Blame · Line-by-line history

`BUILD_BIBLE.md`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

BUILD_BIBLE.mdBlame668 lines · 1 contributor

Normal view Raw

9ab6971Claude	1	# GLUECRON BUILD BIBLE
	2
	3	This file is the single source of truth for the GlueCron build.
	4
	5	Every Claude agent MUST read this file in full before touching code. No exceptions.
	6
	7	GlueCron is a GitHub replacement — AI-native code intelligence, green ecosystem enforcement, git hosting, automated CI. It is production infrastructure for multiple downstream platforms. Production cannot stop.
	8
	9	---
	10
	11	## 1. AGENT POLICY (READ FIRST, FOLLOW ALWAYS)
	12
	13	### 1.1 Required reads at session start
	14	1. `BUILD_BIBLE.md` (this file) — complete
	15	2. `CLAUDE.md` — stack + architecture
	16	3. `README.md` — user-facing overview
	17	4. Most recent commit on the current branch (`git log -1 --stat`)
	18
	19	### 1.2 Do-not-undo rule
	20	- Anything listed in §4 LOCKED BLOCKS is shipped and must not be deleted, renamed, or semantically altered without the owner's explicit written permission in the current session.
	21	- "Refactor" is not permission. "Clean up" is not permission. "Simplify" is not permission.
	22	- If a locked file seems wrong, open an issue in the plan and keep going on a new block.
	23
	24	### 1.3 Continuous-build rule
	25	- The owner runs many parallel projects. Do not stop work to ask for clarification that can be inferred from this file.
	26	- Default behaviour when a block is partially complete: finish it, run tests, commit, push, start the next block.
	27	- Only stop for genuinely blocking decisions: destructive operations, architectural reversals, requests outside this plan, or repeated test failures you can't diagnose.
	28	- Never stop because "the session might run out." Commit what works and keep building.
	29
	30	### 1.4 Branch + commit rules
	31	- Development branch: whatever the current session was told (check session opening message). Fall back to `main` if none given.
	32	- One commit per completed block. Message format: `feat(BLOCK-ID): <summary>`.
	33	- Push after every commit with `git push -u origin <branch>`.
	34	- Never force-push. Never `--no-verify`. Never amend published commits.
	35
	36	### 1.5 Quality bars (non-negotiable)
	37	- `bun test` must pass before every commit.
	38	- New features ship with tests in `src/__tests__/`.
	39	- New routes use `softAuth` or `requireAuth` middleware.
	40	- New DB tables have a corresponding migration in `drizzle/`.
	41	- AI features use `isAiAvailable()` guards and degrade gracefully without `ANTHROPIC_API_KEY`.
	42	- Every user-facing failure mode has a fallback — no 500s reach the UI.
	43
	44	### 1.6 Green-ecosystem-by-default
	45	- Every new repo auto-configures: gates on, branch protection on, labels seeded, CODEOWNERS synced, welcome issue posted.
	46	- Users can opt out per feature but defaults are maximum-green.
	47	- Nothing broken ever reaches production, the website, or the customer.
	48
15e65d2Claude	49	### 1.7 Parallelism rule (added per owner request)
	50	- Default to spawning sub-agents whenever work can be parallelised. Owner-cost of an idle main thread is high; owner-cost of an extra agent is near-zero.
	51	- Independent files = parallel agents. Schema-only edits, new route files, doc updates, test additions, codebase research — all of these run in parallel by default unless they collide.
	52	- Coordinate file ownership: one agent per file. Never let two agents edit the same file. Mounting + middleware integration stay on the main thread to avoid merge conflicts.
	53	- When launching multiple agents, send them in a single message with multiple Agent tool calls so they actually run concurrently.
	54	- The main thread is responsible for: reviewing each agent's output before integrating, running the test suite, and committing. Trust-but-verify — read the changes, don't just rely on the agent's summary.
	55
9ab6971Claude	56	---
	57
	58	## 2. GITHUB PARITY SCORECARD
	59
	60	Legend: ✅ shipped · 🟡 partial · ❌ not built
	61
	62	### 2.1 Repository hosting
	63	\| Feature \| Status \| Notes \|
	64	\|---\|---\|---\|
	65	\| Git Smart HTTP (clone / push / fetch) \| ✅ \| `src/routes/git.ts`, `src/git/protocol.ts` \|
	66	\| SSH keys \| ✅ \| `ssh_keys` table, `src/routes/settings.tsx` \|
	67	\| Public / private visibility \| ✅ \| `repositories.isPrivate` \|
	68	\| Forking \| ✅ \| `src/routes/fork.ts` \|
	69	\| Stars \| ✅ \| `stars` table, `/:owner/:repo/star` \|
	70	\| Topics \| ✅ \| `repo_topics` table \|
71cd5ecClaude	71	\| Archive / disable repo \| ✅ \| I1 — `src/routes/repo-settings.tsx` archive toggle; `RepoHeader` renders an "Archived" badge when `is_archived=true`. \|
	72	\| Repository transfer \| ✅ \| I3 — `src/routes/repo-settings.tsx` transfer form + `POST /:owner/:repo/settings/transfer`; ownership change recorded in `repo_transfers` audit table. Reject conflicts (target owner already has a repo by that name) with a redirect. \|
	73	\| Template repositories \| ✅ \| I2 — `drizzle/0022_repo_templates.sql` adds `is_template`. `src/routes/templates.ts` serves `POST /:owner/:repo/use-template` (git clone --bare into caller's namespace). "Use this template" CTA rendered on the public repo page. \|
4a0dea1Claude	74	\| Repository mirroring \| ✅ \| I9 — pull-style mirror of an upstream git URL. `drizzle/0026_repo_mirrors.sql` adds `repo_mirrors` (one-per-repo config) + `repo_mirror_runs` (audit log). `src/lib/mirrors.ts` validates URLs (https/http/git only, rejects ssh/file/shell metacharacters), runs `git fetch --prune --tags` via `Bun.spawn` with a 5-min timeout + `GIT_TERMINAL_PROMPT=0`. `src/routes/mirrors.tsx` exposes `/:owner/:repo/settings/mirror` + `/admin/mirrors/sync-all`. \|
9ab6971Claude	75
	76	### 2.2 Code browsing
	77	\| Feature \| Status \| Notes \|
	78	\|---\|---\|---\|
	79	\| File tree browser \| ✅ \| `src/routes/web.tsx` \|
	80	\| Syntax highlighting \| ✅ \| 40+ languages, `src/lib/highlight.ts` \|
	81	\| Commit history \| ✅ \| \|
	82	\| Diffs \| ✅ \| \|
	83	\| Blame \| ✅ \| \|
	84	\| Raw file download \| ✅ \| \|
	85	\| Branch switcher \| ✅ \| \|
	86	\| Tag listing \| ✅ \| new this build \|
	87	\| Code search (ILIKE) \| ✅ \| per-repo + global \|
3cbe3d6Claude	88	\| Semantic / embedding search \| ✅ \| D1 — `code_chunks` table + lexical fallback, optional Voyage `voyage-code-3`; `src/lib/semantic-search.ts`, `src/routes/semantic-search.tsx` \|
4c8f666Claude	89	\| Symbol / xref navigation \| ✅ \| I8 — `src/lib/symbols.ts` regex-based extractor for ts/js/py/rs/go/rb/java/kt/swift; on-demand indexer persists top-level definitions into `code_symbols` (0025). `src/routes/symbols.tsx` serves `/:owner/:repo/symbols` overview + A–Z list, `/:owner/:repo/symbols/search?q=` prefix search, `/:owner/:repo/symbols/:name` definition detail. Owner-only reindex. \|
8098672Claude	90	\| Dependency graph \| ✅ \| J1 — `src/lib/deps.ts` parses package.json / requirements.txt / pyproject.toml / go.mod / Cargo.toml / Gemfile / composer.json without a TOML lib. `src/routes/deps.tsx` serves `/:owner/:repo/dependencies` grouped by ecosystem with per-ecosystem counts; owner-only reindex walks the default-branch tree (max 200 manifests, 1MB each). `drizzle/0028_repo_dependencies.sql` adds `repo_dependencies`. \|
f60ccdeClaude	91	\| Security advisories / Dependabot alerts \| ✅ \| J2 — curated 12-entry seed list + minimal semver range matcher cross-referenced against J1 dep rows. `src/lib/advisories.ts` + `src/routes/advisories.tsx` serve `/:owner/:repo/security/advisories` (open) + `/all`, owner-only `POST /scan`, and per-alert dismiss/reopen. `drizzle/0029_security_advisories.sql` adds `security_advisories` + `repo_advisory_alerts`. \|
3951454Claude	92	\| Commit signature verification (Verified badge) \| ✅ \| J3 — GPG + SSH pubkey registration at `/settings/signing-keys`, `gpgsig` extraction from raw commit objects, OpenPGP packet walker for Issuer Fingerprint, SHA-256 fingerprints for SSHSIG pubkeys, memoised in `commit_verifications`. Green "Verified" badge rendered on commit list + detail when a registered key matches. `src/lib/signatures.ts` + `src/routes/signing-keys.tsx` + `drizzle/0030_signing_keys.sql`. \|
9ff7128Claude	93	\| Repository rulesets (push policy engine) \| ✅ \| J6 — named policies group N rules at active/evaluate/disabled enforcement. Pure evaluator `evaluatePush(rulesets, ctx)` → `{allowed, violations}`. Six rule types: commit_message_pattern, branch_name_pattern, tag_name_pattern, blocked_file_paths, max_file_size, forbid_force_push. Glob-lite matcher (`` = non-slash, `*` = anything). Owner-only CRUD at `/:owner/:repo/settings/rulesets`. `src/lib/rulesets.ts` + `src/routes/rulesets.tsx` + `drizzle/0032_repo_rulesets.sql`. \|
0cdfd89Claude	94	\| Commit status API (external CI signals) \| ✅ \| J8 — external systems POST per-commit (sha, context) statuses with state pending/success/failure/error. Combined rollup reduces to worst state. Public list + combined endpoints; write requires owner auth. Rendered on commit detail view as a pill row. `src/lib/commit-statuses.ts` + `src/routes/commit-statuses.ts` + `drizzle/0033_commit_statuses.sql`. \|
9ab6971Claude	95
	96	### 2.3 Collaboration
	97	\| Feature \| Status \| Notes \|
	98	\|---\|---\|---\|
	99	\| Issues (CRUD / comments / labels / close) \| ✅ \| \|
	100	\| Milestones \| ✅ \| `src/routes/insights.tsx` \|
	101	\| Pull requests (CRUD / review / merge) \| ✅ \| \|
	102	\| PR inline comments \| ✅ \| file+line anchored \|
6fc53bdClaude	103	\| Draft PRs \| ✅ \| create as draft, ready-for-review toggle, dedicated tab, merge blocked until ready \|
	104	\| Reactions (emoji) \| ✅ \| 8 reactions, toggle via `POST /api/reactions/:t/:id/:emoji/toggle` on issues + PRs + comments \|
9ab6971Claude	105	\| Mentions + notifications \| ✅ \| `src/routes/notifications.tsx` \|
	106	\| Code owners \| ✅ \| `src/lib/codeowners.ts` \|
24cf2caClaude	107	\| Issue templates \| ✅ \| `.github/ISSUE_TEMPLATE.md` auto-prefills new issues; frontmatter stripped; `src/lib/templates.ts` \|
	108	\| PR templates \| ✅ \| `.github/PULL_REQUEST_TEMPLATE.md` auto-prefills new PRs; `src/lib/templates.ts` \|
	109	\| Saved replies \| ✅ \| per-user canned comments, unique-shortcut, `/settings/replies`, `/api/user/replies` \|
1e162a8Claude	110	\| Discussions / forums \| ✅ \| E2 — categorised threads, pinned/locked, q-and-a answers. `src/routes/discussions.tsx` + `drizzle/0013_discussions.sql` \|
	111	\| Wikis \| ✅ \| E3 — markdown pages per repo with revision history + revert. DB-backed v1. `src/routes/wikis.tsx` + `drizzle/0016_wikis.sql` \|
	112	\| Projects / kanban \| ✅ \| E1 — per-repo boards with auto-seeded To Do/In Progress/Done columns. Notes or linked issues/PRs. `src/routes/projects.tsx` + `drizzle/0015_projects.sql` \|
	113	\| AI incident responder \| ✅ \| D4 — auto-issues on deploy fail, `src/lib/ai-incident.ts` \|
	114	\| AI-generated test stubs \| ✅ \| D8 — `src/lib/ai-tests.ts`, `/:owner/:repo/ai/tests` \|
9ab6971Claude	115
	116	### 2.4 Automation + AI
	117	\| Feature \| Status \| Notes \|
	118	\|---\|---\|---\|
ad6d4adClaude	119	\| Webhooks (outbound, HMAC signed) \| ✅ \| `src/routes/webhooks.tsx` \|
	120	\| GateTest inbound callback \| ✅ \| `POST /api/hooks/gatetest`, bearer or HMAC \|
	121	\| Backup PAT-auth gate ingest \| ✅ \| `POST /api/v1/gate-runs` \|
9ab6971Claude	122	\| Gate runs (test / secret / AI review) \| ✅ \| `gate_runs` table, `src/routes/gates.tsx` \|
	123	\| Branch protection \| ✅ \| `branch_protection` table + UI \|
	124	\| Auto-repair engine \| ✅ \| `src/lib/auto-repair.ts` \|
	125	\| Secret scanner \| ✅ \| 15 patterns, `src/lib/security-scan.ts` \|
	126	\| AI security review \| ✅ \| Sonnet 4, `src/lib/security-scan.ts` \|
	127	\| AI commit messages \| ✅ \| `src/lib/ai-generators.ts` \|
	128	\| AI PR summaries \| ✅ \| \|
3cbe3d6Claude	129	\| AI changelogs \| ✅ \| auto on release create; arbitrary-range viewer at `/:owner/:repo/ai/changelog?from=&to=` (D7) \|
9ab6971Claude	130	\| AI code review \| ✅ \| `src/lib/ai-review.ts` \|
	131	\| AI merge conflict resolver \| ✅ \| `src/lib/merge-resolver.ts` \|
	132	\| AI chat (global + repo) \| ✅ \| `src/routes/ask.tsx` \|
3cbe3d6Claude	133	\| AI explain-this-codebase \| ✅ \| D6 — per-commit cached markdown, `GET /:owner/:repo/explain`, `src/lib/ai-explain.ts` + `src/routes/ai-explain.tsx` \|
	134	\| AI PR triage \| ✅ \| D3 — Claude Haiku suggests labels/reviewers/priority as an AI comment on PR create; `triagePullRequest` in `src/lib/ai-generators.ts`, wired in `src/routes/pulls.tsx` \|
5e888b7Claude	135	\| GitHub Actions equivalent (workflow runner) \| ✅ \| `src/lib/workflow-parser.ts`, `src/lib/workflow-runner.ts`, `src/routes/workflows.tsx`; `.gluecron/workflows/*.yml` auto-discovered on push; Bun subprocess executor, per-step timeouts, size-capped logs \|
