Falcon Flowmira
Technical Documentation

Falcon Flowmira — Full Audit Report

Falcon Flowmira — Full Audit Report

Scope: All requirements from both uploaded PRDs.

  • Master PRD v10 (user-uploads://file-6) — full product blueprint.
  • Excalidraw Integration PRD (user-uploads://file-5) — evaluation & selective integration.

Method: 20 parallel read-only audit agents; one per functional area. Each cross-referenced code against the PRDs and cited file:line evidence. Statuses: BUILT-WIRED (real, works end-to-end), BUILT-STUBBED (surface exists, plumbing incomplete), MISSING (not implemented).

Date: 2026-07-20

Executive Summary

#AreaWiredStubbedMissingNotes
1Auth & Account801MFA missing
2Billing & Plans711Stripe wiring + invoices
3BYOK LLM Vault800Complete
4Diagram Canvas1600Complete
5Whiteboard / Excalidraw800Complete (MIT compliant)
6Template Marketplace710Rafa tool-call bridge stub
7Shape Packs1000Complete
8Talk to Rafa801Input redaction on chat
9RAG & Semantic Search224Largely unbuilt
10Realtime Collaboration501Offline reconcile
11Sharing & Export801Iframe embed
12Blog & Marketing SEO1600Complete
13Docs System501File-5 not hosted
14Support Queue601Admin-view audit event
15Admin & RBAC1500Complete
16Analytics & Audit901AI-cost/revenue analytics
17Security Posture1000Clean
18Plugin System014Not built
19Import / Export Formats602.vsdx + Mermaid
20Community & Engagement521Community packs + profile bios

Highest-priority remaining work (P0 → P2):

  1. P0 — Payments wiring (Stripe/Paddle checkout + webhook + invoices). Without this, ₹499/₹999 plans cannot transact.
  2. P0 — RAG stack (pgvector, ingestion, chunking, retrieval, real citations). Rafa currently generates placeholder citations.
  3. P1 — Rafa agentic tool bridge (LLM tools= parameter to actually call searchTemplatesForAgent / instantiateTemplate). Manifest exists, execution path missing.
  4. P1 — Optional MFA for accounts, especially platform owner.
  5. P1 — Rafa chat input redaction (redactSecrets on user input before hitting BYOK provider).
  6. P1 — Realtime offline reconcile (fetch missed ops on reconnect).
  7. P2 — Plugin system (registry, sandbox iframe, permissions, install flow).
  8. P2 — .vsdx + Mermaid import.
  9. P2 — AI-cost / revenue analytics panels on /insights.
  10. P2 — Iframe embed for shared diagrams.
  11. P2 — Community shape-pack submission + moderation.
  12. P2 — Public profiles / bios, follow, community-event notifications.
  13. P3 — Host File-5 (Excalidraw eval PRD) under /docs.
  14. P3 — Emit ticket.viewed audit event when admins open a support ticket.

1. Auth & Account

FeatureStatusEvidenceGap
Email+Password AuthBUILT-WIREDsrc/routes/auth.tsx:92-114—
Magic Link LoginBUILT-WIREDsrc/routes/auth.tsx:115-123—
Google/Apple/MS Sign-inBUILT-WIREDsrc/routes/auth.tsx:138-151, MS gated at :251MS disabled by default
Password ResetBUILT-WIREDsrc/routes/auth.tsx:124, src/routes/reset-password.tsx—
Optional MFAMISSINGPRD §3 (file-6:110)Not implemented in auth routes or DB
14-day Account DeletionBUILT-WIREDsrc/routes/_authenticated/settings.privacy.tsx:150 + migration ...005411_...sql:51—
Deletion Status TrackingBUILT-WIREDsettings.privacy.tsx:267 StatusPanel—
Role Verification ScreenBUILT-WIREDsrc/routes/auth.tsx:344-432—
Permanent Platform Owner (Joseph)BUILT-WIRED...075932_...sql:19-58 (trigger-protected)—

