CodeIssuesDiscussionsWikiPull RequestsProjectsCommitsActionsReleasesContributorsPulse● GatesSecuritySettingsDeploymentsPipelineInsightsAgents✨ Explain✨ Ask AI✨ Workspace✨ Spec✨ Tests▓ Debt Map✨ NL Search🏛 Archaeology
Blame · Line-by-line history
SITE_AUDIT.md
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 14c3cc8 | 1 | # Gluecron site audit — 2026-04-21 |
| 2 | ||
| 3 | Snapshot: what's shipped, what's stubbed, what's left to finish before and just after launch. | |
| 4 | ||
| 5 | ## TL;DR | |
| 6 | ||
| 7 | - **Readiness: ~90%.** Platform is feature-complete vs the BUILD_BIBLE §2 GitHub parity scorecard. The remaining work is operational (monitoring pipes, alerting) and commercial (Stripe, DPA), not functional. | |
| 8 | - **Top 3 launch blockers:** (1) actually run `flyctl deploy` — code is ready, infra hasn't been provisioned; (2) `LAUNCH_TODAY.md` is badly outdated — 3 items listed as ❌/🟡 are already shipped; (3) no error-tracking sink is configured — `src/lib/observability.ts` is wired but `ERROR_WEBHOOK_URL` / `SENTRY_DSN` need real values. | |
| 9 | - **Most surprising finding:** only **3 TODO/FIXME/HACK markers** in `src/**/*.{ts,tsx}` across 86 route files + 68 test files. The codebase is remarkably clean. | |
| 10 | ||
| 11 | ## Codebase size | |
| 12 | - 86 files in `src/routes/` | |
| 13 | - 68 files in `src/__tests__/` | |
| 14 | - 3 TODO/FIXME/HACK markers total: `src/__tests__/signatures.test.ts:1`, `src/lib/intelligence.ts:1`, `src/lib/ai-tests.ts:1`. None are blockers. | |
| 15 | ||
| 16 | ## LAUNCH_TODAY.md drift | |
| 17 | ||
| 18 | The pre-launch checklist has not been maintained. These items are listed as ❌/🟡 but are actually **shipped**: | |
| 19 | ||
| 20 | | Item as listed | Actual state | Evidence | | |
| 21 | |---|---|---| | |
| 22 | | `🟡 Demo org / sample repos — Design sketch exists; no code yet` | ✅ Shipped | `src/lib/demo-seed.ts` (commit `988380a`) + `DEMO_SEED_ON_BOOT=1` wired in `src/index.ts` | | |
| 23 | | `❌ Error-tracking (Sentry) wiring` | ✅ Shipped (today) | `src/lib/observability.ts` with `ERROR_WEBHOOK_URL` + `SENTRY_DSN` support, wired into `app.onError` | | |
| 24 | | `❌ Launch announcement draft` | ✅ Shipped (today) | `docs/LAUNCH_ANNOUNCEMENT.md` — Show HN + tweet thread + LinkedIn + demo shot list + press kit | | |
| 25 | | `❌ Status page public` | ✅ Shipped | `/status` HTML page + `/status.svg` shields badge (commit `2316be6` + `9b07ca9`) | | |
| 26 | ||
| 27 | Genuinely outstanding: | |
| 28 | - 🟡 `/metrics` → Prometheus/Grafana/Datadog pipe | |
| 29 | - 🟡 Monitoring + on-call rotation (alerting rules) | |
| 30 | - 🟡 Backup restore drill (never rehearsed) | |
| 31 | - 🟡 Legal audit review (`docs/legal-audit.md`) | |
| 32 | - ❌ Changelog / release-notes cadence | |
| 33 | - ❌ DPA template for enterprise SSO customers | |
| 34 | ||
| 35 | ## What's locked and untouched | |
| 36 | ||
| 37 | Per BUILD_BIBLE §4, the locked files are primarily `src/views/layout.tsx`. Spot check of recent commits shows no unauthorized edits — locked files have not been touched in the last 7 commits on this branch. | |
| 38 | ||
| 39 | ## Cross-contamination sweep | |
| 40 | ||
| 41 | Post-`90fa787` decouple, remaining Crontech references in user-visible surfaces are: | |
| 42 | - `.env.example`: `CRONTECH_DEPLOY_URL` as optional outbound webhook (allowed — it's a generic third-party webhook name) | |
| 43 | - `README.md`, `DEPLOY.md`, `CLAUDE.md`: one mention each of `CRONTECH_DEPLOY_URL` as optional env var (allowed) | |
| 44 | ||