3cbe3d6Claude	136	\| Dependabot equivalent (AI dep bumper) \| ✅ \| D2 — `dep_update_runs` table, npm registry fetch, plan + apply bumps, creates `gluecron/dep-update-*` branch + PR row via git plumbing. `src/lib/dep-updater.ts`, `src/routes/dep-updater.tsx`, settings UI at `/:owner/:repo/settings/dep-updater`. \|
08420cdClaude	137	\| Code scanning UI \| ✅ \| I5 — `src/routes/code-scanning.tsx`, `GET /:owner/:repo/security`. Aggregates last-100 `gate_runs` matching `%scan%`/`%security%`, rolls up latest status per gate, shows failed/repaired/total cards + scanner status list + recent runs. \|
3cbe3d6Claude	138	\| Copilot code completion \| ✅ \| D9 — `POST /api/copilot/completions` (PAT/OAuth/session), `GET /api/copilot/ping`. `src/lib/ai-completion.ts`, `src/routes/copilot.ts`. LRU-cached, rate-limited 60/min. \|
	139	\| Semantic code search \| ✅ \| D1 — see 2.2 \|
afd651eClaude	140	\| Spec-to-PR (NL feature spec → draft PR) \| ✅ \| `src/routes/specs.tsx` UI, `src/lib/spec-to-pr.ts` orchestrator, `src/lib/spec-ai.ts` Claude call + parser, `src/lib/spec-context.ts` repo context reader, `src/lib/spec-git.ts` plumbing-only branch writer. Graceful fallback when `ANTHROPIC_API_KEY` is unset. \|
	141	\| Repository intelligence engine \| ✅ \| `src/lib/intelligence.ts` — repo-level summarisation + signals. \|
	142	\| Time-travel code explorer \| ✅ \| `src/lib/timetravel.ts` — historical snapshot navigation. \|
	143	\| Dependency impact analyzer \| ✅ \| `src/lib/depimpact.ts` — "what breaks if I bump X" cross-reference. \|
	144	\| One-click rollback \| ✅ \| `src/lib/rollback.ts` — fast revert helper for failed deploys. \|
	145	\| Auto-repair (intelligence path) \| ✅ \| `src/lib/autorepair.ts` `autoRepair(...)` — invoked from `src/hooks/post-receive.ts`. Distinct from `src/lib/auto-repair.ts` `repairSecrets`/`repairSecurityIssues` (gate-time). Both are load-bearing — do not dedupe without owner approval. \|
9ab6971Claude	146
	147	### 2.5 Platform
	148	\| Feature \| Status \| Notes \|
	149	\|---\|---\|---\|
	150	\| Dashboard \| ✅ \| `src/routes/dashboard.tsx` \|
	151	\| Explore / discover \| ✅ \| \|
	152	\| Global search \| ✅ \| repos / users / issues / PRs \|
	153	\| Insights (graph, contributors, green rate) \| ✅ \| `src/routes/insights.tsx` \|
	154	\| Releases + tags \| ✅ \| AI changelog \|
	155	\| Personal access tokens \| ✅ \| SHA-256 hashed \|
058d752Claude	156	\| OAuth app provider \| ✅ \| `src/routes/oauth.tsx`, `src/routes/developer-apps.tsx`, `src/lib/oauth.ts`; `oauth_apps` + `oauth_authorizations` + `oauth_access_tokens` tables \|
06139e6Claude	157	\| GitHub Apps equivalent \| ✅ \| H2 — `src/lib/marketplace.ts` `generateBearerToken`/`verifyInstallToken` (1h TTL, `ghi_` prefix, sha256 hashed). Each app gets a `<slug>[bot]` identity (`app_bots`). Permissions enforced via `hasPermission` (write implies read). \|
71cd5ecClaude	158	\| GraphQL API \| ✅ \| G2 — see 2.6 \|
058d752Claude	159	\| Organizations + teams \| ✅ \| B1+B2+B3 shipped: `src/routes/orgs.tsx`, `src/lib/orgs.ts`; org-owned repos (`repositories.orgId`); team-based CODEOWNERS (`@org/team` resolution) \|
edf7c36Claude	160	\| Enterprise SAML / SSO \| ✅ \| I10 — OIDC (Okta / Azure AD / Auth0 / Google Workspace). `src/lib/sso.ts` + `src/routes/sso.tsx`, `drizzle/0027_sso_oidc.sql` (tables `sso_config` singleton + `sso_user_links`). Admin config at `/admin/sso`; `/login/sso` starts auth-code flow with state+nonce cookies; `/login/sso/callback` exchanges code, fetches userinfo, links by `sub` (or by email, or auto-creates). Optional email-domain allow-list + auto-create toggle. \|
058d752Claude	161	\| 2FA / TOTP \| ✅ \| `src/routes/settings-2fa.tsx`, `src/lib/totp.ts`; `user_totp` + `user_recovery_codes` tables \|
	162	\| Passkeys / WebAuthn \| ✅ \| `src/routes/passkeys.tsx`, `src/lib/webauthn.ts`; `user_passkeys` + `webauthn_challenges` tables \|
25a91a6Claude	163	\| Packages registry (npm / docker / etc) \| ✅ \| `src/lib/packages.ts`, `src/routes/packages-api.ts`, `src/routes/packages.tsx`; npm protocol (packument, tarball, publish, yank); PAT (`glc_`) auth via Authorization header; container registry deferred \|
	164	\| Pages / static hosting \| ✅ \| `src/lib/pages.ts`, `src/routes/pages.tsx`; serves blobs from bare git at latest `gh-pages` commit; per-repo settings (source branch/dir, custom domain); short-cache headers \|
1e162a8Claude	165	\| Gists \| ✅ \| E4 — multi-file tiny repos with per-revision JSON snapshots + stars. `src/routes/gists.tsx` + `drizzle/0014_gists.sql` \|
08420cdClaude	166	\| Sponsors \| ✅ \| I6 — `src/routes/sponsors.tsx`, `drizzle/0023_sponsors.sql` (tables `sponsorship_tiers`, `sponsorships`). Public `/sponsors/:user` page with tier cards + recent public sponsors; maintainer view at `/settings/sponsors` with add/retire tiers. Payment rails deferred — captures intent + thank-you notes. \|
06139e6Claude	167	\| Marketplace \| ✅ \| H1 — `src/routes/marketplace.tsx` + `src/lib/marketplace.ts`, `drizzle/0021_marketplace_and_apps.sql` (5 tables: `apps`, `app_installations`, `app_bots`, `app_install_tokens`, `app_events`). Public `/marketplace` directory, `/marketplace/:slug` detail + install, `/settings/apps` personal installs, `/developer/apps-new` registration, `/developer/apps/:slug/manage` event log + token issuance. \|
25a91a6Claude	168	\| Environments / deployment tracking \| ✅ \| `src/routes/deployments.tsx` — grouped by env, success-rate rollup, per-deploy detail. Protected environments (`src/routes/environments.tsx`, `src/lib/environments.ts`) with reviewer-gated approval, branch-glob restrictions, approve/reject decisions recorded in `deployment_approvals` \|
a79a9edClaude	169	\| Merge queues \| ✅ \| E5 — serialised merge with re-test. `src/lib/merge-queue.ts`, `src/routes/merge-queue.tsx`, `drizzle/0017_merge_queue.sql`; per `(repo, base_branch)` queue, owner-only process-next re-runs gates against latest base before merging. \|
	170	\| Required checks matrix \| ✅ \| E6 — per branch-protection named check list. `src/routes/required-checks.tsx`, `drizzle/0018_required_checks.sql`; `listRequiredChecks` + `passingCheckNames` helpers in `src/lib/branch-protection.ts`; merge handler verifies every required name has a passing gate_run or workflow_run. \|
	171	\| Protected tags \| ✅ \| E7 — owners can mark tag patterns (`v`, `release-`) protected. `src/lib/protected-tags.ts`, `src/routes/protected-tags.tsx`, `drizzle/0019_protected_tags.sql`; advisory enforcement via post-receive audit log (v1). \|
9ab6971Claude	172
	173	### 2.6 Observability + safety
	174	\| Feature \| Status \| Notes \|
	175	\|---\|---\|---\|
	176	\| Rate limiting \| ✅ \| `src/middleware/rate-limit.ts` \|
	177	\| Request-ID tracing \| ✅ \| `src/middleware/request-context.ts` \|
afd651eClaude	178	\| Health / readiness / metrics \| ✅ \| `/healthz` `/readyz` `/metrics`. Extended probe surface in `src/routes/health-probe.ts`; public dashboard `src/routes/status.tsx` (`GET /status` + `/status.svg` shields badge). \|
	179	\| Public platform status JSON \| ✅ \| `src/routes/platform-status.ts` — machine-readable status JSON. \|
	180	\| Error tracking \| ✅ \| `src/lib/observability.ts` — wired into `app.onError`. Sinks: `ERROR_WEBHOOK_URL` and/or `SENTRY_DSN`. Never throws. \|
	181	\| Comprehensive REST API v2 \| ✅ \| `src/routes/api-v2.ts` — full CRUD across resources. Authoritative integration surface alongside the v1 `/api/*` endpoints in §4.6. \|
	182	\| API documentation page \| ✅ \| `src/routes/api-docs.tsx` — interactive in-app docs. \|
	183	\| SSE in-process pub/sub \| ✅ \| `src/lib/sse.ts` + `src/lib/sse-client.ts` — topic-based broadcaster. `src/routes/live-events.ts` exposes `GET /live-events/:topic`. Used by the live UI updates layer. \|
	184	\| Inbound deploy event receiver (Signal Bus P1) \| ✅ \| `src/routes/events.ts` — Crontech → Gluecron event ingest. Idempotent via `drizzle/0034_processed_events.sql` (sha256 of payload deduped at write-site). \|
	185	\| Autopilot ticker \| ✅ \| `src/lib/autopilot.ts` — 5-min cycle: mirror sync, merge-queue peek, weekly digests, advisory rescans. `AUTOPILOT_DISABLED=1` opt-out. Admin page `/admin/autopilot`. \|
	186	\| Demo seed \| ✅ \| `src/lib/demo-seed.ts` — idempotent `ensureDemoContent()`. `DEMO_SEED_ON_BOOT=1` boot flag. Site-admin reseed at `/admin` (`POST /admin/demo/reseed`). `/demo` redirect to a sample repo. \|
	187	\| SEO (robots + sitemap) \| ✅ \| `src/routes/seo.ts` — `/robots.txt` + `/sitemap.xml`. \|
9ab6971Claude	188	\| Audit log (table) \| ✅ \| `audit_log` table \|
6fc53bdClaude	189	\| Audit log UI \| ✅ \| `/settings/audit` (personal) + `/:owner/:repo/settings/audit` (per-repo, owner-only) \|
8f50ed0Claude	190	\| Traffic analytics per repo \| ✅ \| F1 — `src/lib/traffic.ts` + `src/routes/traffic.tsx`, `drizzle/0020_analytics_and_admin.sql`; owner-only 7/14/30/90d windows, ascii-bar daily chart. SHA-256-truncated IP for unique visitors. Fire-and-forget wiring in `web.tsx` + `git.ts`. \|
	191	\| Org insights dashboard \| ✅ \| F2 — `src/routes/org-insights.tsx`; `computeOrgInsights(orgId)` rollup of gate green-rate + PR/issue counts + per-repo breakdown. `GET /orgs/:slug/insights`. \|
	192	\| Site admin panel \| ✅ \| F3 — `src/lib/admin.ts` + `src/routes/admin.tsx`, tables `site_admins` + `system_flags`. Bootstrap rule (oldest user wins until `site_admins` populated). Flags: registration_locked, site_banner_*, read_only_mode. \|
	193	\| Billing + quotas \| ✅ \| F4 — `src/lib/billing.ts` + `src/routes/billing.tsx`, tables `billing_plans` + `user_quotas` seeded free/pro/team/enterprise. `/settings/billing` personal view + `/admin/billing` site-admin override. \|
24cf2caClaude	194	\| Email notifications \| ✅ \| opt-in per kind (mention/assign/gate-fail) via `/settings`; provider-pluggable `src/lib/email.ts` (log default, resend in prod) \|
08420cdClaude	195	\| Email digest \| ✅ \| I7 — `src/lib/email-digest.ts` + `drizzle/0024_email_digest.sql` (`users.notify_email_digest_weekly` + `last_digest_sent_at`). `composeDigest` pulls notifications + failed/repaired gates + merged PRs over last 7d, renders text + escaped HTML. `/settings/digest/preview` for self-preview; `/admin/digests` dashboard + `POST /admin/digests/run` fires `sendDigestsToAll`; `POST /admin/digests/preview` sends to one user. Never throws. \|
eae38d1Claude	196	\| Mobile PWA \| ✅ \| G1 — `src/routes/pwa.ts` serves `/manifest.webmanifest` + `/sw.js` + `/icon.svg`; Layout injects manifest link + SW registration. Offline-capable (network-first for HTML). \|
	197	\| GraphQL API \| ✅ \| G2 — `src/lib/graphql.ts` parser + executor, `src/routes/graphql.ts` endpoint at `POST /api/graphql`, GraphiQL-lite explorer at `GET /api/graphql`. Queries only (viewer/user/repository/search/rateLimit). \|
	198	\| Official CLI \| ✅ \| G3 — `cli/gluecron.ts` Bun-compilable single binary. REST + GraphQL client, `~/.gluecron/config.json` 0600. \|
	199	\| VS Code extension \| ✅ \| G4 — `vscode-extension/` with commands for explain / open-on-web / semantic search / generate tests. \|
9ab6971Claude	200	\| Native mobile apps \| ❌ \| \|
afd651eClaude	201	\| Repository collaborators (per-repo roles) \| ✅ \| `drizzle/0035_repo_collaborators.sql` (read/write/admin, hierarchical) + `drizzle/0036_invite_token_hash.sql` (sha256 invite tokens). `src/routes/collaborators.tsx`, `src/routes/team-collaborators.tsx`, `src/routes/invites.tsx`, `src/lib/invite-tokens.ts`. Wired through `src/middleware/repo-access.ts` permission middleware. \|
	202	\| GitHub import (single repo) \| ✅ \| `src/routes/import.tsx` + `src/lib/import-helper.ts`. PAT-based clone-and-rehost. \|
	203	\| Bulk GitHub import (org migration) \| ✅ \| `src/routes/import-bulk.tsx` — paste a token, mirror an entire org in one pass. \|
	204	\| Migration history + verifier \| ✅ \| `src/routes/migrations.tsx` per-user history dashboard, `src/lib/import-verify.ts` post-migration smoke check (object count, branches, default branch). \|
	205	\| Onboarding flow \| ✅ \| `src/routes/onboarding.tsx` — guided first-five-minutes for new accounts. \|
	206	\| Public help / quickstart \| ✅ \| `src/routes/help.tsx` — owner-facing migration cheatsheet at `/help`. \|
6fc53bdClaude	207	\| Dark mode \| ✅ \| default \|
	208	\| Light-mode toggle \| ✅ \| `/theme/toggle` + `theme` cookie, pre-paint script avoids FOUC, nav sun/moon icon \|
9ab6971Claude	209	\| Keyboard shortcuts \| ✅ \| `/shortcuts` page \|
71cd5ecClaude	210	\| Command palette \| ✅ \| I4 — `src/views/layout.tsx` injects a Cmd+K palette with ~20 canonical destinations, arrow-key navigation + fuzzy match. Backdrop click or Esc closes. \|
9ab6971Claude	211
	212	---
	213
	214	## 3. BUILD PLAN (BLOCKS)
