Frontend UI Gap Analysis — Final Report

Date: July 23, 2026 Scope: All frontend/UI surfaces in MIZOKICloudRun vs. the full backend product surface Method: Full-repo static audit — route/page inventory, navigation config analysis, API-route tracing, backend endpoint/MCP-tool inventory, config/env review. All counts below were verified against the tree at audit time. Verdict in one line: The product has a ~854-tool / ~94-API-group backend and a frontend that faithfully covers roughly a quarter of it, with the rest either mocked, orphaned, duplicated, or absent — the gap is less about missing pages and more about consolidation, live data, and a missing decision-governance console.

Part 1 — What the frontend IS today

There are four real UI surfaces plus several orphan fragments.

1.1 Command Center UI (miz-oki-command-center-ui/) — the primary product UI

Route classification (152 pages):

Navigation reality:

• Two competing nav systems: canonical config/navigation.ts → NavigationShell (mounted in app/layout.tsx), and legacy components/NavigationSidebar.tsx → MainLayout (not in the root layout).
• ~45 orphan pages exist with no nav entry — including live, important routes: /boss, /chat, /dashboard/srpvdal, /email-agent, /journey/stalls, /relu, /meta-deduplication.
• Legacy sidebar links to non-existent routes: /services/boss-enhanced, /visualize/test-kernel.
• Sidebar-only entries (/agent-launcher, /agentmanager, /media-agent, /boss/mcp-tools, /boss/moa-moe, /boss/realtime, /lift-measurement, /cell32) are unreachable from the canonical shell.

Data path: Browser → same-origin /api/* proxies → Cloud Run (Boss ADK boss-agent-adk, Cell 3 KG, per-cell CELL*_URLs, services). Notable mock fallbacks:

• app/api/srpvdal/metrics/route.ts — returns Math.random() SRPVDAL metrics whenever Firestore is unavailable or empty (verified lines 62–66).
• app/api/boss/chat/route.ts — hardcoded fallback response when the Boss backend is down.
• app/api/registry/* — in-memory LOCAL_REGISTRY fallback.
• Highest mock density: SSE topic streams (app/api/sse/stream/[topic], app/api/cells/stream, app/api/sse/creative-updates), kernel dashboard metrics, KG orchestrate.

Component debt: ~20+ parallel Boss chat implementations. Live: BossAgentV2 (/boss), BOSSChat (/chat), BossChatPanel (Agent IDE), BossAgentFooter. Dead (no app import): BossAgentAutonomous, BossAgentEnhanced, BossAgentSystem, BOSSChatAdvanced, BOSSChatEnhanced, EnhancedBossChat, EnhancedBossChatCompact, PersistentBossChat, BossAgentSRDAL, BossQuickstartView, BossRedirect, BossAgentDashboard.

1.2 Marketing site (# MIZ OKI 3.5/ → mizoki-website / mizoki3.com)

The strongest, most coherent frontend in the repo:

• Complete and tested: hub /demo + six functional demo desks (Signal, Counsel, Estate, Capital w/ SSE, Risk, Nexus) backed by real stdlib engines in mizoki_runtime/demo_*.py, ~237 test methods across 12 test modules.
• Full marketing set (index, how-it-works, industries, resources, roi, investor, walkthrough, division landings, blog with RSS/JSON feeds).
• Real /admin dashboard (env-driven login, MCP tool runner, decision traces) + public /api/demo/*, gated /api/mcp/* and /api/boss/*.
• Known defects: /console operator terminal is a polished mock (no fetch, scripted ACT-991 animation only — mizoki3-site/console/index.html); mizoki_runtime/virtuoso.py registry mirror is stale vs the July 22 flagship pins (still gemini-3.5-flash / claude-opus-4-8 / gpt-5.5 / grok-4.3, flagged in src/shared/virtuoso_models/WIRING.md §10); /11/* routes point at a missing directory; root login.html static stub is dead; some pages thin (pricing.html 114 lines, security.html 124 lines).

1.3 Browser/IDE extensions (active secondary UIs)

• Chrome extension (chrome-boss-agent-extension/, v6.45.11): popup + side panel chat, MCP tool browser, quick actions (LTV/ROAS/CATE/journey risk), CRE deal workflows, legal tools, SSE streaming.
• VS Code extension (vscode-boss-agent-extension/, v6.45.10): chat webview, MCP tools tree, cells status tree, explain/refactor/tests, voice, legal-risk commands.

