1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
@@ -56,8 +56,32 @@ inline test/build evidence — not just written.
logged to `console.error`. Now sends an in-app notification
(`integration_dead` kind) linking back to the webhook's settings page.
+## Production certification (2026-07-17)
+
+1. **Full authenticated `doctor.ts` sweep is ALL GREEN** — ran sections
+ a–e in `--full` mode against `https://gluecron.com` with a real admin
+ PAT. The sweep found and fixed one real bug in the read-only tool matrix:
+ `gluecron_pr_status_summary` was called with only `{owner,repo}`, but it
+ summarizes one specific PR and requires a PR number. The doctor now
+ resolves a live PR number through `gluecron_list_prs` first and skips
+ gracefully when no PR exists.
+2. **Full `agent-journey.ts` write-path certification is GREEN with one
+ warning** — push, branch, PR, comment, merge, webhook delivery, and
+ cleanup all passed against production. No AI-review comment appeared on
+ the test PR within 90 seconds; per the script, this means AI review may
+ legitimately be disabled or `ANTHROPIC_API_KEY` may be unset. Human
+ confirmation is still required (see the top open item below).
+
## Known open items (not closed this session)
+- **TOP PRIORITY — confirm production AI-review configuration** — the
+ full write-path certification produced its sole WARN because no AI-review
+ comment appeared within 90 seconds. Check `/admin/env-health` or the
+ production box's `.env` directly to establish whether AI review is
+ intentionally disabled or `ANTHROPIC_API_KEY` is unset. The old, now-
+ archived `ROADMAP.md` called out this exact environment variable as a
+ blocker back in May; this remains open until a human confirms the live
+ configuration.
- **Offsite backup not armed** — daily Neon dump + weekly restore drill
run fine on the VPS, but dumps only live on the box itself
(`BACKUP_SCP_TARGET` unset). Gates Cutover Runbook Phase 4.
@@ -70,10 +94,6 @@ inline test/build evidence — not just written.
- **Penetration test** — not started, intentionally on hold pending a
signed Rules-of-Engagement / authorization document (attorney-gated,
separate from the legal-pages thread above).
-- **Authenticated `doctor.ts` sections (d/e) and the full PAT-gated
- agent-journey matrix** — only ever run against anonymous endpoints
- plus the one PAT-driven journey run this session; a systematic
- authenticated sweep hasn't happened.
## Known documentation debt
@@ -213,7 +213,20 @@ async function sectionMatrix(): Promise<Row[]> {
if (!PAT) return [skip("read-only tool matrix", "GLUECRON_PAT not set")];
const out: Row[] = [];
for (const [tool, args] of Object.entries(READ_MATRIX)) {
- const [res, ms] = await timed(() => mcpCall(tool, args, PAT));
+ let probeArgs = args;
+ if (tool === "gluecron_pr_status_summary") {
+ const prsRes = await mcpCall("gluecron_list_prs", { owner: "ccantynz", repo: "Gluecron.com", state: "all" }, PAT);
+ const textPart = (prsRes.json?.result?.content ?? []).find((p: any) => p.type === "text")?.text;
+ let listed: any;
+ try { listed = JSON.parse(textPart); } catch { listed = textPart; }
+ const number = listed?.prs?.[0]?.number;
+ if (typeof number !== "number") {
+ out.push(skip(`matrix ${tool}`, "no PRs to summarize"));
+ continue;
+ }
+ probeArgs = { owner: "ccantynz", repo: "Gluecron.com", number };
+ }
+ const [res, ms] = await timed(() => mcpCall(tool, probeArgs, PAT));
const ok = res.status
out.push(row(`matrix ${tool}`, ok, { status: res.status, durationMs: ms, error: ok ? undefined : JSON.stringify(res.json?.error ?? res.json?.result)?.slice(0, 140) }));
} |