# Delivery Log

## Multi-Surface Platform and Oracle Expansion

### Completed in this pass

- Confirmed backend route families are registered in `backend/main.py`:
  - `routes_mobile_edge.py`
  - `routes_inventory.py`
  - `routes_admin_surface.py`
- Confirmed Oracle extension artifacts already exist in the workspace:
  - `backend/oracle/schema_extension_v2.sql`
  - `backend/oracle/oracle_template_seed_db.json`
- Completed iPad residual navigation and feature views:
  - Added `CommunicationsView.swift`
  - Added `CalendarView.swift`
  - Wired both into `ContentView.swift`
- Added Android tablet scaffold under `android-tablet/`
  - Compose app shell
  - Navigation graph
  - Dashboard, Inventory, Oracle, Sentinel, and Settings feature stubs
- Added dedicated iPhone edge app source tree under `iOS/velocity-iphone/`
  - SwiftUI app entry and tab shell
  - Shared Velocity-styled phone UI tokens and cards
  - Alerts, Lead Summary, Communications, Notes, Transcriptions, Settings
  - Live backend auth, notes, transcript, memory, alerts, and heartbeat wiring
- Added Android phone edge scaffold under `android-edge-phone/`
  - Compose app shell
  - Alerts, Lead Summary, Communications, Notes, Transcriptions, Settings
- Added WebOS admin panel surface at `app/src/app/admin/page.tsx`
- Added `docs/KIMI_SYNTHETIC_DATA_DOWNSTREAM_PLAN.md`
- Hardened live auth/session behavior across WebOS:
  - JWT roles are normalized to uppercase in `backend/auth/dependencies.py`
  - WebOS session restore now re-validates the real backend token on reload in `app/src/App.tsx`
  - Top-bar identity now renders the authenticated backend user instead of hard-coded operator text
- Removed misleading mock fallback behavior from active WebOS surfaces:
  - `app/src/store/useStore.ts` now starts with empty/live-only state instead of fabricated leads, visitors, metrics, and units
  - `app/src/hooks/useCrmBootstrap.ts` now hydrates CRM plus inventory state from backend data and clears state on failure instead of silently preserving fake data
  - `app/src/lib/oracleQueryClient.ts` now throws when `VITE_ORACLE_QUERY_URL` is missing instead of generating mock Oracle answers
- Rebuilt the investor-facing WebOS dashboard around live backend data:
  - `app/src/components/modules/Dashboard.tsx` now renders CRM lead counts, real conversation volume, inventory preview, velocity trends, sync state, and mobile-edge alerts
  - Removed the previous fabricated AI chat, top performer, and static KPI content from the dashboard surface
- Extended the live inventory contract and frontend mapping:
  - `backend/api/routes_inventory.py` now includes `price_bands` and `unit_mix` in property summary payloads
  - `app/src/lib/velocityPlatformClient.ts` and `app/src/lib/platformMappers.ts` now map inventory properties into live Inventory module cards
- Reduced fabricated marketing behavior in Catalyst:
  - `app/src/store/useMarketingStore.ts` now initializes empty instead of seeded mock campaigns/assets/insights/events
  - `app/src/components/modules/Catalyst.tsx` no longer auto-generates fake optimization feed events
  - `app/src/components/modules/CatalystMarketingTab.tsx` no longer exposes a synthetic lead seeding path from the production shell
  - `app/src/components/modules/GroundTruthPicker.tsx` now requires real operator-provided assets instead of showing built-in sample media
- Oracle v1 client auth is now aligned with the main platform session:
  - `app/src/oracle/lib/oracleApiClient.ts` will reuse the live Velocity token if a dedicated `oracle_jwt` is not present
- Completed final WebOS production pass:
  - `app/src/app/admin/page.tsx` now stages real bounded admin actions through `POST /api/admin-surface/actions`
  - `app/src/components/modules/Settings.tsx` now reflects truthful session/config state instead of fake device pairing and hard-coded profile data
  - Removed inactive demo-only WebOS files such as `app/src/lib/oracleQueryClient.ts`, `app/src/oracle/lib/oracleDemoData.ts`, and `app/src/components/oracle/mockLeads.ts`
- Confirmed the iPad residual views are now live-backend readers rather than local static arrays:
  - `iOS/velocity/velocity/Features/Communications/CommunicationsView.swift`
  - `iOS/velocity/velocity/Features/Calendar/CalendarView.swift`
  - `iOS/velocity/velocity/Core/Networking/VelocityAPIClient.swift`
  - `iOS/velocity/velocity/Core/Config/AppConfig.swift`
- Completed a broader iOS production hardening pass:
  - `iOS/velocity/velocity/Core/Config/AppConfig.swift` now defaults to `https://api.desineuron.in` instead of a stale instance IP
  - `iOS/velocity/velocity/Core/Networking/VelocityAPIClient.swift` now reads live inventory summaries in addition to leads, events, alerts, and calendar
  - `iOS/velocity/velocity/Core/State/AppStore.swift` no longer seeds fabricated dashboard, visitor, chat, or oracle state and now hydrates a live shared snapshot
  - `iOS/velocity/velocity/Features/Dashboard/DashboardView.swift` now renders live lead, inventory, calendar, and alert posture instead of synthetic KPIs and AI chat
  - `iOS/velocity/velocity/Features/Oracle/OracleView.swift` now uses live pipeline, live communication timelines, and live calendar events; unavailable Oracle modes are shown truthfully instead of mock canvases
  - `iOS/velocity/velocity/Features/Sentinel/SentinelView.swift` now disables visitor analytics until a real Sentinel feed exists and shows live operator urgency instead of fake biometric metrics
  - `iOS/velocity/velocity/Features/Settings/SettingsView.swift` now reflects real backend/auth/runtime state
  - `iOS/velocity/velocity/Features/Inventory/InventoryView.swift` no longer renders the simulator-only fake AR sun overlay in the active production path
- Completed the Android mobile hardening pass:
  - `android-tablet/` now includes a live backend client, Gradle runtime config fields, internet permission, and live-backed Dashboard, Inventory, Oracle, Sentinel, and Settings surfaces
  - `android-edge-phone/` now includes a live mobile-edge client, Gradle runtime config fields, internet permission, and live-backed Alerts, Lead Summary, Communications, Notes, Transcriptions, and Settings surfaces
  - Android Notes now writes to the real `POST /api/mobile-edge/notes` route when credentials are configured
  - Android Sentinel surfaces are now explicitly truthful about missing production biometric feeds instead of implying live analytics
- Completed the dedicated iPhone edge production source pass:
  - `iOS/velocity-iphone/` now supersedes the earlier lightweight edge scaffold and is the single iPhone source of truth
  - Added a dedicated standalone Xcode project at `iOS/velocity-iphone/velocity-iphone.xcodeproj` so the phone app can now be opened and tested directly in Xcode
  - Added `iOS/velocity-iphone/Assets.xcassets` with app icon and accent color catalog plumbing required by the standalone target
  - `iOS/velocity-iphone/Core/Networking/VelocityEdgeAPIClient.swift` now uses live `/api/auth/login`, `/api/leads`, `/api/mobile-edge/alerts`, `/api/mobile-edge/events`, `/api/mobile-edge/memory`, `/api/mobile-edge/notes`, `/api/mobile-edge/transcripts/{eventId}`, and `/api/mobile-edge/session`
  - `iOS/velocity-iphone/Core/State/EdgeAppStore.swift` now manages live shared phone state for the edge surface and refreshes note, transcript, and alert context after writes
  - `iOS/velocity-iphone/Core/UI/EdgeTheme.swift` now preserves the iPad Velocity styling language while adapting cards and layout to narrow iPhone width
  - `iOS/velocity-iphone/Features/Alerts/EdgeAlertsView.swift` now uses an adaptive metric grid suitable for phone resolution instead of a tablet-like fixed row
  - iPhone edge screens now auto-refresh live state periodically so the app behaves like an active operator surface instead of a one-shot fetch
  - `backend/api/routes_mobile_edge.py` session heartbeat handling was fixed so `iphone_edge` and other mobile surfaces update an active session window instead of creating redundant session rows on every heartbeat
  - Removed the superseded `iOS/velocity-edge-phone/` scaffold after confirming nothing useful remained outside the stronger `velocity-iphone` source tree

