# Gaps and inconsistencies (cross-cutting audit)

**Last reviewed:** 2026-03-24 (credential hydration wired in `SyncService`)

Most previously tracked gaps are **implemented**. This file lists only **long-horizon** or **compliance** items.

---

## Implemented (recent)

| Topic | Where |
|-------|--------|
| Shared OkHttp + Retrofit refresh | `SyncRetrofitHolder`, `NetworkModule`, `BackendSyncAPI` / `BackendPullAPI` lambdas |
| Non-blocking hosted config | `ClientConfigRefreshCoordinator.scheduleNonBlockingInitialLoad` |
| Browser VPN policy flag | `BuildConfig.SMOA_BROWSER_VPN_ENFORCED` / `-Psmoa.browser.vpnEnforced=true`, `VPNManager.setBrowserVpnEnforced` |
| Room credential cache | `credential_cache` + `CredentialCacheDatabaseModule` |
| OpenAPI drift process | `docs/development/OPENAPI-SYNCHRONIZATION.md`, `scripts/export-openapi-local.sh` |
| Credential pull → cache + payloads | `SyncService.startSync`: `CredentialCacheSyncPort.mergeFromPullCredentialsJson` then `hydrateMissingPayloads { pullCredentialDetail }`. UI: `CredentialsViewModel` |

---

## Remaining (long-term)

| Topic | Notes |
|-------|--------|
| **Strong multi-tenant isolation** | API key + `X-Unit` are not RLS; see `docs/security/TENANT-THREAT-MODEL.md`. |
| **AAMVA / ICAO production compliance** | Encoders need jurisdiction QA and official test vectors. |
| **Automated OpenAPI golden-file CI** | **Partial:** `OpenApiContractIntegrationTest` in `:backend:test` (also `smoaVerify`) asserts key `/v3/api-docs` paths. Full committed golden JSON diff still optional. |

---

## Related

- **[Outstanding production & compliance work (detailed)](./OUTSTANDING-PRODUCTION-AND-COMPLIANCE-WORK.md)** — expands long-horizon items into deliverables, prerequisites, and acceptance criteria.
- `docs/reference/IDENTITY-TEMPLATE-ALIGNMENT.md`
- `docs/schemas/`
- `backend/docs/BACKEND-GAPS-AND-ROADMAP.md`