Known Gaps

Honest current-state disclosure from KNOWN-GAPS.md and the local code review.

No Fake Completion

These gaps are not hidden behind optimistic UI states. A stage or integration is labeled implemented, protected_required, operator checkpoint, unconfigured, or planned based on real code and available configuration.

Consolidated findings.jsonl

implemented

The runner writes deterministic per-model findings.jsonl files and a top-level run findings.jsonl after report compilation.

Comparative scorecard rubric

implemented

lib/scoring.js implements vulnerability priority scoring. Web real-runs also persist scorecards derived from actual Hunt/Validate findings and token-cost evidence.

LLM router in runner loop

implemented

The web real-run path executes bounded passive recon plus AI Gateway Hunt/Validate work. The original CLI still supports supervised prompt-package operation.

Trust boundary enforcement

partially implemented

Config trust boundaries are loaded and warned on in preflight. Active network enforcement belongs to sandbox/job policy and explicit operator scope review.

Docs, Sheets, Files publishing

protected required

Routes expose protected integration actions and never claim a publish/export/upload occurred without a protected confirmation path.

Real-run automation

implemented

Real run creation is gated by PLATPHORM_API_KEY, responsible-use acceptance, scope validation, and typed AUTHORIZED confirmation. With AI Gateway credentials present, the run performs bounded passive recon, model Hunt/Validate work, finding persistence, and scorecard derivation.