beyondnetcode · beyondnetPeru · Jul 13, 2026 · Jul 13, 2026 · Jul 13, 2026 · chatgpt-codex-connector
diff --git a/product/infra/helm/local-test.sh b/product/infra/helm/local-test.sh
@@ -5,10 +5,10 @@
 # images work with imagePullPolicy: Never — no registry needed).
 #
 # Usage:
-#   bash reference/infrastructure/helm/local-test.sh apps-up # build + install apps only
-#   bash reference/infrastructure/helm/local-test.sh up      # build + install infra + apps
-#   bash reference/infrastructure/helm/local-test.sh smoke   # port-forward + curl
-#   bash reference/infrastructure/helm/local-test.sh down     # uninstall + delete ns
+#   bash product/infra/helm/local-test.sh kind-apps-up # kind + build + load + install apps
+#   bash product/infra/helm/local-test.sh kind-up      # kind + build + load + infra + apps
+#   bash product/infra/helm/local-test.sh smoke        # port-forward + curl
+#   bash product/infra/helm/local-test.sh kind-down    # uninstall + delete kind cluster
 #
 # Env:
 #   EVOLITH_API_KEY   API key used for all three services (default: local-dev-key)
@@ -22,7 +22,7 @@ NS=evolith-local
 API_KEY="${EVOLITH_API_KEY:-local-dev-key}"
 IMAGE_TAG="${EVOLITH_IMAGE_TAG:-local-$(date +%s)}"
 ROOT="$(git rev-parse --show-toplevel)"
-HELM="$ROOT/reference/infrastructure/helm"
+HELM="$ROOT/product/infra/helm"
 CLUSTER="${KIND_CLUSTER:-evolith}"   # dedicated kind cluster name (kind-<name> context)
 
 IMAGES=(evolith-core-api:"$IMAGE_TAG" evolith-mcp:"$IMAGE_TAG" evolith-agent-runtime:"$IMAGE_TAG")
@@ -46,9 +46,9 @@ kind_load() {
 
 build() {
   echo "==> Building images (context = repo root, tag = $IMAGE_TAG)"
-  docker build -f "$ROOT/apps/core-api/Dockerfile"          -t evolith-core-api:"$IMAGE_TAG"     "$ROOT"
-  docker build -f "$ROOT/packages/mcp-server/Dockerfile"    -t evolith-mcp:"$IMAGE_TAG"   "$ROOT"
-  docker build -f "$ROOT/apps/agent-runtime-api/Dockerfile" -t evolith-agent-runtime:"$IMAGE_TAG" "$ROOT"
+  docker build -f "$ROOT/src/apps/core-api/Dockerfile"          -t evolith-core-api:"$IMAGE_TAG"     "$ROOT"
+  docker build -f "$ROOT/src/packages/mcp-server/Dockerfile"    -t evolith-mcp:"$IMAGE_TAG"   "$ROOT"
+  docker build -f "$ROOT/src/apps/agent-runtime-api/Dockerfile" -t evolith-agent-runtime:"$IMAGE_TAG" "$ROOT"
 }
 
