Commitafd651eunknown_key

docs(bible): reconcile against codebase (migrations 0034-0037, +25 modules)

docs(bible): reconcile against codebase (migrations 0034-0037, +25 modules)

The Bible had drifted behind the actual codebase. This pass is strictly
additive — no locked entry was deleted or renamed.

§2 scorecard — surfaced previously undocumented features:
- AI: Spec-to-PR (real AI), repository intelligence engine, time-travel
  code explorer, dependency impact analyzer, one-click rollback. Clarified
  that auto-repair.ts (gate-time) and autorepair.ts (intelligence-time)
  are two distinct load-bearing modules — do not dedupe.
- Platform: repository collaborators (per-repo roles), single-repo +
  bulk org GitHub import, migration history + verifier, onboarding flow,
  /help quickstart.
- Observability: /status page + /status.svg badge, platform-status JSON,
  error-tracking wiring, REST API v2, API docs page, SSE pub/sub +
  /live-events/:topic, inbound deploy event receiver, autopilot, demo
  seed, SEO routes.

§4 LOCKED — added:
- Migrations 0034 (processed_events), 0035 (repo_collaborators),
  0036 (invite_token_hash), 0037 (workflow_engine_v2).
- New §4.3.1 Permissions + collaborators surface (middleware/repo-access,
  invite-tokens, three new collaborator routes).
- AI layer: intelligence, timetravel, depimpact, rollback, spec-to-PR
  family. Flagged pr-triage.ts as a placeholder (D3 lives in
  ai-generators.ts).
- Platform libs: observability, sse, sse-client, autopilot, demo-seed,
  import-helper, import-verify, namespace, action-registry, workflow
  engine v2 family (conditionals/matrix/artifacts/secrets/secrets-crypto).
- 21 new routes covering api-v2, api-docs, collaborators flows, events,
  live-events, health-probe, help, import family, migrations, onboarding,
  platform-status, seo, signing-keys, specs, status, workflow-artifacts,
  workflow-secrets.

§5.1 — bumped test-count claim from 601 → actual 1033 pass / 8 skip /
0 fail. Verified locally with deps installed on this branch.

https://claude.ai/code/session_0163vJChUuZqqtBBznUW6xBU

Claude committed on April 29, 2026Parent: 059c2cb

1 file changed+95−3afd651e70b3a6548d72c1470f63a569d2ae99a9a

1 changed file+95−3

ModifiedBUILD_BIBLE.md+95−3View fileUnified Split

@@ -137,6 +137,12 @@ Legend: ✅ shipped · 🟡 partial · ❌ not built

137137| Code scanning UI | ✅ | I5 — `src/routes/code-scanning.tsx`, `GET /:owner/:repo/security`. Aggregates last-100 `gate_runs` matching `%scan%`/`%security%`, rolls up latest status per gate, shows failed/repaired/total cards + scanner status list + recent runs. |

138138| Copilot code completion | ✅ | D9 — `POST /api/copilot/completions` (PAT/OAuth/session), `GET /api/copilot/ping`. `src/lib/ai-completion.ts`, `src/routes/copilot.ts`. LRU-cached, rate-limited 60/min. |

139139| Semantic code search | ✅ | D1 — see 2.2 |

140| Spec-to-PR (NL feature spec → draft PR) | ✅ | `src/routes/specs.tsx` UI, `src/lib/spec-to-pr.ts` orchestrator, `src/lib/spec-ai.ts` Claude call + parser, `src/lib/spec-context.ts` repo context reader, `src/lib/spec-git.ts` plumbing-only branch writer. Graceful fallback when `ANTHROPIC_API_KEY` is unset. |

141| Repository intelligence engine | ✅ | `src/lib/intelligence.ts` — repo-level summarisation + signals. |

142| Time-travel code explorer | ✅ | `src/lib/timetravel.ts` — historical snapshot navigation. |

