Gladex Agent Logs

STRUCTURE.md records webmail (`app/src/php/mailbox.php`, master-login secret
never in HTML), Apache ProxyPass, mail TLS (`CN=gladex.de` on 25/465/587/993,
snakeoil gone, expires 2026-12-22) and nft mail ports; DOMAIN.md records the
adopted MX (`gladex.de MX 10 gladex.de.`, verified on 1.1.1.1 + 8.8.8.8,
inbound E2E delivered). Adopt obligations: **complete**.

**This run's step — product bug found by using the product: the entire
Workflow Templates Gallery shipped broken (8/8 templates unusable).**

I was picking the next parallel workstream (REPORT §9.3, Workflow Templates
Gallery) and found the data already existed — `examples/workflows/` has 8
templates plus a full `gladex templates` command group. So I exercised them,
and **none of the 8 worked**:

| Check (before) | Result |
|---|---|
| `gladex workflow validate --from examples/workflows/*.json` | **exit 1 on 8/8** |
| `gladex workflow create code-review --from …` (the exact README command) | **exit 1 — `step 2 must have a name`** |
| `gladex templates install` then `workflow run` (had it installed) | would fail: `context step requires config.context_name`, `shell step requires config.command` — and `print`/`set-var` would have **silently done nothing** (empty `config`) |

**Root cause**: the templates wrote step settings as *top-level* fields
(`"command"`, `"value"`, `"message"`, `"name"`), but the schema
(`WorkflowStep.Config map[string]string`) nests them under `"config"`. The
templates and the engine had drifted apart and nothing tested the templates.

**Fix (data + docs, no engine change):**
1. **All 8 templates rewritten to the canonical schema** — every step has a
   `name` (required by `create`), settings under `config`
   (`context_name`, `var`/`value`, `message`, `command`).
   *Detail worth keeping*: context steps use `config.context_name`, **not**
   `config.name` — the validator accepts either, but `executeStepContext` reads
   only `context_name`, so `config.name` would pass validate and still fail at
   run time.
2. **`context-sync`**: dropped `{{.timestamp}}` — no `set-var` ever defines it,
   so it was printing literally into the output.
3. **README example made genuinely copy-paste runnable.** It was missing three
   separate exit-1 traps: no `gladex init`, no named contexts (fresh workspace →
   `context 'backend' not found`), and no `--allow-shell` (shell steps are
   refused by default). Now a 6-step flow, and I **ran the block verbatim** in a
   clean directory: `0 init OK → 1 validate OK → 2 create OK → 3 dry-run OK →
   4 contexts OK → 5 run OK`.
4. **Regression net**: new `TestShippedExampleTemplatesAreValid` — globs
   `examples/workflows/*.json`, requires each to pass `validate` + `create` +
   `show` in a throwaway workspace (8 subtests). **Teeth proven**: I temporarily
   restored the old `code-review.json` and the test failed with the original
   `5 error(s)` + `step 2 must have a name`, then restored the fix.

**Verification (all green this run)**: templates **8/8 validate, 8/8 create,
8/8 run** to completion with `--allow-shell` in a seeded workspace (step counts
5/5/6/6/5/5/6/6 all OK, `{{.task}}` and `{{.env}}` interpolate correctly);
`gladex templates list` (8) / `show` (now prints populated `config` per step —
it previously showed **empty config for every step**) / `install` / `search`
all work; README block verbatim OK. Test totals: **Go 164, PHP 83
(11+16+49+7), shell 26 → 273 passed, 0 failed** (Go vet clean except a
pre-existing `serve_test.go:512` warning I did not touch). No PHP/runtime file
changed → **no deploy, no restart**; dev/prod untouched and still 200.

