# Gluecron Status — 2026-07-17

Single current source of truth for "what's actually shipped, what's actually
open, what to read next." Supersedes `ROADMAP.md`, `CHANGELOG.md`, and the
`AUDIT-2026-*.md` chain — those are now redirect stubs pointing here. Update
this file, not those, when state changes.

`BUILD_BIBLE.md` §4 (LOCKED BLOCKS) remains the authoritative owner-sign-off
gate on renaming/altering shipped code — that mechanism isn't moved here.
Its *content* (the actual locked-file list) is last known to be a full
audit pass behind current `main` (see "Known documentation debt" below) —
treat any specific file:line claim in it as unverified until re-audited,
not as settled fact.

## What changed this session (2026-07-16/17)

All items below are merged to `main` and pushed to the canonical remote
(`gluecron.com/ccantynz/Gluecron.com.git`), verified per their own
inline test/build evidence — not just written.

1. **Push-time secret scanning, CODEOWNERS merge enforcement, PR-workflow
   sync wiring, autorepair/branch-protection fixes** — 5-piece hardening
   batch, 29 dedicated tests green.
2. **`agent-journey.ts` self-healing** — orphaned probe-repo cleanup now
   sweeps stale `journey-*` repos at the start of every run, so a killed
   process no longer leaves permanent leftovers.
3. **Repo-settings and account-settings navigation** — `RepoNav` was
   missing its "Settings" tab entirely (type union had it, no `<a>`
   rendered it), orphaning the whole settings tree (mirrors, dep updater,
   webhooks, collaborators, environments, pages, workflow secrets,
   protected tags, rulesets, automation, audit log) behind the Cmd-K
   palette. Fixed, plus two adjacent bugs found during the fix:
   `dep-updater.tsx` was rendering the wrong nav component entirely
   (`IssueNav` instead of `RepoNav`), and the `/settings` index page
   itself had no top nav. Account settings had the identical shape —
   `SettingsSubnav` only listed 4 of 11 pages; extended to cover
   2FA/passkeys/signing-keys/sessions/integrations.
4. **`fireWebhooks()` wired into 19 real call sites** (was 0) — the
   webhook feature was fully built (retry/dead-letter queue, live
   "last delivery" UI) but no push/issue/PR/star event anywhere in the
   codebase ever called it, on either the web routes *or* the 8 MCP
   write tools (`gluecron_create_pr`, `gluecron_merge_pr`, etc., which
   have their own independent implementations). Verified live end-to-end
   against production via `scripts/agent-journey.ts` — a probe webhook
   pointed at `/healthz` now records a real delivery attempt after a
   real MCP-driven PR create + merge.
5. **AI security gate no longer silently reports "clean" on a provider
   error** — `aiSecurityScan()` returned `[]` on any Anthropic API error
   (timeout, rate limit, unparseable response), identical to a genuine
   zero-finding scan; `gate.ts` then reported "No security issues found"
   either way. Added `aiSecurityScanSafe()` distinguishing the two states,
   mirroring the `runGateTestScan` skip-not-silently-pass precedent
   (commit `6930df0`) already established for the GateTest gate.
6. **Dead webhook deliveries now alert the owner** — a delivery that
   exhausts all retries (or is blocked by the SSRF guard) previously only
   logged to `console.error`. Now sends an in-app notification
   (`integration_dead` kind) linking back to the webhook's settings page.

## Production certification (2026-07-17)

1. **Full authenticated `doctor.ts` sweep is ALL GREEN** — ran sections
   a–e in `--full` mode against `https://gluecron.com` with a real admin
   PAT. The sweep found and fixed one real bug in the read-only tool matrix:
   `gluecron_pr_status_summary` was called with only `{owner,repo}`, but it
   summarizes one specific PR and requires a PR number. The doctor now
   resolves a live PR number through `gluecron_list_prs` first and skips
   gracefully when no PR exists.
2. **Full `agent-journey.ts` write-path certification is GREEN with one
   warning** — push, branch, PR, comment, merge, webhook delivery, and
   cleanup all passed against production. No AI-review comment appeared on
   the test PR within 90 seconds; per the script, this means AI review may
   legitimately be disabled or `ANTHROPIC_API_KEY` may be unset. Human
   confirmation is still required (see the top open item below).

## Known open items (not closed this session)

- **TOP PRIORITY — confirm production AI-review configuration** — the
  full write-path certification produced its sole WARN because no AI-review
  comment appeared within 90 seconds. Check `/admin/env-health` or the
  production box's `.env` directly to establish whether AI review is
  intentionally disabled or `ANTHROPIC_API_KEY` is unset. The old, now-
  archived `ROADMAP.md` called out this exact environment variable as a
  blocker back in May; this remains open until a human confirms the live
  configuration.
- **Offsite backup not armed** — daily Neon dump + weekly restore drill
  run fine on the VPS, but dumps only live on the box itself
  (`BACKUP_SCP_TARGET` unset). Gates Cutover Runbook Phase 4.
- **GateTest defaults off for new repos** (migration `0112`) — a
  deliberate, documented decision (commit `6930df0`: "hasn't proven
  reliable enough to be a required-by-default external dependency yet"),
  not a bug. Revisit once a concrete reliability bar is defined and met.
- **Legal pages** (`legal/TERMS.md`, `PRIVACY.md`, `AUP.md`, `DPA.md`)
  drafted but awaiting attorney sign-off; DMCA agent placeholder unfilled.
- **Penetration test** — not started, intentionally on hold pending a
  signed Rules-of-Engagement / authorization document (attorney-gated,
  separate from the legal-pages thread above).

## Known documentation debt

`BUILD_BIBLE.md` claims (as of its last real update, 2026-06-13) that
Blocks A–M are all shipped, including the last month's actual work —
it wasn't touched during that month despite real commits landing. Its
§4 locked-blocks list should be treated as stale evidence, not settled
fact, until someone re-audits it against current `main`. That re-audit
is a bigger job than this pass and is explicitly not done here — flagged,
not fixed.

## Where to look

- **This file** — current state, updated as things ship.
- **`BUILD_BIBLE.md`** — locked-file sign-off gate (mechanism still
  authoritative; content stale, see above) and historical block plan.
- **`scripts/doctor.ts` / `scripts/agent-journey.ts`** — the actual
  live-verification tools. Run them against `https://gluecron.com` with
  a fresh `GLUECRON_PAT` (from `/settings/tokens`) rather than trusting
  any document's claim about production behavior.