Implementation Status โ historical feature inventory
Not an architectural or build source of truth. This inventory was last
comprehensively reviewed on 2026-06-24 and contains point-in-time feature
notes. Executable code, migrations, tests, and the exact deployed commit are
authoritative for what exists. Accepted ADRs are authoritative for intended
architecture. For the managed Hermes path use
ADR-046, its
remediation ledger, and the
machine contract.
A row below is useful navigation, not proof. Before relying on it, verify the
linked controller/entity/component and the relevant test or live acceptance
path. Do not implement a legacy runtime, prompt, review, polling, projection,
R2/base64, or host-workspace shape merely because an older row describes it.
Past Week โ Shipped 2026-05-27 โ 2026-06-04โ
Major merges since the 2026-05-25 review that are NOT yet expanded into the per-section tables below. Each is filed against the section it touches so future re-syncs can promote the row in-place.
| PR | Section | What |
|---|
| #1604 | ยง15 / Learning loop | New correction_embeddings table โ Phase 1 of #1360 learning-loop closure. Uses OpenAI directly for embedding generation, not OpenRouter โ flagged as a possible exception to ADR-026; pending Eusden confirmation whether deliberate or drift. |
| #1602 / #1613 / #1199 | ยง5 Onboarding briefs | environment_profiles โ client_briefs rename fully shipped (all merged 2026-06-04 under #632). DB-table rename + client_brief_revisions audit table via #1602 (migration 1785500000001-RenameEnvironmentProfilesToClientBriefs.ts, closes #1172); API module / entity / controller / route + permission guards via #1613 (closes #1173) โ module is now api/src/client-briefs/, entity ClientBrief, route /client-briefs/*, old /environment-profiles/* paths kept as 308 redirects (slated for removal ~30 days after the FE path swap); frontend copy + API client via #1199 (closes #1174). |
| #1599 | ยง15 / Resilience | OpenRouter CircuitBreaker moved to Redis (last in-process CB caller removed) so the multi-pod active-active deployment converges on a single shared circuit state. |
| #1584 / #1450 | ยง15, ยง16 | Decommission RailwayPerOrgProvisioner โ only shared_railway and ecs_per_org agent runtimes remain. Implements ADR-028. Supersedes the 2026-05-22 "soak ongoing" claim from #589. |
| #1559 | ยง17 / CI | dev โ staging โ main promotion flow is now CI-enforced โ guard workflow is a required status check that rejects PRs to main not originating from staging (and to staging not from dev). Companion doc: docs/promotion-flow.md. |
| #1537 | ยง1 / domains | Domain canonicalization: h852.work = dev, h853.work = staging, h.work = prod. Sweep any older docs using stale subdomain names. |
| #1583 / #1506 / #1493 | ยง1 / auth | Cross-org IDOR fix on conversations + fail-closed auth + restore @Public() on routes broken by the global guard (webhook ingress, bootstrap). Public-auth surface audit landed simultaneously. |
| #1502 / #1598 | ยง15 / tool gateway | HERMES_TOOLSETS is now wired from the toolsManifest + tool-gateway client โ Specialist-scoped tool surfaces no longer rely on env-var allowlists. |
| #1432 | ยง6 / channels | Gmail Pub/Sub webhook for inbound email (closes #686). |
| #1526 + #1528 | ยง13 / KB | KB search endpoint for Expert workspace (backend) + KB search panel UI. |
| #1551 / #1433 | ยง10 / billing | Grace-period gating + /ops/billing surfacing for payment-failure states. |
| #1475 | ยง10 / billing | In-app notifications on payment failure. |
| #1508 | ยง11 / SLA | Per-org SLA config + Slack breach alerting. |
| #1530 / #1533 | ยง8 / Expert workspace | Customer history timeline (backend + FE). |
| #1549 / #1474 | ยง3 / client portal | Dedicated client notifications drawer. |
| #1083 | ยง14 / Tavus | Tavus expert-application interview integration fixes. |
| #1442 | ยง6 / channels | Email cutover rollback runbook. |
| #1498 | ยง6 / Slack | Slack OAuth install runbook. |
| #1577 | ยง17 / infra | terraform-apply is now workflow_dispatch-only โ no infra change applies on push. |
| #1510 | ยง1 / DEMO_MODE | Audit + CI guard preventing DEMO_MODE=true from leaking into a production deploy. |
| #1522 | ยง15 / RuntimeToolExecutor | Added order_lookup tool to the RuntimeToolExecutor surface. |
#1604 / ADR-026 caveat: The correction_embeddings table generates embeddings via the OpenAI SDK directly, not OpenRouter. ADR-026 says "embed, chat, rerank" should route through OpenRouter. Until Eusden confirms this is a deliberate per-pipeline exception (vs. a drift), do not promote ADR-026 to "live for all embedding paths".
1. Authentication & Rolesโ
| Feature | Status | Notes |
|---|
| Email + password login | โ
Complete | POST /auth/login โ JWT; auth.service.ts |
| Email OTP (passwordless) | โ
Complete | POST /auth/request-otp + POST /auth/verify-otp |
| Onboarding OTP (invite flow) | โ
Complete | POST /auth/send-invite-otp + POST /auth/verify-invite-otp; single-use OTP per invite token |
| Demo login (DEMO_MODE) | โ
Complete | POST /auth/demo-login; supports superadmin, account_manager, expert, client; non-prod only. Maps to canonical seed users: amy@acmefinancial.com (client), expert1@humanwork.dev (expert), am1@humanwork.dev (AM), e@humanity.org (superadmin). CORS auto-allows Vercel dev/staging when DEMO_MODE=true. |
| JWT generation + validation | โ
Complete | RS256 JWT with sub, email, name, platformRole, orgMemberships[]; 7-day expiry |
| 2FA (TOTP) | โ
Complete | TOTP via otplib; POST /auth/2fa/setup + POST /auth/2fa/verify; qrcode generation |
| Role-based routing (frontend) | โ
Complete | getRoleRedirect() in AuthContext; superadmin โ /ops/clients, expert โ /workspace/queue, account_manager โ /ops/clients, client โ /client/chat. Legacy /am/* and /superadmin/* redirect to matching /ops/* routes. |
| Platform roles | โ
Complete | superadmin, account_manager, expert, ai_operator, org_admin, org_member, client_admin, client_member |
| Org memberships (owner/admin/member/billing) | โ
Complete | OrgMembership entity; encoded in JWT |
| Row-level security (RLS) | โ
Complete | PostgreSQL RLS policies in 6 migrations (009, 013, 017, 027, 033, + WhatsApp whitelist); two-tier internal/client domain policy; SQLite test environments skip via guard |
2. Client Onboardingโ
2026-05-10 rebuild (PRs #267โ271): Client onboarding rebuilt as a 3-step SPA at single URL /onboarding/start?token=โฆ โ no page reloads between steps. Channel Setup, Teammates, and Billing steps removed from the wizard (Channels and Billing are still reachable post-onboard from /client/settings/*).
