# FvW Alignment Audit — Phase 3 — Maturity Map + §00.12 Debt

**Date:** 2026-09-14
**Audit lane:** id 9 (vibecoder-standalone-mavis)
**Code HEAD:** a2062aa (post b2994 drift guard)
**Predecessors:** Phase 1 = b2998, Phase 2 = b2999
**Amendment:** Part H (§00.12 debt) added to this report

---

## A. Naming convention decision

**FvW §04.3** (carried unchanged v6→v7→v8) uses **snake_case** keys in the example schema:
- `schema_version`, `app_id`, `app_version`, `generated_at`
- `surface_id`, `behaviour_id` in protection code

The vibecoder atlas uses **camelCase** (`schemaVersion`, `generatedAt`, etc.) with schema string `freshvibe-way-v8.trace-atlas`.

**Decision (per dispatch rule "use the RATIFIED convention, do not pre-empt proposals"):**
- snake_case is the ratified v8 convention (§04.3 example is the law).
- v8.6.0 amendment pack does not change §04 (only §00.12).
- **Therefore: the existing atlas is non-conformant to §04.3 field naming.**
- **Regeneration skipped (Part B):** no generator exists. Future regeneration MUST use snake_case IF a generator is authored.
- **Migration debt** (recorded for §00.12-style future audits): if v8.6.0 ratifies and §00.12 enforcement adds schema-shape checks, the existing atlas must be regenerated in snake_case.

---

## B. Trace atlas regeneration — NOT REGENERATED

No generator exists for the trace atlas anywhere on disk:
- `grep -l "atlas.json\|trace-atlas\|generateAtlas"` across `/workspace/vibecoder-standalone/scripts/` and `/workspace/vibecoder-standalone/*.cjs` returns 0.
- No `tools/` directory exists for the atlas.
- FVRE's package list (A–H) does not generate constitutional artefacts; FVRE is recipe-only.

**Status:** STALE (4–7d) + no generator to refresh it.
**Atlas metadata (current):**
- Schema string: `freshvibe-way-v8.trace-atlas` (v8-claimed, but fields are camelCase, not §04.3 snake_case)
- generatedAt: `2026-09-07T12:06:28Z` (id 9, vibecoder-standalone-mavis)
- vgmManifestRef.buildHash: `190e855` (gallery's 2026-09-07 build)
- Size: 214,171 bytes
- Last modified: 2026-09-10 18:31 UTC
- Source HEAD: NOT TRACKED in the file (no `source_head` field)

**Action:** None (per dispatch constraint — do not build the generator).

---

## C. Maturity check on 5 substantive artefacts

### C1. app-pact — REAL

- 17KB app-pact.md + invariants.md (12KB) + module-map.json (24KB) + 8 governance JSON files + decisions/ (10 cycle decision files).
- Content dated 2026-09-07 to 2026-09-09 (cycles 5–12).
- **READ by code:** `/opt/vibecoder-bridge/src/host/pact/loaders/{sovereign,autonomous,offline,communication,module-map,sandbox,gallery,cross-app,decision-log,boot}.ts` (10 bridge loaders). Pact is the live governance layer.
- Verdict: **REAL**. The pact governs which modules Mavis may invoke (`autonomous-rules.json` `forbidden_invocations`); it's actively used.

### C2. app-dna — REAL (with consolidated twin)

- `/workspace/vibecoder-standalone/app-dna/app.dna.json` (17KB) exists.
- Schema: `freshvibe-way-v8.app-dna`, v1.0.0. App id: `freshvibe-cms.1.0.0`. Updated 2026-09-09.
- **BUT** the `app-recipe/manifest.json` declares: `"app-dna/": ["(consolidated in app-shell/identity.md)"]` — meaning the **authoritative** DNA is in `app-shell/identity.md`, NOT `app-dna/app.dna.json`.
- `app-shell/identity.md` exists (4 files, 17K total).
- Verdict: **REAL** but with **drift** — `app-dna/app.dna.json` is the original FvW §03 location; `app-shell/identity.md` is the consolidated location per the VibeCoder author's design choice. Both exist; `app-shell/` is canonical per the recipe manifest.