143| Dependency impact analyzer | ✅ | `src/lib/depimpact.ts` — "what breaks if I bump X" cross-reference. |

144| One-click rollback | ✅ | `src/lib/rollback.ts` — fast revert helper for failed deploys. |

145| Auto-repair (intelligence path) | ✅ | `src/lib/autorepair.ts` `autoRepair(...)` — invoked from `src/hooks/post-receive.ts`. Distinct from `src/lib/auto-repair.ts` `repairSecrets`/`repairSecurityIssues` (gate-time). Both are load-bearing — do not dedupe without owner approval. |

140146

141147### 2.5 Platform

142148| Feature | Status | Notes |

@@ -169,7 +175,16 @@ Legend: ✅ shipped · 🟡 partial · ❌ not built

169175|---|---|---|

170176| Rate limiting | ✅ | `src/middleware/rate-limit.ts` |

171177| Request-ID tracing | ✅ | `src/middleware/request-context.ts` |

172| Health / readiness / metrics | ✅ | `/healthz` `/readyz` `/metrics` |

178| Health / readiness / metrics | ✅ | `/healthz` `/readyz` `/metrics`. Extended probe surface in `src/routes/health-probe.ts`; public dashboard `src/routes/status.tsx` (`GET /status` + `/status.svg` shields badge). |

179| Public platform status JSON | ✅ | `src/routes/platform-status.ts` — machine-readable status JSON. |

180| Error tracking | ✅ | `src/lib/observability.ts` — wired into `app.onError`. Sinks: `ERROR_WEBHOOK_URL` and/or `SENTRY_DSN`. Never throws. |

181| Comprehensive REST API v2 | ✅ | `src/routes/api-v2.ts` — full CRUD across resources. Authoritative integration surface alongside the v1 `/api/*` endpoints in §4.6. |

182| API documentation page | ✅ | `src/routes/api-docs.tsx` — interactive in-app docs. |

183| SSE in-process pub/sub | ✅ | `src/lib/sse.ts` + `src/lib/sse-client.ts` — topic-based broadcaster. `src/routes/live-events.ts` exposes `GET /live-events/:topic`. Used by the live UI updates layer. |

184| Inbound deploy event receiver (Signal Bus P1) | ✅ | `src/routes/events.ts` — Crontech → Gluecron event ingest. Idempotent via `drizzle/0034_processed_events.sql` (sha256 of payload deduped at write-site). |

185| Autopilot ticker | ✅ | `src/lib/autopilot.ts` — 5-min cycle: mirror sync, merge-queue peek, weekly digests, advisory rescans. `AUTOPILOT_DISABLED=1` opt-out. Admin page `/admin/autopilot`. |

186| Demo seed | ✅ | `src/lib/demo-seed.ts` — idempotent `ensureDemoContent()`. `DEMO_SEED_ON_BOOT=1` boot flag. Site-admin reseed at `/admin` (`POST /admin/demo/reseed`). `/demo` redirect to a sample repo. |

187| SEO (robots + sitemap) | ✅ | `src/routes/seo.ts` — `/robots.txt` + `/sitemap.xml`. |

173188| Audit log (table) | ✅ | `audit_log` table |

174189| Audit log UI | ✅ | `/settings/audit` (personal) + `/:owner/:repo/settings/audit` (per-repo, owner-only) |

175190| Traffic analytics per repo | ✅ | F1 — `src/lib/traffic.ts` + `src/routes/traffic.tsx`, `drizzle/0020_analytics_and_admin.sql`; owner-only 7/14/30/90d windows, ascii-bar daily chart. SHA-256-truncated IP for unique visitors. Fire-and-forget wiring in `web.tsx` + `git.ts`. |

@@ -183,6 +198,12 @@ Legend: ✅ shipped · 🟡 partial · ❌ not built

183198| Official CLI | ✅ | G3 — `cli/gluecron.ts` Bun-compilable single binary. REST + GraphQL client, `~/.gluecron/config.json` 0600. |