These two consume Boss /health, /api/v1/chat, /api/v1/mcp/*, /api/v1/cells/status — i.e., they already implement the "operator shell" pattern the web UI half-implements.

1.4 Orphan/legacy fragments (confusion sources)

• /workspace/index.html (~1,068 lines) — alternate legacy marketing page, superseded.
• /workspace/app/metrics/page.tsx — a standalone path-metrics page outside any Next.js app, deploy story unclear.
• /workspace/apps/web — experimental create-next-app scaffold (JSON-LD tile renderer, mock causal-admin, its own api/boss/chat proxy), guarded by frontend-guard.yml but not a product surface.
• mizoki3-site/console — the mock console noted above.

Part 2 — What the product IS (the surface the frontend must cover)

Backend inventory (verified in code, not just docs):

Largest MCP tool families (each is a candidate UI surface): fl_* (46, federated learning/privacy), connector_* (33), email_* (30, MPP/list hygiene), research_* (19), amo* (~45, marketing optimization), gdp_* (15, Gemini data pipeline), roi_* (15), kg_* (15), journey_* (14), legal_* (13, MoLE), gndi_* (13), cf_* (13, counterfactuals), clds_* (12, closed-loop decisions), aadf_* (12), structured_task_* (11), sixdomain_* (10), srpvdal_* (10), plus cre_*, sfmc_*, relu_*, vbb, uplift/pacing/creative-fatigue, attribution, guardrails, policy engine, rollback, multi-tenant, Cloud Run gate, Vertex AI lifecycle (18 HTTP routes), capsules/closed-code, compliance (EU political ads, consent, GA4 EU).

Part 3 — Coverage matrix: what the frontend covers vs. fails to cover

Legend: ✅ real coverage · 🟡 partial/mock/thin · ❌ none

Score: ~4 capabilities fully covered, ~15 partially (often mock-degraded or nav-orphaned), ~13 with zero frontend. The zero-coverage set clusters exactly around the platform's differentiators: decision governance (DCP/passports/gates/replay), model governance, ML lifecycle, multi-tenancy, and the domain desks.

Part 4 — What the frontend SHOULD BE

Given the backend and the product's own stated posture ("Production Candidate / Controlled Pilot", Stage-3 recommend-only, "No evidence, no action"), the right frontend is not 152 pages. It is one consolidated operator application with five hubs, plus the marketing site, plus the extensions:

1. Operate hub (operator shell) — Boss chat (one implementation), MCP catalog + governed invoke, cells/services health, SRPVDAL loop state, live SSE feed. (exists, fragmented)
2. Decide hub (governance console) — the missing centerpiece: proposal queue → DEL gauge → Validation Passport check matrix (12/13/14) → RiskGate verdicts (APPROVE/HOLD/VETO) → OperatorGate resolve → ActionAuthorization + rollback token → audit replay timeline. Backed by sixdomain_* tools + mizoki-remediation services + policy engine + approval routing. The marketing site's mock /console is the design spec; it needs to become real, in the product UI.
3. Grow hub (channel & marketing desks) — Google GAQL (done), Meta/attribution/dedup, SFMC email, VBB + pacing + creative fatigue + budget reallocation approvals, uplift/lift measurement, journey stalls/NBA. (half exists)
4. Know hub (KG & intelligence) — KG explorer, GraphRAG chat (real), decision provenance/explain, journey/identity graph, path metrics. (partially exists)
5. Platform hub (admin/ops) — Virtuoso registry health + role pins + failover status, multi-tenant SLO/quota/cost dashboards, Cloud Run gate/canary promotions, Vertex ML lifecycle, API-sunset firewall, compliance (consent/political ads), integration health. (almost entirely missing)

Cross-cutting requirements the current UI fails: single navigation source of truth; auth on by default; no silent mock fallbacks (degrade loudly, never fabricate metrics); one Boss chat component; CI that fails on type/lint errors; smoke tests.

Part 5 — Bridging the gap (detailed plan)

Ordered by dependency, not calendar time. Each item lists concrete files/actions.

