# Audit the accepted product surface for production completeness

Type: research
Status: resolved

## Question

Against ADR-0020 and ADR-0021, which required platform-admin, org-admin,
project-onboarding, team/access, session, usage, provider-mode, Organization
policy-limit, emergency workload-control, and Feishu flows are absent,
unreachable, or only test-facing rather than usable in the initial production
service? Treat ADR-0022's capacity control surfaces as part of the accepted
product boundary.

## Answer

The current Hub is not a usable or production-complete SaaS product surface.
Its Organization-scoped JSON APIs and single-Feishu-app Agent Run path are
worth retaining, but the running service has one process-global Feishu
app/bot, one global provider key/base URL, no Organization connection/secret
plane, no platform-administrator control plane, and no real Organization or
platform management UI. OAuth redirects a successful login to an unmounted
`/admin/org/:orgSlug` route.

Two real Fastify integration probes, each run twice, proved that an authenticated
Organization ADMIN receives 404 at the post-login destination and two distinct
Organization return paths produce the same OAuth `client_id`. Official Feishu
documentation also proves that `open_id` is application-scoped, `user_id` is
tenant-scoped, and `union_id` only links applications from the same application
provider. The current globally unique `User.feishuOpenId`, raw `chatId`, event
identity, OAuth state and one-listener composition therefore cannot safely
route independently customer-owned applications.

ADR-0022 remains an additional release blocker: beyond a process-memory
Project queue and global max-turn setting, layered limits, durable
Organization-fair admission, hard storage/run/process budgets, alerts and
audited emergency brakes have no complete persistence or product surface.

The full verdict, deterministic probe results, root causes, retained seams and
required end-to-end release evidence are in the
[accepted SaaS product-surface completeness audit](../assets/product-surface-completeness-audit.md).
The detailed route/schema/test matrix is in the
[accepted product-surface code inventory](../assets/product-surface-code-inventory.md),
and the Feishu identifier/OAuth/event/long-connection facts are in the
[Feishu product-surface primary sources](../assets/product-surface-feishu-primary-sources.md).

The newly-clear execution frontier is:

- [Decide the platform-administrator identity and audit boundary](42-decide-platform-admin-identity-audit.md)
- [Implement the Organization connection and secret plane](43-implement-org-connection-secret-plane.md)
- [Route Feishu identity and traffic by Organization connection](44-route-feishu-by-org-connection.md)
- [Build the private platform-administrator control plane](45-build-private-platform-admin-control-plane.md)
- [Build the private Organization-administrator control plane](46-build-private-org-admin-control-plane.md)

Existing tickets 23 and 32–38 remain the owners of durable ingress/admission,
capacity enforcement, usage alerts, workload brakes and calibration. Ticket 08
now requires all of these product slices before claiming the production release
gate.