# Findings — gap remediation (2026-06-14 audit → fixes)

Status of the audit's actionable gaps. Most are **addressed**; the rest are deferred with reasons. All fixes are committed with 76 panel tests green and the full `agent-joule` binary building.

## P1 — undercuts the core "signed / accountable" claims

1. ✅ **Op author stamped.** Every `CodingOp` now carries the session identity's verifying key as its author (`build_coding_op` gained an `author` param; `record_multi_edit`/`captured_op` stamp `session_key.verifying_key()`), replacing `author: [0u8;32]`. Ops are signed by a principal, not anonymous.
2. ✅ **L4 closes seal deterministically.** The thread-event handler now matches `AcpThreadEvent::Stopped(_)` (turn completion) and seals once, with a `last_l4_op_id` de-dup guard — no partial/duplicate ops, no lost close. An L4 turn that edits files reliably produces exactly one ledger op + L0 entry, like L0–L3.
3. ✅ **`let _ =` discards fixed.** `adopt_from_file`, `cite_op`, spec/ops persistence writes, `record_primary_op`, session `set_status`/`mark_verified`, and the `release.json` write now `.log_err()` per the repo's CLAUDE.md rule.

## P2 — real semantic limits

4. ✅ **L0 keyed on buffer precondition.** Every request captures the active buffer's content-id (`pending_prior`); the L0 lookup and every close's cache insert use it, and `LedgerEntry` carries a `serde(default) precond` for cross-session correctness. A cached edit replays only when the same intent meets the same buffer state. New test: `l0_precondition_differentiates_buffer_state`.
5. ✅ **Session grant enforced.** When a background session is active, `authorize_tier` checks the session's (attenuated) grant names the tier and the session is under its own joule ceiling, before the global gate. A delegate that holds only `{l0,l1,l2}` can no longer reach L3/L4 — delegate-only-what-you-hold, enforced not just declared.
6. ✅ **Ship door** — already resolved in the session arc: `certify_release` uses the live frame-backed `contract_discharged() = !frame.is_empty() && contract_ok`, no hardcoded `false`.
7. ✅ **PostTool / SessionEnd hooks fired.** `note_close` fires PostTool on every tier close; `close_session` fires SessionEnd before teardown. Observe-only (no-op when no hook registered) — the points are now live and extensible.
8. ✅ **"No energy counter" distinct from 0 J.** Render shows `⚠ no host energy counter — figures are estimates` when absent; control `state` reports `energy_counter: bool`. (L4 op energy remains token-estimated, as honestly tagged.)

## P3 — hygiene

9. ✅ **`JOULE_CODE.md` corrected** — the stale "path dependencies" description now reflects the actual pinned git deps on `Transaction-Science/open-standards`.
10. ✅ **Gutting warnings cleared** — removed 8 unused imports (`main.rs`, `zed.rs`, `remote_connection.rs`), `_`-prefixed two unused vars, and `#[allow(dead_code)]`'d the kept-for-compat `title_bar.show_sign_in`. Binary builds with no `agent-joule` warnings.
11. ⏸ **`visual-tests` feature left as-is** — its `visual_test_runner.rs` is deeply tied to the removed `agent_ui`/`AgentPanel` (a test harness for the deleted native agent). Repair = large rewrite, removal = build-config change; dev-only, off the shipped path. Documented, not bulldozed.
12. ✅ **Namespace test fixed** — `test_action_namespaces` was actually **red**: it lacked the new `agent_joule` namespace and still listed `skill_creator` + `inline_assistant` (removed crates). Added `agent_joule`, dropped the two dead ones; test green. (`agents_sidebar` stays — still a live `zed_actions` namespace.)
13. ⏸ **Two near-identical MCP stdio clients** — optional refactor, not a correctness issue.
14. ⏸ **`joulecontract-schema` near-vestigial** — revisit when per-op contract discharge lands.

## CI blind spot (model layer) — ✅ killed

The on-device-model plumbing is now CI-tested with **no download and no `#[ignore]`**: two tests build a complete *tiny synthetic* llama (random weights, embedded vocab) via jouleclaw's public `synthetic::synthesize_llama_gguf`, write it to a temp `.gguf`, and load it through the real `load_l3_model` path —
- `synthetic_model_loads_generates_and_embeds`: `l3_generate` runs end to end and is deterministic; `l3_embed` returns a 16-dim L2-normalized vector.
- `synthetic_model_powers_codebase_index`: builds a real index over a small repo with the synthetic embedder and gets ranked search hits.

These assert the *pipeline runs* (load → generate → embed → retrieve), not edit quality (a 16-dim random model writes nonsense). The five `#[ignore]`'d real-model tests remain as the *quality* probes (manual, `JOULE_CODE_TEST_MODEL`). 78 panel tests green.

---

**Net:** all P1 and all actionable P2 items are fixed and tested. The deferred items are P3 hygiene in upstream/David-owned files, optional refactors, or CI-infra — none affect the correctness of the accountability story, which is the audit's core concern.