit**, cableado en `sdk-cli-release.yml` y `sdk-cli-ci.yml`. **Ya está derivando, y con consecuencia:** 2 de los últimos 60 commits no-merge usan el tipo `security(...)` (`security(fase-7): add Docker/K8s hardening checklist`, `security(fase-6): add executable security rulesets`), que no es un tipo de Conventional Commits. release-please no lo reconoce, así que **un commit que se anuncia como cambio de seguridad no aporta nada al salto de versión** — el mismo modo de fallo que [`GT-570`](./gap-reference-catalog.es.md#gt-570), donde una ola de seguridad sigue sin publicarse. Fix: instalar y configurar commitlint para que el hook tome su rama real, o borrar el hook y dejar de reclamar la convención. Fallar abierto es la peor de las tres opciones, porque produce la apariencia de enforcement. Si se quiere el tipo `security`, declararlo en la config y mapearlo a un bump — no dejarlo a un linter que nunca corre. | | | `Governance` | Cross | P2 | S | `PENDIENTE` | | [`GT-622`](./gap-reference-catalog.es.md#gt-622) | **Cada pull request arrastra un check `CodeQL` en rojo que dice "1 configuration not found", y no es un hallazgo de seguridad — es contabilidad huérfana.** GitHub conserva **82 análisis de code scanning** en `refs/heads/main` bajo la clave `.github/workflows/ci.yml:codeql`. Esa configuración existió de verdad: el commit `87f50ce3` añadió un job `codeql` a `ci.yml`, y `f50030cd` lo quitó el 2026-06-06 al vaciar ese workflow — el último análisis bajo esa clave es de ese mismo día. Como la configuración sigue *registrada* en `main` pero nada la produce, GitHub la reporta como ausente en cada PR. Lleva así 51 días. Verificado: `code-scanning/analyses?ref=refs/heads/main` devuelve tres claves — `ci.yml:codeql` (82, último 2026-06-06), `sdk-cli-ci.yml:codeql-analysis` (159, al día) y `sdk-cli-ci.yml:trivy-scan` (159, al día). El escaneo que importa está sano; `CodeQL SAST` pasa y es check requerido. **El workflow muerto ya está eliminado** (corría un job `Disabled` que sólo hacía `echo`, en cada PR y push a `main` y `develop`); borrar el fichero NO limpia la configuración registrada, y por eso existe esta fila. **La acción restante queda deliberadamente sin automatizar:** eliminar los 82 análisis vía `DELETE /repos/{owner}/{repo}/code-scanning/analyses/{id}` es irreversible y destruye historial de code scanning de una rama protegida. Su valor histórico es nulo —describen una configuración muerta desde junio— pero tirar historial de escaneo de seguridad es decisión del dueño, no de la herramienta. **Por qué importa más allá del ruido:** un check permanentemente rojo enseña a los revisores a descontar los checks rojos, y `CodeQL SAST` —que comparte el nombre CodeQL y SÍ es requerido— es precisamente el check que nadie se puede permitir aprender a ignorar. | | | `Infra` | Cross | P2 | XS | `PENDIENTE` | | [`GT-609`](./gap-reference-catalog.es.md#gt-609) | **Fuga de autorización en la superficie de descubrimiento.** `mcp-cache.service.ts:8` declara `toolsList: 'mcp:tools:list'` — una única clave literal, sin principal, tenant ni scope — y la lista se cachea ANTES de aplicar el filtro de scope. Así que el primer llamador que calienta la caché decide el inventario que ven todos los siguientes durante el TTL: un admin que la caliente publica el inventario con capacidad de escritura a los lectores. **Verificado aquí contra el código.** Fix: indexar la caché por principal (hash de scopes + tenant), o eliminarla — una superficie de descubrimiento que responde con la vista de otro principal es peor que una sin caché. Origen: hallazgo 4.2 del diagnóstico de producto (https://github.com/beyondnetcode/why-architecture/blob/main/docs/evolith-diagnostico-es.md). | | | `MCP Server` | Cross | P0 | S | `PENDIENTE` | | [`GT-610`](./gap-reference-catalog.es.md#gt-610) | **La peor clase de fallo posible para un producto de auditoría: la acción correcta, registrada, ejecutada con las entradas equivocadas.