[11/36] Record OC-010 through OC-040 supervisor audit

[cjohnsto-nz]

---

This is part 11 of 21 in a stack made with GitButler:

•  21  [22/36] Release 0.8.0 with packaged PDF.js preview #54
•  20  [21/36] Complete OC-070 protocol surface polish #56
•  19  [20/36] Record final OpenCollection supervisor acceptance #53
•  18  [19/36] Add OC-110 runtime authoring UX #52
•  17  [18/36] Add OC-080 runtime lifecycle and OC-110 task setup #51
•  16  [16/36] Record OC-050 OC-090 OC-100 supervisor audit #50
•  15  [15/36] Add OC-050 auth and transport support #49
•  14  [14/36] Add OC-100 request type UX #48
•  13  [13/36] Add OC-100 request type UX task #47
•  12  [12/36] Add OC-080 and OC-090 task tracks #46
•  11  [11/36] Record OC-010 through OC-040 supervisor audit #45 <-- current
•  10  [10/36] Add OC-020 WebSocket support #44
•  9  [09/36] Add OC-010 GraphQL support #43
•  8  [08/36] Require demo server fixtures for parallel tracks #42
•  7  [07/36] Record OC-000 and OC-060 supervisor audit #41
•  6  [06/36] Add OC-060 schema round-trip validation #40
•  5  [05/36] Add OC-040 runtime scripting support #39
•  4  [04/36] Add OC-090 gRPC streaming support #38
•  3  [03/36] Add OC-030 gRPC unary protobuf support #37
•  2  [02/36] Add OC-000 protocol dispatch foundation #36
•  1  [01/36] Add OpenCollection agent plan #35

[APKiwi]

Verdict: approve with nits. Internal consistency checks out: the 13-test claim matches the actual test file, and the audit honestly records the two real limitations (WS wiring not atomic to the OC-020 branch, WS/gRPC not running the runtime lifecycle), both accurate against the code.

• Minor: every cited commit hash (d599906, a67a3ad, 7a9dea5, 872660b, 0daa7be, 02155e6, 166c297) is unresolvable, GitButler restacks rewrote them. The doc even warns about this. Evidence pointers that can't be followed aren't evidence, cite branches + paths instead.
• Nit: an audit PR shipping functional package.json changes (the two Copilot tool modelDescription strings) is off-label. The strings themselves are accurate.

[cjohnsto-nz]

Fixed on the stack-tip rework branch fix/open-collection-pr-rework in a2f2b2e, in docs/open-collection-gap-analysis/AGENT_PROGRESS.md.

The rewritten OC-000 through OC-060 evidence pointers now name stable PR numbers, full branch names, and concrete implementation/test paths. This covers the seven stale hashes identified here and the stale OC-000 pointer found in the same audit table.

I did not put that documentation edit on PR #45. A pre-push three-way check against immediate child PR #46 produced a conflict in AGENT_PROGRESS.md, because later branches continue editing that ledger. The correction was therefore placed on the existing rework branch based on current stack-tip PR #71 (feature/oc-170-request-action-first-click) instead of forcing a restack through every descendant. PR #45 and PR #46 remain MERGEABLE/CLEAN at their unchanged heads.

Not changing the package.json model descriptions. The supervisor audit explicitly covered package/build/install verification and found that the Copilot-facing manifest metadata still described only the older HTTP/GraphQL surface. Correcting metadata to match the WebSocket and unary gRPC capabilities delivered across PRs #37, #39, #43, and #44 is an audit remediation, not unrelated runtime scope. Moving those two strings into an already-reviewed feature branch would rewrite lower stack history without improving behavior or ownership.

Validation on the rework branch: 491/491 tests passed, TypeScript compilation passed, and the production build passed after installing the committed lockfile dependencies. The rework branch is verified as a descendant of the current PR #71 stack tip.