# Gluecron Status — 2026-07-17

Single current source of truth for "what's actually shipped, what's actually
open, what to read next." Supersedes `ROADMAP.md`, `CHANGELOG.md`, and the
`AUDIT-2026-*.md` chain — those are now redirect stubs pointing here. Update
this file, not those, when state changes.

`BUILD_BIBLE.md` §4 (LOCKED BLOCKS) remains the authoritative owner-sign-off
gate on renaming/altering shipped code — that mechanism isn't moved here.
Its *content* (the actual locked-file list) is last known to be a full
audit pass behind current `main` (see "Known documentation debt" below) —
treat any specific file:line claim in it as unverified until re-audited,
not as settled fact.

## What changed this session (2026-07-16/17)

All items below are merged to `main` and pushed to the canonical remote
(`gluecron.com/ccantynz/Gluecron.com.git`), verified per their own
inline test/build evidence — not just written.

1. **Push-time secret scanning, CODEOWNERS merge enforcement, PR-workflow
   sync wiring, autorepair/branch-protection fixes** — 5-piece hardening
   batch, 29 dedicated tests green.
2. **`agent-journey.ts` self-healing** — orphaned probe-repo cleanup now
   sweeps stale `journey-*` repos at the start of every run, so a killed
   process no longer leaves permanent leftovers.
3. **Repo-settings and account-settings navigation** — `RepoNav` was
   missing its "Settings" tab entirely (type union had it, no `<a>`
   rendered it), orphaning the whole settings tree (mirrors, dep updater,
   webhooks, collaborators, environments, pages, workflow secrets,
   protected tags, rulesets, automation, audit log) behind the Cmd-K
   palette. Fixed, plus two adjacent bugs found during the fix:
   `dep-updater.tsx` was rendering the wrong nav component entirely
   (`IssueNav` instead of `RepoNav`), and the `/settings` index page
   itself had no top nav. Account settings had the identical shape —
   `SettingsSubnav` only listed 4 of 11 pages; extended to cover
   2FA/passkeys/signing-keys/sessions/integrations.
4. **`fireWebhooks()` wired into 19 real call sites** (was 0) — the
   webhook feature was fully built (retry/dead-letter queue, live
   "last delivery" UI) but no push/issue/PR/star event anywhere in the
   codebase ever called it, on either the web routes *or* the 8 MCP
   write tools (`gluecron_create_pr`, `gluecron_merge_pr`, etc., which
   have their own independent implementations). Verified live end-to-end
   against production via `scripts/agent-journey.ts` — a probe webhook
   pointed at `/healthz` now records a real delivery attempt after a
   real MCP-driven PR create + merge.
5. **AI security gate no longer silently reports "clean" on a provider
   error** — `aiSecurityScan()` returned `[]` on any Anthropic API error
   (timeout, rate limit, unparseable response), identical to a genuine
   zero-finding scan; `gate.ts` then reported "No security issues found"
   either way. Added `aiSecurityScanSafe()` distinguishing the two states,
   mirroring the `runGateTestScan` skip-not-silently-pass precedent
   (commit `6930df0`) already established for the GateTest gate.
6. **Dead webhook deliveries now alert the owner** — a delivery that
   exhausts all retries (or is blocked by the SSRF guard) previously only
   logged to `console.error`. Now sends an in-app notification
   (`integration_dead` kind) linking back to the webhook's settings page.

## Known open items (not closed this session)

- **Offsite backup not armed** — daily Neon dump + weekly restore drill
  run fine on the VPS, but dumps only live on the box itself
  (`BACKUP_SCP_TARGET` unset). Gates Cutover Runbook Phase 4.
- **GateTest defaults off for new repos** (migration `0112`) — a
  deliberate, documented decision (commit `6930df0`: "hasn't proven
  reliable enough to be a required-by-default external dependency yet"),
  not a bug. Revisit once a concrete reliability bar is defined and met.
- **Legal pages** (`legal/TERMS.md`, `PRIVACY.md`, `AUP.md`, `DPA.md`)
  drafted but awaiting attorney sign-off; DMCA agent placeholder unfilled.
- **Penetration test** — not started, intentionally on hold pending a
  signed Rules-of-Engagement / authorization document (attorney-gated,
  separate from the legal-pages thread above).
- **Authenticated `doctor.ts` sections (d/e) and the full PAT-gated
  agent-journey matrix** — only ever run against anonymous endpoints
  plus the one PAT-driven journey run this session; a systematic
  authenticated sweep hasn't happened.

## Known documentation debt

`BUILD_BIBLE.md` claims (as of its last real update, 2026-06-13) that
Blocks A–M are all shipped, including the last month's actual work —
it wasn't touched during that month despite real commits landing. Its
§4 locked-blocks list should be treated as stale evidence, not settled
fact, until someone re-audits it against current `main`. That re-audit
is a bigger job than this pass and is explicitly not done here — flagged,
not fixed.

## Where to look

- **This file** — current state, updated as things ship.
- **`BUILD_BIBLE.md`** — locked-file sign-off gate (mechanism still
  authoritative; content stale, see above) and historical block plan.
- **`scripts/doctor.ts` / `scripts/agent-journey.ts`** — the actual
  live-verification tools. Run them against `https://gluecron.com` with
  a fresh `GLUECRON_PAT` (from `/settings/tokens`) rather than trusting
  any document's claim about production behavior.