 secrets() {

diff --git a/reference/core/control-center/gaps/gap-tracking.es.md b/reference/core/control-center/gaps/gap-tracking.es.md
@@ -95,7 +95,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida
 | [`GT-460`](./gap-reference-catalog.es.md#gt-460) | **Los conteos de la superficie MCP del comando `api` están hardcodeados y se desincronizan del server real.** `api -l` reporta "23 tools / 8 resources", pero un smoke stdio del `@beyondnet/evolith-mcp` en ejecución devuelve **35 tools / 9 resources** (`tools/list`/`resources/list`). La fuente `api.catalog.ts` hardcodea los conteos como strings de descripción. Fix: derivar los conteos/catálogo del registry vivo de tools+resources del MCP (o regenerarlos en CI, cf. GT-445). **EN-PROGRESO (rama): añadido `scripts/gen-api-catalog.mjs` (introspecciona el MCP server vivo) → `api.catalog.generated.ts` commiteado; `api --list` ahora muestra los 35 tools / 9 resources reales con conteos derivados de los arrays, y el footer obsoleto `evolith mcp serve` → `evolith-mcp serve`. Follow-on: enumeración completa de SCHEMAS/COMMANDS + guard de CI que regenere y compare.** | `Evolith CLI` | Cross | P2 | S | `COMPLETADO` |
 | [`GT-465`](./gap-reference-catalog.es.md#gt-465) | ✅ **Hecho:** `kind-cluster.yaml` con `disableDefaultCNI:true` (kindnet off → Cilium aplica la política; el README añade el paso de instalación de Cilium); `deploy/kubernetes/network-policies.yaml` (22 políticas) codifica el modelo §7 — default-deny por ns de producto + allows DNS/broker/Core/OTLP/ingress/intra-ns, con el invariante estructural de que `evolith-core` NO tiene ruta al :5672. **kindnet no aplica NetworkPolicy → el modelo default-deny quedaba sin efecto.** Follow-on: aserciones allow/deny en G1. Riesgo §15 #13 (🟡). | `Infra` | Release | P2 | M | `COMPLETADO` |
 | [`GT-464`](./gap-reference-catalog.es.md#gt-464) | **Broker RabbitMQ = dependencia crítica compartida.** §5.6/§15: mitigado — el outbox transaccional de MMS (validado en vivo) hace las caídas del broker sin pérdida (el productor commitea, los consumidores se ponen al día al reconectar); la readiness nunca depende del broker (§5.4), así que una caída degrada solo frescura, nunca correctitud. Acción permanente: monitoreo + broker con quorum de ≥3 nodos + alertas bus-disconnected/lag. Riesgo §15 #10 (🟠, mitigado → DIFERIDO). | `Infra` | Cross | P2 | S | `DIFERIDO` |
-| [`GT-447`](./gap-reference-catalog.es.md#gt-447) | **MILESTONE — Objetivo 1: stack completo FUNCIONAL EN LOCAL (Docker/Kubernetes).** Levantar el chain completo — Tracker BFF/API → Evolith Core (CLI, core-api, MCP, agent-runtime) — con adapters REALES (no stubs), integración real Tracker↔Core `evaluate()`, y la UI (tracker-web) conectada a las URLs LOCALES. El refactor de diseño de la UI se difiere a Fase 2. Bring-up de un comando (docker-compose / kind). Reúne el subset M1 de GT-435: GT-438 (adapters reales), GT-446 (integración Tracker + DB local), GT-436 (publicar paquetes 1.0.0 reales en npm — cuando estén genuinamente listos), GT-439 (auth fail-closed + tenant guard), GT-440 (observabilidad), compose/k8s local. Solo HITL real / pen-test relajados para local. | `Cross` | Cross | P0 | L | `PENDIENTE` |
