docs(audit): scope GAP-004 blocker by blocker; Core half filed upstream as GT-650

docs/audit/tracker-gaps-opportunities-tracking.md

@@ -25,7 +25,7 @@ This document is the only operational gap register in this repository. The maste
 
 | # | Status | ID | Type | Category | Component | Module | Story(ies) | Description | Resolution / Next Step | Criticality | Complexity |
 |---:|---|---|---|---|---|---|---|---|---|:---:|:---:|
-| 1 | 🔴 BLOCKED | [GAP-004](#detail-gap-004) | GAP | Missing capability / corrective gap | API | N/A | N/A | 3 dependencias upstream bloqueadas (Core API, UMS JWKS, UMS Auth Graph) | BLOCKED — the row is corrected to match its own card, which was right all along. It was marked RESOLVED with the note «Resolved via Defensive Isolation (Mocks)», and installing a stand-in is not resolving a dependency. The code agrees with the card: `StandInPhaseArtifactProfileSource` is still the only implementation of `IPhaseArtifactProfileSource`, every profile it serves is stamped `core-standin`, and the interface's own documentation says a Core-sync implementation replaces it «when Evolith Core publishes the catalog (GAP-004 resolved)». The three upstream dependencies — Core API, UMS JWKS, UMS Auth Graph — are unchanged. This is also where the residue of GAP-020 lands: syncing the artifact catalog from the Core instead of mirroring it belongs to this seam. | 🔴 CRITICAL | 🔴 HIGH |
+| 1 | 🔴 BLOCKED | [GAP-004](#detail-gap-004) | GAP | Missing capability / corrective gap | API | N/A | N/A | 3 dependencias upstream bloqueadas (Core API, UMS JWKS, UMS Auth Graph) | BLOCKED, and now SCOPED — the row said «Define owner and remediation action before execution» and nobody ever had. Each of the three upstream dependencies was probed on 2026-08-02 rather than assumed. **(1) Core API — root cause found and filed upstream as `evolith_arch32` GT-650 (PR #383).** The Core cannot publish an artifact catalog because it holds TWO unreconciled ones: the gate corpus names 24 artifacts in human form with schema refs, `UNIVERSAL_PHASE_ARTIFACTS` names 18 slugs over three phases, and they disagree on names, on membership both ways, and on PHASE — `Coverage Report` is construction in one and quality in the other. Neither is what the HTTP surface serves; that reads a third file with no artifacts at all. So this is not «the Core has not built an endpoint», it is «the Core has no single answer to endorse», which needs an ADR upstream and cannot be unblocked from here. **(2) UMS JWKS — still blocked, and T-053 is still `Proposed`.** The UMS publishes no `.well-known` and issues symmetric HS256; probed today, the local UMS ingress answers 503 on every path, so nothing could even be re-tested. The Tracker already carries both validation modes, so this blocks the target state, not the product. **(3) UMS Auth Graph — still blocked**, same system, same reachability. **What is NOT blocked and was mistaken for it:** the row had been closed once with «Resolved via Defensive Isolation (Mocks)». The stand-ins are real and working, and that is why the product runs; it is not why the dependency is resolved. Also lands here: the residue of GAP-020 — tenant-aware sync of the artifact catalog — because it is the same seam and the same blocker. | 🔴 CRITICAL | 🔴 HIGH |
 | 2 | 🟡⏳ DEFERRED | [OPP-002](#detail-opp-002) | OPP | Improvement opportunity | Backend | N/A | N/A | Extraer AuditTrail como Shared Kernel — 5+ contextos implementan historiales inmutables | Pending owner/action definition in this register. | 🟠 HIGH | 🔴 HIGH |
 | 3 | 🟢 RESOLVED | [GAP-020](#detail-gap-020) | Docs | Documentation gap | Docs | Docs | N/A | Artifact Schema URLs from Core Missing | RESOLVED 2026-08-02. Of the four things the reopen asked for, two shipped and two are settled by decision. **Shipped:** the references are consumed as data (`CoreArtifactSchemaCatalog`), every artifact in `GET /api/phase-artifact-profiles` carries its `canonicalSchema` `$id`, the artifact-fields screen links it, and a test compares the code against `CORE_ARTIFACT_SCHEMAS.md` in both directions. **Withdrawn by product direction (user, 2026-08-02): validating artifact content against these schemas.** T-056 rules — content validation is the tenant's configuration and not engine code — so the Tracker offers the canonical shape and never enforces it. **Handed to GAP-004:** tenant-aware persistence or caching of the references. With validation withdrawn a cache has no consumer, and the meaningful version of «stop mirroring, start consuming» is syncing the catalog from the Core, which is exactly the `IPhaseArtifactProfileSource` seam GAP-004 owns and which is BLOCKED on the Core exposing it. Recorded as a handover rather than dropped, so the residue has an owner instead of evaporating. | 🟡 MEDIUM | 🟡 MEDIUM |
 | 4 | 🟢 RESOLVED | [GAP-023](#detail-gap-023) | Docs | Documentation gap | Docs | Docs | N/A | Re-Do Flow Not Fully Designed | RESOLVED — stale row; the evidence was in the catalog and never reached this register. `tracker-gap-reference-catalog.md` closed it on 2026-07-20 with «YA HECHA» and named the artifact. Re-verified here rather than taken on trust: `reference/specs/design/tracker-redo-flow-design.md` is 254 lines with trigger conditions, the state model, the domain model inside the Release context, the recalculation algorithm, impact propagation, the human-authorization gate, domain events and a traceability table. Its §10 lists five scheduling decisions (RD-D1…RD-D5) explicitly registered as proposals awaiting PO ratification — that is a decision pending an owner, not a design that is missing. | 🟡 MEDIUM | 🟡 MEDIUM |
@@ -150,7 +150,7 @@ This document is the only operational gap register in this repository. The maste
 - **Criticality:** 🔴 CRITICAL
 - **Complexity:** 🔴 HIGH
 - **Description:** 3 dependencias upstream bloqueadas (Core API, UMS JWKS, UMS Auth Graph)
-- **Next Step:** Define owner and remediation action before execution.
+- **Next Step:** Not actionable in this repository. The Core half is `evolith_arch32` GT-650 (reconcile the two artifact vocabularies under an ADR, then publish one catalog); the two UMS halves need the UMS to publish JWKS/OIDC and an auth graph, tracked by `T-053` (still `Proposed`). Re-probe before assuming any of the three moved — this row was closed once on mocks.
 
 [Back to master register](#master-register)