184199| VS Code extension | ✅ | G4 — `vscode-extension/` with commands for explain / open-on-web / semantic search / generate tests. |

185200| Native mobile apps | ❌ | |

201| Repository collaborators (per-repo roles) | ✅ | `drizzle/0035_repo_collaborators.sql` (read/write/admin, hierarchical) + `drizzle/0036_invite_token_hash.sql` (sha256 invite tokens). `src/routes/collaborators.tsx`, `src/routes/team-collaborators.tsx`, `src/routes/invites.tsx`, `src/lib/invite-tokens.ts`. Wired through `src/middleware/repo-access.ts` permission middleware. |

202| GitHub import (single repo) | ✅ | `src/routes/import.tsx` + `src/lib/import-helper.ts`. PAT-based clone-and-rehost. |

203| Bulk GitHub import (org migration) | ✅ | `src/routes/import-bulk.tsx` — paste a token, mirror an entire org in one pass. |

204| Migration history + verifier | ✅ | `src/routes/migrations.tsx` per-user history dashboard, `src/lib/import-verify.ts` post-migration smoke check (object count, branches, default branch). |

205| Onboarding flow | ✅ | `src/routes/onboarding.tsx` — guided first-five-minutes for new accounts. |

206| Public help / quickstart | ✅ | `src/routes/help.tsx` — owner-facing migration cheatsheet at `/help`. |

186207| Dark mode | ✅ | default |

187208| Light-mode toggle | ✅ | `/theme/toggle` + `theme` cookie, pre-paint script avoids FOUC, nav sun/moon icon |

188209| Keyboard shortcuts | ✅ | `/shortcuts` page |

@@ -341,6 +362,10 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

341362- `drizzle/0031_user_follows.sql` (Block J4) — migration, never edited in place. Adds `user_follows` (composite PK on `(follower_id, following_id)`, CHECK no-self-follow, reverse index on `following_id`).

342363- `drizzle/0032_repo_rulesets.sql` (Block J6) — migration, never edited in place. Adds `repo_rulesets` (unique on `(repository_id, name)`, enforcement enum) + `ruleset_rules` (JSON params).

343364- `drizzle/0033_commit_statuses.sql` (Block J8) — migration, never edited in place. Adds `commit_statuses` (unique on `(repository_id, commit_sha, context)`, state vocabulary pending/success/failure/error).

365- `drizzle/0034_processed_events.sql` (Signal Bus P1) — migration, never edited in place. Idempotency table for inbound deploy events; sha256-keyed dedupe of at-least-once delivery from Crontech.

366- `drizzle/0035_repo_collaborators.sql` — migration, never edited in place. Adds `repo_collaborators` (unique on `(repository_id, user_id)`, role enum read/write/admin, `invited_by` nullable, `accepted_at` nullable).

367- `drizzle/0036_invite_token_hash.sql` — migration, never edited in place. Adds `invite_token_hash` column (sha256 of plaintext) to `repo_collaborators` for email-flow invites; NULL on legacy auto-accepted rows.

368- `drizzle/0037_workflow_engine_v2.sql` — migration, never edited in place. Strictly additive to Block C1 (`drizzle/0008_workflows.sql` stays locked). Adds `workflow_secrets` (AES-256-GCM, `(repo, name)` unique), `workflow_dispatch_inputs` (per-workflow input schema), `workflow_run_cache` (content-addressable cache, repo/branch/tag scoped), `workflow_runner_pool` (warm-runner registry).

344369

345370### 4.2 Git layer (locked)

346371- `src/git/repository.ts` — tree / blob / commits / diff / branches / blame / search / raw / tags / commitsBetween

@@ -363,6 +388,13 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

363388- `src/lib/pages.ts` (Block C3) — `onPagesPush` (never throws), `resolvePagesPath` (probe list including pretty URLs + traversal strip), `contentTypeFor` (MIME).