+| [`GT-447`](./gap-reference-catalog.es.md#gt-447) | **MILESTONE — Objetivo 1: stack completo FUNCIONAL EN LOCAL (Docker/Kubernetes).** Levantar el chain completo — Tracker BFF/API → Evolith Core (CLI, core-api, MCP, agent-runtime) — con adapters REALES (no stubs), integración real Tracker↔Core `evaluate()`, y la UI (tracker-web) conectada a las URLs LOCALES. El refactor de diseño de la UI se difiere a Fase 2. Bring-up de un comando (docker-compose / kind). Reúne el subset M1 de GT-435: GT-438 (adapters reales), GT-446 (integración Tracker + DB local), GT-436 (publicar paquetes 1.0.0 reales en npm — cuando estén genuinamente listos), GT-439 (auth fail-closed + tenant guard), GT-440 (observabilidad), compose/k8s local. Solo HITL real / pen-test relajados para local. **EN-PROGRESO (`9f4d592b`):** el **stack Core levantó FUNCIONAL en kind** — `local-test.sh kind-apps-up` (rutas repunteadas post-refactor) buildea las 3 imágenes, crea el cluster `evolith`, carga imágenes, instala los 3 charts Helm; los **3 pods `1/1 Running`**, rollouts verdes. Smoke verificado: `/health` de core-api (envelope ADR-0073), mcp y agent-runtime OK, y **`POST /v1/agent/handle` ejecutó la cadena gobernada completa** (resolve-context→select-capability→policy-preflight→harness-execute→core-evaluate→policy-validate→completed, `verdict: PASS`, `policyEngine: opa`). **Pendiente:** el chain del Tracker BFF/API→Core (cross-repo, GT-446) + la UI en navegador. | `Cross` | Cross | P0 | L | `EN-PROGRESO` |
 | [`GT-448`](./gap-reference-catalog.es.md#gt-448) | **MILESTONE — Objetivo 2: PRODUCCIÓN en la VPS (Coolify + Kubernetes), UI incluida** — tras completar el Objetivo 1 (GT-447) y validarlo. Reúne el subset M2 de GT-435 — los ítems del paso a la VPS: GT-324 (CD deploy), GT-437 (CI/CD del agent-runtime), GT-441 (HITL real), GT-442 (secrets/DB prod), GT-443 (reliability), GT-444 (pen-test), GT-445 (reconciliación de docs) + el refactor de diseño de UI de Fase 2. (GT-436 publicación npm 1.0.0, GT-439 auth fail-closed y GT-440 observabilidad movidos al Objetivo 1.) | `Cross` | Cross | P1 | XL | `PENDIENTE` |
 | [`GT-435`](./gap-reference-catalog.es.md#gt-435) | EPIC — Camino a Producción del diagrama conceptual de la suite (Core hubs → Hermes/Agent Runtime → Exposición CLI/API/MCP → Tracker → satélites). Evaluación 2026-07-04: Core ~95% listo (L4); el único bloqueante de CD activo es `GT-324`; la distribución está bloqueada por la deprecación a 0.0.1; el agent-runtime usa stubs por defecto; el Tracker es un scaffold .NET real pero desfasado del diseño actual de Core. **Umbrella — descompuesto en `GT-436`…`GT-446` (+ `GT-324`), organizado en dos milestones: `GT-447` (Objetivo 1 — funcional local) y `GT-448` (Objetivo 2 — producción).** | `Cross` | Cross | P0 | XL | `PENDIENTE` |
 | [`GT-436`](./gap-reference-catalog.es.md#gt-436) | Publicar los paquetes npm. El scope viejo `@evolith/*` estaba contaminado con historial publicado (1.0.x/1.1.x/2.0.0-beta/tombstones) que bloqueaba un 1.0.0 limpio, así que se renombró toda la familia a un scope nuevo unificado. **HECHO (0edaa22b): los 7 libs publicados a `1.0.0` limpio bajo `@beyondnet/evolith-*` (core-domain, infra-providers, core, agent-runtime, sdk, mcp, cli — todos HTTP 200 en el registry). Viejos `@evolith/*` deprecados apuntando a los nuevos (4 quedaron en estado 404 corrupto del registry, inservibles de todos modos).** Follow-on: barrido de docs `@evolith/*` → `@beyondnet/evolith-*`. | `CLI` | Cross | P0 | M | `COMPLETADO` |
@@ -547,7 +547,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida
 | [`GT-246`](./gap-reference-catalog.es.md#gt-246) | Implementar experimentos Chaos Mesh/Litmus | `QA` | Cross | P3 | L | `COMPLETADO` |
 