2. Billing & Plans

FeatureStatusEvidenceGap
Free — No AIBUILT-WIREDmigration ai.byok_enabled=false:560Server-side AI gating relies on client checks
Free — 3 DiagramsBUILT-WIREDcanvas.max_active_diagrams:551 + diagrams_enforce_free_limits() trigger—
Free — 3-Day Auto-DeleteBUILT-WIREDTrigger expires_at := now() + interval '3 days':387; hourly purge_expired_diagrams:464—
Pro / Pro Plus seedBUILT-WIREDmigration :470-475 (pro=₹499, pro_plus=₹999)—
Stripe / Paddle wiringBUILT-STUBBEDsrc/routes/_authenticated/settings.billing.tsx:76 reads "wire up in Sprint 5"No checkout, no webhook
Invoices / receiptsMISSING—No UI or table
Entitlement Enforcement (creation)BUILT-WIREDeffective_entitlements view + triggerAI/RAG limits client-only
Admin Plan MatrixBUILT-WIREDadmin/plans.tsx—
pg_cron Auto-DeleteBUILT-WIREDcron.schedule('flowmira-purge-ephemeral-diagrams'):461Requires pg_cron on prod DB

3. BYOK LLM Vault

ComponentStatusEvidence
Provider Support (OpenAI/Anthropic/Gemini/Groq/OpenRouter/Ollama/Mistral/Cohere/Custom)BUILT-WIREDsrc/routes/_authenticated/settings.keys.tsx:35
AES-256-GCM Encryption + HMAC dedupeBUILT-WIREDsrc/lib/llm-crypto.server.ts:37
dev/prod Environment IsolationBUILT-WIREDsrc/lib/llm-providers.functions.ts:203
Provider Selection (default → active → any)BUILT-WIREDsrc/routes/api/rafa/chat.ts:40
Connection Test (HTTP + completion)BUILT-WIREDllm-providers.functions.ts:254
Secret Rotation (versioned masters)BUILT-WIREDllm-crypto.server.ts:12 (LLM_KEY_SECRET_Vn)
Column-level REVOKE on api_key_ciphertextBUILT-WIREDmigration ...083423.sql:4
No Lovable AI FallbackBUILT-WIREDchat.ts:265 returns 428 if no vault key

4. Diagram Canvas

FeatureStatusEvidence
Node/Edge CRUDBUILT-WIREDdiagram-canvas.tsx:275,303,313,330,340
Waypoint EdgesBUILT-WIREDcanvas/waypoint-edge.tsx
Orthogonal / Bezier / Straight routingBUILT-WIREDdiagram-canvas.tsx:41,149,174,350,427
16px Grid SnapBUILT-WIRED:430-431
Smart GuidesBUILT-WIREDcanvas/smart-guides.tsx
Undo / RedoBUILT-WIRED:181-250
Keyboard Shortcuts (Ctrl+Z/Y, Del, Esc)BUILT-WIRED:360-377
Autosave (debounced 1.2s)BUILT-WIRED:216
Node label editing (dbl-click)BUILT-WIRED:330-338
Edge labelsBUILT-WIRED:340-348, waypoint-edge.tsx:143
ArrowheadsBUILT-WIRED:143,383
Minimap / ControlsBUILT-WIRED:440-441
Dark/Light ThemeBUILT-WIREDUses semantic Aurora tokens :72,136,382

5. Whiteboard / Excalidraw

FeatureStatusEvidence
Lazy client-only mountBUILT-WIREDexcalidraw-board.tsx:18,47
Checkpoint / Autosave (1.5s)BUILT-WIRED:106,340
Pro entitlement gateBUILT-WIREDwhiteboards.tsx:32 UpgradeWall
Library imports (.excalidrawlib + SVG)BUILT-WIRED:266
Custom shape renderingBUILT-WIREDshape-catalog.ts via convertToExcalidrawElements
PNG/SVG export via official helpersBUILT-WIRED:221
kind='excalidraw' routingBUILT-WIREDdiagrams.$id.tsx:71
/board/$id routeBUILT-WIREDboard.$id.tsx
MIT attribution & no branding hijackPASSTHIRD_PARTY_NOTICES.md:14, UI credit line