	215
	216	Each block is a self-contained unit. Order matters for dependencies. Each block ends with tests + commit + push.
	217
	218	### BLOCK A — Hardening the current surface
	219	Polish what's shipped before adding more. Priority: do this first if parity gaps are minor.
6fc53bdClaude	220	- A1 — Dark/light theme toggle (cookie, CSS variable swap) ✅
	221	- A2 — Audit log UI page (`/settings/audit` + `/:owner/:repo/settings/audit`) ✅
	222	- A3 — Reactions UI on issues / PRs / comments (data exists) ✅
	223	- A4 — Draft PR toggle + filter ✅
24cf2caClaude	224	- A5 — Issue + PR templates (`.github/*_TEMPLATE.md` auto-prefill) ✅
	225	- A6 — Saved replies per user ✅
	226	- A7 — Environments + deployment history UI (`deployments` table) ✅
	227	- A8 — Email notifications (opt-in, provider-pluggable) ✅
	228
	229	BLOCK A COMPLETE. Next: BLOCK B (Identity + orgs).
9ab6971Claude	230
	231	### BLOCK B — Identity + orgs
058d752Claude	232	- B1 — Organizations (schema: `organizations`, `org_members`, `teams`, `team_members`) → ✅ shipped (`6563f0a`)
6563f0aClaude	233	- Helpers in `src/lib/orgs.ts`: slug validation, role rank, reserved-slug set, loaders
	234	- Routes in `src/routes/orgs.tsx`: list / create / profile / people / teams / team detail
	235	- Role-based guards: admin adds members, owner grants owner, last-owner demote/remove blocked
	236	- All sensitive actions `audit()`'d (org.create, member.add/role/remove, team.create, team.member.add/remove)
058d752Claude	237	- B2 — Repos owned by orgs (nullable `repositories.orgId`) → ✅ shipped (`7437605`)
	238	- B3 — Team-based CODEOWNERS (`@org/team` resolution) → ✅ shipped (`40d3e3f`)
	239	- B4 — 2FA / TOTP (enroll, recovery codes) → ✅ shipped (`7298a17`)
	240	- B5 — WebAuthn / passkeys → ✅ shipped (`2df1f8c`)
	241	- B6 — OAuth 2.0 provider (third-party apps can request access) → ✅ shipped (pending final commit)
9ab6971Claude	242
	243	### BLOCK C — Runtime + hosting
5e888b7Claude	244	- C1 — Actions-equivalent workflow runner → ✅ shipped (`eafe8c6`)
	245	- Workflow YAML parser (`src/lib/workflow-parser.ts`) — hand-rolled subset
	246	- Background worker (`src/lib/workflow-runner.ts`) — Bun.spawn, size-capped logs, SIGTERM→SIGKILL timeouts
	247	- Auto-discovery from `.gluecron/workflows/*.yml` on default-branch push
	248	- UI at `/:owner/:repo/actions` with manual trigger + cancel
25a91a6Claude	249	- C2 — Package registry (npm protocol) → ✅ shipped
	250	- Packument + tarball + publish + yank via `PUT /npm/<name>` + `GET /npm/<name>`
	251	- PAT (`glc_`) bearer auth for CLI clients; add `//host/npm/:_authToken=<PAT>` to .npmrc
	252	- Container registry deferred (schema ready for it)
	253	- C3 — Pages / static hosting → ✅ shipped
	254	- Serves `/:owner/:repo/pages/*` from the latest successful `pages_deployments` row
	255	- Auto-records on push to the repo's configured source branch (default `gh-pages`)
	256	- Settings UI at `/:owner/:repo/settings/pages` + manual redeploy
	257	- C4 — Environments with protected approvals → ✅ shipped
	258	- Per-repo `environments` with reviewer list + branch-glob allowlist
	259	- Auto-deploy on main is gated by `requiresApprovalFor()`; pending rows show status `pending_approval`
	260	- Approve/reject at `POST /:owner/:repo/deployments/:id/approve\|reject`
9ab6971Claude	261
	262	### BLOCK D — AI-native differentiation
	263	This is where GlueCron beats GitHub outright. Priority: ship these loud.
3cbe3d6Claude	264	- D1 — Semantic code search → ✅ shipped. `src/lib/semantic-search.ts` + `src/routes/semantic-search.tsx`. `code_chunks` table stores chunk embeddings as JSON (upgrade path to `pgvector`). Embedding provider: Voyage AI `voyage-code-3` when `VOYAGE_API_KEY` is set, otherwise deterministic 512-dim hashing fallback. Index via `POST /:owner/:repo/search/semantic/reindex` (owner-only).
	265	- D2 — AI dependency updater → ✅ shipped. `src/lib/dep-updater.ts` + `src/routes/dep-updater.tsx`. `dep_update_runs` table tracks run history. Parses `package.json`, queries `registry.npmjs.org`, plans bumps (skips workspace/github specs + downgrades), writes an `gluecron/dep-update-<ts>` branch via git plumbing (`hash-object` + `mktree` + `commit-tree` + `update-ref`), inserts a pull_requests row with a markdown bump table. Settings UI at `/:owner/:repo/settings/dep-updater` with "Run now".
	266	- D3 — AI PR triage → ✅ shipped. `triagePullRequest` in `src/lib/ai-generators.ts`; hooked into PR create in `src/routes/pulls.tsx` (fire-and-forget). Posts a non-applied "## AI Triage" comment with suggested labels, reviewers, priority, and risk area. Suggestions only — PR author stays in control.
1e162a8Claude	267	- D4 — AI incident responder → ✅ shipped. `src/lib/ai-incident.ts` exports `onDeployFailure(args)` — on deploy-fail hooks, samples ~10 recent commits, calls Sonnet 4 for a structured root-cause JSON, opens an issue (number via `serial`), best-effort attaches `incident` label, sets `deployments.blockedReason="auto-issue #N"`. Wired from `src/hooks/post-receive.ts triggerCrontechDeploy` (fire-and-forget) and from `POST /:owner/:repo/deployments/:id/retry-incident` (owner-only re-run button on the deployment detail page). Never throws; degrades to deterministic body when no `ANTHROPIC_API_KEY`.
	268	- D5 — AI code reviewer blocks merges → ✅ shipped. `src/lib/branch-protection.ts` exports `matchProtection(repoId, branch)` (exact > glob, reuses `matchGlob` from environments.ts), `evaluateProtection(rule, ctx)` pure decision helper (checks `requireAiApproval` / `requireGreenGates` / `requireHumanReview` / `requiredApprovals`), and `countHumanApprovals(prId)` (LGTM/`+1`/approved heuristic on non-AI PR comments). Wired into `src/routes/pulls.tsx` merge handler after the existing hard-gate filter — blocks merge with readable reasons when rule fails. 8 unit tests in `src/__tests__/branch-protection.test.ts`.
3cbe3d6Claude	269	- D6 — AI "explain this codebase" → ✅ shipped. `src/lib/ai-explain.ts` + `src/routes/ai-explain.tsx`. Samples up to ~25 representative files (~60KB cap), generates a Markdown explanation via Sonnet 4, caches per (repo, commit sha) in `codebase_explanations`. `GET /:owner/:repo/explain` + owner-only `POST /:owner/:repo/explain/regenerate`. Explain link added to `RepoNav`.
	270	- D7 — AI changelog for every commit range → ✅ shipped. `src/routes/ai-changelog.tsx`. `GET /:owner/:repo/ai/changelog?from=&to=(&format=markdown)` — runs `git log` on the range, calls existing `generateChangelog`, renders form + rendered Markdown + copy-box; `format=markdown` returns `text/markdown` for CLI/CI consumers. Caps at 500 commits.
1e162a8Claude	271	- D8 — AI-generated test suite → ✅ shipped. `src/lib/ai-tests.ts` exports `detectLanguage(path)`, `detectTestFramework(repo tree)`, `buildTestsPrompt(...)`, `suggestedTestPath(...)`, `generateTestStub({path, content, framework, language})` (returns `{code:"", framework:"fallback"}` when AI unavailable), `contentTypeFor(path)`. Route `src/routes/ai-tests.tsx` adds `GET /:owner/:repo/ai/tests` (form + file picker), `GET /:owner/:repo/ai/tests?format=raw` (raw text with correct MIME), `POST /:owner/:repo/ai/tests/generate` (requireAuth, renders highlighted source + generated failing test, copy button). Stubs are intentionally failing so the author fills them in.
3cbe3d6Claude	272	- D9 — Copilot-style completion endpoint → ✅ shipped. `src/lib/ai-completion.ts` + `src/routes/copilot.ts`. `POST /api/copilot/completions` (requireAuth accepts PAT/OAuth/session), `GET /api/copilot/ping`. Claude Haiku; in-memory LRU (size 200, 5-min TTL); code-fence stripping; 60/min rate limit per caller.
9ab6971Claude	273
	274	### BLOCK E — Collaboration parity
1e162a8Claude	275	- E1 — Projects / kanban boards → ✅ shipped. `src/routes/projects.tsx`, tables `projects`/`project_columns`/`project_items` (migration 0015). Create creates three default columns (To Do/In Progress/Done); cards carry note or issue/pr link; one-click move between columns; owner-only close.
	276	- E2 — Discussions (forum threads per repo) → ✅ shipped. `src/routes/discussions.tsx`, tables `discussions`/`discussion_comments` (migration 0013). Categorised (general/q-and-a/ideas/announcements/show-and-tell), pinnable, lockable, q-and-a answers.
	277	- E3 — Wikis → ✅ shipped as DB-backed v1. `src/routes/wikis.tsx`, tables `wiki_pages`/`wiki_revisions` (migration 0016). Slug auto-derived; every edit bumps revision + appends a revision row; owner can revert. Git-backed mirror deferred.
	278	- E4 — Gists → ✅ shipped. `src/routes/gists.tsx`, tables `gists`/`gist_files`/`gist_revisions`/`gist_stars` (migration 0014). Multi-file; each edit takes a JSON snapshot into `gist_revisions` keyed on revision number; stars toggle; secret gists hidden from non-owners.
a79a9edClaude	279	- E5 — Merge queues → ✅ shipped. `src/lib/merge-queue.ts`, `src/routes/merge-queue.tsx`, table `merge_queue_entries` (migration 0017). Per `(repo, base_branch)` FIFO queue; `POST /:owner/:repo/pulls/:n/enqueue` adds from the PR page; owner-only `POST /queue/process-next` re-runs gates against latest base before merging the head. Entries have queued \| running \| merged \| failed \| dequeued states.
	280	- E6 — Required status checks matrix → ✅ shipped. `src/routes/required-checks.tsx`, table `branch_required_checks` (migration 0018); helpers `listRequiredChecks` + `passingCheckNames` in `src/lib/branch-protection.ts`. Settings UI at `/:owner/:repo/gates/protection/:id/checks`; merge handler (`src/routes/pulls.tsx`) loads required names + computes passing set from `gate_runs` (passed/repaired) + `workflow_runs` (success) and blocks if any required name is missing.
	281	- E7 — Protected tags → ✅ shipped. `src/lib/protected-tags.ts`, `src/routes/protected-tags.tsx`, table `protected_tags` (migration 0019). Settings CRUD at `/:owner/:repo/settings/protected-tags`; patterns use same glob syntax as branch protection. v1 enforcement is advisory: post-receive logs audit entries (`protected_tags.{create\|update\|delete}_violation_candidate`) so owners can see violations; pre-receive blocking is future work.
9ab6971Claude	282
	283	### BLOCK F — Observability + admin
8f50ed0Claude	284	- F1 — Traffic analytics per repo → ✅ shipped. `src/lib/traffic.ts` + `src/routes/traffic.tsx`, table `repo_traffic_events` (migration 0020). `track`/`trackView`/`trackClone`/`trackByName` are fire-and-forget; SHA-256 of IP truncated to 16 chars for unique-visitor approximation. Owner-only `GET /:owner/:repo/traffic` renders 7/14/30/90 day windows with an ascii-bar daily chart. Wired into `src/routes/web.tsx` repo overview + `src/routes/git.ts` git-upload-pack handler.
	285	- F2 — Org-wide insights → ✅ shipped. `src/routes/org-insights.tsx` exports `computeOrgInsights(orgId)`. `GET /orgs/:slug/insights` requires org membership; aggregates gate green-rate, open/merged PR counts, open issue count, and per-repo rows sorted by activity. No new tables — live rollup across existing `repositories`, `gate_runs`, `pull_requests`, `issues`.
	286	- F3 — Admin / superuser panel → ✅ shipped. `src/lib/admin.ts` + `src/routes/admin.tsx`, tables `site_admins` + `system_flags` (migration 0020). `isSiteAdmin(userId)` with bootstrap rule (empty `site_admins` table → oldest user wins); `KNOWN_FLAGS` = { registration_locked, site_banner_text, site_banner_level, read_only_mode }. Routes: `GET /admin` (dashboard), `GET /admin/users` + toggle grant/revoke, `GET /admin/repos` + nuclear delete, `GET /admin/flags` + save. All mutations audit-logged.
