Blame · Line-by-line history

`AUDIT-2026-07-09.md`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

AUDIT-2026-07-09.mdBlame119 lines · 1 contributor

Normal view Raw

e64c368ccanty labs	1	# Gluecron Audit & Work Log — 2026-07-09
	2
	3	Verified against code and the live site, not the older markdown docs
	4	(several of which were stale — noted inline). Supersedes the 2026-07-07 audit
	5	where they disagree.
	6
	7	## TL;DR
	8
	9	- Last week's deploy did ship: gluecron.com runs current `main` (light
	10	landing, login with password form + lockout throttle, the 07-07 security
	11	fixes). The "still looks like the old site" feeling is the **logged-in app
	12	shell, not the landing — and it was mostly a stale `theme=dark` cookie**
	13	plus indigo buttons / dark-only code highlighting. Fixed (see Design).
	14	- Biggest strategic gap remains: CI does not run on push.
	15	- New priority this session: cut the GitHub mirror, go fully self-sufficient.
	16	Architecture was ready; the durability gap (no offsite repo backup) is now
	17	closed in code and sequenced in a runbook.
	18
	19	## What shipped this session (local commits on `main`, not yet deployed)
	20
	21	Push to `main`/deploy is pending owner authorization + a `GLUECRON_PAT`
	22	(the auto-classifier blocked the push; deploy needs the canonical remote).
	23
	24	\| Area \| Commits \| Summary \|
	25	\|---\|---\|---\|
	26	\| Self-sufficiency \| offsite backup, LF attr, bootstrap, docs, runbook \| See Track C below \|
	27	\| Security \| api-v2 IDOR/leak, GitHub OAuth takeover \| 2 of 3 open HIGHs fixed \|
	28	\| Design \| QI light foundation \| tokens + ink buttons + light code highlighting + theme default \|
	29	\| Docs \| MCP `.mcp.json` fix \| docs.tsx + connect.tsx corrected \|
	30
	31	## Track C — Self-sufficiency (GitHub mirror removal)
	32
	33	Findings: no automatic self-mirror to GitHub exists (safe to cut); the
	34	`post-receive.ts` → `self-deploy.sh` pipeline (health-check + auto-rollback) is
	35	fully built and GitHub-independent in steady state. Two gaps handled:
	36
	37	- Durability (the real risk): bare git repos under `GIT_REPOS_PATH` had
	38	no off-box copy — GitHub was the de-facto backup. Added
	39	`scripts/backup-offsite.sh` (tar repos + `pg_dump` Neon → rclone, fail-loud,
	40	retention, dead-man's-switch) and `scripts/restore.sh` (DR restore, never
	41	clobbers prod by default). `.gitattributes` forces LF so the scripts run on Linux.
	42	- Bootstrap tie: fresh-host bootstrap seeded from GitHub. `DEFAULT_SOURCE`
	43	is now empty (`self-bootstrap.ts`, `self-host-bootstrap.ts`, `index.ts`);
	44	a fresh host re-seeds from a restored backup, not GitHub.
	45	- Docs/marketing: `CLAUDE.md` + `SELF_HOST.md` now declare Gluecron
	46	self-canonical; corrected the false "two-way GitHub mirror" product claim.
	47	- Runbook: `docs/CUTOVER_RUNBOOK.md` — owner-executed, backup-first, then
	48	freeze GitHub → 7 green days → delete in 30. Decision: offsite rclone
	49	backup, freeze-then-delete GitHub, owner runs the VPS steps.
	50
	51	The one fact I can't verify off-box (in the runbook): the VPS `/opt/gluecron`
	52	working-tree `origin` must point at the local bare repo, not GitHub.
	53
	54	## Track A — Verification results
	55
	56	Test suite: 2910 pass / 122 skip / 23 fail (pre-existing). Triage:
	57	9 stale skills-bundle assertions, 3 "2030 reboot" landing-hero (DB-mock
	58	`innerJoin` unsupported), 1 stale login-shell assertion (signin-v2 redesign),
	59	several playground/env tests needing `DATABASE_URL`, and 1 real minor bug:
	60	`GET /:owner/:repo/wiki` on a missing repo returns 200 instead of 404
