# Gluecron Status — 2026-07-17 Single current source of truth for "what's actually shipped, what's actually open, what to read next." Supersedes `ROADMAP.md`, `CHANGELOG.md`, and the `AUDIT-2026-*.md` chain — those are now redirect stubs pointing here. Update this file, not those, when state changes. `BUILD_BIBLE.md` §4 (LOCKED BLOCKS) remains the authoritative owner-sign-off gate on renaming/altering shipped code — that mechanism isn't moved here. Its *content* (the actual locked-file list) is last known to be a full audit pass behind current `main` (see "Known documentation debt" below) — treat any specific file:line claim in it as unverified until re-audited, not as settled fact. ## What changed this session (2026-07-16/17) All items below are merged to `main` and pushed to the canonical remote (`gluecron.com/ccantynz/Gluecron.com.git`), verified per their own inline test/build evidence — not just written. 1. **Push-time secret scanning, CODEOWNERS merge enforcement, PR-workflow sync wiring, autorepair/branch-protection fixes** — 5-piece hardening batch, 29 dedicated tests green. 2. **`agent-journey.ts` self-healing** — orphaned probe-repo cleanup now sweeps stale `journey-*` repos at the start of every run, so a killed process no longer leaves permanent leftovers. 3. **Repo-settings and account-settings navigation** — `RepoNav` was missing its "Settings" tab entirely (type union had it, no `` rendered it), orphaning the whole settings tree (mirrors, dep updater, webhooks, collaborators, environments, pages, workflow secrets, protected tags, rulesets, automation, audit log) behind the Cmd-K palette. Fixed, plus two adjacent bugs found during the fix: `dep-updater.tsx` was rendering the wrong nav component entirely (`IssueNav` instead of `RepoNav`), and the `/settings` index page itself had no top nav. Account settings had the identical shape — `SettingsSubnav` only listed 4 of 11 pages; extended to cover 2FA/passkeys/signing-keys/sessions/integrations. 4. **`fireWebhooks()` wired into 19 real call sites** (was 0) — the webhook feature was fully built (retry/dead-letter queue, live "last delivery" UI) but no push/issue/PR/star event anywhere in the codebase ever called it, on either the web routes *or* the 8 MCP write tools (`gluecron_create_pr`, `gluecron_merge_pr`, etc., which have their own independent implementations). Verified live end-to-end against production via `scripts/agent-journey.ts` — a probe webhook pointed at `/healthz` now records a real delivery attempt after a real MCP-driven PR create + merge. 5. **AI security gate no longer silently reports "clean" on a provider error** — `aiSecurityScan()` returned `[]` on any Anthropic API error (timeout, rate limit, unparseable response), identical to a genuine zero-finding scan; `gate.ts` then reported "No security issues found" either way. Added `aiSecurityScanSafe()` distinguishing the two states, mirroring the `runGateTestScan` skip-not-silently-pass precedent (commit `6930df0`) already established for the GateTest gate. 6. **Dead webhook deliveries now alert the owner** — a delivery that exhausts all retries (or is blocked by the SSRF guard) previously only logged to `console.error`. Now sends an in-app notification (`integration_dead` kind) linking back to the webhook's settings page. ## Production certification (2026-07-17) 1. **Full authenticated `doctor.ts` sweep is ALL GREEN** — ran sections a–e in `--full` mode against `https://gluecron.com` with a real admin PAT. The sweep found and fixed one real bug in the read-only tool matrix: `gluecron_pr_status_summary` was called with only `{owner,repo}`, but it summarizes one specific PR and requires a PR number. The doctor now resolves a live PR number through `gluecron_list_prs` first and skips gracefully when no PR exists. 2. **Full `agent-journey.ts` write-path certification is GREEN with one warning** — push, branch, PR, comment, merge, webhook delivery, and cleanup all passed against production. No AI-review comment appeared on the test PR within 90 seconds; per the script, this means AI review may legitimately be disabled or `ANTHROPIC_API_KEY` may be unset. Human confirmation is still required (see the top open item below). ## Known open items (not closed this session) - **TOP PRIORITY — confirm production AI-review configuration** — the full write-path certification produced its sole WARN because no AI-review comment appeared within 90 seconds. Check `/admin/env-health` or the production box's `.env` directly to establish whether AI review is intentionally disabled or `ANTHROPIC_API_KEY` is unset. The old, now- archived `ROADMAP.md` called out this exact environment variable as a blocker back in May; this remains open until a human confirms the live configuration. - **Offsite backup not armed** — daily Neon dump + weekly restore drill run fine on the VPS, but dumps only live on the box itself (`BACKUP_SCP_TARGET` unset). Gates Cutover Runbook Phase 4. - **GateTest defaults off for new repos** (migration `0112`) — a deliberate, documented decision (commit `6930df0`: "hasn't proven reliable enough to be a required-by-default external dependency yet"), not a bug. Revisit once a concrete reliability bar is defined and met. - **Legal pages** (`legal/TERMS.md`, `PRIVACY.md`, `AUP.md`, `DPA.md`) drafted but awaiting attorney sign-off; DMCA agent placeholder unfilled. - **Penetration test** — not started, intentionally on hold pending a signed Rules-of-Engagement / authorization document (attorney-gated, separate from the legal-pages thread above). ## Known documentation debt `BUILD_BIBLE.md` claims (as of its last real update, 2026-06-13) that Blocks A–M are all shipped, including the last month's actual work — it wasn't touched during that month despite real commits landing. Its §4 locked-blocks list should be treated as stale evidence, not settled fact, until someone re-audits it against current `main`. That re-audit is a bigger job than this pass and is explicitly not done here — flagged, not fixed. ## Where to look - **This file** — current state, updated as things ship. - **`BUILD_BIBLE.md`** — locked-file sign-off gate (mechanism still authoritative; content stale, see above) and historical block plan. - **`scripts/doctor.ts` / `scripts/agent-journey.ts`** — the actual live-verification tools. Run them against `https://gluecron.com` with a fresh `GLUECRON_PAT` (from `/settings/tokens`) rather than trusting any document's claim about production behavior.