	287	- F4 — Billing + quotas → ✅ shipped. `src/lib/billing.ts` + `src/routes/billing.tsx`, tables `billing_plans` + `user_quotas` (migration 0020, seeded with free/pro/team/enterprise). `FALLBACK_PLANS` mirror the seeds so billing works pre-migration. Helpers: `getUserQuota` (auto-initialises free row on first read), `bumpUsage`, `checkQuota` (fail-open), `wouldExceedRepoLimit`, `resetIfCycleExpired`. Routes: `GET /settings/billing` (personal view with usage bars + plan cards), `GET /admin/billing` (site-admin plan override), `POST /admin/billing/:userId/plan`.
9ab6971Claude	288
	289	### BLOCK G — Mobile + client
eae38d1Claude	290	- G1 — PWA manifest + service worker → ✅ shipped. `src/routes/pwa.ts` serves `/manifest.webmanifest`, `/sw.js`, `/icon.svg`; `Layout` injects `<link rel="manifest">` + a tiny SW registration script. Service worker is network-first for HTML + skips `.git/`/`/api/`/`/login*` routes.
	291	- G2 — GraphQL API mirror of REST → ✅ shipped. `src/lib/graphql.ts` is a dependency-free recursive-descent parser + executor over a fixed schema (viewer, user, repository, search, rateLimit). `src/routes/graphql.ts` serves `POST /api/graphql` + a GraphiQL-lite explorer at `GET /api/graphql`. Queries only; writes stay on REST.
	292	- G3 — Official CLI (`gluecron`) → ✅ shipped. `cli/gluecron.ts` is a Bun-compilable single-file CLI. Commands: `login`, `whoami`, `repo ls/show/create`, `issues ls`, `gql`, `host`, `version`. Config in `~/.gluecron/config.json` (0600). Talks to the server via REST + GraphQL.
	293	- G4 — VS Code extension → ✅ shipped. `vscode-extension/` contains package.json + `src/extension.ts`. Commands: `gluecron.explainFile`, `gluecron.openOnWeb`, `gluecron.searchSemantic`, `gluecron.generateTests`. Detects Gluecron remotes via `git config remote.origin.url`. Settings: `gluecron.host` + `gluecron.token`.
9ab6971Claude	294
71cd5ecClaude	295	### BLOCK I — Filling parity gaps
	296	- I1 — Archive / unarchive repository → ✅ shipped. `src/routes/repo-settings.tsx` archive/unarchive toggle (existing `repositories.is_archived` column). `RepoHeader` surfaces an "Archived" badge.
	297	- I2 — Template repositories → ✅ shipped. `drizzle/0022_repo_templates.sql` adds `is_template` column + partial index. `src/routes/templates.ts` serves `POST /:owner/:repo/use-template` (git clone --bare into caller's namespace, fresh `activity_feed` entry). Settings UI gains a "Mark as template" toggle. Public repo page renders a prominent "Use this template" CTA for non-owners.
	298	- I3 — Repository transfer → ✅ shipped. `drizzle/0022_repo_templates.sql` adds `repo_transfers` audit table. `src/routes/repo-settings.tsx` `POST /:owner/:repo/settings/transfer` (validate target user exists, reject name conflicts, update `owner_id`, log to `repo_transfers`).
	299	- I4 — Generic command palette → ✅ shipped. `src/views/layout.tsx` injects a Cmd+K palette with ~20 canonical destinations (Dashboard, Explore, Notifications, Ask AI, Create repo, Marketplace, Installed apps, Register app, Shortcuts, Settings, 2FA, Passkeys, PATs, Billing, Audit, Gists, GraphQL, Admin, Theme). Fuzzy-match, arrow-key navigation, Esc/backdrop to close.
08420cdClaude	300	- I5 — Code scanning UI → ✅ shipped. `src/routes/code-scanning.tsx` `GET /:owner/:repo/security` aggregates `gate_runs` matching `%scan%`/`%security%` (last 100), computes latest-per-gate status, renders failed/repaired/total summary cards + per-scanner status list + recent-runs table. Private-repo visibility enforced. Zero new tables — pure surfacing layer.
	301	- I6 — Sponsors → ✅ shipped. `drizzle/0023_sponsors.sql` adds `sponsorship_tiers` (maintainer_id, name, monthly_cents, one_time_allowed, is_active) + `sponsorships` (sponsor_id, maintainer_id, tier_id, amount_cents, kind, note, is_public, cancelled_at). `src/routes/sponsors.tsx` serves public `/sponsors/:username` (tier cards + recent public sponsors join) + maintainer `/settings/sponsors` (tier CRUD, soft-retire via is_active=false, activity list). Payment rails deferred — v1 captures intent + thank-you notes.
	302	- I7 — Weekly email digest → ✅ shipped. `drizzle/0024_email_digest.sql` adds `users.notify_email_digest_weekly` + `last_digest_sent_at`. `src/lib/email-digest.ts` exposes `composeDigest`/`sendDigestForUser`/`sendDigestsToAll` (never-throws). Pulls notifications + failed/repaired gate_runs + merged PRs from the last 7d, composes escaped HTML + plaintext, and sends via the shared email provider. `/settings/digest/preview` renders the digest inline for self-preview; `/admin/digests` gives site admins a "Send now" trigger + single-user preview, audit-logged as `admin.digests.run`/`admin.digests.preview`.
4c8f666Claude	303	- I8 — Symbol / xref navigation → ✅ shipped. `drizzle/0025_code_symbols.sql` adds a `code_symbols` table. `src/lib/symbols.ts` provides a regex-based top-level extractor for ts/js/py/rs/go/rb/java/kt/swift. On-demand indexing via `POST /:owner/:repo/symbols/reindex` walks the default-branch tree, caps at 2000 files/1MB each, replaces the prior set. Browse at `/:owner/:repo/symbols` (A–Z + per-kind counts), search via `/symbols/search?q=`, inspect at `/symbols/:name`. 14 new tests.
4a0dea1Claude	304	- I9 — Repository mirroring → ✅ shipped. `drizzle/0026_repo_mirrors.sql` adds `repo_mirrors` (one-per-repo config) + `repo_mirror_runs` (audit log). `src/lib/mirrors.ts` provides URL validation (https/http/git only, no ssh/file/paths/shell metas), credentials-redaction for logs, and `runMirrorSync` that shells out to `git fetch --prune --tags` with a 5-min timeout and `GIT_TERMINAL_PROMPT=0`. `src/routes/mirrors.tsx` serves owner-only `/:owner/:repo/settings/mirror` + site-admin `/admin/mirrors/sync-all`. 17 new tests.
edf7c36Claude	305	- I10 — Enterprise SSO via OIDC → ✅ shipped. `drizzle/0027_sso_oidc.sql` adds `sso_config` (singleton `id='default'` row with issuer + authorize/token/userinfo endpoints + client credentials + scopes + optional email-domain allow-list + `auto_create_users` toggle) and `sso_user_links` (maps local user to IdP `sub`, unique per-subject). `src/lib/sso.ts` exposes `buildAuthorizeUrl`/`exchangeCode`/`fetchUserinfo`/`findOrCreateUserFromSso` pure helpers — plain OIDC auth-code flow, no XML / no signature verification dep. `src/routes/sso.tsx` serves site-admin `/admin/sso` config page, `/login/sso` initiator (state + nonce cookies, 10-min TTL), `/login/sso/callback` exchanger + session issuer, plus `POST /settings/sso/unlink` for users. `/login` renders "Sign in with <provider name>" when enabled. 24 new tests (pure helpers + route-auth smokes).
71cd5ecClaude	306
8098672Claude	307	### BLOCK J — Beyond-parity advanced features
	308	- J1 — Dependency graph → ✅ shipped. `drizzle/0028_repo_dependencies.sql` adds `repo_dependencies` (ecosystem + name + version_spec + manifest_path + is_dev + commit_sha) with indexes on `(repository_id, ecosystem)` + `(name)`. `src/lib/deps.ts` parses seven manifest formats (package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml, Gemfile, composer.json) without a TOML library — each parser is defensive and returns `[]` on malformed input. Walks default-branch tree (max 200 manifests, 1MB each), replaces the prior set on reindex. `src/routes/deps.tsx` serves `/:owner/:repo/dependencies` (grouped by ecosystem with per-ecosystem counts) + owner-only `POST /dependencies/reindex`. Reverse-dep lookup via `repositoriesDependingOn(ecosystem, name)` for future "who depends on me" network-graph UI. 21 new tests.
f60ccdeClaude	309	- J2 — Security advisories (Dependabot-style) → ✅ shipped. `drizzle/0029_security_advisories.sql` adds `security_advisories` (GHSA + CVE IDs, severity, affected range, fixed version) + `repo_advisory_alerts` (per-repo match state with open/dismissed/fixed, unique on `(repo, advisory, manifest_path)`). `src/lib/advisories.ts` ships a 12-entry seed list (log4shell, lodash, minimist, vm2, urllib3, jwt-go, etc.), a minimal version-range matcher (`satisfiesRange` + `rangeMatches`) that handles `<`/`<=`/`>`/`>=`/`=` clauses including compound ranges, and `scanRepositoryForAlerts(repoId)` which cross-references J1 dep rows against the advisory list — inserts new alerts, reopens fixed-then-regressed ones, auto-closes alerts whose dep went away. `src/routes/advisories.tsx` serves `/:owner/:repo/security/advisories` (open), `/all` (everything), owner-only `POST /scan`, and per-alert `POST /:id/dismiss` + `POST /:id/reopen` with audit-log entries. 27 new tests (version parser, range matcher, seed shape, route auth).
3951454Claude	310	- J3 — Commit signature verification (GPG + SSH "Verified" badge) → ✅ shipped. `drizzle/0030_signing_keys.sql` adds `signing_keys` (per-user GPG/SSH pubkeys, unique on `(key_type, fingerprint)`) + `commit_verifications` (memoised per-commit result, unique on `(repo, sha)`). `src/lib/signatures.ts` extracts `gpgsig` / `gpgsig-sha256` from raw commit objects (`getRawCommitObject` added to `src/git/repository.ts`), unarmors PGP + SSH signature blobs, walks OpenPGP packet streams for Issuer Fingerprint (subpacket 33) / Issuer Key ID (subpacket 16), parses the SSHSIG inner publickey field, and SHA-256 fingerprints SSH wire-format keys. Identity matching via fingerprint → optional email check → cached. `src/routes/signing-keys.tsx` serves `GET/POST /settings/signing-keys` + `POST /settings/signing-keys/:id/delete`, audit-logged. `CommitList` + single commit view render a green "Verified" badge when cached `verified=true`. 29 new tests (extraction, unarmor, packet walker, SSH fp, end-to-end fast paths, route auth).
7aa8b99Claude	311	- J4 — User following + personalised feed → ✅ shipped. `drizzle/0031_user_follows.sql` adds `user_follows` (composite PK on `(follower_id, following_id)`, CHECK constraint rejecting self-follows, reverse-lookup index on `following_id`). `src/lib/follows.ts` exposes `followUser/unfollowUser/isFollowing/listFollowers/listFollowing/followCounts` + `feedForUser(userId, limit)` which joins `activity_feed` against the follow set (bounded to 200 edges) and filters out private repos the viewer doesn't own. `src/routes/follows.tsx` serves `POST /:user/follow` + `/:user/unfollow` (auth-gated, audit-logged), public `GET /:user/followers` + `/:user/following`, and `GET /feed` (personalised timeline). Follow button + follower/following counts added to the user profile page via `src/routes/web.tsx`. Reserved-name set protects fixed paths (`login`, `settings`, `feed`, etc.). 8 new tests (verb table + route auth).
d412586Claude	312	- J5 — Profile READMEs → ✅ shipped. User profile page at `/:owner` now attempts to render `<user>/<user>/README.md` (GitHub convention) or `<user>/.github/README.md` (org-style fallback) as the hero panel above the repo list. No schema changes — reuses `getReadme` / `renderMarkdown` + `repoExists` from the git layer. Failures are silent; missing repo just hides the panel. 2 smoke tests.
9ff7128Claude	313	- J6 — Repository rulesets (push policy engine) → ✅ shipped. `drizzle/0032_repo_rulesets.sql` adds `repo_rulesets` (unique on `(repository_id, name)`, enforcement enum active/evaluate/disabled) + `ruleset_rules` (JSON params). `src/lib/rulesets.ts` exposes six rule types (`commit_message_pattern`, `branch_name_pattern`, `tag_name_pattern`, `blocked_file_paths`, `max_file_size`, `forbid_force_push`) + the pure evaluator `evaluatePush(rulesets, ctx) → {allowed, violations}`. Helpers: glob-lite matcher (`globToRegex`), defensive `parseParams`. CRUD: `listRulesetsForRepo`, `getRuleset`, `createRuleset`, `updateRulesetEnforcement`, `deleteRuleset`, `addRule`, `deleteRule`. `src/routes/rulesets.tsx` serves owner-only UI at `/:owner/:repo/settings/rulesets` (list + create), `/:id` (detail, enforcement toggle, add rule), `/:id/delete`, `/:id/rules/:ruleId/delete`. 23 new tests covering each rule type, enforcement modes, glob edge cases, and route-auth redirects.
d62fb36Claude	314	- J7 — Closing keywords auto-close issues on PR merge → ✅ shipped. `src/lib/close-keywords.ts` exports pure `extractClosingRefs(text)` and `extractClosingRefsMulti(sources[])` — scans for `(close\|closes\|closed\|fix\|fixes\|fixed\|resolve\|resolves\|resolved)[:\|-]? #N` with case-insensitive, punctuation-tolerant, word-boundary-respecting matching. Rejects cross-repo refs (`owner/repo#N`), embedded-in-word verbs (`disclose`, `unresolved`), and non-positive numbers. Wired into the PR merge handler in `src/routes/pulls.tsx` — after a successful merge, scans `pr.title + pr.body`, looks up each referenced open issue in the same repo, closes it, and posts a "Closed by pull request #N" comment. Wrapped in try/catch so close-keyword failures never block the merge redirect. 14 new tests covering verb forms, punctuation variants, de-dup+sort, cross-repo rejection, embedded-word rejection, case-insensitivity, and multi-source merging. Total suite 749/749.
