# Quality and capability gaps Baseline reviewed 2026-09-26; architecture and maintainability evidence refreshed 2026-09-29. This is an evidence inventory, not a certification, coverage percentage or uptime promise. Update the affected row when evidence changes. | Area | Executable evidence | Remaining limitation | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------- | | Identity and project isolation | [Security tests](../tests/security.test.ts), [HTTP tests](../tests/http.test.ts) | Does not establish shared-database customer tenancy | | Board and analytics | [Board tests](../tests/board.test.ts), [analytics tests](../tests/analytics.test.ts), [browser workflow acceptance](verification.md#project-workflows-and-subscribed-delivery) | Current-record/history bounds apply; no workforce ranking or reconstructed historic board configurations | | Subscribed email | [Delivery tests](../tests/notifications.test.ts), [native worker tests](../tests/notifications-postgres.test.ts), [email guide](email-notifications.md) | Provider acceptance is separate from inbox placement; each sender/account needs live verification | | External workflows | [Tracker tests](../tests/trackers.test.ts), [guided connection tests](../tests/tracker-discovery.test.ts), [Jira consent tests](../tests/tracker-jira-consent.test.ts), [channels](../tests/channels.test.ts), [replay references](../tests/replay-links.test.ts), [time entries](../tests/time-tracking.test.ts), [TestMu intake](../tests/testmu-intake.test.ts) | Synthetic requests do not certify live account consent, quotas, remote changes or marketplace availability | | Permanent public intake | [Intake tests](../tests/public-intake.test.ts), [browser flow](../tests/public-intake-browser.test.ts) | Actual host CSP, Turnstile and CMS installation require deployment acceptance | | Transactions and cursors | [Native PostgreSQL tests](../tests/cursor-concurrency.test.ts) | PGlite cannot establish concurrent commit ordering | | Agent contracts | [Shared registry](../src/shared/contracts.ts), HTTP/MCP tests | Client import/discovery behavior still needs actual-client verification | | Extension onboarding | [Connection](../tests/extension-connection.test.ts), [pairing](../tests/extension-pairing.test.ts) and [isolated browser QA](../scripts/extension-browser-qa.mjs) | Store-installed Chrome permissions and published package still need live evidence | | Video recording | [Media options and timer tests](../tests/video-options.test.ts), [browser QA](../scripts/extension-browser-qa.mjs) | Native Windows/Ubuntu picker and microphone prompts remain unverified; browser tests use synthetic streams | | Screenshot editing | [Export/PDF tests](../tests/screenshot-export.test.ts), [pixel/browser QA](../scripts/screenshot-editor-qa.mjs) | Full-page raster exports depend on browser dimension limits; crop applies to local exports only | | Thread deletion | [Deletion tests](../tests/thread-deletion.test.ts), [native worker lease tests](../tests/cursor-concurrency.test.ts) | Production object-version retention and backup removal are provider-specific; no real data is deleted by tests | | Native mobile clients | [Scoped HTTP contract test](../tests/mobile-sdk-contract.test.ts), [Android host build](../sdk/android-host/build.gradle.kts) | Real iOS and Android device capture, pairing and upload remain unverified | | Asset storage | [S3 adapter tests](../tests/s3-adapter.test.ts), [asset implementation](../src/server/assets.ts) | Provider credentials and restore procedures need deployment-specific tests | | Scheduled project QA | [Focused QA tests](../tests/scheduled-qa.test.ts), [worker and comparison](../src/server/scheduled-qa.ts) | Static public pages only; no unattended browser capture or live external-site proof | | Architecture and knowledge | [Harness checks](../scripts/check-harness.mjs), [guard tests](../tests/harness.test.ts) | Import rules do not prove internal server layering; docs prose can still become stale | | Source maintainability | [Modular refactor plan](plans/modular-source-structure.md), [domain registry](../src/shared/contracts/registry.ts), [server diagnostics](../src/server/diagnostics/read.ts), [browser acceptance workflows](../scripts/qa/extension/setup/popup-options.mjs) | Injected content, worker dispatch, and session coordination remain large; browser scenarios share one mutable run context | | Reproduction | [Disposable sandbox](../scripts/dev-sandbox.mjs) | Built UI without hot reload; no persistent fixtures or production data | | Operations and scale | [Container smoke](../scripts/smoke-containers.mjs), [operations](operations.md) | No measured SLO/load baseline, shared rate limiter or verified HA claim | Prioritize new work from actual failure evidence. For material gaps, create a scoped [plan](plans/README.md) with acceptance criteria, compatibility and recovery. Do not turn this list into promises about unimplemented enterprise features. Agent workflow evidence: [compact adapter tests](../tests/agent-workflow.test.ts), [MCP SDK tests](../tests/agent-mcp.test.ts), [503-thread selection and crop tests](../tests/agent-selection.test.ts), [skill installer tests](../tests/skill-install.test.ts) and the [implementation receipt](plans/agent-workflow.md). Model behavior, fresh-chat client installation and live rollout remain separate acceptance gates. GitHub operation evidence: [connection and Issue tests](../tests/github-app.test.ts), [quick Issue tests](../tests/github-quick-issue.test.ts), and [status sync tests](../tests/github-status-sync.test.ts) cover the grouped server handlers. These tests use controlled GitHub responses; they do not establish live GitHub App installation or external failure behavior in production. ## Public distribution follow-ups Standalone Windows, Ubuntu and macOS companions and Android/iOS apps or sharing extensions are Coming soon / planned in [Upcoming](upcoming.md). The [platform matrix](platform-compatibility.md) distinguishes the implemented web capture/import pilot and host-app SDK source from those future native clients. Real native-window capture, physical-device acceptance and platform distribution require separate evidence in the [capture plan](plans/cross-platform-capture.md). The public [0.3.2 release](https://github.com/Softinator-TechLabs/feedbacks-oss/releases/tag/v0.3.2) includes reviewed source and Codex/Claude Code plugin packages. Versioned multi-platform Docker Hub images and the [stable installer](plans/guided-docker-install.md) have separate publication and fresh-install evidence. [Dokploy/Coolify catalog templates](https://github.com/Softinator-TechLabs/feedbacks-oss/issues/177), official plugin catalog acceptance and actual client installation remain separate delivery gates; a ZIP or registry image does not establish those outcomes. Direct Codex and Claude Code plugins and MCP connections are available through the [agent setup guide](../site-docs/guide/mcp.md). Direct availability and official directory publication are separate statuses. Provider-account consent and successful remote task creation remain separate from the released [ten task adapters and guided setup](integrations.md). ## Extension-free capture and widget installation The [app screenshot pilot](app-capture.md) has schema/access/retry tests and [browser acceptance](../tests/app-capture-browser.test.ts) for import, redaction pixels, uncertain upload recovery and a synthetic media stream. Native system pickers and physical mobile devices remain unverified. The dedicated widget installer reuses the origin-bound text intake; a fresh browser context submits against a separate synthetic host with mocked Turnstile. Real host CSP and production verification remain deployment-specific checks.