### C3. app-vp — REAL

- 5 test files: 4 protection + 1 validity.
- Tests: `atlas-integrity.test.ts` (1.3KB), `communication-critical.test.ts` (0.8KB), `sandbox.test.ts` (0.4KB), `sovereign-risk.test.ts` (1.0KB), `atlas-validation.test.ts` (0.7KB).
- Verdict: **REAL**. Tests exist and are the FvW §13.9 app-VP test target per §04.1 ("mandatory App-VP test target"). Whether they RUN in CI is unknown (Part H10 says no CI exists).

### C4. app-recipe — REAL

- 29KB codex.md + recipe.md (1.4KB) + rules.md (1.2KB) + manifest.json (2.5KB).
- manifest.json claims `compliance_score: "20/20 (per Step 14, FvW v8.3.0 + v8.4.0 VGM)"` — this is a self-reported score from author step 14.
- manifest.json also discloses: `"vgm_note"` mentions VGM doctrine verification failed at the time of authoring, with the canonical path potentially `/workspace/repos/fv-module-gallery/` (not in `ls /workspace/`). Worth noting but not blocking.
- Verdict: **REAL** with self-disclosed gaps. The recipe itself is the doctrine author of record for this app.

### C5. app-trace-atlas — STALE (handled in Part B)

- Atlas is 214KB substantive but 4–7d stale.
- Atlas embeds gallery `vgmManifestRef.buildHash = 190e855` from 2026-09-07.
- No `source_head` field; cannot determine from file alone which HEAD generated it.
- Verdict: **STALE**. Generator missing. (Per dispatch rule, do not build one.)

---

## D. Stub impact — the BIG surprise

Phase 2 concluded app-codex, app-fragments, app-overlays were empty stubs. Phase 3 reveals they are **intentional consolidation placeholders**, not orphaned stubs. Per `app-recipe/manifest.json`:

| Stub | Phase 2 verdict | Phase 3 reality | Consolidates to |
|---|---|---|---|
| app-codex | stub (.gitkeep only) | content in app-surfaces/ + app-behaviours/ | 56 YAML surfaces (221K), 12 YAML behaviours (65K) |
| app-fragments | stub (.gitkeep only) | content in app-registry/modules.index.json | modules.index.json (41K) |
| app-dna | substantive but loose | authoritative content in app-shell/identity.md | app-shell/ (4 files, 17K) |
| app-overlays | stub (.gitkeep only) | "reserved per FvW v8 §2.1.6" — not needed yet | (deferred) |

**The 4 "stubs" are NOT gaps.** They are intentional consolidation per the VibeCoder doctrine author's design documented in `app-recipe/manifest.json`. The 8-artefact set is supplemented by 6 additional directories that hold the consolidated content:

| Consolidated dir | Files | Size | Purpose |
|---|---:|---:|---|
| app-shell | 4 | 17K | identity, entrypoints, sovereign-boundaries, codex-mapping |
| app-surfaces | 56 | 221K | 54 FvW surface YAMLs (47 FvW surfaces + 7 extras) |
| app-behaviours | 12 | 65K | 96 behaviours total |
| app-modules | 151 | 713K | 75 module dirs with module.json + recipe-book |
| app-registry | 1 | 41K | modules.index.json |
| app-vgm | 10 | 205K | VGM manifest + 4 doctrine refs + runtime-api + constitutional-atlas |

**Total: 6 supplementary dirs holding 234 files (1.26 MB) of substantive doctrine content.**

**Verdict on the 3 originally-stubbed artefacts:**
- app-codex: NON-BLOCKING — content consolidated in app-surfaces/ + app-behaviours/. Stale if you expect §01.9 strict layout, but design-rationalised in manifest.json.
- app-fragments: NON-BLOCKING — content consolidated in app-registry/. Same.
- app-overlays: REFERENCED-NOWHERE / DEFERRED — explicitly reserved per FvW v8 §2.1.6, not yet authored, no current need.