Workstream A — Stop the bleeding (hygiene, low risk, high leverage)

1. Delete/quarantine dead routes: remove the 8 archived route trees (app/boss-archived-v3|v4|v5, app/boss-standalone-archived, app/boss-versions-archived-react, app/docs-boss-agent-system-archived, app/test-boss-archived) and the ~12 dead Boss chat components listed in §1.1. Move anything historically interesting to archive/ (already exists).
2. Unify navigation: make config/navigation.ts the single source; delete or refactor components/NavigationSidebar.tsx + MainLayout usage; fix broken targets (/services/boss-enhanced, /visualize/test-kernel); add nav entries for live orphans — /boss or /chat (pick one, redirect the other), /dashboard/srpvdal, /agent-launcher, /agentmanager, /media-agent, /boss/mcp-tools, /boss/moa-moe, /boss/realtime, /lift-measurement, /journey/stalls, /relu, /email-agent, /meta-deduplication.
3. Re-enable build gates: flip ignoreDuringBuilds/ignoreBuildErrors to false in next.config.mjs, fix what breaks. Add a minimal CI job (typecheck + lint + next build).
4. Kill silent mock fallbacks: in app/api/srpvdal/metrics/route.ts, app/api/boss/chat/route.ts, app/api/registry/*, SSE topic routes, kernel metrics — replace fabricated data with an explicit degraded payload ({ degraded: true, reason }) and render a visible "backend unavailable" state. Gate any remaining demo data behind NEXT_PUBLIC_ENABLE_MOCK_DATA (already false in env.production.yaml) and honor it everywhere.
5. Repo-level orphans: delete /workspace/index.html, /workspace/app/metrics (or fold into the command center), decide apps/web's fate (archive unless it is the intended v2 shell); fix or remove marketing-site /11/* routes and root login.html.

Workstream B — One operator shell (consolidation)

1. Single Boss chat: standardize on the Agent IDE BossChatPanel engine (streaming + voice + thinking toggle), wrap it as the /chat page and the footer widget; delete BossAgentV2 vs BOSSChat duplication.
2. Auth: pick one stack (Supabase SSR is already wired in middleware.ts), remove the Firebase-auth path from login (useTenantAuth/TenantLogin) or make it the one choice; set REQUIRE_AUTH=true in cloudbuild.yaml for the deployed service with real keys via Secret Manager (mirror the marketing site's --set-secrets pattern); protect at minimum: all write/invoke actions, approvals, MCP invoke.
3. Cells & services health: replace mocked stream proxies with the real /api/v1/cells/status + service /health fan-out (the VS Code extension already proves this pattern); one health dashboard, retire /system-health vs /system/health-dashboard duplication.
4. MCP catalog: promote /boss/mcp-tools into a first-class governed console — namespace/tag filtering (registry v2 supports it), schema-driven invoke forms, invocation history — reusing connector_v2_* / capability-discovery endpoints.

Workstream C — The Decision Governance console (the biggest missing piece)

New route group app/decide/ backed by existing backends (no new backend required for v1):

1. Proposal queue: sixdomain_submit_proposal results + /api/v1/actions/pending + mizoki-remediation approval-routing /pending — one inbox with filters (domain, DEL, gate state).
2. Decision detail: DEL score vs threshold-80 gauge; ReasoningPath weights; EvidenceBundle links; Validation Passport matrix (12/13/14 checks, hard vs soft, PASS/PASS_WITH_CONSTRAINTS/FAIL) — render DecisionProof.render_markdown()'s twelve-slot grammar as the canonical layout.
3. Gate actions: RiskGate verdict display (APPROVE/HOLD/VETO + undeclared-exposure holds); OperatorGate resolve form (sixdomain_resolve_gate) with alternative-proposal support (the ACT-991 flow already demoed on the marketing site); FORBIDDEN_AUTONOMY scopes rendered as hard-blocked.
4. Audit replay: timeline view over sixdomain_replay / audit-replay service, with hash-chain verification status.
5. Policy Engine panel: list/create policies, transition history, one-click rollback (policy_* HTTP group /api/v1/policy-engine/* already exists — 11 endpoints, zero UI today).
6. Reuse the mock /console's visual language (it is already investor-approved) but drive it from live APIs. This also fixes the credibility problem of demoing a governance product with a scripted terminal.