| Feature | Status | Notes |
|---|
| Phase 0 โ validation gate (AM-side) | โ
Complete | GET /am/orgs/:orgId/phase0-status; hard-blocks until company info, specialist, AM profile, trial date all pass |
| Phase 1.1 โ company info (AM creates org) | โ
Complete | Name, slug, industry, domains, email, website, country, timezone; real-time slug validation |
| Phase 1.2 โ assign specialists | โ
Complete | Multi-specialist assignment with primary designation; no confidence/review delivery field; OrgSpecialistAssignment entity |
| Phase 1.3 โ AM profile | โ
Complete | Global AM profile (shared across orgs) |
| Phase 1.4 โ send client invite | โ
Complete | ClientInvite token (7-day expiry); resend extends window; stale org auto-archives after 90 days |
| Step 1.4 wizard โ send button | โ
Complete | PR #243: was permanently disabled due to trialEndDateSet pre-check; fixed with client-side override so button enables when other gates pass |
| Step 1.4 wizard โ Copy Onboarding Link | โ
Complete | PR #243: "Copy Onboarding Link" button now available before invitation is sent |
| Step 1.4 wizard โ Complete Setup CTA | โ
Complete | PR #243: "Complete Setup" CTA added for orgs already in pending_client_confirmation status |
| Client onboarding SPA โ 3 steps | โ
Complete | PRs #267โ271 (2026-05-10): Workspace Setup โ Your h.work Team โ Done; single URL /onboarding/start?token=โฆ; no page reloads between steps |
| Step 1: Workspace Setup | โ
Complete | Email field as disabled input (not plain text); inline [input].h852.work slug picker; flat sorted timezone list with (GMT +X:00) City format; submit button surfaces specific validation errors on click |
| Step 2: Your h.work Team | โ
Complete | Read-only specialist preview + AM email + AM name surfaced; Specialist monthly rate displayed with override/catalog source caption (PR #518 / #498 closed) |
| Step 3: Done | โ
Complete | "Continue to your Workspace" โ /client/chat (auto-authenticated); welcome email sent |
| Onboarding progress bar | โ
Complete | Full-bleed, equal-width segments, correct active/inactive colors |
| Idempotent re-visits | โ
Complete | Invitation accepted status still allows org/specialist/slug/profile fetches; validateInvitationToken no longer 410s when org is active |
| Phase 2.1 โ OTP + password + profile | โ
Complete | Email OTP verification; password set; name/title/phone fields (entry point preserved at /accept-invite) |
| Phase 2.2 โ confirm company info + slug | โ
Complete | Slug reserved atomically; immutable after confirmation; slug alias system for rebrands |
| Phase 2.3 โ meet your specialist | โ
Complete | Read-only specialist preview; team composition hidden from client |
| Phase 2.4 โ channels setup (in onboarding) | โ Removed | Channels setup moved out of onboarding to post-onboard /client/settings/channels. Email + corporate-domain whitelist seeded automatically at org creation. |
| Phase 2.5 โ invite teammates / billing (in onboarding) | โ Removed | Both moved out of onboarding to /client/settings/team and /client/settings/billing post-onboard. |
| Phase 2.6 โ completion | โ
Complete | Status โ active; trial starts; welcome emails sent (no longer references "Invite your team" or "Set up billing"); invite token invalidated |
| Slug validation rules | โ
Complete | Format ^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$; reserved words blocked; personal domains blocked; never recycled |
| Stale org auto-archive | โ
Complete | StaleOrgService; 90-day window |
| Business context import (onboarding wizard) | โ Not built | USER_STORIES C-O6 (P1 gap) โ no upload or config UI for initial knowledge base |
2a. Client Settings & Team Managementโ
Routes: /client/settings/*. Old /portal/admin/* and /client/admin/* routes redirect here.
| Feature | Status | Notes |
|---|
Client settings route (/client/settings) | โ
Complete | Redirects to /client/settings/profile; replaces /portal/admin/* |
Profile settings (/client/settings/profile) | โ
Complete | Name, avatar, phone, title, bio; all roles |
Team view (/client/settings/team) | โ
Complete | All roles can view member list; GET /admin/members |
| Self-service team invites | โ
Complete | POST /admin/members/invite; accessible to org_admin (admin/owner orgRole) |
| Remove team member | โ
Complete | DELETE /orgs/:orgId/members/:userId; Admin/Owner only via OrgRolesGuard("admin") |
| Role management (change member roles) | โ
Complete | PATCH /admin/members/:id/role; Admin/Owner can change roles up to Admin level |
| Workspace roles (Owner/Admin/Billing/Member) | โ
Complete | OrgMembership.orgRole; encoded in JWT; 4-tier model fully wired in UI and API |
| Transfer ownership | โ
Complete | POST /orgs/:orgId/transfer-ownership; Owner-only; guard enforced server-side |
| Leave workspace (self-service) | โ ๏ธ Partial | UI stub exists in /client/settings/team; self-removal API pending โ issue #148 |
Channel settings (/client/settings/channels) | โ
Complete | Admin/Owner only; channel connect/manage UI |
Billing settings (/client/settings/billing) | โ
Complete | Admin, Owner, Billing roles; plan, usage, payment method |
3. Client Portal Chatโ
| Feature | Status | Notes |
|---|
| Portal chat UI | โ
Complete | PortalChat.tsx (1,473 lines); conversation list sidebar + message thread |
| Create conversation | โ
Complete | POST /conversations; agent name auto-assigned from curated name pool |
| Send message | โ
Complete | POST /conversations/:id/messages; validated at org boundary |
| Receive Specialist response | โ
Complete | Managed Hermes ACP returns the canonical reply for the existing SessionDB session; Socket.io delivers updates and clients perform one bounded refresh after reconnect. No fixed polling fallback or Expert release gate. |