| 45 | No "green ecosystem", "self-hosting triangle", or cross-product pitching in user-visible UI. Internal function names like `triggerCrontechDeploy` remain (server-only, not user-facing). | |
| 46 | ||
| 47 | ## Integration hygiene | |
| 48 | ||
| 49 | All third-party integrations gracefully degrade when env vars are missing — confirmed in DEPLOY.md §7. Specifically: | |
| 50 | - `DATABASE_URL` — hard required (only real blocker) | |
| 51 | - `ANTHROPIC_API_KEY` — missing → all AI features return deterministic fallback strings | |
| 52 | - `GATETEST_API_KEY` — missing → outbound gate silently skipped | |
| 53 | - `RESEND_API_KEY` — missing → emails logged instead of sent | |
| 54 | - `VOYAGE_API_KEY` — missing → hashing embedder fallback | |
| 55 | - `ERROR_WEBHOOK_URL` / `SENTRY_DSN` — missing → errors still logged to stderr | |
| 56 | - `CRONTECH_DEPLOY_URL` — default points at `crontech.ai`; if 401, treated as failed deploy (fine) | |
| 57 | - `DEMO_SEED_ON_BOOT` — opt-in | |
| 58 | ||
| 59 | ## Test posture | |
| 60 | ||
| 61 | Baseline: **140 pass / ~54 fail / 63 test files** (fail count is entirely sandbox `hono/jsx/jsx-dev-runtime` module-resolution errors in this environment — not real regressions; confirmed by running stashed-HEAD comparisons in prior sessions). | |
| 62 | ||
| 63 | Spot-check coverage gaps (big features without a dedicated test file): | |
| 64 | - Merge queue (`src/routes/merge-queue.ts`) — logic exists, no `__tests__/merge-queue.test.ts` | |
| 65 | - Wikis (`src/routes/wikis.ts`) — no dedicated test | |
| 66 | - Packages API (`src/routes/packages-api.ts`) — no dedicated test | |
| 67 | - Marketplace + bot identities — no dedicated test | |
| 68 | ||
| 69 | None are launch-blocking. Coverage is good enough for v1. | |
| 70 | ||
| 71 | ## New features this sprint (post-audit snapshot) | |
| 72 | ||
| 73 | In-flight this session, not yet committed: | |
| 74 | - `/import/bulk` — paste GitHub org + token, migrate multiple repos at once | |
| 75 | - `/migrations` — per-user migration history + verify button | |
| 76 | - `src/lib/import-verify.ts` — smoke-verifies imported repos are clonable | |
| 77 | - `/:owner/:repo/spec` + `src/lib/spec-to-pr.ts` — experimental spec-to-PR UI (backend is v1 stub; returns "experimental" message pending full AI integration) | |
| 78 | ||
| 79 | ## Launch blocker punch list (prioritized) | |
| 80 | ||
| 81 | 1. **Run `flyctl deploy`** — 10 min. Blocks everything else. | |
| 82 | 2. **Refresh LAUNCH_TODAY.md** — 5 min. Strike through shipped items so the next reader knows where we actually are. | |
| 83 | 3. **Set `ERROR_WEBHOOK_URL` or `SENTRY_DSN` as a Fly secret** — 5 min. Without this, production errors go to stderr only. | |
| 84 | 4. **First admin bootstrap** — 2 min. Register the intended admin account first (oldest user becomes site admin automatically). | |
| 85 | 5. **Smoke: `/healthz`, `/readyz`, `/status`, clone, push, AI review** — 15 min manual run-through post-deploy. | |
| 86 | 6. **Set up changelog cadence** — pick a cadence (weekly? on every launch?) and put the first entry live. | |
| 87 | 7. **DPA template** — boilerplate for enterprise SSO customers. 1-2 hours with a legal template. | |
| 88 | 8. **Finish spec-to-PR full integration** — v1 stub ships now; real AI integration is a 3-4 hour follow-up sprint. | |
| 89 | 9. **Backup restore drill** — verify the `/data/repos` filesystem snapshot can actually be restored. | |
| 90 | 10. **Alerting rules on `/metrics` + `/healthz`** — Fly + external pager (PagerDuty / OpsGenie). | |
| 91 | ||
| 92 | Items 1-5 are the true launch gate. 6-10 are first-week operational work. |