 
-**Progreso:** 496 / 532 completados · 20 en progreso · 14 pendientes · 2 diferido
+**Progreso:** 496 / 532 completados · 21 en progreso · 13 pendientes · 2 diferido
 
 **Oleada 2026-06-23 (auditoría profunda de Winston III):** Añadidos 14 gaps nuevos `GT-212`…`GT-225` del Winston Audit Playbook que cubren: higiene de estado ADR (GT-212), metadata + presupuestos operativos + corpus de guías por topología (GT-213, GT-217, GT-219), observabilidad + OpenAPI en controladores REST (GT-214, GT-215), paridad de input-schemas OPA + densidad de tests por topología (GT-216, GT-222), plantillas de rollback + on-call de Fase 05 (GT-218), cobertura de ramas CLI + paridad de envelope --format + limpieza de skip-list (GT-220, GT-224, GT-225), audit logging HTTP de MCP (GT-221), y tests e2e de paridad cross-surface (GT-223).
 

diff --git a/reference/core/control-center/gaps/gap-tracking.md b/reference/core/control-center/gaps/gap-tracking.md
@@ -95,7 +95,7 @@ This board is the single source of truth for technical debt, gaps, opportunities
 | [`GT-460`](./gap-reference-catalog.md#gt-460) | **`api` command's MCP-surface counts are hardcoded and drift from the live server.** `api -l` reports "23 tools / 8 resources", but a stdio smoke of the running `@beyondnet/evolith-mcp` server returns **35 tools / 9 resources** (`tools/list`/`resources/list`). Source `api.catalog.ts` hardcodes the counts as description strings. Fix: derive the counts/catalog from the live MCP tool+resource registry (or regenerate them in CI, cf. GT-445). **IN-PROGRESS (branch): added `scripts/gen-api-catalog.mjs` (introspects the live MCP server) → checked-in `api.catalog.generated.ts`; `api --list` now shows the real 35 tools / 9 resources with counts derived from the arrays, and the stale `evolith mcp serve` footer → `evolith-mcp serve`. Follow-on: full SCHEMAS/COMMANDS enumeration + a CI guard that regenerates and diffs.** | `Evolith CLI` | Cross | P2 | S | `DONE` |
 | [`GT-465`](./gap-reference-catalog.md#gt-465) | ✅ **Done:** `kind-cluster.yaml` sets `disableDefaultCNI:true` (kindnet off → Cilium enforces policy; README adds the Cilium install step); `deploy/kubernetes/network-policies.yaml` (22 policies) codifies the §7 model — default-deny per product ns + DNS/broker/Core/OTLP/ingress/intra-ns allows, with the structural invariant that `evolith-core` has NO path to :5672. **kindnet doesn't enforce NetworkPolicy → the default-deny model was silently ineffective.** Follow-on: allow/deny assertions in G1. Risk §15 #13 (🟡). | `Infra` | Release | P2 | M | `DONE` |
 | [`GT-464`](./gap-reference-catalog.md#gt-464) | **RabbitMQ broker = shared critical dependency.** §5.6/§15: mitigated — MMS's transactional outbox (validated live) makes broker outages lossless (the producer commits, consumers catch up on reconnect); readiness never gates on the broker (§5.4), so an outage degrades freshness only, never correctness. Standing action: monitoring + a quorum broker with ≥3 nodes + bus-disconnected/lag alerts. Risk §15 #10 (🟠, mitigated → DEFERRED). | `Infra` | Cross | P2 | S | `DEFERRED` |
-| [`GT-447`](./gap-reference-catalog.md#gt-447) | **MILESTONE — Objective 1: full stack FUNCTIONAL LOCALLY (Docker/Kubernetes).** Bring up the whole chain — Tracker BFF/API → Evolith Core (CLI, core-api, MCP, agent-runtime) — with REAL adapters (not stubs), real Tracker↔Core `evaluate()` integration, and the UI (tracker-web) connected to the LOCAL URLs. UI design refactor is deferred to Phase 2. One-command bring-up (docker-compose / kind). Gathers the M1 subset of GT-435: GT-438 (real adapters), GT-446 (Tracker integration + local DB), GT-436 (publish real 1.0.0 packages to npm — when genuinely ready), GT-439 (fail-closed auth + tenant guard), GT-440 (observability), local compose/k8s. Only real HITL / pen-test relaxed for local. | `Cross` | Cross | P0 | L | `PENDING` |