| Conversation history | โ
Complete | GET /conversations (list) + GET /conversations/:id (thread with paginated messages) |
| Keyword search | โ
Complete | GET /conversations/search?q=&orgId=; full-text via pg_trgm |
| Channel badge | โ
Complete | ChannelBadge.tsx; shows web / email / WhatsApp / Slack / Telegram with icon + color |
| Specialist persona display | โ
Complete | Client sees Specialist name, avatar, and full profile in the /client/chat dashboard right-panel carousel; expert identity never exposed. GET /client/specialists returns assigned Specialist personas. |
| Trial banner | โ
Complete | TrialBanner shown to client users; GET /client/trial-info |
| Internal notes hidden from client | โ
Complete | isInternal filter on message list; client role excluded via EXPERT_ROLES check |
| Read-only status badge (client) | โ
Complete | Client sees status as read-only badge; cannot change status |
| Client-facing approval UI (high-stakes actions) | โ Not built (P2 โ deferred) | USER_STORIES C-W8. Demoted from P0 โ P2 on 2026-05-23: MVP handles approval manually via the conversation channel since most work is done through communication. |
| Canonical sender identity | ๐ง ADR-046 remediation | Client-visible canonical replies retain the Specialist identity. Synthetic AI/Expert-review labels and Expert-edited projections are being removed; genuine later human corrections/follow-ups remain separately auditable. |
4. Expert Workspaceโ
| Feature | Status | Notes |
|---|
| Expert attention list | โ
Complete | /workspace/queue; explicit human requests and genuine failures scoped by expert_access; ordinary successful deliveries create no item |
| Filter by status | โ
Complete | Pending / in_progress / resolved filter; listPending() service method |
| Filter by org | โ
Complete | Org filter in queue service |
| Full conversation thread view | โ
Complete | TicketDetail.tsx; CustomerThread component; all messages shown |
| Canonical reply and failure evidence | ๐ง ADR-046 remediation | Exact Hermes locators identify canonical SessionDB rows. Confidence/risk/review response fields are being removed rather than retained as compatibility metadata; see the remediation ledger. |
| Correct delivered reply | โ
Complete | Human correction rewrites the exact canonical locator and is audited |
| Write genuine follow-up | โ
Complete | Expert can author an additional message without replacing the already-delivered Hermes reply |
| Send as Specialist persona | โ
Complete | Genuine follow-up is attributed to the Specialist; Expert identity is not exposed to the client |
| Resolve ticket | โ
Complete | resolve() endpoint; status โ resolved |
| Internal notes | โ
Complete | Note toggle in PortalChat (expert-only); is_internal + sender_id on messages; addInternalNote() API call |
| Conversation status dropdown | โ
Complete | Status <select> (pending/awaiting_client/resolved/snoozed) in PortalChat for expert role; PATCH /conversations/:id/status. No archived state โ it was collapsed into resolved (#2002). See conversation-status-lifecycle. |
| Assign to self | โ
Complete | "Assign to me" button in PortalChat; PATCH /conversations/:id/assign; assigned_expert_id on Conversation |
| Defer ticket | โ
Complete (backend) | defer() sets deferred_until; frontend defer UI not yet confirmed |
| Reassign queue item | โ ๏ธ Disabled | reassign() backend exists; pool model removed 2026-05-03; frontend reassign UI disabled pending new direct-assignment model |
| Queue refresh | ๐ง ADR-046 remediation | Target: scoped Socket.io mutation events plus one bounded reconnect/navigation refresh and zero idle full-list polling. Residual loops are tracked in the remediation ledger. |
| Explicit human-owned task decisions | โ
Complete | Task approval endpoints remain for genuine human-owned product operations, not for normal Hermes turns or tools |
| Tool execution | โ ๏ธ Partial | Hermes prefers progressively disclosed normal/native tools. Humanwork MCP supplies only missing capabilities; the narrow configured write-action compatibility carrier may gate one concrete server-owned side effect. |
| Expert profile + assignment UI | โ Not built | USER_STORIES E-O2, E-O3 (P1 gap) โ skill tags in User entity but no profile UI. Pool-based assignment is gone (ADR-007); assignment now via expert_access. |
| Correction categorization UI | โ ๏ธ Partial | Correction entity + POST /learning/corrections exist; UI for selecting error type not confirmed |
| Push notifications (critical escalations) | โ Not built | USER_STORIES E-P3 (P0 gap) |
| Native mobile app | โ Not built | USER_STORIES E-P4 (P1 gap) |
5. Conversation Managementโ
| Feature | Status | Notes |
|---|
| Conversation status | โ
Complete | PATCH /conversations/:id/status; pending / awaiting_client / resolved / snoozed (no archived โ collapsed into resolved, #2002). See conversation-status-lifecycle. |
| Snooze with resurface time | โ
Complete | snooze_until column on Conversation (migration 034); snoozeUntil in entity and frontend interface |
| Specialist assignment | โ
Complete | PATCH /conversations/:id/assign; assigned_expert_id on Conversation |
| Internal notes | โ
Complete | is_internal + sender_id on Message (migration 034); note toggle; filtered server-side in conversations.service.ts โ canSeeInternal role check in query builder excludes is_internal=true rows for client roles |
| Full-text search | โ
Complete | pg_trgm index; GET /conversations/search |
| Multi-tenant scoping | โ
Complete | All queries org-scoped; RLS enforced at DB layer |
| Audit trail | โ
Complete | AuditLog entity; AuditService records every significant action |
| SLA deadline tracking | โ