	61	(`wikis.test.ts`). None are regressions; none block this work.
	62
	63	Security re-verification (the 5 still-open 07-07 HIGHs):
	64
	65	\| # \| Finding \| Verdict \| Action \|
	66	\|---\|---\|---\|---\|
	67	\| 1 \| git-grep arg injection \| FIXED (array argv) \| none \|
	68	\| 2 \| X-Forwarded-For spoofing (`rate-limit.ts:89`) \| OPEN \| follow-up (infra-dependent trusted-proxy config) \|
	69	\| 3 \| GitHub OAuth unverified-email takeover \| FIXED this session \| `sso.ts` + `github-oauth.tsx` verified-email gate \|
	70	\| 4 \| SSRF DNS-rebinding \| FIXED (`assertPublicUrl` in webhook+mirror) \| none \|
	71	\| 5 \| api-v2 workflow-dispatch IDOR \| FIXED this session \| write-access gate; also closed an unauth private-repo runs-list leak \|
	72
	73	Broader follow-up: the api-v2 write surface (issues/PR/label/topic/webhook
	74	POSTs under `requireScope("repo")`) needs a per-endpoint authorization audit —
	75	access level varies, so no blanket rule.
	76
	77	MCP: 60 real tools (15 `mcp-tools.ts` + 45 `mcp-tools-expanded.ts`),
	78	`.mcp.json` correct. Fixed `/docs/mcp-server` + `/connect` teaching the wrong
	79	config file. Live 60-tool matrix needs a running instance + PAT (deferred).
	80
	81	Onboarding: all landing "Migrate from GitHub" CTAs point to `/import`
	82	(`import.tsx`) — that's the blessed flow; the other 4 route files are
	83	secondary/overlapping. Live import test needs creds (deferred to runbook).
	84
	85	OAuth login (owner-reported broken): not a bug — Google/GitHub OAuth was
	86	never configured (`getGoogleOauthConfig` reads an empty `sso_config`). Fix:
	87	owner sets client id/secret at `/admin/google-oauth` + `/admin/github-oauth`;
	88	and the login page should hide unconfigured providers instead of erroring
	89	(small follow-up). GitHub login is now safe to enable after the #3 fix.
	90
	91	## Track B — Design (Quiet Intelligence)
	92
	93	Root cause corrected: the app is already light-by-default at runtime; the
	94	"old dark site" was a stale `theme=dark` cookie + a `readTheme()` dark default
	95	(fixed). Shipped B0–B2: QI light tokens (page `#fcfcfd`, ink `#16181d`, ink
	96	primary buttons, green `#1e7f5c`, amber `#b45309`), a light syntax-highlighting
	97	palette (code blocks were dark-only on light pages), theme-color meta — all
	98	scoped to `:root[data-theme='light']` so the locked dark-theme tests stay green.
	99
	100	Remaining (next session): B3 shell chrome + shared `.qi-*` utilities; B4
	101	high-traffic view conversions (dashboard → RepoHeader/RepoNav → repo page → PR
	102	→ issues → auth); B5 long-tail hex sweep (717 `#5b6ee8` + 24 `#58a6ff`) + emails
	103	+ pwa manifest; B6 a hex-count ratchet test. Then a Playwright screenshot sweep.
	104
	105	## Strategic answer — "the platform for the next decade?"
	106
	107	The AI-native/MCP layer is genuinely differentiated (60 MCP tools, agent
	108	sessions, ship-spec — a shape GitHub doesn't have). Four table-stakes gaps keep
	109	it at "impressive demo" rather than "platform you'd bet a company on":
	110
	111	1. CI doesn't run on push — every GitHub refugee notices day one.
	112	2. CI runner has no real sandbox (env-allowlist only; gVisor/Firecracker/
	113	nsjail still TODO).
	114	3. "Verified" commit badge does no real crypto verification.
	115	4. Org/team permissions aren't enforced for repo access.
	116
	117	Next-decade bet: double down on the AI layer while closing those four, and —
	118	now — nail self-sufficiency + durable backups so it can be trusted to run on
	119	its own. The self-sufficiency work this session is the first plank of that.