364389- `src/lib/environments.ts` (Block C4) — `matchGlob`, `listEnvironments`, `getOrCreateEnvironment`, `getEnvironmentByName`, `isReviewer`, `reviewerIdsOf`, `allowedBranchesOf`, `computeApprovalState`, `reduceApprovalState`, `recordApproval`, `requiresApprovalFor`. Empty reviewers list → repo owner approves. Any rejection hard-stops.

365390

391### 4.3.1 Permissions + collaborators (locked)

392- `src/middleware/repo-access.ts` — centralised permission check applied to all repo-write routes. Resolves owner / collaborator-role / org-team-role and rejects unauthorised mutations.

393- `src/lib/invite-tokens.ts` — opaque single-use invite secret generator + sha256 hasher. Hash stored in `repo_collaborators.invite_token_hash`; plaintext is delivered once via the invite email link.

394- `src/routes/collaborators.tsx` — per-repo collaborator add/list/remove. Owner-or-admin only. Audit-logged.

395- `src/routes/team-collaborators.tsx` — bulk-grant: invite every accepted member of a given team to a repo as a collaborator in one action.

396- `src/routes/invites.tsx` — invite acceptance landing page. Verifies token hash, sets `accepted_at`, redirects to repo.

397

366398### 4.4 AI layer (locked)

367399- `src/lib/ai-client.ts` — Anthropic client + model constants

368400- `src/lib/ai-generators.ts` — commit / PR / changelog / issue-triage / **pull-request-triage (D3)**

@@ -377,6 +409,13 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

377409- `src/lib/ai-incident.ts` (Block D4) — `onDeployFailure({deploymentId, reason, logs?})` and pure helper `summariseCommitsForIncident(commits)`. Sonnet 4 structured JSON RCA → opens `issues` row, attaches `incident` label if present, sets `deployments.blockedReason`. Never throws; deterministic fallback body when no API key. Wired from `post-receive.ts triggerCrontechDeploy` + `deployments.tsx retry-incident`.

378410- `src/lib/ai-tests.ts` (Block D8) — pure helpers `detectLanguage`, `detectTestFramework`, `buildTestsPrompt`, `suggestedTestPath`, `generateTestStub`, `contentTypeFor`. Returns `{code:"", framework:"fallback"}` on no API key. Never throws.

379411- `src/lib/branch-protection.ts` (Block D5) — `matchProtection(repoId, branch)` (exact wins; deterministic glob sort), `evaluateProtection(rule, ctx)` (pure — checks `requireAiApproval | requireGreenGates | requireHumanReview | requiredApprovals`), `countHumanApprovals(prId)` (LGTM/+1/approved heuristic). Never throws. Enforcement is in `src/routes/pulls.tsx` merge handler, after existing hard-gate filter.

412- `src/lib/intelligence.ts` — repository intelligence engine (repo-level summarisation + signals).

413- `src/lib/timetravel.ts` — time-travel code explorer (historical snapshot navigation).

414- `src/lib/depimpact.ts` — dependency impact analyzer (cross-reference of who breaks if X bumps).

415- `src/lib/rollback.ts` — one-click rollback helper for failed deploys.

416- `src/lib/spec-to-pr.ts` + `src/lib/spec-ai.ts` + `src/lib/spec-context.ts` + `src/lib/spec-git.ts` — Spec-to-PR v2 pipeline (NL feature spec → Claude → branch via git plumbing → PR row). Graceful fallback when no `ANTHROPIC_API_KEY`.

417- `src/lib/autorepair.ts` — `autoRepair(...)` invoked from `src/hooks/post-receive.ts` and exercised by `src/__tests__/intelligence.test.ts`. **Distinct from `src/lib/auto-repair.ts`** (gate-time `repairSecrets`/`repairSecurityIssues` used by `src/lib/gate.ts`). Both are load-bearing — do not dedupe.

418- `src/lib/pr-triage.ts` — placeholder for a future post-create PR-triage hook (logs only, no AI call). Distinct from `triagePullRequest` in `src/lib/ai-generators.ts` which is the live D3 path.