### MVP limits still in place

- The `iOS/velocity-iphone/` source tree now includes a dedicated standalone `.xcodeproj`, but full `xcodebuild` verification still depends on a machine with full Xcode, simulator runtimes, signing configuration, and live credentials.
- The WebOS admin page is mounted into the live Vite shell and can now stage bounded actions against the backend audit trail; auto-execution remains intentionally out of scope.
- The iPad production shell no longer uses fabricated dashboard/oracle/sentinel state, but some specialist inventory helpers remain beyond the current source hardening pass; on iPhone, the main remaining gaps are host-side build verification, signing, and supplying final production app-icon artwork rather than feature wiring.
- Android mobile surfaces now read live data, but full device verification still requires Gradle on the host and real credentials in Gradle properties.
- Oracle template seed metadata needs correction: `_meta.total_seed_examples` does not match the actual seed example count in `backend/oracle/oracle_template_seed_db.json`.
- Sprint-1 documentation artifacts called for in the delivery pack are still missing as committed repo outputs, including the residual audit artifact and contract/package documentation.

### Verification steps run

- Python syntax compilation for backend route files
- JSON validation for Oracle seed DB
- SQL parse sanity check on extension migration
- `npx tsc --noEmit` for the WebOS app after live-auth and no-mock hardening changes
- `python3 -m py_compile` for backend auth and route modules after role/session hardening
- `swiftc -parse` over the active iPad Swift source set after mobile production hardening
- `swiftc -parse` over the complete `iOS/velocity-iphone/` source tree
- `plutil -lint` for `iOS/velocity-iphone/Info.plist`
- `plutil -lint` for `iOS/velocity-iphone/velocity-iphone.xcodeproj/project.pbxproj`
- `python3 -m py_compile backend/api/routes_mobile_edge.py` after fixing surface session heartbeat behavior
- XML validation for both Android manifests
- Kotlin delimiter sanity checks over `android-tablet` and `android-edge-phone` source trees
- Full `xcodebuild` and Gradle assembly were not run on this host because full Xcode and Gradle are not installed here

### Recommended next implementation step

 WebOS and the primary iPad/Android/iPhone source surfaces are now aligned around live backend truthfulness. The next implementation step should be dedicated device/build-host verification across the standalone `iOS/velocity-iphone/velocity-iphone.xcodeproj`, the existing iPad target, and the Android builds with live credentials.