0cdfd89Claude	315	- J8 — Commit status API (external CI signals) → ✅ shipped. `drizzle/0033_commit_statuses.sql` adds `commit_statuses` (unique on `(repository_id, commit_sha, context)`, state vocabulary pending/success/failure/error). `src/lib/commit-statuses.ts` exposes pure helpers (`isValidSha`, `isValidState`, `sanitiseContext`, `reduceCombined`) and DB helpers (`setStatus` with delete-then-insert upsert, `listStatuses`, `combinedStatus`). `src/routes/commit-statuses.ts` serves `POST /api/v1/repos/:owner/:repo/statuses/:sha` (requireAuth + owner check), `GET /api/v1/repos/:owner/:repo/commits/:sha/statuses` (list, private-repo visibility), `GET /api/v1/repos/:owner/:repo/commits/:sha/status` (combined rollup). Commit detail view now renders a "Checks" pill row when statuses exist, colour-coded per state with clickable target URLs. 18 new tests covering the pure helpers + route auth + invalid-sha rejection. Total suite 767/767.
8098672Claude	316
9ab6971Claude	317	### BLOCK H — Marketplace
06139e6Claude	318	- H1 — App marketplace → ✅ shipped. `src/routes/marketplace.tsx` + `src/lib/marketplace.ts` + `drizzle/0021_marketplace_and_apps.sql` (5 tables: `apps`, `app_installations`, `app_bots`, `app_install_tokens`, `app_events`). Routes: `GET /marketplace` (public directory with search), `GET /marketplace/:slug` (detail + install CTA), `POST /marketplace/:slug/install` (user-target install in v1), `POST /marketplace/installations/:id/uninstall`, `GET /settings/apps` (personal list), `GET+POST /developer/apps-new` (register), `GET /developer/apps/:slug/manage` (event log + install count), `POST /developer/apps/:slug/tokens/new` (show-once token). Install idempotent via soft-update on existing non-uninstalled row.
	319	- H2 — GitHub Apps equivalent (bot identities + installation tokens) → ✅ shipped. Same schema as H1: every app gets a `<slug>[bot]` row in `app_bots`. `generateBearerToken()` produces `ghi_`-prefixed bearers; `hashBearer` (sha256) is the only form persisted. `verifyInstallToken(token)` returns `{installation, app, botUsername, permissions}` or `null` (checks revoked/expired/uninstalled/suspended). Permission vocabulary: `contents:read/write`, `issues:read/write`, `pulls:read/write`, `checks:read/write`, `deployments:read/write`, `metadata:read` — `hasPermission` implements write→read implication.
9ab6971Claude	320
	321	---
	322
	323	## 4. LOCKED BLOCKS (DO NOT UNDO)
	324
	325	Everything below is committed, tested, and load-bearing. Do not delete, rename, or semantically change without owner permission.
	326
	327	### 4.1 Infrastructure (locked)
	328	- `src/app.tsx` — route composition, middleware order, error handlers
	329	- `src/index.ts` — Bun server entry
	330	- `src/lib/config.ts` — env getters (late-binding)
0cdfd89Claude	331	- `src/db/schema.ts` — 95 tables. New tables only via new migration.
9ab6971Claude	332	- `src/db/index.ts` — lazy proxy DB connection
	333	- `src/db/migrate.ts` — migration runner
	334	- `drizzle/0000_initial.sql`, `drizzle/0001_green_ecosystem.sql` — migrations
058d752Claude	335	- `drizzle/0004_org_owned_repos.sql` (Block B2) — migration, never edited in place
	336	- `drizzle/0005_totp_2fa.sql` (Block B4) — migration, never edited in place
	337	- `drizzle/0006_webauthn_passkeys.sql` (Block B5) — migration, never edited in place
	338	- `drizzle/0007_oauth_provider.sql` (Block B6) — migration, never edited in place
5e888b7Claude	339	- `drizzle/0008_workflows.sql` (Block C1) — migration, never edited in place
25a91a6Claude	340	- `drizzle/0009_packages.sql` (Block C2) — migration, never edited in place
	341	- `drizzle/0010_pages.sql` (Block C3) — migration, never edited in place
	342	- `drizzle/0011_environments.sql` (Block C4) — migration, never edited in place
3cbe3d6Claude	343	- `drizzle/0012_ai_native.sql` (Block D) — migration, never edited in place. Adds `codebase_explanations`, `dep_update_runs`, `code_chunks`.
1e162a8Claude	344	- `drizzle/0013_discussions.sql` (Block E2) — migration, never edited in place. Adds `discussions`, `discussion_comments`.
	345	- `drizzle/0014_gists.sql` (Block E4) — migration, never edited in place. Adds `gists`, `gist_files`, `gist_revisions`, `gist_stars`.
	346	- `drizzle/0015_projects.sql` (Block E1) — migration, never edited in place. Adds `projects`, `project_columns`, `project_items`.
	347	- `drizzle/0016_wikis.sql` (Block E3) — migration, never edited in place. Adds `wiki_pages`, `wiki_revisions`.
a79a9edClaude	348	- `drizzle/0017_merge_queue.sql` (Block E5) — migration, never edited in place. Adds `merge_queue_entries` (with partial unique index on `pull_request_id WHERE state IN ('queued','running')`).
	349	- `drizzle/0018_required_checks.sql` (Block E6) — migration, never edited in place. Adds `branch_required_checks`.
	350	- `drizzle/0019_protected_tags.sql` (Block E7) — migration, never edited in place. Adds `protected_tags`.
8f50ed0Claude	351	- `drizzle/0020_analytics_and_admin.sql` (Block F) — migration, never edited in place. Adds `repo_traffic_events`, `system_flags`, `site_admins`, `billing_plans` (seeded free/pro/team/enterprise), `user_quotas`.
06139e6Claude	352	- `drizzle/0021_marketplace_and_apps.sql` (Block H) — migration, never edited in place. Adds `apps`, `app_installations` (partial unique index on `(app_id, target_type, target_id) WHERE uninstalled_at IS NULL`), `app_bots` (one-per-app, `<slug>[bot]` username), `app_install_tokens` (sha256 hash, expires_at, revoked_at), `app_events` (audit trail).
71cd5ecClaude	353	- `drizzle/0022_repo_templates.sql` (Block I2+I3) — migration, never edited in place. Adds `repositories.is_template` (partial index where true) + `repo_transfers` audit table.
08420cdClaude	354	- `drizzle/0023_sponsors.sql` (Block I6) — migration, never edited in place. Adds `sponsorship_tiers` + `sponsorships` tables.
	355	- `drizzle/0024_email_digest.sql` (Block I7) — migration, never edited in place. Adds `users.notify_email_digest_weekly` + `users.last_digest_sent_at`.
4c8f666Claude	356	- `drizzle/0025_code_symbols.sql` (Block I8) — migration, never edited in place. Adds `code_symbols` table with indexes on `(repository_id, name)` + `(repository_id, path)`.
4a0dea1Claude	357	- `drizzle/0026_repo_mirrors.sql` (Block I9) — migration, never edited in place. Adds `repo_mirrors` (unique on `repository_id`) + `repo_mirror_runs`.
edf7c36Claude	358	- `drizzle/0027_sso_oidc.sql` (Block I10) — migration, never edited in place. Adds `sso_config` singleton (`id='default'`) + `sso_user_links` (`subject` unique, FK to `users` with ON DELETE CASCADE).
8098672Claude	359	- `drizzle/0028_repo_dependencies.sql` (Block J1) — migration, never edited in place. Adds `repo_dependencies` with indexes on `(repository_id, ecosystem)` + `(name)`.
f60ccdeClaude	360	- `drizzle/0029_security_advisories.sql` (Block J2) — migration, never edited in place. Adds `security_advisories` (`ghsa_id` unique) + `repo_advisory_alerts` (unique on `(repository_id, advisory_id, manifest_path)`, status index).
3951454Claude	361	- `drizzle/0030_signing_keys.sql` (Block J3) — migration, never edited in place. Adds `signing_keys` (unique on `(key_type, fingerprint)`) + `commit_verifications` (unique on `(repository_id, commit_sha)`).
7aa8b99Claude	362	- `drizzle/0031_user_follows.sql` (Block J4) — migration, never edited in place. Adds `user_follows` (composite PK on `(follower_id, following_id)`, CHECK no-self-follow, reverse index on `following_id`).
9ff7128Claude	363	- `drizzle/0032_repo_rulesets.sql` (Block J6) — migration, never edited in place. Adds `repo_rulesets` (unique on `(repository_id, name)`, enforcement enum) + `ruleset_rules` (JSON params).
0cdfd89Claude	364	- `drizzle/0033_commit_statuses.sql` (Block J8) — migration, never edited in place. Adds `commit_statuses` (unique on `(repository_id, commit_sha, context)`, state vocabulary pending/success/failure/error).
afd651eClaude	365	- `drizzle/0034_processed_events.sql` (Signal Bus P1) — migration, never edited in place. Idempotency table for inbound deploy events; sha256-keyed dedupe of at-least-once delivery from Crontech.
	366	- `drizzle/0035_repo_collaborators.sql` — migration, never edited in place. Adds `repo_collaborators` (unique on `(repository_id, user_id)`, role enum read/write/admin, `invited_by` nullable, `accepted_at` nullable).
	367	- `drizzle/0036_invite_token_hash.sql` — migration, never edited in place. Adds `invite_token_hash` column (sha256 of plaintext) to `repo_collaborators` for email-flow invites; NULL on legacy auto-accepted rows.
	368	- `drizzle/0037_workflow_engine_v2.sql` — migration, never edited in place. Strictly additive to Block C1 (`drizzle/0008_workflows.sql` stays locked). Adds `workflow_secrets` (AES-256-GCM, `(repo, name)` unique), `workflow_dispatch_inputs` (per-workflow input schema), `workflow_run_cache` (content-addressable cache, repo/branch/tag scoped), `workflow_runner_pool` (warm-runner registry).
9ab6971Claude	369
	370	### 4.2 Git layer (locked)
	371	- `src/git/repository.ts` — tree / blob / commits / diff / branches / blame / search / raw / tags / commitsBetween
	372	- `src/git/protocol.ts` — Smart HTTP pkt-line
	373	- `src/hooks/post-receive.ts` — CODEOWNERS sync, gates, auto-deploy, webhook fan-out
	374
	375	### 4.3 Auth + security (locked)
	376	- `src/lib/auth.ts` — bcrypt, session tokens
25a91a6Claude	377	- `src/middleware/auth.ts` — softAuth + requireAuth. Accepts three auth inputs: session cookie (web), OAuth access token (`glct_` prefix, Block B6), and personal access token (`glc_` prefix, Block C2). Invalid bearer → 401 JSON. Cookie flow → /login redirect.
9ab6971Claude	378	- `src/middleware/rate-limit.ts` — fixed-window limiter
	379	- `src/middleware/request-context.ts` — request-ID
	380	- `src/lib/security-scan.ts` — `SECRET_PATTERNS` (exported) + `scanForSecrets` + `aiSecurityScan`
058d752Claude	381	- `src/lib/codeowners.ts` — parser + `ownersForPath` (last-match-wins); team expansion helpers for `@org/team` (Block B3)
	382	- `src/lib/totp.ts` (Block B4) — TOTP enroll / verify / recovery codes
	383	- `src/lib/webauthn.ts` (Block B5) — WebAuthn registration + assertion helpers
	384	- `src/lib/oauth.ts` (Block B6) — OAuth 2.0 provider: authorization code grant, token issuance, scope enforcement
5e888b7Claude	385	- `src/lib/workflow-parser.ts` (Block C1) — YAML subset parser for `.gluecron/workflows/*.yml`. Exports `parseWorkflow(src)` returning `{ ok, workflow \| error }`. Never throws.
	386	- `src/lib/workflow-runner.ts` (Block C1) — shell executor. Exports `executeRun`, `drainOneRun`, `enqueueRun`, `startWorker`. Clones repo to tmpdir, runs each job via `Bun.spawn(["bash","-c",step.run])` with SIGTERM→SIGKILL timeouts, size-capped stdout/stderr, cleans up in `finally`.
25a91a6Claude	387	- `src/lib/packages.ts` (Block C2) — npm protocol helpers: `parsePackageName`, `computeShasum` (sha1), `computeIntegrity` (sha512 base64), `buildPackument`, `resolveRepoFromPackageJson`, `parseRepoUrl`, `tarballFilename`. Pure functions.
	388	- `src/lib/pages.ts` (Block C3) — `onPagesPush` (never throws), `resolvePagesPath` (probe list including pretty URLs + traversal strip), `contentTypeFor` (MIME).
	389	- `src/lib/environments.ts` (Block C4) — `matchGlob`, `listEnvironments`, `getOrCreateEnvironment`, `getEnvironmentByName`, `isReviewer`, `reviewerIdsOf`, `allowedBranchesOf`, `computeApprovalState`, `reduceApprovalState`, `recordApproval`, `requiresApprovalFor`. Empty reviewers list → repo owner approves. Any rejection hard-stops.
9ab6971Claude	390
afd651eClaude	391	### 4.3.1 Permissions + collaborators (locked)
	392	- `src/middleware/repo-access.ts` — centralised permission check applied to all repo-write routes. Resolves owner / collaborator-role / org-team-role and rejects unauthorised mutations.
	393	- `src/lib/invite-tokens.ts` — opaque single-use invite secret generator + sha256 hasher. Hash stored in `repo_collaborators.invite_token_hash`; plaintext is delivered once via the invite email link.
	394	- `src/routes/collaborators.tsx` — per-repo collaborator add/list/remove. Owner-or-admin only. Audit-logged.
	395	- `src/routes/team-collaborators.tsx` — bulk-grant: invite every accepted member of a given team to a repo as a collaborator in one action.
	396	- `src/routes/invites.tsx` — invite acceptance landing page. Verifies token hash, sets `accepted_at`, redirects to repo.
	397
9ab6971Claude	398	### 4.4 AI layer (locked)
	399	- `src/lib/ai-client.ts` — Anthropic client + model constants
3cbe3d6Claude	400	- `src/lib/ai-generators.ts` — commit / PR / changelog / issue-triage / pull-request-triage (D3)
9ab6971Claude	401	- `src/lib/ai-chat.ts` — conversational chat
	402	- `src/lib/ai-review.ts` — PR code review
	403	- `src/lib/auto-repair.ts` — worktree-backed repair commits
	404	- `src/lib/merge-resolver.ts` — AI merge conflict resolution
3cbe3d6Claude	405	- `src/lib/ai-explain.ts` (Block D6) — `explainCodebase(...)` + `getCachedExplanation(...)`. Samples up to ~25 representative files (~60KB cap), Sonnet 4, upserts into `codebase_explanations`. Fallback to README-ish synthesis when no key. Never throws.