** Los tres motores rellenan `proposedArguments` — `swarms-agent.adapter.ts:99`, `hermes-agent.adapter.ts:98`, `stub-agent-engine.adapter.ts:46` — y el servicio lee sólo `plan.proposedTool` (`agent-runtime.service.ts:168-169`). Los argumentos propuestos se calculan, cruzan el puerto y se tiran; la skill se ejecuta con lo que hubiera en `request.parameters`. **Verificado aquí contra el código.** Fix: fusionar los argumentos propuestos con revalidación contra el contrato de entrada declarado por la skill antes de ejecutar, y registrar en la traza qué conjunto se usó. Origen: hallazgo 5.5 del diagnóstico de producto (https://github.com/beyondnetcode/why-architecture/blob/main/docs/evolith-diagnostico-es.md). | | | `agent-runtime` | Cross | P0 | S | `PENDIENTE` | @@ -637,7 +638,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida | [`GT-246`](./gap-reference-catalog.es.md#gt-246) | Implementar experimentos Chaos Mesh/Litmus | | | `QA` | Cross | P3 | L | `COMPLETADO` | -**Progreso:** 561 / 622 completados · 9 en progreso · 48 pendientes · 4 diferidos +**Progreso:** 561 / 623 completados · 9 en progreso · 49 pendientes · 4 diferidos **Oleada 2026-06-23 (auditoría profunda de Winston III):** Añadidos 14 gaps nuevos `GT-212`…`GT-225` del Winston Audit Playbook que cubren: higiene de estado ADR (GT-212), metadata + presupuestos operativos + corpus de guías por topología (GT-213, GT-217, GT-219), observabilidad + OpenAPI en controladores REST (GT-214, GT-215), paridad de input-schemas OPA + densidad de tests por topología (GT-216, GT-222), plantillas de rollback + on-call de Fase 05 (GT-218), cobertura de ramas CLI + paridad de envelope --format + limpieza de skip-list (GT-220, GT-224, GT-225), audit logging HTTP de MCP (GT-221), y tests e2e de paridad cross-surface (GT-223). diff --git a/reference/core/control-center/gaps/gap-tracking.md b/reference/core/control-center/gaps/gap-tracking.md index 9eebb1c3..32e83b8b 100644 --- a/reference/core/control-center/gaps/gap-tracking.md +++ b/reference/core/control-center/gaps/gap-tracking.md @@ -13,6 +13,7 @@ This board is the single source of truth for technical debt, gaps, opportunities | ID | Gap | What it means | Example | Component | Phase | Criticality | Complexity | Status | |---|---|---|---|:---:|:---:|:---:|:---:|:---:| +| [`GT-623`](./gap-reference-catalog.md#gt-623) | **The hook exists, is wired, and cannot enforce anything.** `.husky/commit-msg` runs `npx --no -- commitlint --version`; when that fails it prints `commitlint is not installed — skipping commit message lint` and exits **successfully**. Verified: `commitlint` appears in neither `dependencies` nor `devDependencies` of the root `package.json`, there is no `commitlint.config.*` or `.commitlintrc*`, and no `commitlint` key in `package.json`. So the else-branch is the only branch that ever runs, on every commit. Observed live on 2026-07-27 while merging `develop` into a feature branch. **What depends on the convention it does not enforce:** `CONTRIBUTING.md` and `.github/pull_request_template.md` mandate Conventional Commits in three places, and — the part that costs money — **release-please derives version bumps from commit messages**, wired into `sdk-cli-release.yml` and `sdk-cli-ci.yml`. **It is already drifting, with a consequence:** 2 of the last 60 non-merge commits use the type `security(...)