380419

381420### 4.5 Platform (locked)

382421- `src/lib/notify.ts` — notification creation + audit log (swallow-failures pattern). Also fans out email to opted-in recipients for `mention|review_requested|assigned|gate_failed`. Exports `__internal` for tests.

@@ -387,6 +426,19 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

387426- `src/lib/gate.ts` — gate orchestration + persistence

388427- `src/lib/cache.ts` — LRU cache, git-cache invalidation

389428- `src/lib/reactions.ts` — `summariseReactions`, `toggleReaction`, `ALLOWED_EMOJIS`, `EMOJI_GLYPH`, `isAllowedEmoji`, `isAllowedTarget`

429- `src/lib/observability.ts` — minimal dependency-free observability layer. Wired into `app.onError`. Sinks: `ERROR_WEBHOOK_URL` and/or `SENTRY_DSN`. Never throws.

430- `src/lib/sse.ts` — in-process topic-based pub/sub broadcaster for Server-Sent Events. Backs the live UI updates layer.

431- `src/lib/sse-client.ts` — emits a `<script>`-droppable JS snippet for SSR'd views to subscribe to a topic. Plain JS only — no client framework.

432- `src/lib/autopilot.ts` — 5-minute self-sufficiency ticker (mirror sync, merge-queue peek, weekly digests, advisory rescans). `AUTOPILOT_DISABLED=1` opt-out. Observability via `getLastTick()` + `getTickCount()`.

433- `src/lib/demo-seed.ts` — idempotent `ensureDemoContent()` (creates `demo` user + `hello-python` / `todo-api` / `design-docs`). `DEMO_SEED_ON_BOOT=1` boot flag in `src/index.ts`.

434- `src/lib/import-helper.ts` — small helpers for the GitHub import flow (`src/routes/import.tsx`).

435- `src/lib/import-verify.ts` — post-migration smoke verifier (object count, branches, default-branch HEAD). Re-runnable from `src/routes/migrations.tsx`.

436- `src/lib/namespace.ts` — namespace resolution for Block B2 (user vs org slug → owner record).

437- `src/lib/action-registry.ts` — built-in action registry for workflow engine v2 (Sprint 1). Backs `src/lib/actions/{cache,checkout,download-artifact,gatetest,upload-artifact}-action.ts`.

438- `src/lib/workflow-conditionals.ts` — `if:` expression evaluator for workflow steps.

439- `src/lib/workflow-matrix.ts` — matrix expansion for workflow jobs.

440- `src/lib/workflow-artifacts.ts` — artifact persistence helpers backing `workflow_run_cache`-style storage.

441- `src/lib/workflow-secrets.ts` + `src/lib/workflow-secrets-crypto.ts` — AES-256-GCM secret storage. Crypto lib stays separate from DB lib so the DB layer holds opaque bytes only.

390442

391443### 4.6 Routes (locked endpoints — behaviour must be preserved)

392444- `src/routes/git.ts` — Smart HTTP (clone/push)

@@ -473,6 +525,26 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

473525- `src/lib/close-keywords.ts` (Block J7) — pure parser. Exports `extractClosingRefs(text)` + `extractClosingRefsMulti(sources[])`. Verbs: close/closes/closed/fix/fixes/fixed/resolve/resolves/resolved. Case-insensitive, word-boundary-respecting, ignores cross-repo `owner/repo#N` refs, rejects non-positive numbers, returns sorted de-duped list. Tolerates `:` / `-` / whitespace between verb and ref.

474526- `src/lib/commit-statuses.ts` (Block J8) — pure helpers: `isValidSha`, `isValidState`, `sanitiseContext`, `reduceCombined`. DB helpers: `setStatus` (delete-then-insert upsert on `(repo, sha, context)`, SHA lowercased, description/url clamped to 1000/2048 chars), `listStatuses` (newest first), `combinedStatus` (latest per context, reduces to worst state, returns counts + context pills). `STATUS_STATES` exported array. Never throws on clamping; null/empty description returns null.