	406	- `src/lib/ai-completion.ts` (Block D9) — `completeCode({prefix, suffix?, language?, maxTokens?, repoHint?})` via Haiku. Inline LRU (size 200, 5-min TTL) keyed on sha256 of prefix+suffix+language. Code-fence stripping. Never throws. `__test` bundle exposed.
	407	- `src/lib/dep-updater.ts` (Block D2) — `parseManifest`, `queryNpmLatest`, `planUpdates` (injectable `fetchLatest`), `applyBumps`, `runDepUpdateRun`. Creates `gluecron/dep-update-<ts>` branch via git plumbing + opens a PR row. Never throws.
	408	- `src/lib/semantic-search.ts` (Block D1) — `tokenize`, `hashEmbed` (512-dim L2-normalised FNV-1a + sign trick), `embedBatch` (Voyage `voyage-code-3` when `VOYAGE_API_KEY` set, else fallback), `chunkFile`, `isCodeFile`, `indexRepository`, `searchRepository`, `cosine`, `isEmbeddingsProviderAvailable`, `__test` bundle.
1e162a8Claude	409	- `src/lib/ai-incident.ts` (Block D4) — `onDeployFailure({deploymentId, reason, logs?})` and pure helper `summariseCommitsForIncident(commits)`. Sonnet 4 structured JSON RCA → opens `issues` row, attaches `incident` label if present, sets `deployments.blockedReason`. Never throws; deterministic fallback body when no API key. Wired from `post-receive.ts triggerCrontechDeploy` + `deployments.tsx retry-incident`.
	410	- `src/lib/ai-tests.ts` (Block D8) — pure helpers `detectLanguage`, `detectTestFramework`, `buildTestsPrompt`, `suggestedTestPath`, `generateTestStub`, `contentTypeFor`. Returns `{code:"", framework:"fallback"}` on no API key. Never throws.
	411	- `src/lib/branch-protection.ts` (Block D5) — `matchProtection(repoId, branch)` (exact wins; deterministic glob sort), `evaluateProtection(rule, ctx)` (pure — checks `requireAiApproval \| requireGreenGates \| requireHumanReview \| requiredApprovals`), `countHumanApprovals(prId)` (LGTM/+1/approved heuristic). Never throws. Enforcement is in `src/routes/pulls.tsx` merge handler, after existing hard-gate filter.
afd651eClaude	412	- `src/lib/intelligence.ts` — repository intelligence engine (repo-level summarisation + signals).
	413	- `src/lib/timetravel.ts` — time-travel code explorer (historical snapshot navigation).
	414	- `src/lib/depimpact.ts` — dependency impact analyzer (cross-reference of who breaks if X bumps).
	415	- `src/lib/rollback.ts` — one-click rollback helper for failed deploys.
	416	- `src/lib/spec-to-pr.ts` + `src/lib/spec-ai.ts` + `src/lib/spec-context.ts` + `src/lib/spec-git.ts` — Spec-to-PR v2 pipeline (NL feature spec → Claude → branch via git plumbing → PR row). Graceful fallback when no `ANTHROPIC_API_KEY`.
	417	- `src/lib/autorepair.ts` — `autoRepair(...)` invoked from `src/hooks/post-receive.ts` and exercised by `src/__tests__/intelligence.test.ts`. Distinct from `src/lib/auto-repair.ts` (gate-time `repairSecrets`/`repairSecurityIssues` used by `src/lib/gate.ts`). Both are load-bearing — do not dedupe.
	418	- `src/lib/pr-triage.ts` — placeholder for a future post-create PR-triage hook (logs only, no AI call). Distinct from `triagePullRequest` in `src/lib/ai-generators.ts` which is the live D3 path.
9ab6971Claude	419
	420	### 4.5 Platform (locked)
24cf2caClaude	421	- `src/lib/notify.ts` — notification creation + audit log (swallow-failures pattern). Also fans out email to opted-in recipients for `mention\|review_requested\|assigned\|gate_failed`. Exports `__internal` for tests.
	422	- `src/lib/email.ts` — provider-pluggable email sender (`log`\|`resend`). `sendEmail()` never throws. `absoluteUrl()` joins paths against `APP_BASE_URL`.
	423	- `src/lib/templates.ts` — `loadIssueTemplate` / `loadPrTemplate`. Checks standard paths (`.github/`, `.gluecron/`, root, `docs/`) on the default branch, strips YAML frontmatter, 16KB cap, returns null on any failure.
9ab6971Claude	424	- `src/lib/unread.ts` — unread count helper (never throws)
	425	- `src/lib/repo-bootstrap.ts` — green defaults on repo creation
	426	- `src/lib/gate.ts` — gate orchestration + persistence
	427	- `src/lib/cache.ts` — LRU cache, git-cache invalidation
6fc53bdClaude	428	- `src/lib/reactions.ts` — `summariseReactions`, `toggleReaction`, `ALLOWED_EMOJIS`, `EMOJI_GLYPH`, `isAllowedEmoji`, `isAllowedTarget`
afd651eClaude	429	- `src/lib/observability.ts` — minimal dependency-free observability layer. Wired into `app.onError`. Sinks: `ERROR_WEBHOOK_URL` and/or `SENTRY_DSN`. Never throws.
	430	- `src/lib/sse.ts` — in-process topic-based pub/sub broadcaster for Server-Sent Events. Backs the live UI updates layer.
	431	- `src/lib/sse-client.ts` — emits a `<script>`-droppable JS snippet for SSR'd views to subscribe to a topic. Plain JS only — no client framework.
	432	- `src/lib/autopilot.ts` — 5-minute self-sufficiency ticker (mirror sync, merge-queue peek, weekly digests, advisory rescans). `AUTOPILOT_DISABLED=1` opt-out. Observability via `getLastTick()` + `getTickCount()`.
	433	- `src/lib/demo-seed.ts` — idempotent `ensureDemoContent()` (creates `demo` user + `hello-python` / `todo-api` / `design-docs`). `DEMO_SEED_ON_BOOT=1` boot flag in `src/index.ts`.
	434	- `src/lib/import-helper.ts` — small helpers for the GitHub import flow (`src/routes/import.tsx`).
	435	- `src/lib/import-verify.ts` — post-migration smoke verifier (object count, branches, default-branch HEAD). Re-runnable from `src/routes/migrations.tsx`.
	436	- `src/lib/namespace.ts` — namespace resolution for Block B2 (user vs org slug → owner record).
	437	- `src/lib/action-registry.ts` — built-in action registry for workflow engine v2 (Sprint 1). Backs `src/lib/actions/{cache,checkout,download-artifact,gatetest,upload-artifact}-action.ts`.
	438	- `src/lib/workflow-conditionals.ts` — `if:` expression evaluator for workflow steps.
	439	- `src/lib/workflow-matrix.ts` — matrix expansion for workflow jobs.
	440	- `src/lib/workflow-artifacts.ts` — artifact persistence helpers backing `workflow_run_cache`-style storage.
	441	- `src/lib/workflow-secrets.ts` + `src/lib/workflow-secrets-crypto.ts` — AES-256-GCM secret storage. Crypto lib stays separate from DB lib so the DB layer holds opaque bytes only.
9ab6971Claude	442
	443	### 4.6 Routes (locked endpoints — behaviour must be preserved)
	444	- `src/routes/git.ts` — Smart HTTP (clone/push)
	445	- `src/routes/api.ts` — REST (`POST /api/repos`, `GET /api/users/:u/repos`, `GET /api/repos/:o/:n`, `POST /api/setup`)
ad6d4adClaude	446	- `src/routes/hooks.ts` — `POST /api/hooks/gatetest` (bearer/HMAC), `GET /api/hooks/ping`, `POST /api/v1/gate-runs` (PAT backup), `GET /api/v1/gate-runs`. See `GATETEST_HOOK.md`.
6fc53bdClaude	447	- `src/routes/theme.ts` — `GET /theme/toggle`, `GET /theme/set?mode=`. Writes `theme` cookie (`dark`\|`light`, 1-year). Layout reads via pre-paint inline script.
	448	- `src/routes/audit.tsx` — `GET /settings/audit` (personal) + `GET /:owner/:repo/settings/audit` (owner-only).
24cf2caClaude	449	- `src/routes/saved-replies.tsx` — `GET/POST /settings/replies`, `POST /settings/replies/:id`, `POST /settings/replies/:id/delete`, `GET /api/user/replies`. Unique constraint `saved_replies_user_shortcut`.
	450	- `src/routes/deployments.tsx` — `GET /:owner/:repo/deployments` (grouped by env, success-rate rollup), `GET /:owner/:repo/deployments/:id` (detail).
6fc53bdClaude	451	- `src/routes/reactions.ts` — `POST /api/reactions/:targetType/:targetId/:emoji/toggle` (authed, form- or fetch-compatible), `GET /api/reactions/:targetType/:targetId`. Targets: `issue\|pr\|issue_comment\|pr_comment`. Emojis: 8 canonical.
9ab6971Claude	452	- `src/routes/auth.tsx` — register / login / logout
	453	- `src/routes/web.tsx` — home / new / browse / blob / commits / raw / blame / star / search / profile
	454	- `src/routes/issues.tsx` — issue CRUD + comments + labels + lock
	455	- `src/routes/pulls.tsx` — PR CRUD + review + merge + close
	456	- `src/routes/editor.tsx` — web file editor
	457	- `src/routes/compare.tsx` — base...head diff
24cf2caClaude	458	- `src/routes/settings.tsx` — profile + password + email notification preferences (`POST /settings/notifications`)
9ab6971Claude	459	- `src/routes/repo-settings.tsx` — repo settings + delete
	460	- `src/routes/webhooks.tsx` — webhook CRUD + test + `fireWebhooks`
	461	- `src/routes/fork.ts` — fork
	462	- `src/routes/explore.tsx` — discover
	463	- `src/routes/tokens.tsx` — personal access tokens
	464	- `src/routes/contributors.tsx` — contributor list
	465	- `src/routes/notifications.tsx` — inbox + unread API
	466	- `src/routes/dashboard.tsx` — authed home (`renderDashboard` exported)
	467	- `src/routes/ask.tsx` — global + repo AI chat + explain
	468	- `src/routes/releases.tsx` — tags + AI changelog
	469	- `src/routes/gates.tsx` — history + settings + branch protection UI
	470	- `src/routes/insights.tsx` — insights + milestones
	471	- `src/routes/search.tsx` — global search + `/shortcuts`
	472	- `src/routes/health.ts` — `/healthz` `/readyz` `/metrics`
6563f0aClaude	473	- `src/routes/orgs.tsx` — `/orgs` list, `/orgs/new` create, `/orgs/:slug` profile, `/orgs/:slug/people` + add/role/remove, `/orgs/:slug/teams` + create, `/orgs/:slug/teams/:teamSlug` + member add/remove. All require auth. Role guards via `orgRoleAtLeast`; last-owner cannot be demoted or removed; every write path `audit()`'d.
058d752Claude	474	- `src/lib/orgs.ts` (Block B1) — `isValidSlug` (rejects reserved + too-short/long + consecutive/leading/trailing hyphens), `normalizeSlug`, `orgRoleAtLeast` (owner>admin>member), `isValidOrgRole`, `isValidTeamRole`, `loadOrgForUser`, `listOrgsForUser`, `listOrgMembers`, `listTeamsForOrg`, `listTeamMembers`, `__test` export for unit tests.
	475	- `src/routes/settings-2fa.tsx` (Block B4) — TOTP enroll / verify / disable + recovery codes UI. All require auth.
	476	- `src/routes/passkeys.tsx` (Block B5) — WebAuthn passkey registration / assertion / management. All require auth.
	477	- `src/routes/oauth.tsx` (Block B6) — OAuth 2.0 authorize + token + userinfo endpoints.
	478	- `src/routes/developer-apps.tsx` (Block B6) — developer-facing OAuth app CRUD (`/settings/developer/apps`), client secret rotation, audit-logged.
5e888b7Claude	479	- `src/routes/workflows.tsx` (Block C1) — Actions UI. `GET /:owner/:repo/actions`, `GET /:owner/:repo/actions/runs/:runId`, `POST /:owner/:repo/actions/:workflowId/run` (auth+owner), `POST /:owner/:repo/actions/runs/:runId/cancel` (auth+owner). Manual runs are `event=manual`, ref=default branch.
25a91a6Claude	480	- `src/routes/packages-api.ts` (Block C2) — npm protocol: `GET/PUT/DELETE /npm/*` (packument, tarball, publish, yank); JSON helpers at `/api/packages/:owner/:repo/...`. PAT (`glc_`) bearer auth.
	481	- `src/routes/packages.tsx` (Block C2) — UI: `/:owner/:repo/packages` list + `/:owner/:repo/packages/:pkgName` detail.
	482	- `src/routes/pages.tsx` (Block C3) — `GET /:owner/:repo/pages/*` serves static files from latest gh-pages commit (binary via `getRawBlob`, text via `getBlob`). `GET/POST /:owner/:repo/settings/pages` settings + redeploy.
	483	- `src/routes/environments.tsx` (Block C4) — settings CRUD at `/:owner/:repo/settings/environments`; approval endpoints at `/:owner/:repo/deployments/:id/{approve,reject}`.
3cbe3d6Claude	484	- `src/routes/ai-explain.tsx` (Block D6) — `GET /:owner/:repo/explain` (softAuth), `POST /:owner/:repo/explain/regenerate` (requireAuth, owner-only).
	485	- `src/routes/ai-changelog.tsx` (Block D7) — `GET /:owner/:repo/ai/changelog` (softAuth). Form + rendered output; `?format=markdown` returns `text/markdown`.
	486	- `src/routes/copilot.ts` (Block D9) — `POST /api/copilot/completions` (requireAuth, 60/min rate limit), `GET /api/copilot/ping` (public).
	487	- `src/routes/dep-updater.tsx` (Block D2) — `GET /:owner/:repo/settings/dep-updater` + `POST /:owner/:repo/settings/dep-updater/run` (requireAuth, owner-only).
	488	- `src/routes/semantic-search.tsx` (Block D1) — `GET /:owner/:repo/search/semantic?q=` (softAuth) + `POST /:owner/:repo/search/semantic/reindex` (requireAuth, owner-only).
1e162a8Claude	489	- `src/routes/ai-tests.tsx` (Block D8) — `GET /:owner/:repo/ai/tests` (softAuth form + picker), `GET /:owner/:repo/ai/tests?format=raw` (raw text w/ MIME), `POST /:owner/:repo/ai/tests/generate` (requireAuth, renders highlighted source + AI-generated failing test with copy button).
