docs(audit): close OPP-002 — the AuditTrail shared kernel already exists

docs/audit/tracker-gaps-opportunities-tracking.md

@@ -26,7 +26,7 @@ This document is the only operational gap register in this repository. The maste
 | # | Status | ID | Type | Category | Component | Module | Story(ies) | Description | Resolution / Next Step | Criticality | Complexity |
 |---:|---|---|---|---|---|---|---|---|---|:---:|:---:|
 | 1 | 🔴 BLOCKED | [GAP-004](#detail-gap-004) | GAP | Missing capability / corrective gap | API | N/A | N/A | 3 dependencias upstream bloqueadas (Core API, UMS JWKS, UMS Auth Graph) | BLOCKED, and now SCOPED — the row said «Define owner and remediation action before execution» and nobody ever had. Each of the three upstream dependencies was probed on 2026-08-02 rather than assumed. **(1) Core API — root cause found and filed upstream as `evolith_arch32` GT-650 (PR #383).** The Core cannot publish an artifact catalog because it holds TWO unreconciled ones: the gate corpus names 24 artifacts in human form with schema refs, `UNIVERSAL_PHASE_ARTIFACTS` names 18 slugs over three phases, and they disagree on names, on membership both ways, and on PHASE — `Coverage Report` is construction in one and quality in the other. Neither is what the HTTP surface serves; that reads a third file with no artifacts at all. So this is not «the Core has not built an endpoint», it is «the Core has no single answer to endorse», which needs an ADR upstream and cannot be unblocked from here. **(2) UMS JWKS — still blocked, and T-053 is still `Proposed`.** The UMS publishes no `.well-known` and issues symmetric HS256; probed today, the local UMS ingress answers 503 on every path, so nothing could even be re-tested. The Tracker already carries both validation modes, so this blocks the target state, not the product. **(3) UMS Auth Graph — still blocked**, same system, same reachability. **What is NOT blocked and was mistaken for it:** the row had been closed once with «Resolved via Defensive Isolation (Mocks)». The stand-ins are real and working, and that is why the product runs; it is not why the dependency is resolved. Also lands here: the residue of GAP-020 — tenant-aware sync of the artifact catalog — because it is the same seam and the same blocker. | 🔴 CRITICAL | 🔴 HIGH |
-| 2 | 🟡⏳ DEFERRED | [OPP-002](#detail-opp-002) | OPP | Improvement opportunity | Backend | N/A | N/A | Extraer AuditTrail como Shared Kernel — 5+ contextos implementan historiales inmutables | Pending owner/action definition in this register. | 🟠 HIGH | 🔴 HIGH |
+| 2 | 🟢 RESOLVED | [OPP-002](#detail-opp-002) | OPP | Improvement opportunity | Backend | N/A | N/A | Extraer AuditTrail como Shared Kernel — 5+ contextos implementan historiales inmutables | RESOLVED — REFUTED by measurement 2026-08-02. The row says «5+ contexts implement immutable histories» and proposes extracting an AuditTrail shared kernel. **The shared kernel already exists, in two layers, and no context has its own.** (1) `Domain/ValueObjects/AuditProps.cs` is a single audit stamp used by **16** contexts — Geo, Governance, Qa, Tenancy, Sdlc, Integration, Intake, Discovery, Products, Design, Audit, Artifacts, Release, Metrics, Construction. (2) `Domain/Audit/AuditEntry` plus `IAuditEntryRepository` is ONE append-only trail: a repository-wide search for a second history repository returns exactly one interface. The strongest evidence is GT-588's signing wire itself — it signs every governed decision by decorating that single interface, which only works because gate evaluation, approval recording, decision publication and agent turns all already write through it. Five paths, one trail; the duplication the row assumes would have made that decorator impossible. Append-only is enforced by `AuditAppendOnlyTests`, which fails if either the repository or the aggregate grows a mutator. **One real thing the row was circling, recorded rather than lost:** `AuditProps` deliberately does NOT adopt the Core's shared-kernel `AuditProps`, because the Core's members are `CreatedAt`/`UpdatedAt` and mutable-in-place while the Tracker's are `CreatedAtUtc`/`UpdatedAtUtc` on immutable records that the persisted schema depends on. That divergence is written in the type's own docstring citing ADR-0071. It is a deliberate deviation with a reason, not the missing extraction this row describes. | 🟠 HIGH | 🔴 HIGH |