` (`security(fase-7): add Docker/K8s hardening checklist`, `security(fase-6): add executable security rulesets`), which is not a Conventional Commits type. release-please does not recognise it, so **a commit that announces itself as a security change contributes nothing to the version bump** — which is the same failure mode as [`GT-570`](./gap-reference-catalog.md#gt-570), where a security wave sits unpublished. Fix: install and configure commitlint so the hook takes its real branch, or delete the hook and stop claiming the convention. Failing open is the worst of the three options, because it produces the appearance of enforcement. If the `security` type is wanted, declare it in the config and map it to a bump — do not leave it to a linter that never runs. | | | `Governance` | Cross | P2 | S | `PENDING` | | [`GT-622`](./gap-reference-catalog.md#gt-622) | **Every pull request carries a red `CodeQL` check reading "1 configuration not found", and it is not a security finding — it is orphaned bookkeeping.** GitHub still has **82 code-scanning analyses** on `refs/heads/main` under the analysis key `.github/workflows/ci.yml:codeql`. That configuration was real: commit `87f50ce3` added a `codeql` job to `ci.yml`, and `f50030cd` removed it on 2026-06-06 while gutting that workflow — the last analysis under the key is from that same day. Because the configuration is still *recorded* on `main` but nothing produces it, GitHub reports it missing on every PR. It has done so for 51 days. Verified: `code-scanning/analyses?ref=refs/heads/main` returns three analysis keys — `ci.yml:codeql` (82, last 2026-06-06), `sdk-cli-ci.yml:codeql-analysis` (159, current) and `sdk-cli-ci.yml:trivy-scan` (159, current). The scanning that matters is healthy; `CodeQL SAST` passes and is a required check. **The dead workflow itself is already deleted** (it ran a no-op `Disabled` job on every PR and push to `main` and `develop`); deleting the file does NOT clear the recorded configuration, which is why this row exists. **The remaining action is deliberately not automated:** removing the 82 analyses via `DELETE /repos/{owner}/{repo}/code-scanning/analyses/{id}` is irreversible and destroys code-scanning history on a protected branch. Their historical value is nil — they describe a configuration dead since June — but discarding security-scan history is an owner decision, not a tooling one. **Why it matters beyond the noise:** a permanently red check trains reviewers to discount red checks, and `CodeQL SAST` — which shares the CodeQL name and IS required — is exactly the check nobody can afford to learn to ignore. | | | `Infra` | Cross | P2 | XS | `PENDING` | | [`GT-609`](./gap-reference-catalog.md#gt-609) | **Authorization leak in the discovery surface.** `mcp-cache.service.ts:8` declares `toolsList: 'mcp:tools:list'` — a single literal key, with no principal, tenant or scope in it — and the list is cached BEFORE the scope filter runs. So the first caller to warm the cache decides the inventory every subsequent caller sees for the TTL: an admin warming it publishes the write-capable inventory to readers. **Verificado aquí contra el código.** Fix: key the cache by principal (a hash of scopes + tenant), or delete the cache — a discovery surface that answers from another principal's view is worse than an uncached one. Origin: finding 4.2 of the product diagnostic (https://github.com/beyondnetcode/why-architecture/blob/main/docs/evolith-diagnostico-es.md). | | | `MCP Server` | Cross | P0 | S | `PENDING` | | [`GT-610`](./gap-reference-catalog.md#gt-610) | **The worst failure class available to an audit product: the right action, recorded, executed with the wrong inputs.** All three engines populate `proposedArguments` — `swarms-agent.adapter.ts:99`, `hermes-agent.adapter.ts:98`, `stub-agent-engine.adapter.ts:46` — and the service reads only `plan.proposedTool` (`agent-runtime.service.ts:168-169`). The proposed arguments are computed, carried across the port, and dropped on the floor; the skill then runs with whatever `request.parameters` held. **Verificado aquí contra el código.