Complete | sla_deadline on ExpertQueueItem (migration 012-SlaDeadline) |
| SLA performance dashboard (client) | โ Not built | USER_STORIES C-V5 (P1 gap) |
6. Channel Adaptersโ
| Channel | Status | Notes |
|---|
| Web / portal | โ
Complete | Direct portal chat; POST /conversations/:id/messages |
| CORS fix (Vercel preview) | โ
Complete | PR #244: Vercel preview deployments (dynamic *-humanityprotocol.vercel.app URLs) now allowed in non-production environments via regex pattern |
| Email (Gmail API inbound polling) | โ
Complete 2026-06-05 | Primary inbound path. Gmail API polling via cron (*/30 * * * * * on Railway dev) shipped via PR #1722 (closes #1060). Uses ONE Google Workspace service account with domain-wide delegation to read each Specialist's mailbox (bob@h.work); no per-Specialist OAuth tokens. |
| Email (Gmail API outbound via DWD) | โ
Complete 2026-06-05 | Primary outbound path. Replies sent from the Specialist's gsuite mailbox via DWD impersonation (PR #1722). Specialist mailboxes are provisioned by organizations.service.ts enqueuing WORKSPACE_JOB_CREATE on SpecialistโOrg assignment; the processor calls Admin SDK users.insert. |
| Email (Cloudflare inbound) | โ ๏ธ Fallback during 2-week soak | Cloudflare email worker (deployed 2026-05-10) is fallback while we soak the Gmail polling path. Routes @dev.h852.work โ dev API and @h852.work โ staging API. Worker sends base64 RFC822; API parses with mailparser at POST /channels/email/inbound; HMAC-SHA256 verify via CLOUDFLARE_EMAIL_WEBHOOK_SECRET. Decommission tracked in #1440/#1441 (still open). |
| Email (Resend outbound) | โ
Transactional only | No longer the Specialist conversation channel. Resend is reserved for invites/onboarding/transactional email via email/email.service.ts. Auto-replies use verified email domain (not dev.* subdomain). Templates redesigned 2026-05-10. |
| WhatsApp (Twilio) | โ
Complete | HMAC-SHA1 signature verification; number pool (โ20 numbers); whitelist enforcement; POST /channels/whatsapp/inbound; real media/attachments reach managed Hermes; each successful canonical reply dispatches once; reply truncated to 4096 chars before Twilio send; boot guard logs warning when TWILIO_AUTH_TOKEN is missing; deactivated-org check before creating any conversation. |
| Slack | โ ๏ธ Partial | Adapter implemented (HMAC-SHA256 verify; app_mention + message events); Slack org resolution wired (resolveSlackOrgId maps team_id/enterprise_id/app_id/channel_id โ org via stored Slack integration credentials); still blocked on live Slack credentials (BLK-004) |
| Telegram | โ
Complete | Per-org tokens in integration_credentials; TelegramModule (fix/issue7) |
| Microsoft Teams | โ ๏ธ Built, not launched | Transport complete and on the V2 session path; JWT validation complete. Blocked on fail-open auth, dedup, thread model and mention-gating โ see parity plan. BLK-032 (credentials) remains for launch. |
| WeChat | โ Stub | Official Account webhook XML parsing not done (BLK-042, P3) |
| Channel health API | โ
Complete | GET /orgs/:orgId/channels/status; GET /orgs/:orgId/channels/webhook-urls |
| Integration credentials (encrypted) | โ
Complete | AES-256-GCM encryption; integration_credentials table; CRUD at /orgs/:orgId/integrations |
| Circuit breaker | โ
Complete | Implemented for Slack, Email, Teams error handling |
| Outbound org webhooks | ๐ฎ Future | Signed payloads; per-org subscriptions โ in FUTURE_REQUIREMENTS.md |
6a. Third-Party Integrations (Nango + bespoke)โ
2026-05-22 model: Nango is the integration infrastructure platform โ covers the 700+ provider catalog (QuickBooks, Xero, HubSpot, Salesforce, etc.) via per-Org OAuth Connect Sessions. Bespoke services (Jumio, Shopify, Amazon SP-API) remain for vendors not in Nango or where deeper integration is required. Agent tool dispatch routes both via a single static registry. See PR #399.
| Feature | Status | Notes |
|---|
| Self-hosted Nango server (dev) | โ
Complete | PR #403 / #228. Railway-deployed; /health and /connection both 200 with dev secret. Public URL + API env wiring documented. |
| Self-hosted Nango server (staging/prod) | โ Not built | Tracked under #228 follow-on; needs staging + prod Railway projects + secret rotation procedure. |
NangoModule (NestJS) | โ
Complete | PR #399 / #229. api/src/integrations/nango/{nango.module,nango.service,nango.client}.ts. |
| Nango Connect Session (OAuth handoff) | โ
Complete | cfd05d76 / #421. createConnectSession issues per-Org session tokens; getConnection / listConnections / deleteConnection wired. Connection ids are Nango-GENERATED in the Connect-session flow (pinning connection_id is forbidden with a session token, live-verified 2026-07-22) โ the stored nango_connection_id in the credential row is authoritative, verified server-side at confirm via getConnection().end_user.organization.id. buildNangoConnectionId(orgSlug, provider) survives only as the legacy fallback for pre-session / script-imported connections and the executor's derivation fallback. |
| Nango connection revoke | โ
Complete | bf0c78b0. Deleted Nango connections treated as revoked; legacy local credential rows cleaned via e67ea995. |
| Static agent tool registry | โ
Complete | PR #399. api/src/agent-api/tool-registry.ts; GET /v1/agent-api/tools/:toolName; AgentToolKind = "bespoke" | "nango". |
| SA Nango catalog autocomplete + link-out | โ
Complete | #423. /ops/clients/:id integrations panel surfaces tool kind badge and links to Nango catalog. |
| QuickBooks (Nango) | โ ๏ธ Registered, not wired | quickbooks_query tool descriptor in registry with kind: "nango"; backend action handler + agent prompt wiring deferred. Supersedes the stub row in #176. |
