feat/#24 WebOS Completion (#25)

#24 WebOS Completion

Co-authored-by: Sayan Datta <sayan@Sayans-MacBook-Air.local>
Reviewed-on: sagnik/Project_Velocity#25

delivery_log.md

@@ -0,0 +1,81 @@
+# Delivery Log
+
+## Multi-Surface Platform and Oracle Expansion
+
+### Completed in this pass
+
+- Confirmed backend route families are registered in `backend/main.py`:
+  - `routes_mobile_edge.py`
+  - `routes_inventory.py`
+  - `routes_admin_surface.py`
+- Confirmed Oracle extension artifacts already exist in the workspace:
+  - `backend/oracle/schema_extension_v2.sql`
+  - `backend/oracle/oracle_template_seed_db.json`
+- Completed iPad residual navigation and feature views:
+  - Added `CommunicationsView.swift`
+  - Added `CalendarView.swift`
+  - Wired both into `ContentView.swift`
+- Added Android tablet scaffold under `android-tablet/`
+  - Compose app shell
+  - Navigation graph
+  - Dashboard, Inventory, Oracle, Sentinel, and Settings feature stubs
+- Added iPhone edge app scaffold under `iOS/velocity-edge-phone/`
+  - SwiftUI app entry
+  - Alerts, Lead Summary, Communications, Notes, Transcriptions, Settings
+- Added Android phone edge scaffold under `android-edge-phone/`
+  - Compose app shell
+  - Alerts, Lead Summary, Communications, Notes, Transcriptions, Settings
+- Added WebOS admin panel surface at `app/src/app/admin/page.tsx`
+- Added `docs/KIMI_SYNTHETIC_DATA_DOWNSTREAM_PLAN.md`
+- Hardened live auth/session behavior across WebOS:
+  - JWT roles are normalized to uppercase in `backend/auth/dependencies.py`
+  - WebOS session restore now re-validates the real backend token on reload in `app/src/App.tsx`
+  - Top-bar identity now renders the authenticated backend user instead of hard-coded operator text
+- Removed misleading mock fallback behavior from active WebOS surfaces:
+  - `app/src/store/useStore.ts` now starts with empty/live-only state instead of fabricated leads, visitors, metrics, and units
+  - `app/src/hooks/useCrmBootstrap.ts` now hydrates CRM plus inventory state from backend data and clears state on failure instead of silently preserving fake data
+  - `app/src/lib/oracleQueryClient.ts` now throws when `VITE_ORACLE_QUERY_URL` is missing instead of generating mock Oracle answers
+- Rebuilt the investor-facing WebOS dashboard around live backend data:
+  - `app/src/components/modules/Dashboard.tsx` now renders CRM lead counts, real conversation volume, inventory preview, velocity trends, sync state, and mobile-edge alerts
+  - Removed the previous fabricated AI chat, top performer, and static KPI content from the dashboard surface
+- Extended the live inventory contract and frontend mapping:
+  - `backend/api/routes_inventory.py` now includes `price_bands` and `unit_mix` in property summary payloads
+  - `app/src/lib/velocityPlatformClient.ts` and `app/src/lib/platformMappers.ts` now map inventory properties into live Inventory module cards
+- Reduced fabricated marketing behavior in Catalyst:
+  - `app/src/store/useMarketingStore.ts` now initializes empty instead of seeded mock campaigns/assets/insights/events
+  - `app/src/components/modules/Catalyst.tsx` no longer auto-generates fake optimization feed events
+  - `app/src/components/modules/CatalystMarketingTab.tsx` no longer exposes a synthetic lead seeding path from the production shell
+  - `app/src/components/modules/GroundTruthPicker.tsx` now requires real operator-provided assets instead of showing built-in sample media
+- Oracle v1 client auth is now aligned with the main platform session:
+  - `app/src/oracle/lib/oracleApiClient.ts` will reuse the live Velocity token if a dedicated `oracle_jwt` is not present
+- Completed final WebOS production pass:
+  - `app/src/app/admin/page.tsx` now stages real bounded admin actions through `POST /api/admin-surface/actions`
+  - `app/src/components/modules/Settings.tsx` now reflects truthful session/config state instead of fake device pairing and hard-coded profile data
+  - Removed inactive demo-only WebOS files such as `app/src/lib/oracleQueryClient.ts`, `app/src/oracle/lib/oracleDemoData.ts`, and `app/src/components/oracle/mockLeads.ts`
+- Confirmed the iPad residual views are now live-backend readers rather than local static arrays:
+  - `iOS/velocity/velocity/Features/Communications/CommunicationsView.swift`
+  - `iOS/velocity/velocity/Features/Calendar/CalendarView.swift`
+  - `iOS/velocity/velocity/Core/Networking/VelocityAPIClient.swift`
+  - `iOS/velocity/velocity/Core/Config/AppConfig.swift`
+
+### MVP limits still in place
+
+- Android projects are scaffolds only; they are not yet wired to shared API clients, auth, or install registration.
+- The iPhone edge scaffold is source-first and does not yet include a dedicated `.xcodeproj` target.
+- The WebOS admin page is mounted into the live Vite shell and can now stage bounded actions against the backend audit trail; auto-execution remains intentionally out of scope.
+- The iPad Communications and Calendar views read live backend data, but the broader iPad app still contains other legacy mock-backed modules outside this residual slice.
+- The active WebOS runtime path has been hardened away from mock/demo behavior, but deeper non-WebOS workstream items remain out of scope for this pass, especially legacy iPad modules and simulator-only inventory/AR helpers on iOS.
+- Oracle template seed metadata needs correction: `_meta.total_seed_examples` does not match the actual seed example count in `backend/oracle/oracle_template_seed_db.json`.
+- Sprint-1 documentation artifacts called for in the delivery pack are still missing as committed repo outputs, including the residual audit artifact and contract/package documentation.
+
+### Verification steps run
+
+- Python syntax compilation for backend route files
+- JSON validation for Oracle seed DB
+- SQL parse sanity check on extension migration
+- `npx tsc --noEmit` for the WebOS app after live-auth and no-mock hardening changes
+- `python3 -m py_compile` for backend auth and route modules after role/session hardening
+
+### Recommended next implementation step
+
+ WebOS is now the strongest completed surface. The next implementation step should move fully to iOS and Android completion while preserving the live backend/auth patterns established here.