475527- `src/routes/commit-statuses.ts` (Block J8) — `POST /api/v1/repos/:owner/:repo/statuses/:sha` (requireAuth — accepts session/OAuth/PAT; owner-only), `GET /api/v1/repos/:owner/:repo/commits/:sha/statuses` (softAuth, private-repo visibility enforced), `GET /api/v1/repos/:owner/:repo/commits/:sha/status` (combined rollup, same visibility rules).

528- `src/routes/api-v2.ts` — Comprehensive REST API v2 (full CRUD across resources). Authoritative integration surface alongside the v1 endpoints in this section.

529- `src/routes/api-docs.tsx` — interactive in-app API documentation page.

530- `src/routes/collaborators.tsx` — repo collaborator add / list / remove. Owner-or-admin only. Audit-logged. (See §4.3.1.)

531- `src/routes/team-collaborators.tsx` — bulk team-to-repo collaborator grant. (See §4.3.1.)

532- `src/routes/invites.tsx` — invite acceptance flow. (See §4.3.1.)

533- `src/routes/events.ts` — `POST /events/...` inbound deploy-event receiver for Crontech (Signal Bus P1). Idempotent via `processed_events`.

534- `src/routes/live-events.ts` — `GET /live-events/:topic` SSE subscription endpoint backed by `src/lib/sse.ts`.

535- `src/routes/health-probe.ts` — extended health + metrics probes for load-balancer + observability sinks.

536- `src/routes/help.tsx` — public `/help` quickstart + API cheatsheet for owners migrating from GitHub.

537- `src/routes/import.tsx` — single-repo GitHub → Gluecron import (PAT-based clone-and-rehost).

538- `src/routes/import-bulk.tsx` — `/import/bulk` paste-a-token org-wide migration.

539- `src/routes/migrations.tsx` — `/migrations` per-user import history dashboard with re-run-verifier button.

540- `src/routes/onboarding.tsx` — guided first-five-minutes flow for new accounts.

541- `src/routes/platform-status.ts` — machine-readable platform status JSON.

542- `src/routes/seo.ts` — `/robots.txt` + `/sitemap.xml`.

543- `src/routes/signing-keys.tsx` — Block J3 UI: `GET/POST /settings/signing-keys` + `POST /settings/signing-keys/:id/delete`. Audit-logged. (Library is `src/lib/signatures.ts`, see §4.6 for the underlying lib.)

544- `src/routes/specs.tsx` — Spec-to-PR UI. Paste a plain-English feature spec, get back a draft PR. Calls `src/lib/spec-to-pr.ts`.

545- `src/routes/status.tsx` — public `GET /status` HTML dashboard + `/status.svg` shields-style badge.

546- `src/routes/workflow-artifacts.ts` — REST API for workflow run artifacts (workflow engine v2 / Sprint 1).

547- `src/routes/workflow-secrets.tsx` — per-repo workflow secrets settings UI (list / create / delete encrypted secrets). Backed by `workflow_secrets` table from `drizzle/0037`.

476548

477549### 4.7 Views (locked contracts)

478550- `src/views/layout.tsx` — `Layout` accepts `title`, `user`, `notificationCount`

@@ -507,7 +579,7 @@ Everything below is committed, tested, and load-bearing. **Do not delete, rename

507579```bash

508580bun install

509581bun dev # hot reload

510bun test # 601 tests currently pass

582bun test # 1033 tests currently pass (8 skipped, 0 failed) as of 2026-04-29 — run `bun install` first

511583bun run db:migrate

512584```

513585

@@ -556,7 +628,27 @@ If a block is too large for a single session, split it into a sub-plan at the to

556628

557629(Intentionally empty. Add here if a block is partially complete at session end.)