 | 3 | 🟢 RESOLVED | [GAP-020](#detail-gap-020) | Docs | Documentation gap | Docs | Docs | N/A | Artifact Schema URLs from Core Missing | RESOLVED 2026-08-02. Of the four things the reopen asked for, two shipped and two are settled by decision. **Shipped:** the references are consumed as data (`CoreArtifactSchemaCatalog`), every artifact in `GET /api/phase-artifact-profiles` carries its `canonicalSchema` `$id`, the artifact-fields screen links it, and a test compares the code against `CORE_ARTIFACT_SCHEMAS.md` in both directions. **Withdrawn by product direction (user, 2026-08-02): validating artifact content against these schemas.** T-056 rules — content validation is the tenant's configuration and not engine code — so the Tracker offers the canonical shape and never enforces it. **Handed to GAP-004:** tenant-aware persistence or caching of the references. With validation withdrawn a cache has no consumer, and the meaningful version of «stop mirroring, start consuming» is syncing the catalog from the Core, which is exactly the `IPhaseArtifactProfileSource` seam GAP-004 owns and which is BLOCKED on the Core exposing it. Recorded as a handover rather than dropped, so the residue has an owner instead of evaporating. | 🟡 MEDIUM | 🟡 MEDIUM |
 | 4 | 🟢 RESOLVED | [GAP-023](#detail-gap-023) | Docs | Documentation gap | Docs | Docs | N/A | Re-Do Flow Not Fully Designed | RESOLVED — stale row; the evidence was in the catalog and never reached this register. `tracker-gap-reference-catalog.md` closed it on 2026-07-20 with «YA HECHA» and named the artifact. Re-verified here rather than taken on trust: `reference/specs/design/tracker-redo-flow-design.md` is 254 lines with trigger conditions, the state model, the domain model inside the Release context, the recalculation algorithm, impact propagation, the human-authorization gate, domain events and a traceability table. Its §10 lists five scheduling decisions (RD-D1…RD-D5) explicitly registered as proposals awaiting PO ratification — that is a decision pending an owner, not a design that is missing. | 🟡 MEDIUM | 🟡 MEDIUM |
 | 5 | 🟢 RESOLVED | [GAP-025](#detail-gap-025) | Docs | Documentation gap | Docs | Docs | N/A | Portal DDD incomplete — NARROWED 2026-08-01: the strategic-map half is DONE (`reference/specs/architecture/bounded-context-map.md` calls itself «the single, authoritative strategic map» of the 9 contexts, with integration patterns and cross-context events). What remains is the four support contexts. | RESOLVED — stale row, same shape. The catalog closed it on 2026-07-19; this register kept the narrowed half open. Verified directly: `bounded-context-map.md` §2 classifies all nine contexts and names the four supporting ones — Governance, Artifacts, Metrics, Integration — each linked to its own tactical model, and all ten `ddd-model.md` files exist on disk. Both halves of the row are satisfied. | 🟡 MEDIUM | 🟡 MEDIUM |
@@ -562,15 +562,15 @@ This document is the only operational gap register in this repository. The maste
 
 ### Detail OPP-002
 
-- **Status:** 🟡⏳ DEFERRED
+- **Status:** 🟢 RESOLVED
 - **Type:** OPP (Improvement opportunity)
 - **Component:** Backend
 - **Module:** N/A
 - **Story(ies):** N/A
 - **Criticality:** 🟠 HIGH
 - **Complexity:** 🔴 HIGH
 - **Description:** Extraer AuditTrail como Shared Kernel — 5+ contextos implementan historiales inmutables
-- **Next Step:** Define owner and remediation action before execution.
+- **Next Step:** None — the extraction it proposes was already done. If a future context needs a history that AuditEntry cannot serve, that is a new row with its own evidence, not this one.
 
 [Back to master register](#master-register)