| Xero (Nango) | โ ๏ธ Registered, not wired | xero_query tool descriptor in registry with kind: "nango"; same status as QuickBooks. |
| HKEX (Nango) | โ Not built | #176. Not in Nango catalog; needs bespoke or alt provider. |
| Shopify | โ
Complete (bespoke) | Pre-existing bespoke proxy; remains bespoke per #399 โ deeper integration than Nango exposes. |
| Amazon SP-API | โ
Complete (bespoke) | Pre-existing bespoke proxy; remains bespoke per #399. |
| Jumio (bespoke KYC) | โ ๏ธ Skeleton only | #230 โ assignee Dankovk. api/src/integrations/jumio/{jumio.module,jumio.service,jumio.client}.ts exist (122 LOC); jumio_lookup tool descriptor registered; JumioService.lookup() throws NotFoundException until per-Org IntegrationCredential row exists. Blocker: no Jumio sandbox account / API key on file โ procurement-side, not engineering. OQ-202 (per-Org vs HP-shared key) still open. |
| Per-Org integration credentials encryption | โ
Complete | #551 / PR #570. integration_credentials.encrypted_config now AES-256-GCM at rest via decryptConfig() helper; boot guard refuses prod without CREDENTIALS_ENCRYPTION_KEY. |
| Tool execution audit (per call) | โ
Complete | PR #399. Audit row emitted on every tool dispatch with model, provider, masked params; Jumio path uses buildJumioAuditPayload (PII-safe). |
| Tool execution metrics (success/failure per tool per org) | โ Not built | #176 work item; deferred until P0s clear. |
| Integration health monitoring + credential rotation | โ Not built | #176 work item; rotation procedure documented in Jumio PRD (#230). |
7. Specialist Managementโ
| Feature | Status | Notes |
|---|
| AM creates specialist | โ
Complete | admin-specialists.controller.ts; Specialist entity with name, avatar, routing email, skill tags |
| AM assigns specialist to org | โ
Complete | OrgSpecialistAssignment entity with direct managed delivery and an isPrimary flag; no confidence/review compatibility field |
| Multiple specialists per org | โ
Complete | Migration 024; multiple assignments supported |
| Specialist change request | โ
Complete | SpecialistChangeRequest entity (pending/fulfilled/declined) |
| Specialist routing email | โ
Complete | bob@h.work style dedicated routing address |
| Email outbound via Gmail Send (DWD service-account impersonation) | โ
Complete | Phase 2 ADR-0002 originally shipped per-OSA oauth_refresh_token_encrypted (#1065 / #1079); inbound dual-read (#1093); outbound dispatch (#1095), all 2026-05-29. 2026-06-05 update (PR #1722): architecture moved to ONE Google Workspace service account with domain-wide delegation impersonating each Specialist's mailbox โ no per-Specialist OAuth tokens. Cloudflare worker retained as inbound fallback during 2-week soak (#1440/#1441). |
| Named account lead assignment per org | โ Not built | USER_STORIES SA-C9 (P1 gap) โ no UI to set named AM per org |
8. Notifications & Real-Timeโ
| Feature | Status | Notes |
|---|
| WebSocket gateway (Socket.io) | โ
Complete | NotificationsModule; rooms: experts, org:<id>, pool:<id>; events: expert_queue_item_added, queue_item_resolved, agent_message_sent |
| SSE streaming (agent responses) | โ
Complete | POST /conversations/:id/messages/stream; server-sent events |
| In-app notifications (AppNotification) | โ
Complete | AppNotification REST + Socket.io delivery rail shipped via #915 (2026-05-27); item 1 of #170's 5-item scope. Push delivery / email delivery / prefs UI still pending under #170. |
| Realtime reconnect recovery | ๐ง ADR-046 remediation | Target: scoped mutation events plus one bounded reconnect/navigation refresh; residual polling loops are tracked in the remediation ledger. |
| Push notifications (mobile / browser) | โ Not built | USER_STORIES E-P3 (P0 gap) โ pending under #170 follow-ups |
9. Analytics & Reportingโ
| Feature | Status | Notes |
|---|
| Analytics page (superadmin) | โ
Complete | AnalyticsModule + controller; live data from DB: queue status, top request types, pool resolution times, auto-resolve rate, active experts. SA-B4 P0 gap resolved. |
| Client dashboard (summary) | โ ๏ธ Partial | Dashboard page exists; quota data live via GET /orgs/:orgId/quota; conversation counts from live API; volume chart mock |
| Conversation search | โ
Complete | Full-text via pg_trgm |
| Correction stats | โ ๏ธ Partial | LearningService stores corrections; no stats aggregation endpoint or UI confirmed |
| Expert leverage ratio | โ
Complete | SA-E4 โ /ops/analytics Expert leverage section + GET /ops/analytics/expert-leverage (SuperAdmin); from expert_access (ADR-007). PR #3199 |
| Per-org cost tracking | โ ๏ธ Partial | SA-B5 โ per-org LLM cost + Expert workload on /ops/billing?org=<id> (PRs #3195/#3200). Dollarized labour + infra cost โ gross margin still pending (#3196) |
| Autonomous handling rate | โ
Complete | auto_responded flag on Conversation; autoResolveRate surfaced in analytics API and superadmin analytics page |
| SLA performance dashboard | โ Not built | USER_STORIES C-V5 (P1 gap) |
10. Billing & Subscriptionsโ
2026-05-29 rail flip: Lago โ self-hosted Lago (Railway for dev; AWS for staging + prod โ AWS bring-up tracked in #1287) โ is the canonical billing rail โ Orb was abandoned. Invoicing is per-Specialist monthly rate (sum of assigned Specialists' resolved rates ร period), not plan-tier subscription. LagoProvider shipped via #1069; dual pricing strategy (plan_per_rate default, plan_overrides premium) via #1105; client invoice surface via #1155; ops billing UI via #1155 (note: #1165 was the originally-cited Phase-8 PR but was closed-unmerged and superseded by #1155); Phase-7 legacy fixed-plan teardown via #1016. Direct Stripe lives only inside Lago's PSP config. See docs/features/billing.md and docs/decisions/2026-05-29-lago-pricing-strategy.md.