558630

559**Polish batch shipped this session:**

631**2026-04-29 reconciliation pass (branch `claude/platform-launch-assessment-8dWV8`):**

632

633The Bible had drifted behind reality. This session reconciled §2 / §4 / §5 against the actual codebase. All edits below are strictly additive — no locked entry was deleted or renamed.

634

635What was added:

636- §2.4 — surfaced previously undocumented AI features now on disk: Spec-to-PR (real AI), repository intelligence engine, time-travel code explorer, dependency impact analyzer, one-click rollback. Clarified that `auto-repair.ts` (gate-time) and `autorepair.ts` (intelligence-time) are two distinct load-bearing modules — do not dedupe.

637- §2.5 — surfaced repository collaborators (per-repo roles), single-repo GitHub import, bulk org import, migration history + verifier, onboarding flow, public `/help` quickstart.

638- §2.6 — surfaced public status page (`/status` + `/status.svg`), platform-status JSON, error-tracking wiring (`src/lib/observability.ts`), comprehensive REST API v2 (`src/routes/api-v2.ts`), API docs page, SSE pub/sub (`src/lib/sse.ts` + `src/routes/live-events.ts`), inbound deploy event receiver (`src/routes/events.ts`), autopilot ticker, demo seed, SEO routes.

639- §4.1 — added migrations 0034–0037 to LOCKED.

640- §4.3.1 (new sub-section) — permissions + collaborators surface (`src/middleware/repo-access.ts`, `src/lib/invite-tokens.ts`, three new collaborator routes).

641- §4.4 — added intelligence / time-travel / depimpact / rollback / spec-to-PR libs; clarified the `auto-repair` vs `autorepair` distinction; flagged `pr-triage.ts` as a placeholder distinct from the live D3 path.

642- §4.5 — added observability, SSE, autopilot, demo-seed, import helpers, namespace, action-registry, and the workflow-engine-v2 family (conditionals / matrix / artifacts / secrets / secrets-crypto).

643- §4.6 — added 21 new routes: api-v2, api-docs, collaborators, team-collaborators, invites, events, live-events, health-probe, help, import, import-bulk, migrations, onboarding, platform-status, seo, signing-keys, specs, status, workflow-artifacts, workflow-secrets. Plus a note pointing signing-keys.tsx at the existing `src/lib/signatures.ts`.

644- §5.1 — bumped the test-count claim from `601` to the actual current number `1033 pass / 8 skip / 0 fail` (verified with deps installed on this branch).

645

646What was verified, not changed:

647- `bun install && bun test` → 1033 pass, 0 fail. Suite is genuinely green.

648- `auto-repair.ts` (472 lines, used by `src/lib/gate.ts`) and `autorepair.ts` (328 lines, used by `src/hooks/post-receive.ts`) are not duplicates — they expose disjoint APIs (`repairSecrets` / `repairSecurityIssues` vs `autoRepair`) and are both in active use.

649- Workflow engine v2 is strictly additive on top of the locked v1 (`src/lib/workflow-runner.ts`); no v1 file was replaced.

650

651**Polish batch shipped earlier:**

560652- `src/lib/autopilot.ts` + tests — 5-min ticker (mirror sync, merge-queue peek, weekly digests, advisory rescans). `AUTOPILOT_DISABLED=1` opt-out. Observability via `getLastTick()` / `getTickCount()`. Admin page at `/admin/autopilot` with "Run tick now" button.

561653- `src/views/landing.tsx` — marketing landing for logged-out `/`. Accepts optional `stats` prop; `src/routes/web.tsx` queries public repo + user counts.

562654- `src/lib/demo-seed.ts` + tests — idempotent `ensureDemoContent()` seeds `demo` user + 3 public sample repos + seeded issues/PR. Boot flag `DEMO_SEED_ON_BOOT=1`. Site-admin reseed button on `/admin` (`POST /admin/demo/reseed`). Public `/demo` convenience redirect to `/demo/hello-python`.

563655