**Two findings deliberately NOT fixed this run** (kept small; queued in CHANGELOG):
- **`workflow create` never runs the per-type `config` validation** that
  `validate` runs — it only checks `step.Name` + step type. That gap is exactly
  why these templates shipped broken: a bad definition installs cleanly and only
  explodes at `run`. Sharing the validator would catch it at authoring time.
- **Concurrent `gladex` runs on one workspace DB → `SQLITE_BUSY` /
  `database is locked`** (no `busy_timeout` on the connection). I hit it by
  running two loops in parallel myself; serial runs are fine. Relevant once the
  HTTP `/api/workflows/:name/run` and the CLI share a workspace.

**Docs**: CHANGELOG **0.4.10 → 0.4.11**; README usage block; this entry.

**Budget**: untouched — month 2026-09, allowance 5.00, spent 1.50, remaining
3.50; model spend **0.00** (`*-free` only). No spend, no API keys, no DNS change.

**SOA MNAME (queued DNS item) — decision this run: NOT doing it myself.**
Re-checked: `pdns-api.py` exposes only `zones | records | set-a | set-aaaa |
set-cname | set-txt | set-mx | delete` — **there is no SOA command**, and
AGENT_BRIEF §2.3 scopes my API rights to `A/AAAA/CNAME/TXT, no NS change`.
A SOA MNAME edit *is* the primary-NS field, i.e. NS territory → outside my
granted scope, so it stays a provider-panel action for the investor/operator.
(Also checked while there: the NS targets `example-dns.net` / `example-dns.org`
**do** resolve — A `77.90.60.110` / `94.249.188.145` — so `ns1.example-dns.net`
does *not* exist; setting MNAME to it would be wrong anyway.) No DNS touched,
serial still 2026092305.

**NEEDS-INVESTOR (unchanged, still open)**: the **A/B/C public-gating
decision** — `https://gladex.de/{investor,mailbox,api/messages,budget,trust,
changelog,docs,log}` are still world-reachable because Apache `:443` ProxyPass
delivers every internet request to the app as `REMOTE_ADDR=127.0.0.1`. I
re-confirmed it this run (public 200 on all 7) and **did not touch the gating** —
the operator's own Mac/iPhone session rides that exact path, so closing it
unilaterally would lock the investor out mid-session. No config change, no spend.

**Next (queued)**: (1) 08:06–08:51 CEST — observe the first *unattended*
identity fires with the fixed wrapper (all 6 shift logs present, no `cat:`
errors, and **no commit of pre-existing WIP**); (2) ship the `/templates` web
gallery page (REPORT §9.3) now that its data actually works — public product
route, exact-match before the catch-all, same pattern as `/team`; (3) share the
validator with `workflow create`.

**System status**: 0 unread investor_to_agent (dev+prod), 0 unhandled INBOX,
0 pending Dispatcher assignments, healthz **200/200**, tests **164+83+26 = 273 /
0**, units `investor-app-dev`, `investor-app-prod`, `apache2`, `postfix`,
`dovecot` all **active**, git committed + pushed.
EOF
echo "appended"; tail -5 /data/repo/agent-logs/PROGRESS.md
appended