6. Template Marketplace

FeatureStatusEvidence
54 built-in templatesBUILT-WIREDcatalog.ts + extra.ts
20+ CategoriesBUILT-WIREDcatalog.ts:16-39
One-click Clone → canvasBUILT-WIREDmarketplace.functions.ts:288
List + Detail routes with SEOBUILT-WIREDtemplates.index.tsx, templates.$slug.tsx
Copy count trackingBUILT-WIRED:329
Admin ModerationBUILT-WIRED:416, RLS in ...235211_...sql:53
Rafa agentic selectionBUILT-STUBBEDManifest at templates.functions.ts:87; system prompt at rafa/prompt.ts:208 — but tools= parameter is not passed in /api/rafa/chat.ts, so the LLM cannot invoke them
Plug-and-playBUILT-WIREDtemplates.$slug.tsx:108 routes into working editor

7. Industry Shape Packs

FeatureStatusEvidence
BPMN 2.0 / UML / C4 / AWS(2024) / GCP / Azure / K8s / Agentic AI / NIST / ERD / NetworkBUILT-WIREDregistry.ts:49-229
Central registry with metadata (vendor/tier/license/SPDX)BUILT-WIREDregistry.ts:1,17
Per-user enable/disableBUILT-WIREDprefs.functions.ts:38
Install status badgesBUILT-WIREDsettings.packs.tsx:310
Bulk enable/uninstallBUILT-WIREDprefs.functions.ts:125,148
Drag-dropBUILT-WIREDshape-library.tsx:275
Keyboard navigationBUILT-WIREDshape-library.tsx:110
Custom import (Flowmira JSON, draw.io mxlibrary, SVG, ZIP)BUILT-WIREDimporters.ts:290
SVG sanitizationBUILT-WIREDimporters.ts:8
Provenance dialogBUILT-WIRED—

8. Talk to Rafa

FeatureStatusEvidence
Streaming BYOK ChatBUILT-WIREDapi/rafa/chat.ts
Agentic Tool Endpoint (draft_diagram/explain/cleanup)BUILT-WIREDapi/rafa/tool.ts
Canvas Panel IntegrationBUILT-WIREDrafa-canvas-panel.tsx
SECURITY OVERRIDE promptBUILT-WIREDrafa/prompt.ts
Secret redaction utilityBUILT-WIREDsupport-redact.ts (40+ patterns)
Input redaction on chat/tool payloadMISSINGapi/rafa/chat.ts does not run redactSecrets before sending user messages to providers
Support triage flowBUILT-WIREDsupport.new.tsx
BYOK-only UXBUILT-WIREDsettings.keys.tsx
No hidden fallbackBUILT-WIREDchat.ts:265 returns 428

9. RAG & Semantic Search

FeatureStatusEvidence
Document IngestionMISSING—
Embeddings (BYOK)BUILT-STUBBEDProvider infra exists; no embedding model calls
pgvector schemaMISSINGNo vector columns, only tsvector
Chunking pipelineMISSING—
Semantic retrieval RPCs (match_documents)MISSING—
Citations in RafaBUILT-STUBBEDSchema defines citations at tool.ts:153; LLM-generated placeholders only
Per-user isolationBUILT-WIREDchat.ts:245 verifyUser — but no RAG data yet
Opt-in retentionBUILT-WIREDRetention table exists (...696f5550.sql:144) — no RAG scope

10. Realtime Collaboration

FeatureStatusEvidence
Supabase Realtime channel per diagramBUILT-WIREDuse-collab.ts:63
Presence (avatars/cursors/colors)BUILT-WIREDcollab/presence.tsx:28,69, protocol.ts:35
Lamport-clock conflict handlingBUILT-WIREDuse-collab.ts:123, diagrams.$id.tsx:264
diagram_ops tableBUILT-WIREDmigration ...224131_...sql:5
Per-user role scopingBUILT-WIREDRLS at :22
Offline reconcile (fetch missed ops on reconnect)MISSINGuse-collab.ts lacks resync logic

11. Sharing & Export

FeatureStatusEvidence
PNG/SVG/PDF WYSIWYG exportBUILT-WIREDdiagram-export.ts (html-to-image + jspdf)
Filename / padding controlsBUILT-WIREDExportDialog.tsx:180-211
Background color / orientationBUILT-WIRED:230-333
Share tokens + RBAC (Viewer/Commenter/Editor)BUILT-WIREDShareDialog.tsx:25-30,171-189
Passcode protectionBUILT-WIRED:56,204-214
Access logs + Activity tabBUILT-WIRED:293-338 from diagram_share_access_logs
Filter + CSV exportBUILT-WIRED:251-290
Expiration + revokeBUILT-WIRED:191-202
Iframe embed generatorMISSINGPRD v10 lines 122, 142