---

## E. PACT indexes — structural gap

### E1. Confirmation

```
find /workspace -maxdepth 5 -name surface-map.md   → 0 results
find /workspace -maxdepth 5 -name lifecycle-map.md → 0 results
find /workspace -maxdepth 5 -name host-map.md      → 0 results
find /workspace -maxdepth 5 -name naming-map.md    → 0 results
find /workspace -maxdepth 5 -name contradiction-docket.md → 0 results
```

What DOES exist: `/workspace/pact/pact-index.json` (v8.0.0, locked 2026-09-06) + `/workspace/pact/pact-rules.json` (PR-001..PR-006) + `/workspace/pact/drift-log.jsonl`. These are an older **FvW v8 strict-mode validator docket** — different naming convention from the gallery's 5 indexes (surface/lifecycle/host/naming/contradiction-docket).

### E2. Generator

`grep -r "surface-map\|host-map\|lifecycle-map\|naming-map\|contradiction-docket" --include="*.cjs" --include="*.js" --include="*.py" --include="*.ts" --include="*.sh"` — **0 results** workspace-wide.

### E3. Verdict

**Structural gap: tooling does not exist.** The 5 PACT indexes (gallery-style surface/lifecycle/host/naming/contradiction-docket.md) are neither authored nor generatable. This is a **capability finding**, not a compliance failure. The older `/workspace/pact/` directory holds a related but distinct artefact set (the strict-mode docket) that pre-dates the gallery's 5-index nomenclature.

Whether to (a) author the 5 indexes by hand, (b) build a generator, or (c) re-namespace to align with the gallery nomenclature — is an architectural decision that belongs to the operator. NOT a Phase 3 deliverable.

---

## F. Maturity map

| Area | Status | Real/Stub/Stale/Missing | Notes |
|---|---|---|---|
| app-pact | REAL | Real | 10 bridge loaders; live governance |
| app-codex | NON-BLOCKING | Stub (intentional) | Consolidated in app-surfaces/ + app-behaviours/ |
| app-fragments | NON-BLOCKING | Stub (intentional) | Consolidated in app-registry/ |
| app-dna | REAL (drift) | Real + twin | Canonical in app-shell/identity.md per manifest |
| app-trace-atlas | STALE | Stale | 4-7d old, no generator, non-conformant to §04.3 snake_case |
| app-overlays | DEFERRED | Stub (reserved) | §2.1.6 reservation; no current need |
| app-vp | REAL | Real | 5 test files (4 protection + 1 validity) |
| app-recipe | REAL | Real | 29KB codex + manifest claiming 20/20 self-score |
| 5 PACT indexes | MISSING (capability) | Missing | No generator; older `/workspace/pact/` has related but distinct dockets |
| Constitutional atlas | STALE | Stale | fvwVersion 8.4.1, behind active 8.5.0 |
| app-shell (consolidated) | REAL | Real | identity + entrypoints + sovereign-boundaries + codex-mapping |
| app-surfaces | REAL | Real | 56 YAML files (54 surfaces + 2 .gitkeep) |
| app-behaviours | REAL | Real | 13 YAML files (12 behaviours + 1 .gitkeep) |
| app-modules | REAL | Real | 75 module dirs with module.json + recipe-book (151 files) |
| app-registry | REAL | Real | modules.index.json |
| app-vgm | REAL | Real | manifest + 4 doctrine refs + runtime-api + constitutional-atlas |
| /workspace/pact/ (older docket) | STALE | Stale | v8.0.0 strict-mode, locked 2026-09-06, 8d stale |

---

## Plain-English summary by category

### 1. What's REAL and working
- **app-pact** — live governance; 10 bridge loaders consult it; cycles 5–12 documented.
- **app-recipe** — substantive; declares self-score 20/20; documents consolidated layout.
- **app-vp** — 5 tests exist (atlas-integrity, communication-critical, sandbox, sovereign-risk, atlas-validation).
- **app-shell / app-surfaces / app-behaviours / app-modules / app-registry / app-vgm** — VibeCoder's consolidated doctrine. 1.26 MB of YAML/JSON across 234 files. 75 modules, 54 surfaces, 12 behaviours, runtime-api with 10 methods.

