Known Gaps

Honest current-state disclosure from KNOWN-GAPS.md and the local code review.

No Fake Completion

These gaps are not hidden behind optimistic UI states. A stage or integration is labeled implemented, protected_required, operator checkpoint, unconfigured, or planned based on real code and available configuration.

Consolidated findings.jsonl

implemented

The runner writes deterministic per-model findings.jsonl files and a top-level run findings.jsonl after report compilation.

Comparative scorecard rubric

supervised operator

lib/scoring.js implements vulnerability priority scoring. The spec's model-comparison rubric remains a supervised Opus 4.8 scorecard prompt and is surfaced as a manual-required stage.

LLM router in runner loop

supervised operator

llm-router.route() can make provider calls, but the CLI runner scaffolds prompts and pauses for human/agent operator invocation.

Trust boundary enforcement

partially implemented

Config trust boundaries are loaded and warned on in preflight. Active network enforcement belongs to sandbox/job policy and explicit operator scope review.

Docs, Sheets, Files publishing

protected required

Routes expose protected integration actions and never claim a publish/export/upload occurred without a protected confirmation path.

Real-run automation

operator checkpoint

Real run creation is gated by PLATPHORM_API_KEY, responsible-use acceptance, scope validation, and typed AUTHORIZED confirmation. Operator checkpoints remain first-class.