| Feature | Status | Notes |
|---|
| Per-Specialist rate schema | โ
Complete | specialists.monthly_rate_config (catalog default; 364 roles populated in dev) + org_specialist_assignments.monthly_rate_config (AM override with optional rate_effective_from / rate_effective_until window) |
| AM rate override (per-org) | โ
Complete | PR #518 / #498 closed; override wins when its window is active, falls back to catalog default, then null |
| Onboarding rate display (client side) | โ
Complete | PR #518: GET /onboarding/:token/specialist returns monthlyRate: { amount, currency, source: 'override' | 'specialist' } | null; rendered via Intl.NumberFormat in Step 2 of 3-step SPA |
| Lago provider (canonical invoice rail) | โ
Complete | #1069 LagoProvider (2026-05-29); #1105 dual-strategy (LAGO_PRICING_STRATEGY=plan_per_rate default; plan_overrides requires Lago premium license). Self-hosted Lago โ Railway for dev; AWS for staging + prod (AWS bring-up tracked in #1287). See docs/superpowers/specs/2026-05-26-billing-provider-leveraged-design.md ยงOperational note. |
| Lago client invoice surface | โ
Complete | #1155 wired /client/settings/billing to Lago Manage Billing portal + per-Specialist subscriptions list (2026-05-31). |
| Lago ops billing UI (Phase 8) | โ
Complete | #1155 (#1165 was closed-unmerged, superseded by #1155): /ops/billing rebuilt on Lago โ subscription DataTable, sync-failure alert, Retry sync; nav opened from saOnly โ AM + SuperAdmin (2026-05-31). |
| Phase 7 legacy teardown | โ
Complete | #1016 removed legacy fixed-plan Stripe path from BillingController (2026-05-28). |
| Mid-month proration / assignment-event ledger | โ
Delegated to Lago | Lago handles calendar-day proration natively on its subscription engine; no separate ledger needed. Earlier #514 obsoleted by rail flip. |
| Direct Stripe integration | ๐๏ธ Removed | Lago wraps Stripe as its PSP. Legacy STRIPE_SECRET_KEY env retained only because Lago needs it; standalone Stripe code removed via #1016. |
| Request Finance disabled | โ
Complete | PR #219: ENABLE_REQUEST_FINANCE flag defaults to false; crypto payment path disabled unless explicitly re-enabled; RF code preserved but inactive |
| Message quota tracking | ๐ Re-scoped โ partial cleanup | GET /orgs/:orgId/quota; OrgThrottlerGuard. No longer a billing construct โ abuse protection only. Partial cleanup landed via PR #531 2026-05-23 (global APP_GUARD registration + /auth rate-limit decorator removed). Note: throttler was re-registered in shadow mode via #812 + webhook throttle #839; see ADR-021. |
| Client invoice view UI rewrite | โ
Wired | /client/settings/billing shows consolidated invoices + per-Specialist line items (Lago), shipped via #1155; JSON-safe serialization #1180. (#528) |
| Client payment collection (add card) | โ
Wired | Add payment method button โ GET /client/billing/checkout-url โ Lago Stripe Checkout URL (setup-mode); ensureCustomer eagerly links the customer to the org's Stripe provider (LAGO_STRIPE_PAYMENT_PROVIDER_CODE); Lago auto-charges finalized invoices off-session. (#1268) |
| Trial period | โ
Complete | 30-day default; trialStartedAt on Organization; TrialBanner in client portal |
| Trial state on billing page | โ
Complete | 2026-05-10 (commit 8f83779, issue #187): orgs without an active subscription now show "Trial โ N days remaining" / "Trial expired" instead of "Free plan" |
| Plan + usage page (client) | โ
Complete | Lago-backed (#1155). Per-Specialist line itemization shipped. |
| Invoice history / download | โ
Complete | Lago Manage Billing portal handles invoice history + PDF download (#1155). |
| VAT / tax ID | โ ๏ธ Partial | VAT field collected; Lago tax handling wiring still pending. |
| All-org subscriptions table (superadmin) | โ
Complete | /ops/billing rebuilt on Lago in #1155 (#1165 was closed-unmerged and superseded by #1155): stat cards (total/active/sync_failed), subscription DataTable, Retry sync. |
11. API Webhooks (Outbound)โ
| Feature | Status | Notes |
|---|
| Inbound webhooks (channels) | โ
Complete | Slack, Email, WhatsApp, Telegram all receive inbound webhooks |
| Outbound org-level webhooks | ๐ฎ Future | Signed payloads; per-org subscriptions โ spec in FUTURE_REQUIREMENTS.md; not started |
| Webhook URL helper | โ
Complete | GET /orgs/:orgId/channels/webhook-urls returns per-channel webhook URLs for client to configure |
12. Mobileโ
| Feature | Status | Notes |
|---|
| Responsive web (PWA) | โ
Complete | ServiceWorkerRegistrar in root layout; responsive Tailwind styles; manifest.json present with correct start_url (/workspace/queue) and shortcut URLs |
| Native mobile app (expert) | โ Not built | USER_STORIES E-P4 (P1 gap) |
| Push notifications | โ Not built | USER_STORIES E-P3 (P0 gap) |
13. Knowledge Base & AI Trainingโ
| Feature | Status | Notes |
|---|
| Correction capture | โ
Complete | Correction entity (factual_error, tone, missing_step, wrong_action); POST /learning/corrections; LearningService |
| Correction categorization UI | โ ๏ธ Partial | Error-type enum in entity; UI for selecting category not confirmed in workspace |
| Vector memory (agent) | โ ๏ธ Deprecated | Retrieval now lives via Haystack (api/src/haystack/*); agent_memories table is retained but unused. Issue #172 (agentic mode tool execution / checkpointing) was closed via PR #696 โ no longer the reactivation rationale. |
| KB ingestion from corrections | ๐ฎ Future | RF-0015 โ corrections refine the org KB through a downstream LearningService consumer |
| KB upload (business context) | โ
Complete | API and onboarding upload endpoint added via Haystack; client KB management UI delivered by humanwork#297 |
| Agent memory visibility (client) | โ
Complete | USER_STORIES C-T4 delivered by humanwork#297: /client/admin/knowledge-base supports list, upload, search, delete, detail chunks, and parse-status live updates |
| Feature | Status | Notes |
|---|
| Health dashboard | โ
Complete | /ops/health (SA only); HealthController; API + DB + Redis + channel adapter status |
| Prometheus metrics | โ
Complete | MetricsService + MetricsController; /metrics endpoint |
| Audit log viewer | โ
Complete | AuditLog entity; AuditLogController; /ops/audit (SA only โ #1238/#1298). Docs: docs/features/audit-log.md |
| Expert pool management (create/add member) | โ Removed | Expert pools removed 2026-05-03. Expert โ data access is now via expert_access (ADR-007). The legacy org_experts table is deprecated 2026-05-22 and dropped in #540 after soak. |
| Impersonation (superadmin) | โ
Complete | ImpersonationService; audit-logged; superadmin only |
| Stale org auto-archive | โ
Complete | StaleOrgService; 90-day threshold |
| Tool permission management (API) | โ
Complete | ToolPermission entity; PUT /orgs/:orgId/tool-permissions/:toolName |
| Tool permission management (UI) | โ Not built | USER_STORIES SA-P5 (P1 gap) โ API exists; no frontend |
| Per-org channel adapter health (superadmin UI) | โ Not built | USER_STORIES SA-P4 (P1 gap) โ API exists; not surfaced in superadmin UI |
| Named account lead per org (UI) | โ Not built | USER_STORIES SA-C9 (P1 gap) |
| Expert leverage ratio analytics | โ
Complete | SA-E4 โ /ops/analytics Expert leverage (clients & Specialist instances per Expert); from expert_access. PR #3199 |
| Humanity Protocol credential verification | โ ๏ธ Stub | /users/:id/hp-verify endpoint is a stub; integration not functional |
15. AI Agent Runtimeโ
| Feature | Status | Notes |
|---|