### 2. What's STUB and intentionally placeholder
- **app-codex** — consolidated away.
- **app-fragments** — consolidated away.
- **app-dna** — has content but is duplicated; canonical twin is app-shell/identity.md.
- **app-overlays** — reserved per §2.1.6; not needed yet.

### 3. What's STALE and needs regeneration
- **app-trace-atlas** (4–7d old; snake_case non-conformant; no generator).
- **/workspace/pact/pact-index.json** (8d old, locked 2026-09-06, predates reconciliation and amendments).
- **/workspace/fv-module-gallery/gallery-pact/trace-atlas/constitutional-atlas.json** (fvwVersion 8.4.1 behind active 8.5.0).

### 4. What's MISSING and needs authoring
- **5 PACT indexes** (surface/lifecycle/host/naming/contradiction-docket.md) — none exist anywhere in any branch of any repo.

### 5. What's a STRUCTURAL GAP (tooling doesn't exist)
- **No trace-atlas generator** anywhere — atlas cannot be regenerated by automation.
- **No PACT-index generator** anywhere — 5 indexes cannot be created by automation.

---

## G. Surprises

1. **Phase 1 was wrong about the 8 artefacts being missing.** Phase 2 corrected this. Phase 3 reveals MORE: the 3 original "stubs" are not stubs at all — they are intentional consolidation placeholders documented in `app-recipe/manifest.json`. **Phase 1's "all 8 missing" finding was wrong in TWO ways** (presence AND purpose).

2. **Consolidated layout was undocumented to Phase 1+2 readers.** The presence of `app-shell`, `app-surfaces`, `app-behaviours`, `app-modules`, `app-registry`, `app-vgm` (1.26 MB of doctrine) was a structural finding for Phase 3 — not surfaced by Phase 1 or 2 because we looked only at the 8 artefact names. The doctrine author's consolidation choice is documented in only one place: `app-recipe/manifest.json`. This single source of doctrinal intent could be lost if that file is corrupted.

3. **The trace atlas is non-conformant to §04.3 field naming.** §04.3 is the ratified v8 example; it uses snake_case. The existing atlas uses camelCase. No one has noted this drift in any prior audit.

4. **The 8-artefact doctest for FvW is loose.** The VibeCoder doctrine author took creative liberty to consolidate; this is compatible with §02 (folder layout) since §02.1.6 explicitly reserves "overlays" as not-yet-defined. But the broader pattern (consolidating 8 artefacts into 14 directories) is doctrine-extension — it should probably be ratified as a VibeCoder-specific profile.

5. **No CI exists** for any of the artefacts (H10 confirmed: no `.github`, no `.gitlab-ci.yml`, no `Jenkinsfile`). The `app-vp/*.test.ts` tests are not wired to run automatically. This means the "REAL" verdict on app-vp is "files exist" not "tests pass".

---

## H. §00.12 debt assessment (AMENDMENT)

§00.12 is **proposed** in v8.6.0. Not law. This is a forward-looking debt reading: if v8.6.0 ratifies tomorrow, how much work is needed?

### H0. §00.12 confirmation

10 principles confirmed:
1. Units — relative only
2. Typography — rem-based
3. Contrast — WCAG AA
4. Motion — `prefers-reduced-motion`
5. Accessibility — keyboard, ARIA, semantic HTML
6. Responsiveness — 320px to 4K
7. Performance — Core Web Vitals
8. Content — meaningful empty/error states
9. No legacy patterns
10. World-class by construction

FVRE clause: §00.12.4 requires FVRE output to be **fidelity-perfect at reference** (pixel-equal to original) AND **FvW-aligned** (conforms to principles when reconstructed into a different runtime).