12. Blog & Marketing SEO

FeatureStatusEvidence
Markdown editor + live previewBUILT-WIREDadmin/blog.$id.tsx:168
Cover image uploader (WebP)BUILT-WIRED:248
Categories / TagsBUILT-WIREDblog.functions.ts:59,67
RSS 2.0BUILT-WIREDroutes/rss.xml.ts:10
Dynamic sitemap.xmlBUILT-WIREDroutes/sitemap.xml.ts:40
Scheduled publishingBUILT-WIREDblog.functions.ts:54
Full-text searchBUILT-WIREDblog-search.functions.ts:29 (RPC search_blog_posts)
Comments moderationBUILT-WIREDadmin/comments.tsx:12
Newsletter formBUILT-WIREDnewsletter-form.tsx:10
JSON-LD (FAQ/HowTo/Article/Product/SoftwareApplication)BUILT-WIREDlib/seo/jsonld.ts
Competitor comparison pagesBUILT-WIREDvs.drawio.tsx, vs.miro.tsx, vs.visio.tsx
robots.txtBUILT-WIREDpublic/robots.txt
Canonical URLs + og:image at leaf onlyBUILT-WIREDblog.$slug.tsx:38,65

13. Docs System

FeatureStatusEvidence
Search + fuzzy scoringBUILT-WIREDlib/docs-index.ts
12 Category filtersBUILT-WIREDroutes/docs.index.tsx
⌘K shortcutBUILT-WIREDdocs.index.tsx
Master PRD (file-6) hosted at /docs/prdBUILT-WIREDsrc/content/prd/falcon-flowmira-prd-v10.md
Excalidraw eval PRD (file-5)MISSINGNot in docs/ or src/content/
Security / Architecture docs (11 files)BUILT-WIREDdocs/*.md
Per-doc SEO metadataBUILT-WIREDhead() in docs.tsx, docs.$slug.tsx

14. Support Queue

FeatureStatusEvidence
Privacy-first Rafa creationBUILT-WIREDsupport.functions.ts:56
Server-side redaction pre-insertBUILT-WIRED:42-45
Admin triage list + detailBUILT-WIREDadmin/support.*.tsx
Threaded replies (sender_role, internal notes)BUILT-WIRED:135-141
SLA state transitionsBUILT-WIRED:146-153
RLS scopingBUILT-WIRED:127-129 + has_support_access RPC
Admin-view audit event (ticket.viewed)MISSINGOnly mutations audited

15. Admin & RBAC

FeatureStatusEvidence
user_roles tableBUILT-WIREDmigration ...696f5550...sql:26-33
has_role() SECURITY DEFINERBUILT-WIRED:39-43
Permanent platform-owner + admin for Joseph (trigger-protected)BUILT-WIRED:248-264
Accordion sidebar + breadcrumbs + mobile drawerBUILT-WIREDadmin/route.tsx:108-209
Subpages: Users / Plans / Marketplace / Templates / Blog / Comments / Feature Flags / Owner sign-ins / AuditBUILT-WIREDsee admin/*.tsx

16. Analytics & Audit

FeatureStatusEvidence
/insights KPI cardsBUILT-WIREDinsights.tsx:25-32
Engagement chartsBUILT-WIRED:207-280
AI-usage / Revenue / Cost analyticsMISSINGPRD-mandated
Audit log pageBUILT-WIREDsettings.audit.tsx
Search + filter + time rangeBUILT-WIRED:118-142
CSV / JSON exportBUILT-WIRED:51-61
Owner sign-in log with IP/UABUILT-WIREDadmin/owner-signins.tsx
Engagement libBUILT-WIREDlib/engagement.ts
Audit libBUILT-WIREDlib/audit.ts
DB schema (audit_logs / engagement_events / owner_signin_logs)BUILT-WIREDmigrations