| Sole managed runtime | ๐ง ADR-046 remediation | Resident Hermes is supervised by hermes-run and the Bun machine. No local-only fallback, second Docker ACP transport, host config endpoint, or one-shot hydrate/flush path is allowed. Exact removal status is in the ledger. |
| Process supervision | โ
Contracted; verify pushed head | Hermes is launched through Bun.spawn, preserving fd 3-7, env/CA, memfd payloads, raw ACP relay, cancellation, child exit, and orderly shutdown. The native exec/execve helper is retired. |
| Turn content | ๐ง ADR-046 remediation | Humanwork raw-passes the actual inbound message as native ACP blocks: exact text remains text and an attachment remains its own standard resource/image/audio message referencing the object already written to AgentFS. Humanwork does not flatten, reject, or wrap native blocks and does not inject KB, history, persona, directives, tool grants, response schemas, delivery instructions, or synthetic envelopes. |
| Session filesystem | ๐ง ADR-046 remediation | One organization AgentFS is the sole agent-file authority. The API accesses its cloud authority directly; one supervisor-resident Bun machine owns the local writable overlay shared by conversation-scoped Hermes children. No per-session AgentFS database, R2/base64/host-workspace duplicate, or runner file API is permitted. |
| Transcript | ๐ง ADR-046 remediation | SessionDB is canonical. Completion returns exact Hermes locators; Postgres stores governance/routing metadata only. Projection construction, content/time deduplication, and fabricated unavailable rows are forbidden. |
| Warm path | ๐ง ADR-046 remediation | The supervisor-resident Bun machine retains one local organization AgentFS overlay. File-work boundaries use Turso's native plain pull -> local work -> pull -> push-if-dirty sequence; there is no held request, timer, Redis/event/revision/ACP sync signal, or empty push. Stable release/persona/skills/tools are established once per conversation configuration. |
| Tools | โ
Architecture; runtime probes required | Normal/native tools are primary, including terminal, filesystem, HyperSH Git, browser/network, and image capabilities. MCP fills only missing capabilities; Humanwork does not create per-turn grant narrowing. |
| Retrieval and memory | โ
On-demand architecture; live proof required | Hermes decides when to retrieve KB or other context. Humanwork does not perform a pre-turn KB query or inject a synthetic context block. Session memory remains native to AgentFS/SessionDB. |
| Delivery | ๐ง ADR-046 remediation | Every successful canonical reply is delivered once. Confidence, risk, review, clarification, task mode, or approval continuation cannot withhold it; a real failure remains a failure. |
| Realtime freshness | ๐ง ADR-046 remediation | Conversation, queue, and transcript updates use exact-locator events. AgentFS synchronization uses only explicit native Turso work boundaries, not a product event or long poll. Idle time performs no application interval poll, sync request, or full-transcript reread; explicit open/reload/refresh may make one bounded authoritative read. |
| Acceptance | โ Not complete until verified | Required evidence is ADR-046 ยงRequired acceptance evidence, including real-binary probes, exact-locator/idempotency tests, zero-idle-read proof, Percy 01-10 fresh conversations, reload persistence, and measured warm latency on the exact deployed commit. |
16. Per-Org Dogfood (acmefinancial)โ
2026-06-04 framing: Acme Financial is the first dogfood org. Eleanora Voss is the assigned KYC Specialist (per scripts/seed-dev.sh:429; eleanora@h852.work on dev). The prior "Bob" label was retired when the canonical seed was updated; references in older PR descriptions and ADRs may still say Bob โ these are historical and have been re-aligned in docs/example-flow.md, docs/USER_OPERATIONS_MANUAL.md, and the MVP_P0_RUNBOOK. This section tracks runtime state for the Acme/Eleanora/KYC stack so contributors don't continue work against the stale generic-ecommerce or Bob-era frame. Sourced from #239 work items.
| Component | Status | Notes |
|---|
| Acme org seed (acmefinancial) | โ
Complete | Seeded in dev; amy@acmefinancial.com (client), Eleanora Voss assigned as primary Specialist. |
| Eleanora Voss Specialist persona | โ
Complete | Catalog entry + routing email (eleanora@h852.work); persona prompt merged via PR #244 (no more bare-prompt regression). |
KYC role template (kyc_ops.txt) | โ
Complete | agent/prompts/kyc_ops.txt declares jumio_lookup tool with customer_id + lookup_type (basic|enhanced|sanctions). Verified by agent/evals/test_kyc_role.py. |
| SOUL + skills for Acme | โ
Complete | orgs/acmefinancial/skills/kyc-ops/{jumio-lookup,sanctions-check,escalation-draft}/SKILL.md present. |
jumio_lookup tool descriptor | โ
Complete | Registered in api/src/agent-api/tool-registry.ts; dispatch wired via PR #399. |
jumio_lookup end-to-end | โ Not shipped | Bespoke Jumio backend (#230) skeleton-only; blocked on Jumio sandbox account. Eval test_kyc_role.py currently asserts the graceful "Jumio not_implemented โ escalate" branch only. |
| Per-Org sandboxed agent runtime | โ
Complete via ECS provisioner | #362 Phase A (per-org Hermes session isolation) shipped earlier; Phase B Railway-per-org provisioner landed 2026-05-22 via PR #589 and was subsequently decommissioned via PR #1584 / #1450 / ADR-028. Only supported agent runtimes are now shared_railway and ecs_per_org. |
| HP credential verification (Eleanora's KYC turn) | โ ๏ธ Stub | /users/:id/hp-verify endpoint still a stub (see ยง14); separate from Jumio path. |
| Acme channel adapters | โ ๏ธ Partial | Email (Cloudflare inbound + Resend outbound) and WhatsApp (Twilio) confirmed live; Slack landed 2026-05-26 via #816 (Connect OAuth) + #1219 (per-org signing_secret) โ see MVP_P0_RUNBOOK v2.0. |
| End-to-end smoke (F1 in #239) | โ Not built | Live smoke must cover Amy โ Eleanora managed Hermes session โ direct exactly-once outbound reply, then a separate optional Expert correction/follow-up. |
Gap Summaryโ
| Priority | Gap count | Examples |
|---|
| P0 gaps | 1 | Push notifications (E-P3). Notes: per-Org sandboxed agent runtime (#362) shipped 2026-05-22 via PR #589; the Railway-per-org code path was subsequently decommissioned in PR #1584 / #1450 per ADR-028 (only shared_railway and ecs_per_org remain). Client approval UI (C-W8) demoted from P0 โ P2 on 2026-05-23 โ manual approval via chat for MVP. |
| P1 gaps | 9 | Jumio bespoke (#230 โ blocked on sandbox account), business context import, SLA dashboard, expert profile UI, named account lead, tool permission UI, per-org channel health UI, HP credential verification, correction categorization UI, defer/reassign frontend. (Expert leverage ratio shipped 2026-06-24 via #3199.) |
| P2 gaps | 5 | Nango QuickBooks/Xero wiring (#176), invoice history, per-org gross-margin (partial: LLM cost + Expert workload shipped via PRs #3195/#3200; dollarized labour+infra cost pending #3196), inline ticket discussion, tool execution metrics |
| Future | 2 | Outbound webhooks, KB ingestion from corrections |
Status key: โ
Complete | โ ๏ธ Partial | โ Not built | ๐ฎ Future (in FUTURE_REQUIREMENTS.md)
Workstream Notes & Cleanup Targetsโ
Absorbed from the retired docs/technical-scopes.md on 2026-05-25. Only items still accurate against current code are kept; stale claims (LangGraph 4-node pipeline, R2 zero-impl, AgentMemory as live, Stripe as canonical billing, api/src/collab|tickets|seed|integrations/shopee, api/src/scheduler/ as unregistered, agent/placeholder/ as deletable) have been dropped.