### H1. Units — NON-COMPLIANT

- `grep -rn "px" src --include="*.tsx" --include="*.css"` returns **4,113 lines** of px usage across src/.
- Sampled lines: `padding: '8px 12px'`, `width: 220px`, `border: 1px solid #e5e5e5`, `font-size: 15px` — heavy px usage in layout primitives.
- Of 543 `font-size` declarations: **539 are px**, 2 are rem, 4 are em.
- §00.12 permits px ONLY for icon sizes, border widths, shadow blur.
- **Debt: MAJOR.** Refactoring 4,113 lines is multi-week work. Practical approach: convert the layout primitives to rem/vw first, leave icon/border/shadow as px per §00.12 exception.

### H2. Typography — NON-COMPLIANT

- `font-size` distribution: **99% px** (539/543), with 2 rem and 4 em entries.
- §00.12 requires rem-based scale, minimum body 1rem.
- **Debt: MAJOR.** Same magnitude as H1 (coupled — fixing H1 fixes most of H2).

### H3. Contrast WCAG AA — UNMEASURABLE

- `grep -rln "wcag\|contrast\|a11y"` finds 10 files but **all are docs/MD text** (audit reports, app-pact prose) — no contrast tooling wired.
- `grep "axe-core\|jest-axe"` returns 0.
- **No CI / linter / contrast checker exists.**
- **Debt: UNKNOWN.** Cannot measure without tooling. Building axe-core into CI is a half-day task; auditing every contrast ratio would be a sprint.

### H4. Motion / `prefers-reduced-motion` — NON-COMPLIANT

- `grep "prefers-reduced-motion"` returns **0 hits** in src/.
- 248 `transition`/`animation` declarations across CSS files.
- §00.12 requires all animations honour `@media (prefers-reduced-motion: reduce)`.
- **Debt: MINOR–MAJOR.** Adding the wrapper CSS rule is <1 day; auditing 248 declarations to ensure no transform/motion remains when `reduce` is set is several days of work.

### H5. Accessibility (ARIA / keyboard) — PARTIAL

- `grep "aria-\|role=" src/**/*.tsx` returns **138 hits** (some coverage).
- `grep "onKeyDown\|onKeyPress" src/**/*.tsx` returns **only 4 hits** — very low keyboard handler coverage.
- §00.12 requires keyboard navigable + Escape closes panel + focus order matches visual order + ARIA where appropriate.
- **Debt: MAJOR.** Adding keyDown handlers to ~80 components is multi-week; the ARIA coverage pattern (label the 138 existing roles) is a separate audit.

### H6. Responsiveness (320px–4K) — PARTIAL

- 17 `@media` rules in CSS; **breakpoints seen: 480px, 600px, 601px, 640px, 700px, 768px, 900px**.
- Lowest: 480px (above 320px floor). Highest: 900px (below 1920px 4K threshold).
- §00.12 floor 320px NOT reached.
- **Debt: MINOR.** Adding @320px and @1920px / @4K breakpoints is a few hours; audit of layout collapse below 320 is longer.

### H7. Performance — UNMEASURABLE

- `find "*lighthouse*" -o "*web-vitals*"` returns 0 results (excluding node_modules).
- No `web-vitals` or `lighthouse` in package.json.
- §00.12 references Core Web Vitals (LCP < 2.5s, FID < 100ms, CLS < 0.1).
- **Debt: UNKNOWN.** Cannot measure without tooling. Installing web-vitals + writing a script is hours; establishing CI gates is days.

### H8. Empty/error states — PARTIAL

- `grep "isEmpty\|EmptyState\|errorMessage\|errorBoundary" src/**/*.tsx` returns **26 hits**.
- Coverage exists but partial — many components likely lack explicit empty/error fallbacks.
- §00.12 requires "meaningful" empty/error states (not just blank).
- **Debt: MINOR.** Audit-and-fill is ~1 day for a comprehensive sweep.

### H9. No legacy patterns — COMPLIANT (passing)

- `grep "componentWill\|UNSAFE_componentWillMount\|deprecated" src` returns 0 hits.
- No deprecated React lifecycle methods, no obvious deprecated APIs in the codebase.
- §00.12 P9 satisfied.
- **Debt: NONE.** Already clean.