+| [`GT-447`](./gap-reference-catalog.md#gt-447) | **MILESTONE — Objective 1: full stack FUNCTIONAL LOCALLY (Docker/Kubernetes).** Bring up the whole chain — Tracker BFF/API → Evolith Core (CLI, core-api, MCP, agent-runtime) — with REAL adapters (not stubs), real Tracker↔Core `evaluate()` integration, and the UI (tracker-web) connected to the LOCAL URLs. UI design refactor is deferred to Phase 2. One-command bring-up (docker-compose / kind). Gathers the M1 subset of GT-435: GT-438 (real adapters), GT-446 (Tracker integration + local DB), GT-436 (publish real 1.0.0 packages to npm — when genuinely ready), GT-439 (fail-closed auth + tenant guard), GT-440 (observability), local compose/k8s. Only real HITL / pen-test relaxed for local. **IN-PROGRESS (`9f4d592b`):** the **Core stack came up FUNCTIONAL on kind** — `local-test.sh kind-apps-up` (paths repointed post-refactor) builds the 3 images, creates the `evolith` cluster, loads images, installs the 3 Helm charts; **all 3 pods `1/1 Running`**, rollouts green. Smoke verified: core-api `/health` (ADR-0073 envelope), mcp and agent-runtime OK, and **`POST /v1/agent/handle` ran the full governed chain** (resolve-context→select-capability→policy-preflight→harness-execute→core-evaluate→policy-validate→completed, `verdict: PASS`, `policyEngine: opa`). **Remaining:** the Tracker BFF/API→Core chain (cross-repo, GT-446) + the browser UI. | `Cross` | Cross | P0 | L | `IN-PROGRESS` |
 | [`GT-448`](./gap-reference-catalog.md#gt-448) | **MILESTONE — Objective 2: PRODUCTION on the VPS (Coolify + Kubernetes), UI included** — after Objective 1 (GT-447) is done and validated. Gathers the M2 subset of GT-435 — the VPS-pass items: GT-324 (CD deploy), GT-437 (agent-runtime CI/CD), GT-441 (real HITL), GT-442 (secrets/DB prod), GT-443 (reliability), GT-444 (pen-test), GT-445 (doc reconcile) + the Phase-2 UI design refactor. (GT-436 npm 1.0.0 publish, GT-439 fail-closed auth and GT-440 observability moved to Objective 1.) | `Cross` | Cross | P1 | XL | `PENDING` |
 | [`GT-435`](./gap-reference-catalog.md#gt-435) | EPIC — Road to Production of the conceptual suite diagram (Core hubs → Hermes/Agent Runtime → Exposure CLI/API/MCP → Tracker → satellites). Assessment 2026-07-04: Core ~95% ready (L4); the sole active CD blocker is `GT-324`; distribution blocked by the 0.0.1 package deprecation; agent-runtime defaults to stubs; Tracker is a real .NET scaffold but lagging the current Core design. **Umbrella — decomposed into `GT-436`…`GT-446` (+ `GT-324`), organized under two milestones: `GT-447` (Objective 1 — local functional) and `GT-448` (Objective 2 — production).** | `Cross` | Cross | P0 | XL | `PENDING` |
 | [`GT-436`](./gap-reference-catalog.md#gt-436) | Ship the npm packages. The old `@evolith/*` scope was polluted with published history (1.0.x/1.1.x/2.0.0-beta/tombstones) that blocked a clean 1.0.0, so the whole library family was renamed to a fresh unified scope. **DONE (0edaa22b): all 7 libs published at a clean `1.0.0` under `@beyondnet/evolith-*` (core-domain, infra-providers, core, agent-runtime, sdk, mcp, cli — all HTTP 200 on the registry). Old `@evolith/*` deprecated pointing to the new names (4 are in a broken 404 registry state and unusable anyway).** Follow-on: sweep the docs from `@evolith/*` → `@beyondnet/evolith-*`. | `CLI` | Cross | P0 | M | `DONE` |
@@ -547,7 +547,7 @@ This board is the single source of truth for technical debt, gaps, opportunities
 | [`GT-246`](./gap-reference-catalog.md#gt-246) | Implement Chaos Mesh/Litmus experiments | `QA` | Cross | P3 | L | `DONE` |
 
 
-**Progress:** 496 / 532 done · 20 in progress · 14 pending · 2 deferred
+**Progress:** 496 / 532 done · 21 in progress · 13 pending · 2 deferred
 
 **Wave 2026-06-23 (Winston deep audit III):** Added 14 new gaps `GT-212`…`GT-225` from the Winston Audit Playbook covering: ADR status hygiene (GT-212), topology manifest metadata + operational budgets + guidance corpus (GT-213, GT-217, GT-219), REST controller observability + OpenAPI (GT-214, GT-215), OPA input-schema parity + per-topology test density (GT-216, GT-222), SDLC Phase 05 rollback + on-call templates (GT-218), CLI branch coverage + envelope format coverage + skip-list cleanup (GT-220, GT-224, GT-225), MCP HTTP audit logging (GT-221), and cross-surface parity e2e tests (GT-223).