	490	- `src/routes/discussions.tsx` (Block E2) — full discussion CRUD + categories + q-and-a answers + lock/pin. Exports `isValidCategory(c)` helper. Owner-only lock/pin; owner-or-author can close/toggle.
	491	- `src/routes/gists.tsx` (Block E4) — `GET /gists` discover, `/gists/new\|:slug\|:slug/edit\|:slug/delete\|:slug/star\|:slug/revisions\|:slug/revisions/:rev` + `/:username/gists`. Exports `generateSlug()` (8-hex) and `snapshotOf(files)` JSON serializer. Retries on slug collision up to 5x.
	492	- `src/routes/projects.tsx` (Block E1) — kanban board CRUD. Auto-seeds three default columns on project create. `/:owner/:repo/projects/:number/items/:itemId/move` recomputes position via `max+1` of target column.
	493	- `src/routes/wikis.tsx` (Block E3) — DB-backed wiki with revision history + revert. Exports `slugifyTitle(title)` (lowercase alphanumerics joined by single dashes, trimmed). Every edit appends a `wiki_revisions` row; revert creates a new revision.
a79a9edClaude	494	- `src/routes/merge-queue.tsx` (Block E5) — `GET /:owner/:repo/queue` list, `POST /:owner/:repo/pulls/:n/enqueue` (requireAuth), `POST /:owner/:repo/queue/:id/dequeue` (owner-or-enqueuer), `POST /:owner/:repo/queue/process-next?base=X` (owner-only, re-runs gates against base then updates base ref). PR page has an extra "Add to merge queue" button.
	495	- `src/lib/merge-queue.ts` (Block E5) — `enqueuePr`, `dequeueEntry`, `peekHead`, `markHeadRunning`, `completeEntry`, `isQueued`, `queueDepth`, `listQueue`, `listQueueWithPrs`. No side effects beyond the `merge_queue_entries` table; callers own gate execution + git updates.
	496	- `src/routes/required-checks.tsx` (Block E6) — `/:owner/:repo/gates/protection/:id/checks` CRUD (owner-only, requireAuth). "Required checks" link added on gates settings UI next to each branch protection rule.
	497	- `src/lib/branch-protection.ts` extends for E6 — `listRequiredChecks(branchProtectionId)`, `passingCheckNames(repositoryId, commitSha)` (scans `gate_runs` + `workflow_runs`), and `evaluateProtection(rule, ctx, requiredChecks[])` now takes a third param + reports `missingChecks`.
	498	- `src/routes/protected-tags.tsx` (Block E7) — `/:owner/:repo/settings/protected-tags` CRUD (owner-only, requireAuth).
	499	- `src/lib/protected-tags.ts` (Block E7) — `matchProtectedTag`, `isProtectedTag`, `canBypassProtectedTag`, `listProtectedTags`, `addProtectedTag`, `removeProtectedTag`, `userIdFromUsername`. Matching uses `matchGlob` from environments.ts with `refs/tags/` prefix stripped. Post-receive hook writes audit log entries (`protected_tags.{create\|update\|delete}_violation_candidate`) on matched pushes.
8f50ed0Claude	500	- `src/lib/traffic.ts` (Block F1) — `track`, `trackView`, `trackClone`, `trackByName(owner, repo, kind, meta)`, `summarise(repoId, windowDays=14)`, pure `bucketDaily(events)`. SHA-256-truncated IP hashing (16 hex) for unique-visitor approximation. All callers use `.catch(() => {})` fire-and-forget.
	501	- `src/routes/traffic.tsx` (Block F1) — `GET /:owner/:repo/traffic` (owner-only) with 7/14/30/90d windows, ascii-bar daily chart, top referers, unique visitors.
	502	- `src/routes/org-insights.tsx` (Block F2) — exports `computeOrgInsights(orgId)` returning `OrgInsightsSummary` (repoCount, gateRunsTotal, greenRate, openIssues, openPrs, mergedPrs30d, perRepo[]). `GET /orgs/:slug/insights` requires org membership. No new tables.
	503	- `src/lib/admin.ts` (Block F3) — `isSiteAdmin(userId)` with bootstrap rule (empty `site_admins` → oldest user wins), `listSiteAdmins`, `grantSiteAdmin`, `revokeSiteAdmin`, `getFlag`, `setFlag`, `listFlags`, `KNOWN_FLAGS = { registration_locked, site_banner_text, site_banner_level, read_only_mode }`. All helpers swallow DB errors.
	504	- `src/routes/admin.tsx` (Block F3) — `GET /admin` dashboard (user/repo/admin counts + recent signups), `/admin/users` + toggle grant/revoke, `/admin/repos` + nuclear delete, `/admin/flags` form. All mutations audit-logged via `audit()`. Gated through a `gate(c)` helper that returns `{user} \| Response`.
	505	- `src/lib/billing.ts` (Block F4) — plan + quota helpers. `FALLBACK_PLANS` (free/pro/team/enterprise) mirror the seed rows. `getUserQuota(userId)` auto-initialises free row. `bumpUsage`, `checkQuota` (fail-open), `wouldExceedRepoLimit`, `resetIfCycleExpired`, `formatPrice`. Never throws into request path.
	506	- `src/routes/billing.tsx` (Block F4) — `GET /settings/billing` (personal view with usage bars + plan cards), `GET /admin/billing` (site-admin user/plan table), `POST /admin/billing/:userId/plan` (override plan, audit-logged).
eae38d1Claude	507	- `src/routes/pwa.ts` (Block G1) — `/manifest.webmanifest`, `/sw.js`, `/icon.svg`. Exports `MANIFEST`, `SERVICE_WORKER_SRC`, `PWA_REGISTER_SNIPPET` for testing. SW deliberately skips `.git/`, `/api/`, `/login*`, `/register`, `/logout`.
	508	- `src/lib/graphql.ts` (Block G2) — hand-rolled recursive-descent parser (`parseQuery`) + executor (`execute`) over a fixed schema. Zero dependencies. Root fields: viewer, user, repository, search, rateLimit. No mutations.
	509	- `src/routes/graphql.ts` (Block G2) — `POST /api/graphql` JSON endpoint + `GET /api/graphql` GraphiQL-lite explorer (Cmd+Enter to run).
	510	- `cli/gluecron.ts` (Block G3) — single-file Bun CLI. Exports `dispatch(argv, out)` for programmatic use, `HELP` constant, `loadConfig`/`saveConfig`. Config at `~/.gluecron/config.json` (0600). Compile: `bun build cli/gluecron.ts --compile --outfile gluecron`.
	511	- `vscode-extension/` (Block G4) — VS Code extension with `package.json` declaring four commands (explainFile, openOnWeb, searchSemantic, generateTests) + `gluecron.host` / `gluecron.token` settings. Detects Gluecron remotes via `git config remote.origin.url`.
06139e6Claude	512	- `src/lib/marketplace.ts` (Block H1+H2) — marketplace + app identity surface. `KNOWN_PERMISSIONS` (10 scopes), `KNOWN_EVENTS` (8 kinds). Pure helpers: `slugify` (40-char cap), `botUsername` (`<slug>[bot]`), `normalisePermissions` (drops unknown, de-dupes), `parsePermissions` (JSON), `hasPermission` (write→read implication), `permissionsSubset`, `generateBearerToken` (`ghi_` prefix + 24-byte hex), `hashBearer` (sha256). DB helpers: `listPublicApps(query)`, `getAppBySlug`, `createApp` (retries slug collisions, creates matching bot row), `installApp` (idempotent soft-update), `uninstallApp` (revokes all tokens), `issueInstallToken` (1h TTL default), `verifyInstallToken` (checks revoked/expired/uninstalled/suspended), `listInstallationsForApp`, `listInstallationsForTarget`, `listEventsForApp`, `countInstalls`. Never throws into request path.
	513	- `src/routes/marketplace.tsx` (Block H1+H2) — public marketplace + developer UX. `GET /marketplace` (directory + search), `GET /marketplace/:slug` (detail + install form), `POST /marketplace/:slug/install` (v1 user-target only), `POST /marketplace/installations/:id/uninstall` (installer-only), `GET /settings/apps` (personal list), `GET+POST /developer/apps-new` (register), `GET /developer/apps/:slug/manage` (event log + install count, owner-only), `POST /developer/apps/:slug/tokens/new` (show-once `ghi_` token). All mutations audit-logged.
08420cdClaude	514	- `src/routes/code-scanning.tsx` (Block I5) — `GET /:owner/:repo/security` (softAuth, private-repo visibility enforced). Aggregates last-100 scan-related `gate_runs`, builds `latestByName` map, renders summary cards + scanner status list + recent runs.
	515	- `src/routes/sponsors.tsx` (Block I6) — public `/sponsors/:username` + maintainer `/settings/sponsors` (requireAuth). Tier CRUD (`POST /settings/sponsors/tiers/new`, soft-retire via `is_active=false` on delete). Exports `sponsorshipTotalForUser(userId)` helper and `__internal.formatCents` for tests.
	516	- `src/lib/email-digest.ts` (Block I7) — `composeDigest(userId, since?)` (never throws, null on failure), `sendDigestForUser(userId)` (opt-out check + updates `last_digest_sent_at` on success), `sendDigestsToAll()` (iterates opted-in users). Pulls notifications + owned-repo gate_runs (failed/repaired) + merged PRs over last 7d. Builds text + escaped HTML body. Exports `__internal = { textToHtml, escapeHtml, fmtRange }` for tests.
	517	- `src/routes/admin.tsx` (extends Block F3 for I7) — adds `GET /admin/digests` (opted-in count + recently sent list), `POST /admin/digests/run` (calls `sendDigestsToAll`, audit-logged with counts), `POST /admin/digests/preview` (sends to one user by username, audit-logged). New "Email digests" tile on the /admin dashboard grid.
	518	- `src/routes/settings.tsx` (extends for I7) — adds `notify_email_digest_weekly` checkbox to email prefs + handler wiring in `POST /settings/notifications`, and `GET /settings/digest/preview` (renders `composeDigest` output inline via `raw(body.html)` with Hono's `hono/html`).
4c8f666Claude	519	- `src/lib/symbols.ts` (Block I8) — regex-based top-level symbol extractor. Pure helpers: `detectLanguage(path)` (10 extensions mapped to 8 languages), `extractSymbols(content, lang)` (per-language rule list, 1-based line numbers, 240-char signature cap, skips lines >500 chars). `indexRepositorySymbols(repoId)` walks the default-branch tree, caps at 2000 files / 1MB each, replaces the prior set in batches of 500. `findDefinitions(repoId, name)` + `countSymbolsForRepo(repoId)`. `__internal` exposes `RULES` + `EXT_LANG` for tests.
	520	- `src/routes/symbols.tsx` (Block I8) — `/:owner/:repo/symbols` overview (total + per-kind counts + A–Z list with blob deep-links), `/:owner/:repo/symbols/search?q=` prefix search (ilike `q%`), `/:owner/:repo/symbols/:name` detail (all definitions with signature preview + deep link). `POST /:owner/:repo/symbols/reindex` is requireAuth + owner-only.
4a0dea1Claude	521	- `src/lib/mirrors.ts` (Block I9) — upstream URL validator (accepts https/http/git schemes, rejects ssh/file/paths/shell metacharacters, 2048-char cap), `safeUrlForLog` (redacts embedded credentials), `upsertMirror` / `deleteMirror` / `getMirrorForRepo` / `listRecentRuns`, `runMirrorSync` (runs `git fetch --prune --tags --no-write-fetch-head` via `Bun.spawn` with 5-min timeout + `GIT_TERMINAL_PROMPT=0`; updates `last_synced_at` + `last_status` + `last_error`), `listDueMirrors` + `syncAllDue` for the admin trigger.
	522	- `src/routes/mirrors.tsx` (Block I9) — owner-only config at `/:owner/:repo/settings/mirror` (GET form + recent-runs panel, POST save, POST delete, POST sync-now). Site-admin `POST /admin/mirrors/sync-all` iterates due mirrors. All mutations `audit()`-logged.
9ff7128Claude	523	- `src/lib/rulesets.ts` (Block J6) — exports `RULE_TYPES` (6 types), pure `globToRegex`, defensive `parseParams`, pure evaluator `evaluatePush(rulesets, ctx) → {allowed, violations}`. CRUD: `listRulesetsForRepo`, `getRuleset`, `createRuleset`, `updateRulesetEnforcement`, `deleteRuleset`, `addRule`, `deleteRule`. `__internal = { evalRule, globToRegex, parseParams }` for tests. Every rule variant no-ops on malformed params or bad regex rather than throwing.
	524	- `src/routes/rulesets.tsx` (Block J6) — owner-only UI at `/:owner/:repo/settings/rulesets` (list + create), `/:id` (detail + enforcement toggle + add rule), `/:id/delete`, `/:id/rules/:ruleId/delete`. All mutations `audit()`-logged via the existing `gate(c)` owner pattern.
d62fb36Claude	525	- `src/lib/close-keywords.ts` (Block J7) — pure parser. Exports `extractClosingRefs(text)` + `extractClosingRefsMulti(sources[])`. Verbs: close/closes/closed/fix/fixes/fixed/resolve/resolves/resolved. Case-insensitive, word-boundary-respecting, ignores cross-repo `owner/repo#N` refs, rejects non-positive numbers, returns sorted de-duped list. Tolerates `:` / `-` / whitespace between verb and ref.
0cdfd89Claude	526	- `src/lib/commit-statuses.ts` (Block J8) — pure helpers: `isValidSha`, `isValidState`, `sanitiseContext`, `reduceCombined`. DB helpers: `setStatus` (delete-then-insert upsert on `(repo, sha, context)`, SHA lowercased, description/url clamped to 1000/2048 chars), `listStatuses` (newest first), `combinedStatus` (latest per context, reduces to worst state, returns counts + context pills). `STATUS_STATES` exported array. Never throws on clamping; null/empty description returns null.
	527	- `src/routes/commit-statuses.ts` (Block J8) — `POST /api/v1/repos/:owner/:repo/statuses/:sha` (requireAuth — accepts session/OAuth/PAT; owner-only), `GET /api/v1/repos/:owner/:repo/commits/:sha/statuses` (softAuth, private-repo visibility enforced), `GET /api/v1/repos/:owner/:repo/commits/:sha/status` (combined rollup, same visibility rules).
afd651eClaude	528	- `src/routes/api-v2.ts` — Comprehensive REST API v2 (full CRUD across resources). Authoritative integration surface alongside the v1 endpoints in this section.
	529	- `src/routes/api-docs.tsx` — interactive in-app API documentation page.