** Fix: merge the proposed arguments with revalidation against the skill's declared input contract before execution, and record which set was used in the trace. Origin: finding 5.5 of the product diagnostic (https://github.com/beyondnetcode/why-architecture/blob/main/docs/evolith-diagnostico-es.md). | | | `agent-runtime` | Cross | P0 | S | `PENDING` | @@ -637,7 +638,7 @@ This board is the single source of truth for technical debt, gaps, opportunities | [`GT-246`](./gap-reference-catalog.md#gt-246) | Implement Chaos Mesh/Litmus experiments | | | `QA` | Cross | P3 | L | `DONE` | -**Progress:** 561 / 622 done · 9 in progress · 48 pending · 4 deferred +**Progress:** 561 / 623 done · 9 in progress · 49 pending · 4 deferred **Wave 2026-06-23 (Winston deep audit III):** Added 14 new gaps `GT-212`…`GT-225` from the Winston Audit Playbook covering: ADR status hygiene (GT-212), topology manifest metadata + operational budgets + guidance corpus (GT-213, GT-217, GT-219), REST controller observability + OpenAPI (GT-214, GT-215), OPA input-schema parity + per-topology test density (GT-216, GT-222), SDLC Phase 05 rollback + on-call templates (GT-218), CLI branch coverage + envelope format coverage + skip-list cleanup (GT-220, GT-224, GT-225), MCP HTTP audit logging (GT-221), and cross-surface parity e2e tests (GT-223). diff --git a/reference/core/control-center/maturity-reports/executive-summary.es.md b/reference/core/control-center/maturity-reports/executive-summary.es.md index 1bd9548d..b8bcaac7 100644 --- a/reference/core/control-center/maturity-reports/executive-summary.es.md +++ b/reference/core/control-center/maturity-reports/executive-summary.es.md @@ -29,7 +29,7 @@ La forma correcta de usar este resumen es simple: si necesitas contexto, abre so | 2 | Área de mayor riesgo | `Evolith Core` tiene la mayor carga ponderada abierta. | [GT-601](../gaps/gap-reference-catalog.es.md#gt-601), [GT-583](../gaps/gap-reference-catalog.es.md#gt-583), [GT-589](../gaps/gap-reference-catalog.es.md#gt-589), [GT-598](../gaps/gap-reference-catalog.es.md#gt-598), [GT-614](../gaps/gap-reference-catalog.es.md#gt-614), [GT-587](../gaps/gap-reference-catalog.es.md#gt-587), +4 | | 3 | Ganancias rápidas | Alta criticidad con complejidad XS/S. | [GT-570](../gaps/gap-reference-catalog.es.md#gt-570), [GT-571](../gaps/gap-reference-catalog.es.md#gt-571), [GT-575](../gaps/gap-reference-catalog.es.md#gt-575), [GT-601](../gaps/gap-reference-catalog.es.md#gt-601), [GT-609](../gaps/gap-reference-catalog.es.md#gt-609), [GT-610](../gaps/gap-reference-catalog.es.md#gt-610), [GT-586](../gaps/gap-reference-catalog.es.md#gt-586), [GT-597](../gaps/gap-reference-catalog.es.md#gt-597) | | 4 | Ola P1 | Endurecimiento siguiente después de limpiar P0. | [GT-586](../gaps/gap-reference-catalog.es.md#gt-586), [GT-597](../gaps/gap-reference-catalog.es.md#gt-597), [GT-607](../gaps/gap-reference-catalog.es.md#gt-607), [GT-618](../gaps/gap-reference-catalog.es.md#gt-618), [GT-620](../gaps/gap-reference-catalog.es.md#gt-620), [GT-324](../gaps/gap-reference-catalog.es.md#gt-324), [GT-578](../gaps/gap-reference-catalog.es.md#gt-578), [GT-580](../gaps/gap-reference-catalog.es.md#gt-580), +14 | -| 5 | P2/P3 | Solo después de estabilizar seguridad, CI, reglas y contratos. | [GT-619](../gaps/gap-reference-catalog.es.md#gt-619), [GT-622](../gaps/gap-reference-catalog.es.md#gt-622), [GT-424](../gaps/gap-reference-catalog.es.md#gt-424), [GT-444](../gaps/gap-reference-catalog.es.md#gt-444), [GT-464](../gaps/gap-reference-catalog.es.md#gt-464), [GT-614](../gaps/gap-reference-catalog.es.md#gt-614), +16 | +| 5 | P2/P3 | Solo después de estabilizar seguridad, CI, reglas y contratos. | [GT-619](../gaps/gap-reference-catalog.es.md#gt-619), [GT-622](../gaps/gap-reference-catalog.es.md#gt-622), [GT-424](../gaps/gap-reference-catalog.es.md#gt-424), [GT-444](../gaps/gap-reference-catalog.es.md#gt-444), [GT-464](../gaps/gap-reference-catalog.es.md#gt-464), [GT-614](../gaps/gap-reference-catalog.es.md#gt-614), +17 | ## Bloqueadores Actuales @@ -54,13 +54,13 @@ La forma correcta de usar este resumen es simple: si necesitas contexto, abre so | Indicador | Valor | |---|---:| | Fecha canónica del tablero | 2026-07-26 | -| Gaps totales | 622 | +| Gaps totales | 623 | | Gaps cerrados | 561 | -| Gaps pendientes | 61 | +| Gaps pendientes | 62 | | P0 abiertos | 13 | | P1 abiertos | 22 | -| P2 abiertos | 22 | -| Cierre total | 90.2% | +| P2 abiertos | 23 | +| Cierre total | 90% | | Registros de evidencia de cierre | 543 | | Readiness registrado | 4 PASS | diff --git a/reference/core/control-center/maturity-reports/executive-summary.md b/reference/core/control-center/maturity-reports/executive-summary.md index 3d7a737b..9b8a08bd 100644 --- a/reference/core/control-center/maturity-reports/executive-summary.md +++ b/reference/core/control-center/maturity-reports/executive-summary.md @@ -29,7 +29,7 @@ Use this summary with a simple rule: if you need context, open only the linked I | 2 | Highest-risk area | `Evolith Core` has the largest weighted open load. | [GT-601](../gaps/gap-reference-catalog.md#gt-601), [GT-583](../gaps/gap-reference-catalog.md#gt-583), [GT-589](../gaps/gap-reference-catalog.md#gt-589), [GT-598](../gaps/gap-reference-catalog.md#gt-598), [GT-614](../gaps/gap-reference-catalog.md#gt-614), [GT-587](../gaps/gap-reference-catalog.md#gt-587), +4 | | 3 | Quick wins | High criticality with XS/S complexity. | [GT-570](../gaps/gap-reference-catalog.md#gt-570), [GT-571](../gaps/gap-reference-catalog.md#gt-571), [GT-575](../gaps/gap-reference-catalog.md#gt-575), [GT-601](../gaps/gap-reference-catalog.md#gt-601), [GT-609](../gaps/gap-reference-catalog.md#gt-609), [GT-610](../gaps/gap-reference-catalog.md#gt-610), [GT-586](../gaps/gap-reference-catalog.md#gt-586), [GT-597](../gaps/gap-reference-catalog.md#gt-597) | | 4 | P1 wave | Next hardening after P0 is cleared. | [GT-586](../gaps/gap-reference-catalog.md#gt-586), [GT-597](../gaps/gap-reference-catalog.md#gt-597), [GT-607](../gaps/gap-reference-catalog.md#gt-607), [GT-618](../gaps/gap-reference-catalog.md#gt-618), [GT-620](../gaps/gap-reference-catalog.md#gt-620), [GT-324](../gaps/gap-reference-catalog.md#gt-324), [GT-578](../gaps/gap-reference-catalog.md#gt-578), [GT-580](../gaps/gap-reference-catalog.md#gt-580), +14 | -| 5 | P2/P3 | Only after security, CI, rules, and contracts stabilize. | [GT-619](../gaps/gap-reference-catalog.md#gt-619), [GT-622](../gaps/gap-reference-catalog.md#gt-622), [GT-424](../gaps/gap-reference-catalog.md#gt-424), [GT-444](../gaps/gap-reference-catalog.md#gt-444), [GT-464](../gaps/gap-reference-catalog.md#gt-464), [GT-614](../gaps/gap-reference-catalog.md#gt-614), +16 | +| 5 | P2/P3 | Only after security, CI, rules, and contracts stabilize. | [GT-619](../gaps/gap-reference-catalog.md#gt-619), [GT-622](../gaps/gap-reference-catalog.md#gt-622), [GT-424](../gaps/gap-reference-catalog.md#gt-424), [GT-444](../gaps/gap-reference-catalog.md#gt-444), [GT-464](../gaps/gap-reference-catalog.md#gt-464), [GT-614](../gaps/gap-reference-catalog.md#gt-614), +17 | ## Current Blockers @@ -54,13 +54,13 @@ Use this summary with a simple rule: if you need context, open only the linked I | Indicator | Value | |---|---:| | Canonical board date | 2026-07-26 | -| Total gaps | 622 | +| Total gaps | 623 | | Closed gaps | 561 | -| Open gaps | 61 | +| Open gaps | 62 | | Open P0 | 13 | | Open P1 | 22 | -| Open P2 | 22 | -| Total closure | 90.2% | +| Open P2 | 23 | +| Total closure | 90% | | Closure evidence records | 543 | | Recorded readiness | 4 PASS | diff --git a/reference/core/control-center/maturity-reports/maturity-reconciliation.json b/reference/core/control-center/maturity-reports/maturity-reconciliation.json index 373e0bb3..c47a119b 100644 --- a/reference/core/control-center/maturity-reports/maturity-reconciliation.json +++ b/reference/core/control-center/maturity-reports/maturity-reconciliation.json @@ -3,9 +3,9 @@ "scope": "evolith-core", "asOf": "2026-07-26", "gaps": { - "total": 622, + "total": 623, "done": 561, - "pending": 48, + "pending": 49, "inProgress": 9, "deferred": 4 },