A fourteen-scope architecture audit of the working tree, independently checked for coverage, materiality, overlap, and priority, then revalidated against current origin/main.
The new Message Relay and upstream-shaped agent server are the right architectural direction. The highest-leverage work is to encode their ownership claims in data and construction interfaces before more ingresses depend on them.
Across WhatsApp, GitHub, email, Slack, Discord, the coordinator, and the agent server, invalid states appear where one real-world operation gains multiple unrelated keys or owners.
These survived independent schema, overlap, and priority checks and remain present on current main. GitHub creation was attempted as enyst, but credentials could not write; the finished drafts are preserved beside this report.
The lane directory says it owns external-thread → conversation binding. The schema allows duplicate conversation bindings, orphan work, and independent lane/conversation pairs.
lanes.conversation_idwork.lane_key foreign keyMalformed or unreadable lease files are treated exactly like absent files, allowing generation-one overwrite. Managed app construction also drops apparent lease options.
The scenario generator guesses modules, factories, and option aliases; it cannot unwrap the real app return shape and has a temporal-dead-zone error path.
Concurrent profile, settings, and secret mutations can overwrite one another. Any read/parse error silently resets to defaults; writes replace the target directly.
The allowlist uses renameable username/tag while conversation identity already uses the stable Discord snowflake.
DISCORD_ALLOWED_USER_IDSThese should expand existing Beads or cutover acceptance criteria, not become duplicate GitHub issues.
| Finding | Disposition | Why |
|---|---|---|
| WhatsApp monotonic cursor + explicit successful acceptance | kxa.2 / kxa.3 | Current equal-timestamp loss is real; the standalone bridge migration owns the transport cursor and durable intake. |
| Scope uniqueness + exactly one control scope | kxa.2 + 69w | Narrow migration acceptance, not a second registry rewrite. |
| One schedule parser + per-task quarantine | kxa.4 | One malformed recurrence can abort later due tasks; the moved scheduler is the right seam. |
| Canonical GitHub event identity | 3iy | Webhook and notification intake can represent the same comment with different turn keys. |
| Email end-to-end idempotency | email activation / b1r.24 | Required before dormant email dispatch is enabled; stable emailId should own turn and Resend effects. |
| Durable Slack thread eligibility | b1r.20 after lane fix | Capped in-memory timestamp tracking forgets accepted lanes on restart/eviction. |
| Context doc classes + private memory path | 1yd / 750 | Loader injects heartbeat/reserved docs into every conversation and points at the public memory stub. |
| Legacy conversation deletion / Discord startup ownership | b1r.24 | Go/no-go hardening and rollback ownership belong in the cutover plan. |
Every tracked surface has an explicit behavior or inventory owner. Generated, vendored, static, private, and task-state paths were named rather than silently ignored.
The order matters more than the volume. Harden the representation before trusting more channels; delete rollback paths last.
The useful part of an audit is what it refuses to overstate.
One reviewer checked coverage and evidence quality; one checked overlap, authoritative ownership, and materiality; one ranked priority and dependencies. A bounded follow-up assigned 27 initially implicit CI/meta/governance paths.
The working branch was four commits behind origin/main. Broad route/OpenAPI drift, dangling manifest hints, and an active CI reference were removed from the filing set because main had already corrected the observed evidence. The five candidates above remain present at f70dc2c.
Generated lockfiles and OpenAPI bodies were treated as artifacts; vendored/reference skills were inventoried rather than re-audited as product code; static media/games and private/untracked runtime state were excluded from architectural findings. Larger TurnLedger/state-machine rewrites, generic relay abstractions, and policy-dependent guest/DM changes failed the materiality test.
No source, Bead, workflow, documentation, or generated artifact was edited. Tests were intentionally not run under the requested read-only audit brief. The only worktree entry remained the pre-existing untracked .openhands/.
The GitHub connector authenticated as enyst but returned HTTP 403 for issue creation. The local Keychain item github.com/enyst returned HTTP 401. No issue was created. Five finished Markdown drafts are saved beside this report and can be filed immediately after the token is refreshed.