Directory ownership (for parallel work)โ
Each scope below has roughly exclusive directory ownership; shared files require PR coordination.
| Area | Primary directories | Cross-ref ยงยง |
|---|
| Platform Core | api/src/{auth,common,admin,audit,users,health,config,database} | ยง1, ยง14 |
| Conversation delivery & Expert oversight | api/src/{conversations,expert-queue,notifications,learning,customers,specialists} | ยง3, ยง4, ยง5, ยง8 |
| Channels | api/src/{channels,email} (incl. channels/whatsapp/, channels/telegram/, channels/teams/) | ยง6 |
| Billing & Onboarding | api/src/{billing,onboarding,organizations} | ยง2, ยง10 |
| Integrations | api/src/integrations/ (shopify, amazon, jumio, nango, credentials), api/src/tools/ | ยง6a |
| AI Agent | agent/ (entire dir), api/src/{agentic,agents,agent-api}, api/src/haystack/, api/src/kb/ | ยง15, ยง16 |
| Client Portal FE | frontend/src/app/client/, frontend/src/app/onboarding/, frontend/src/components/client/ | ยง3 |
| Internal Surfaces FE | frontend/src/app/{workspace,ops}/, frontend/src/components/{internal,analytics}/ | ยง4, ยง9, ยง14 |
| Frontend Platform | frontend/src/{components/ui,components/shared,contexts,hooks,lib,__tests__}, frontend/src/app/login/ | โ |
| Analytics | api/src/analytics/, frontend/src/components/analytics/ | ยง9 |
| Infra & DevOps | k8s/, .github/workflows/, e2e/, scripts/, docker-compose.yml | โ |
Coordination-required shared files:
api/src/common/entities.ts โ all TypeORM entities. Touch via PR review.frontend/src/lib/api.ts โ comprehensive API client (~3.2K lines). Imported by every FE scope.frontend/src/contexts/AuthContext.tsx โ JWT parsing + role-based redirect; FE-wide.api/migrations/ โ append-only, sequentially numbered. Coordinate the next number in Slack before opening a PR.
Cleanup targets (verified 2026-05-25)โ
Real dead-code targets that still exist on disk:
| Target | Path | Action | Notes |
|---|
Legacy /am/* sub-pages | frontend/src/app/am/ | Delete | Root-level redirect to /ops/* already in place. |
Legacy /superadmin/* sub-pages | frontend/src/app/superadmin/ | Delete | Redirects to /ops/* already in place. |
| Orphan top-level routes | frontend/src/app/{dashboard,analytics,integrations,queue}/ | Delete | Not linked from current nav; no role redirect lands here. |
| Duplicate setup route | frontend/src/app/ops/clients/[id]/setup/step2/ | Delete | Keep step-2/. |
| Demo backdoor | frontend/src/lib/api.ts (demo login bypass branch) | Remove before launch | Confirmed P0 blocker in mvp-launch-checklist.md. |
Refactor channels.controller.ts | api/src/channels/channels.controller.ts (~2.1K LOC monolith) | Split per channel adapter | Tracked as part of channels follow-up. |
Previously listed but already deleted (do not re-add to cleanup lists): api/src/collab/, api/src/tickets/, api/src/seed/, api/src/integrations/shopee/. api/src/scheduler/ is NOT dead โ it is wired into health.module.ts and expert-queue.module.ts. agent/placeholder/ is retained as a deliberate local-dev fallback (see agent/placeholder/README.md); do not delete without coordinating with the agent team.
Suggested team groupings โ
| Team | Primary scopes | Primary skills |
|---|
| Platform Core | ยง1, ยง5, ยง14 | NestJS, TypeORM, PostgreSQL, WebSocket |
| Channels | ยง6 | Twilio, Slack/Teams APIs, Cloudflare workers |
| Commercial | ยง10, ยง9 analytics | Lago billing (per-Specialist monthly), onboarding UX, dashboards |
| Integrations | ยง6a | OAuth, Nango, Shopify/Amazon, credential mgmt |
| Intelligence | ยง15, ยง13 | Python, Hermes CLI, GPT-4o, pgvector, Haystack |
| Frontend | ยง3, ยง4, FE platform | Next.js 16, React 19, CSS, testing |
| Infrastructure | infra & DevOps | K8s, GitHub Actions, R2, Railway, Playwright |
Collision-avoidance rulesโ
- Each scope has effective exclusive directory ownership. If your change crosses into another scope's directory, tag that scope's owner on the PR.
- The two shared FE files (
lib/api.ts, AuthContext.tsx) and the shared entities file (common/entities.ts) require PR review from affected scope owners.
- Migrations are append-only and sequentially numbered โ coordinate the next number before authoring it.
- The
agent/ service is wholly owned by the Intelligence team. Other scopes that need agent changes provide the NestJS-side API surface (api/src/agent-api/); the Intelligence team wires the agent side.
Schema Changes (2026-05-03 audit)โ
expert_pools and pool_memberships tables removed โ Expert โ data access is now via expert_access (ADR-007). The earlier intermediate org_experts table (2026-05-03 โ 2026-05-22) is deprecated and removed in #540 after soak.Organization.status consolidated to: pending_am_setup, pending_specialist_assignment, pending_client_confirmation, active, trial_ending, suspended, deactivated.Organization.metadata JSONB column added for arbitrary fields without migrations.email_audit_log table added for inbound/outbound email audit trail.HWORK_DOMAIN env var replaces SPECIALIST_EMAIL_DOMAIN and NEXT_PUBLIC_APP_DOMAIN.