	530	- `src/routes/collaborators.tsx` — repo collaborator add / list / remove. Owner-or-admin only. Audit-logged. (See §4.3.1.)
	531	- `src/routes/team-collaborators.tsx` — bulk team-to-repo collaborator grant. (See §4.3.1.)
	532	- `src/routes/invites.tsx` — invite acceptance flow. (See §4.3.1.)
	533	- `src/routes/events.ts` — `POST /events/...` inbound deploy-event receiver for Crontech (Signal Bus P1). Idempotent via `processed_events`.
	534	- `src/routes/live-events.ts` — `GET /live-events/:topic` SSE subscription endpoint backed by `src/lib/sse.ts`.
	535	- `src/routes/health-probe.ts` — extended health + metrics probes for load-balancer + observability sinks.
	536	- `src/routes/help.tsx` — public `/help` quickstart + API cheatsheet for owners migrating from GitHub.
	537	- `src/routes/import.tsx` — single-repo GitHub → Gluecron import (PAT-based clone-and-rehost).
	538	- `src/routes/import-bulk.tsx` — `/import/bulk` paste-a-token org-wide migration.
	539	- `src/routes/migrations.tsx` — `/migrations` per-user import history dashboard with re-run-verifier button.
	540	- `src/routes/onboarding.tsx` — guided first-five-minutes flow for new accounts.
	541	- `src/routes/platform-status.ts` — machine-readable platform status JSON.
	542	- `src/routes/seo.ts` — `/robots.txt` + `/sitemap.xml`.
	543	- `src/routes/signing-keys.tsx` — Block J3 UI: `GET/POST /settings/signing-keys` + `POST /settings/signing-keys/:id/delete`. Audit-logged. (Library is `src/lib/signatures.ts`, see §4.6 for the underlying lib.)
	544	- `src/routes/specs.tsx` — Spec-to-PR UI. Paste a plain-English feature spec, get back a draft PR. Calls `src/lib/spec-to-pr.ts`.
	545	- `src/routes/status.tsx` — public `GET /status` HTML dashboard + `/status.svg` shields-style badge.
	546	- `src/routes/workflow-artifacts.ts` — REST API for workflow run artifacts (workflow engine v2 / Sprint 1).
	547	- `src/routes/workflow-secrets.tsx` — per-repo workflow secrets settings UI (list / create / delete encrypted secrets). Backed by `workflow_secrets` table from `drizzle/0037`.
9ab6971Claude	548
	549	### 4.7 Views (locked contracts)
	550	- `src/views/layout.tsx` — `Layout` accepts `title`, `user`, `notificationCount`
3cbe3d6Claude	551	- `src/views/components.tsx` — `RepoHeader`, `RepoNav` (active: `code\|issues\|pulls\|commits\|releases\|actions\|gates\|insights\|explain\|changelog\|semantic`), `RepoCard`, etc.
6fc53bdClaude	552	- `src/views/reactions.tsx` — `ReactionsBar` (no-JS compatible, form-per-emoji)
	553	- Nav links: logo · search · theme-toggle · Explore · Ask · Notifications · New · Profile (or Sign in / Register)
9ab6971Claude	554	- Keyboard chords: `/`, `Cmd+K`, `?`, `n`, `g d`, `g n`, `g e`, `g a`
	555
	556	### 4.8 Tests (locked)
	557	- `src/__tests__/green-ecosystem.test.ts` — secret scanner, codeowners, AI fallback, health, rate-limit headers, `/shortcuts`, `/search`
	558	- All other existing test files — do not delete without owner permission
	559
	560	### 4.9 Invariants (never break these)
	561	- `isAiAvailable()` guard returns true fallback strings when no ANTHROPIC_API_KEY. AI features degrade gracefully.
	562	- `getUnreadCount` never throws; returns 0 on any error.
	563	- Rate-limit middleware adds `X-RateLimit-Limit` + `X-RateLimit-Remaining` to every response, including 500s.
	564	- `c.header("X-Request-Id", ...)` set by request-context on every response.
	565	- Secret scanner skips binary/lock paths (`shouldSkipPath`).
	566	- `SECRET_PATTERNS` is an exported array. Its shape is `{ type, regex, severity }`.
6fc53bdClaude	567	- Theme routes live outside `/settings/*` (they must work for logged-out visitors). Cookie name: `theme`, values: `dark\|light`.
	568	- Draft PRs cannot be merged — `/pulls/:n/merge` returns a redirect with the draft error when `pr.isDraft=true`.
	569	- Reactions API accepts only `ALLOWED_EMOJIS` and `ALLOWED_TARGETS`. Toggle is idempotent per (user, target, emoji).
24cf2caClaude	570	- `sendEmail()` never throws — always resolves to `{ ok, provider, ... }`. Email failures never break notification delivery or the primary request path.
	571	- Email fan-out in `notify()` is scoped to kinds in `EMAIL_ELIGIBLE` (mention / review_requested / assigned / gate_failed). Each eligible kind maps to exactly one user preference column.
	572	- Issue + PR template loading must return `null` on any git-subprocess failure (templates are a convenience, not a requirement). Forms always render.
9ab6971Claude	573
	574	---
	575
	576	## 5. OPERATIONAL NOTES
	577
	578	### 5.1 Running locally
	579	```bash
	580	bun install
	581	bun dev # hot reload
afd651eClaude	582	bun test # 1033 tests currently pass (8 skipped, 0 failed) as of 2026-04-29 — run `bun install` first
9ab6971Claude	583	bun run db:migrate
	584	```
	585
	586	### 5.2 Environment
	587	- `DATABASE_URL` — Neon Postgres
	588	- `ANTHROPIC_API_KEY` — unlocks AI features
	589	- `GIT_REPOS_PATH` — default `./repos`
	590	- `PORT` — default 3000
24cf2caClaude	591	- `EMAIL_PROVIDER` — `log` (default, stderr-only) or `resend`
	592	- `EMAIL_FROM` — sender address for outbound mail
	593	- `RESEND_API_KEY` — required when `EMAIL_PROVIDER=resend`
	594	- `APP_BASE_URL` — canonical URL used to build absolute links in emails
3cbe3d6Claude	595	- `VOYAGE_API_KEY` — optional; when set, D1 semantic search uses Voyage `voyage-code-3` embeddings. Otherwise falls back to a deterministic 512-dim hashing embedder.
9ab6971Claude	596
	597	### 5.3 Models
	598	- `claude-sonnet-4-20250514` — code review, security, chat
	599	- `claude-haiku-4-5-20251001` — commit messages, summaries, light tasks
	600	- Swap via `MODEL_SONNET` / `MODEL_HAIKU` constants in `src/lib/ai-client.ts`
	601
	602	### 5.4 Deployment
	603	- `railway.toml` / `fly.toml` present
	604	- Crontech deploy on green push to default branch (can opt out via `autoDeployEnabled`)
	605
	606	---
	607
	608	## 6. SESSION WORKFLOW (WHAT THE NEXT AGENT DOES)
	609
	610	1. Read this file, `CLAUDE.md`, `README.md`, `git log -1 --stat`.
	611	2. Check `git status` + current branch.
	612	3. Pick the next unfinished block from §3 (lowest letter + number first, unless owner specifies).
	613	4. Create a todo list that mirrors the sub-items of that block.
	614	5. Build. Write tests. Run `bun test`.
	615	6. Commit with `feat(<BLOCK-ID>): ...`.
	616	7. Push.
	617	8. Update this file:
	618	- Move the block's row in §2 to ✅ where applicable.
	619	- Add the block's files to §4 LOCKED BLOCKS.
	620	- Commit + push again.
	621	9. Start the next block. Do not stop to ask.
	622
	623	If a block is too large for a single session, split it into a sub-plan at the top of the session, ship what you can, and document what's left at the end of this file under a `## 7. IN-FLIGHT` section.
	624
	625	---
	626
	627	## 7. IN-FLIGHT
	628
988380aClaude	629	(Intentionally empty. Add here if a block is partially complete at session end.)
	630
afd651eClaude	631	2026-04-29 reconciliation pass (branch `claude/platform-launch-assessment-8dWV8`):
	632
	633	The Bible had drifted behind reality. This session reconciled §2 / §4 / §5 against the actual codebase. All edits below are strictly additive — no locked entry was deleted or renamed.
	634
	635	What was added:
	636	- §2.4 — surfaced previously undocumented AI features now on disk: Spec-to-PR (real AI), repository intelligence engine, time-travel code explorer, dependency impact analyzer, one-click rollback. Clarified that `auto-repair.ts` (gate-time) and `autorepair.ts` (intelligence-time) are two distinct load-bearing modules — do not dedupe.
	637	- §2.5 — surfaced repository collaborators (per-repo roles), single-repo GitHub import, bulk org import, migration history + verifier, onboarding flow, public `/help` quickstart.
	638	- §2.6 — surfaced public status page (`/status` + `/status.svg`), platform-status JSON, error-tracking wiring (`src/lib/observability.ts`), comprehensive REST API v2 (`src/routes/api-v2.ts`), API docs page, SSE pub/sub (`src/lib/sse.ts` + `src/routes/live-events.ts`), inbound deploy event receiver (`src/routes/events.ts`), autopilot ticker, demo seed, SEO routes.
	639	- §4.1 — added migrations 0034–0037 to LOCKED.
	640	- §4.3.1 (new sub-section) — permissions + collaborators surface (`src/middleware/repo-access.ts`, `src/lib/invite-tokens.ts`, three new collaborator routes).
	641	- §4.4 — added intelligence / time-travel / depimpact / rollback / spec-to-PR libs; clarified the `auto-repair` vs `autorepair` distinction; flagged `pr-triage.ts` as a placeholder distinct from the live D3 path.
	642	- §4.5 — added observability, SSE, autopilot, demo-seed, import helpers, namespace, action-registry, and the workflow-engine-v2 family (conditionals / matrix / artifacts / secrets / secrets-crypto).
	643	- §4.6 — added 21 new routes: api-v2, api-docs, collaborators, team-collaborators, invites, events, live-events, health-probe, help, import, import-bulk, migrations, onboarding, platform-status, seo, signing-keys, specs, status, workflow-artifacts, workflow-secrets. Plus a note pointing signing-keys.tsx at the existing `src/lib/signatures.ts`.
	644	- §5.1 — bumped the test-count claim from `601` to the actual current number `1033 pass / 8 skip / 0 fail` (verified with deps installed on this branch).
	645
	646	What was verified, not changed:
	647	- `bun install && bun test` → 1033 pass, 0 fail. Suite is genuinely green.
	648	- `auto-repair.ts` (472 lines, used by `src/lib/gate.ts`) and `autorepair.ts` (328 lines, used by `src/hooks/post-receive.ts`) are not duplicates — they expose disjoint APIs (`repairSecrets` / `repairSecurityIssues` vs `autoRepair`) and are both in active use.
	649	- Workflow engine v2 is strictly additive on top of the locked v1 (`src/lib/workflow-runner.ts`); no v1 file was replaced.
	650
	651	Polish batch shipped earlier:
988380aClaude	652	- `src/lib/autopilot.ts` + tests — 5-min ticker (mirror sync, merge-queue peek, weekly digests, advisory rescans). `AUTOPILOT_DISABLED=1` opt-out. Observability via `getLastTick()` / `getTickCount()`. Admin page at `/admin/autopilot` with "Run tick now" button.
	653	- `src/views/landing.tsx` — marketing landing for logged-out `/`. Accepts optional `stats` prop; `src/routes/web.tsx` queries public repo + user counts.
	654	- `src/lib/demo-seed.ts` + tests — idempotent `ensureDemoContent()` seeds `demo` user + 3 public sample repos + seeded issues/PR. Boot flag `DEMO_SEED_ON_BOOT=1`. Site-admin reseed button on `/admin` (`POST /admin/demo/reseed`). Public `/demo` convenience redirect to `/demo/hello-python`.
	655	- Doc sync: `README.md`, `DEPLOY.md`, `LAUNCH_TODAY.md` aligned with current reality.
ba93444Claude	656
	657	BLK-016 Crontech-Gluecron deploy wire — Gluecron sender rewritten (pending live verification):
	658	- `src/hooks/post-receive.ts triggerCrontechDeploy` now matches the Crontech receiver at `apps/api/src/webhooks/gluecron-push.ts`:
	659	- Endpoint default `POST https://crontech.ai/api/webhooks/gluecron-push` (was `/api/hooks/gluecron/push`).
	660	- Auth model: HMAC-SHA256 of the JSON body in `X-Gluecron-Signature: sha256=<hex>`, signed with `GLUECRON_WEBHOOK_SECRET` (no longer Bearer).
	661	- Payload shape is GitHub-style: `{event, repository:{full_name}, ref, after, before, pusher:{name,email}, commits:[{id,message,timestamp}]}` plus ancillary `sent_at`/`source`. Receiver dedupes on `after`.
	662	- At-least-once delivery: 6 attempts (initial + 5 backoffs at 1s/4s/16s/64s/256s). Stops on first 2xx; bails immediately on unrecoverable 4xx (except 408/429); retries on 5xx + network errors.
	663	- `commits[]` + pusher derived via `commitsBetween(owner, repo, before, after)` from the bare repo (capped at 50, like GitHub). Empty when the git layer can't read the repo.
	664	- `onPostReceive` no longer hardcodes `refs/heads/main` — gated by `${owner}/${repo} === config.crontechRepo` (env `CRONTECH_REPO`, default `ccantynz-alt/crontech`) and the repo's actual default branch via `getDefaultBranch`. Handles `Main` (capital M) without a code change.
	665	- Config additions: `config.crontechRepo` (env `CRONTECH_REPO`); `config.crontechDeployUrl` default flipped; both reflected in `.env.example`.
	666	- Tests: `src/__tests__/crontech-deploy.test.ts` rewritten — 19 tests covering endpoint, HMAC signature, payload shape, branch-case carry-through (`Main`), retry-on-5xx, give-up-after-N, no-retry-on-4xx, retry-on-408/429, retry-on-network-error, default backoff schedule. `triggerCrontechDeploy` now takes a single `args` object and an optional `opts: {fetchImpl, sleep, retryDelaysMs, now}` for injectability.
	667	- Removed dead `fanoutWebhooks` helper (defined-but-uncalled, per audit).
	668	- Live verification (the BLK-016 done-criterion) is out of scope for this session — it requires SSH to the Vultr box, a real test push, and confirming the deploy-agent log + GitHub Actions silence. Do not flip `BLK-016 → ✅ SHIPPED` in the Crontech BUILD_BIBLE without owner authorisation per Crontech CLAUDE.md §0.7.