17. Security Posture — CLEAN ✅

CategoryStatusEvidence
RLS on all 48 public tablesBUILT-WIREDmigrations
Correct GRANT scoping (anon/authenticated/service_role)BUILT-WIREDmigrations
supabaseAdmin isolated to .server.ts / api/BUILT-WIREDgrep clean
SUPABASE_SERVICE_ROLE_KEY never in client bundleBUILT-WIRED—
AES-256-GCM for BYOK keys (96-bit IV, versioned AAD)BUILT-WIREDllm-crypto.server.ts
Secret redaction (40+ patterns)BUILT-WIREDsupport-redact.ts
SVG XSS sanitizerBUILT-WIREDsecurity/svg-sanitizer.ts
Rafa SECURITY OVERRIDE promptBUILT-WIREDrafa/prompt.ts
Lovable AI/Gateway lockout policy in DBBUILT-WIREDmigration ai.policy.no_lovable_ai=true
No unsanitized dangerouslySetInnerHTMLBUILT-WIRED—

18. Plugin System — NOT BUILT

FeatureStatusNotes
Plugin registry (plugin_manifests)MISSING—
Sandboxed execution (iframe / worker)MISSING—
Install / enable flowMISSINGplugins.enabled=false in system_settings
Permission modelMISSINGPrompt-level rules only
Marketplace plugin supportBUILT-STUBBEDMarketplace infra exists (templates only)

19. Import / Export Formats

FormatStatusEvidence
draw.io XML (mxfile + mxlibrary)BUILT-WIREDimporters.ts:107-180
SVG import + sanitizerBUILT-WIREDsecurity/svg-sanitizer.ts:29-75
ZIP shape packs (fflate)BUILT-WIREDimporters.ts:238-287
Flowmira native JSONBUILT-WIREDimporters.ts:66, excalidraw/serialize.ts:33-47
Visio .vsdxMISSINGPRD file-6:20, 2280
Mermaid text importMISSINGSprint 3 item; not wired
PNG/SVG/PDF exportBUILT-WIREDdiagram-export.ts:204-291
Excalidraw .excalidraw / .excalidrawlib interopBUILT-WIREDexcalidraw-board.tsx:122

20. Community & Engagement

FeatureStatusEvidence
Blog comments (moderated)BUILT-WIREDblog-comments.tsx, admin/comments.tsx
Newsletter + double opt-in + unsubscribeBUILT-WIREDnewsletter-form.tsx:10, RPCs :43,52
Engagement trackingBUILT-WIREDengagement.ts:19
Community templates + secret scan + moderationBUILT-WIREDtemplates.submit.tsx:19, scan :275, mod :416
Community shape packsMISSINGStatic curated catalog only
Public profiles / biosBUILT-STUBBEDName editable; bios/public profiles missing
Follow / Like on templatesBUILT-WIRED (likes)marketplace.functions.ts:165,184; follow missing
Notification centerBUILT-STUBBEDnotification-bell.tsx wired only to support notifications

Proposed next build sequence

Batch A (P0, unblocks monetization + agentic AI):

  1. Stripe (or Paddle) checkout + webhook + invoices UI. INR pricing configured.
  2. RAG stack: pgvector schema, ingestion pipeline (PDF/MD/HTML), chunker, embeddings via BYOK (OpenAI text-embedding-3-small / Cohere / local Ollama), match_documents RPC, retrieval in Rafa with real citations.
  3. Rafa agentic tool-call bridge — pass tools= in /api/rafa/chat.ts, execute searchTemplatesForAgent and instantiateTemplate end-to-end, stream tool events into the UI.

Batch B (P1, security & UX polish): 4. Rafa chat input redaction (redactSecrets in /api/rafa/chat.ts + /api/rafa/tool.ts). 5. Optional MFA (TOTP via Supabase). 6. Realtime offline reconcile — replay ops since last lamport on reconnect.

Batch C (P2, PRD completeness): 7. Plugin system MVP (registry + iframe sandbox + permissions + install flow). 8. .vsdx and Mermaid importers. 9. AI-cost / revenue / infra-cost analytics on /insights. 10. Shared-diagram iframe embed generator. 11. Community shape-pack submission + moderation queue. 12. Public profiles + bio + follow + community notifications.

Batch D (P3, cleanup): 13. Host file-5 (Excalidraw eval PRD) under docs/. 14. Emit ticket.viewed audit event on admin support-ticket open.

Await approval before starting Batch A.