### H10. World-class by construction — NON-COMPLIANT

- `grep "validator-v8\|G40\|G41"` only hits `/workspace/vibecoder-standalone/package-lock.json` (lockfile entry for `ajv` JSON-Schema impl, NOT a real validator ref).
- No `.github/` directory, no `.gitlab-ci.yml`, no `Jenkinsfile`.
- §00.12 P10 requires principles enforced **at build time**, not added after.
- **Debt: MAJOR.** Wiring validator-v8.json into a CI gate is a project of weeks: pick a runner, write the gate logic, integrate G40 + G41 checks, write the green-build pipeline.

### H11. FVRE wired — NOT WIRED

- Repo refs to FVRE: only `/workspace/vibecoder-standalone/src/engine/README.md` mentions FVRE (descriptive, not invocation).
- Bridge refs to FVRE: 0.
- No `@fvre/cli`, no `freshvibe-reconstruction-engine` import, no subprocess invocation.
- §00.12.4 FVRE clause requires FVRE-compliant output. **Currently VibeCoder does NOT invoke FVRE.**
- **Debt: MAJOR.** Wiring FVRE as a subprocess per the FvW §26 lifecycle is itself a multi-week project.

### H12. Debt table

| Principle | Status | Debt if v8.6.0 ratifies |
|---|---|---|
| 1. Units | NON-COMPLIANT | **MAJOR** (4,113 px lines; multi-week refactor) |
| 2. Typography | NON-COMPLIANT | **MAJOR** (coupled with P1) |
| 3. Contrast (WCAG AA) | UNMEASURABLE | **UNKNOWN** (no tooling) |
| 4. Motion (prefers-reduced-motion) | NON-COMPLIANT | **MAJOR** (248 declarations, 0 wrappers) |
| 5. Accessibility (keyboard/ARIA) | PARTIAL | **MAJOR** (138 ARIA, 4 keyDown handlers) |
| 6. Responsiveness (320px–4K) | PARTIAL | **MINOR** (17 breakpoints; floor 480, ceiling 900) |
| 7. Performance (CWV) | UNMEASURABLE | **UNKNOWN** (no tooling) |
| 8. Empty/error states | PARTIAL | **MINOR** (26 fallback patterns; partial) |
| 9. No legacy patterns | COMPLIANT | **NONE** (0 deprecated React patterns) |
| 10. World-class by construction | NON-COMPLIANT | **MAJOR** (no CI; G40/G41 not wired) |
| FVRE clause | NOT WIRED | **MAJOR** (no FVRE subprocess; FvW §26 lifecycle unfulfilled) |

### H13. Summary

If v8.6.0 ratifies tomorrow:
- **Already compliant:** 1 of 11 (P9, no legacy patterns)
- **Need work (partial or non-compliant):** 8 of 11 (P1, P2, P4, P5, P6, P8, P10, FVRE clause)
- **Unmeasurable (no tooling):** 2 of 11 (P3 contrast, P7 perf)

**Estimated debt (rough):**
- 1 principle satisfies "minor" (P6)
- 1 principle satisfies "minor" (P8)
- 6 principles require "major" (>1 week each) — P1, P2, P4, P5, P10, FVRE
- 2 principles are "unknown" — P3, P7 (need tooling first)

**Realistic minimum debt: 6 person-weeks** for the major items, plus **2–4 days** to build the missing tooling (axe-core + web-vitals + G40/G41 CI gate). The largest single chunk is the units refactor (4,113 px lines) which is its own project.

**Important:** This is NOT a compliance failure today. v8.6.0 is not law. It is a forward-looking debt reading only. If the operator decides not to ratify v8.6.0, or to ratify with relaxed scope, the debt evaporates entirely.

---

## Provenance + integrity

- Audit read-only (except none — Part B3 not executed due to no generator).
- Atlas regeneration NOT attempted (per dispatch: skip if no generator).
- All grep commands listed for operator re-verification.
- No tool failure observed.