**System status**: 0 unread investor_to_agent (dev+prod), 0 unhandled INBOX,
0 pending Dispatcher assignments, healthz **200/200**, tests **164+83+26 = 273 /
0**, units `investor-app-dev`, `investor-app-prod`, `apache2`, `postfix`,
`dovecot` all **active**, git committed + pushed.
> build · mimo-v2.6-flash-free
Now commit and push.
$ cd /data/repo && git remote -v; echo "---"; git add -A && git commit -q -m "fix: all 8 shipped workflow templates were unusable (top-level step fields instead of config) — validate 8/8 red, README create command exit 1; canonical schema, runnable README flow, regression test (0.4.11)" && git log --oneline -1; echo "--- status ---"; git status --porcelain; echo "--- files ---"; git show --stat --oneline HEAD | head -20
origin	git://git.gladex.de/gladex.git (fetch)
origin	git://git.gladex.de/gladex.git (push)
---
fa65307 fix: all 8 shipped workflow templates were unusable (top-level step fields instead of config) — validate 8/8 red, README create command exit 1; canonical schema, runnable README flow, regression test (0.4.11)
--- status ---
--- files ---
fa65307 fix: all 8 shipped workflow templates were unusable (top-level step fields instead of config) — validate 8/8 red, README create command exit 1; canonical schema, runnable README flow, regression test (0.4.11)
 CHANGELOG.md                                       |  15 +++
 README.md                                          |  26 ++++-
 agent-logs/PROGRESS.md                             | 118 +++++++++++++++++++++
 .../cmd/gladex/commands/workflow_validate_test.go  |  63 +++++++++++
 examples/workflows/code-review.json                |  23 +++-
 examples/workflows/context-sync.json               |  24 ++++-
 examples/workflows/deploy-check.json               |  29 +++--
 examples/workflows/doc-gen.json                    |  27 +++--
 examples/workflows/hello-workflow.json             |  25 ++++-
 examples/workflows/refactor-plan.json              |  23 +++-
 examples/workflows/security-audit.json             |  28 +++--
 examples/workflows/test-create.json                |  27 +++--
 12 files changed, 381 insertions(+), 47 deletions(-)
> build · mimo-v2.6-flash-free
$ cd /data/repo && timeout 90 git push origin main 2>&1 | tail -5; echo "push_rc=$?"; echo "--- verify ---"; git ls-remote origin main; git log --oneline -1
To git://git.gladex.de/gladex.git
   347432a..fa65307  main -> main
push_rc=0
--- verify ---
fa65307b1b193769239d2b11925ffc951d06d189	refs/heads/main
fa65307 fix: all 8 shipped workflow templates were unusable (top-level step fields instead of config) — validate 8/8 red, README create command exit 1; canonical schema, runnable README flow, regression test (0.4.11)
> build · mimo-v2.6-flash-free
Pushed successfully. Final verification sweep:
$ echo "=== STEP 0 final ==="; echo -n "dev unread: "; sqlite3 /opt/startup/dev/data/messages.db "SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0;"; echo -n "prod unread: "; sqlite3 /opt/startup/prod/data/messages.db "SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0;"; echo -n "INBOX unhandled: "; grep '^## ' /data/repo/INBOX.md | grep -vc 'HANDLED'; echo -n "dispatcher pending: "; find /data/repo/mailboxes -type f ! -name '.gitkeep' | wc -l; echo "=== git ==="; cd /data/repo && git status --porcelain | wc -l; echo -n "remote==local: "; [ "$(git rev-parse HEAD)" = "$(git ls-remote origin main | cut -f1)" ] && echo YES || echo NO; echo "=== demo artifact ==="; ls -d /data/repo/demo 2>/dev/null || echo "absent (good)"
=== STEP 0 final ===
dev unread: 0
prod unread: 0
INBOX unhandled: 0
dispatcher pending: 0
=== git ===
0
remote==local: YES
=== demo artifact ===
absent (good)
$ echo "=== healthz ==="; curl -s -o /dev/null -w "dev=%{http_code} prod=" http://127.0.0.1:8000/healthz; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8001/healthz; echo "=== public product routes ==="; for p in / /team /info /stats; do printf "%-8s " "$p"; curl -sk -o /dev/null -w "%{http_code}\n" --max-time 8 "https://gladex.de$p"; done; echo "=== budget ==="; head -6 /data/repo/BUDGET.md
=== healthz ===
dev=200 prod=200
=== public product routes ===
/        200
/team    200
/info    200
/stats   200
=== budget ===
month: 2026-09
allowance: 5.00
spent: 1.50 (gladex.de — investor-approved 2026-09-20, purchase pending at registrar)
remaining: 3.50
log:
  - 2026-09-20: init, no domains ordered yet
> build · mimo-v2.6-flash-free
Done. One verifiable step shipped, committed as `fa65307`, pushed.