Workstream D — Platform hub (admin/ops surfaces with zero coverage)

1. Virtuoso model governance page: role→model pins (from virtuoso-models-service /registry, /models, /health), served_by primary vs global_fallback rates, forbidden-legacy scan results, credential status (Anthropic/OpenAI/xAI), JourneyEvent ingest stats (inserted/duplicate/updated), schema hash. Also re-sync the marketing site's stale mizoki_runtime/virtuoso.py mirror (flagged in WIRING.md §10).
2. Multi-tenant dashboard: /api/v1/mt/dashboard, quotas, costs, SLO health, alerts (kg-multi-tenant-service is fully built; UI is zero).
3. Deploy gates: Cloud Run ROI/SLO gate + gate-eval-service + replay-sim-ope causal gate — a promotions board (evaluate → promote/hold/rollback with the causal-evidence check surfaced).
4. Vertex ML lifecycle: models/endpoints/monitoring drift/batch jobs off the 18 existing /api/v1/vertex-ai/* routes.
5. Compliance panel: API-sunset firewall alerts (mcp_check_api_versions), consent defaults by region, EU political-ads declarations.

Workstream E — Domain desks (product depth)

Port the marketing site's six demo desks into real Command Center desks, in this order of backend readiness:

1. Risk desk — sixdomain_risk_register/risk_overview, exposure graph, limit headroom, stress results (backend complete in mizoki_risk).
2. Counsel desk — legal_* (13 tools): MoLE query with IRAC output, conflict check, authority corpus browser, compliance playbooks; must render the UPL disclaimer + flagged_for_review state (use the legal-disclaimer skill contract).
3. Media/Capital desks — budget reallocation approvals (realloc_*/ABR with ReLU-gate scores), uplift pacing, creative fatigue rotation queue.
4. Estate/CRE desks — ownership graph, reconciliation runs, underwriting handoff drift (the Chrome extension's CRE flows are the interaction spec).
5. Journey/Email consolidation: merge /journey*, /email-agent, /operations/email-intelligence into one Grow-hub journey desk with stall/NBA/hygiene actions.

Workstream F — Quality floor

1. Tests: Playwright smoke suite (login → each hub renders → chat round-trip → MCP list loads); route-handler unit tests for the top 20 API proxies asserting no fabricated data on failure; contract test that every config/navigation.ts href resolves to a page (would have caught the current broken links).
2. Telemetry: the OTel wiring exists (instrumentation.ts, lib/telemetry.ts) — add per-hub spans and a real error boundary reporting path.
3. Docs: one ARCHITECTURE.md refresh describing the five-hub IA and the single nav source; deprecate the many stale BOSS_*/A2A_* docs in the UI folder.

Sequencing & risk notes

• A and B are prerequisites for everything (nav + auth + no-mock discipline); they are also the cheapest.
• C (governance console) is the highest product value and unblocks the "Production Candidate" pilot story — the backend for it is already deployed or scaffolded; risk is mostly API-shape drift between sixdomain_* MCP tools and the remediation HTTP services (they overlap conceptually — pick MCP-first for v1, since the Boss /execute invoke path is proven).
• D items are independent of each other; virtuoso health and multi-tenant are pure read dashboards (lowest risk).
• E desks each depend on C's passport/gate components — build those as shared components first (PassportMatrix, DELGauge, GateActionBar, AuditReplayTimeline).
• The 89 mock-tinged API routes should shrink to near zero as a side effect of A.4 plus each workstream wiring its real backend; track the count in CI (grep -rl "Math.random" app/api | wc -l as a ratchet).

Appendix A — Key files cited

• miz-oki-command-center-ui/next.config.mjs (lines 6, 12 — build gates off)
• miz-oki-command-center-ui/middleware.ts (lines 27–35 — auth off by default)
• miz-oki-command-center-ui/app/api/srpvdal/metrics/route.ts (lines 62–66 — random metrics fallback)
• miz-oki-command-center-ui/config/navigation.ts vs components/NavigationSidebar.tsx (dual nav)
• # MIZ OKI 3.5/mizoki3-site/console/index.html (mock operator console)
• # MIZ OKI 3.5/mizoki_runtime/virtuoso.py (stale registry mirror; src/shared/virtuoso_models/WIRING.md §10)
• miz-oki-adk-agents/boss/six_domain_integration.py (sixdomain_* tools — governance backend for Workstream C)
• mizoki-remediation/services/* (ten governance services — zero UI)
• services/kg-multi-tenant-service, services/gate-eval-service, services/replay-sim-ope, services/virtuoso-models-service (zero UI)

Appendix B — Counts summary