## STEP 0 — investor first
- **0 unread** `investor_to_agent` rows (dev + prod DBs) — the `read=0` rows are my own replies awaiting the investor.
- **INBOX.md 65/65 HANDLED**, 0 unhandled; **0** pending Dispatcher assignments.
- Re-verified the RECENT-INBOX adopt duties rather than trusting the markers: PHP sources are **tracked in git** and **md5-identical** across repo/dev/prod, STRUCTURE.md records webmail/Apache/mail-TLS/nft, DOMAIN.md records the adopted MX. All complete.

## This run's step — the shipped workflow templates were 8/8 broken
While picking the next workstream (REPORT §9.3, Workflow Templates Gallery) I found the data already existed (`examples/workflows/` + a full `gladex templates` command group) — so I exercised it, and **none of the 8 worked**:

| Check (before) | Result |
|---|---|
| `workflow validate --from examples/workflows/*.json` | **exit 1 on 8/8** |
| `workflow create … --from` (the exact README command) | **exit 1 — `step 2 must have a name`** |
| install + run | would fail (`context/shell step requires config.…`); `print`/`set-var` would have **silently done nothing** |

**Cause:** templates wrote step settings as *top-level* fields, but the schema nests them under `config`. Nothing tested the templates, so the drift shipped.

**Fixed:** all 8 rewritten to canonical schema (every step named, settings under `config`); a dead `{{.timestamp}}` placeholder removed; README example made actually copy-paste runnable (it was missing `init`, the contexts, and `--allow-shell` — three separate exit-1 traps).

**Verification:** 8/8 validate, 8/8 create, 8/8 run to completion; README block executed **verbatim** in a clean dir (`0→5 OK`); `templates show` now prints populated config instead of empty entries. New `TestShippedExampleTemplatesAreValid` (8 subtests) — **teeth proven** by temporarily restoring the old schema and watching it fail with the original errors. **Tests: Go 164 + PHP 83 + shell 26 = 273 passed, 0 failed.** No PHP/runtime touched → no deploy, no restart.

## Deliberately not done (queued in CHANGELOG)
- **SOA MNAME**: `pdns-api.py` has **no SOA command**, and the brief scopes me to `A/AAAA/CNAME/TXT, no NS change` — a MNAME edit *is* the primary-NS field, so it's a provider-panel action outside my granted scope. (Also `ns1.example-dns.net` doesn't exist, so that value would be wrong anyway.) No DNS touched.
- **A/B/C public-gating**: re-confirmed still open (public 200 on all 7 investor routes), **left untouched** — the operator's own session rides that path and closing it would lock the investor out mid-session.
- `workflow create` still skips the per-type `config` validation (the gap that let this ship); concurrent runs hit `SQLITE_BUSY`. Both queued.

**Budget:** untouched — 5.00 allowance, 1.50 spent, 3.50 remaining; model spend **0.00** (`*-free` only).
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Sep 25 01:42:51 2026] 127.0.0.1:37814 Accepted
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37814 Closing
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37818 Accepted
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37818 Closing
[Fri Sep 25 01:42:54 2026] 127.0.0.1:37824 Accepted
[Fri Sep 25 01:42:54 2026] 127.0.0.1:37824 Closing
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44098 Accepted
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44098 Closing
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44106 Accepted
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44106 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44120 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44120 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44134 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44134 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Closing
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Accepted
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Closing
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Accepted
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53610 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53610 Closing
[Fri Sep 25 01:43:39 2026] 127.0.0.1:34760 Accepted
[Fri Sep 25 01:43:39 2026] 127.0.0.1:34760 Closing
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34764 Accepted
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34764 Closing
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34780 Accepted
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34780 Closing
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51444 Accepted
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51444 Closing
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51450 Accepted
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51450 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51462 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51462 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51470 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51470 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51474 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51474 Closing
[Fri Sep 25 01:44:41 2026] 127.0.0.1:51486 Accepted
[Fri Sep 25 01:44:41 2026] 127.0.0.1:51486 Closing
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51490 Accepted
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51490 Closing
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51494 Accepted
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51494 Closing
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53326 Accepted
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53326 Closing
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53332 Accepted