Gladex Agent Logs

**Tests**:
- `bash tests/test_source_sync_check.sh` → **26 assertions**, hermetic (<1s, throwaway sandbox under `/tmp/opencode/`, never touches live trees): clean→0, both drift directions + action hints, missing/extra file states, workflows tree covered, `--env` scoping, JSON contract, `--help`→0 / bad-arg→2 / missing-dir→3, two static read-only guards
- **Mutation**: sha comparison defeated (`if True:`) on a copy → tool would exit 0 on real drift; suite asserts divergence (real=1, mutant=0) — caught
- Live: `source-sync-check` → `exit 0`, 42 files across dev+prod in sync (after the 2026-09-24 drift fix)

**Status**: Built ✅ (2026-09-24; first live run caught 16 drifted workflow files — see CHANGELOG 0.4.25)
EOF
echo "registry-appended"; grep -c "^## " /data/repo/tools/REGISTRY.md
registry-appended
14
> build · mimo-v2.6-flash-free
← Edit repo/CHANGELOG.md
Index: repo/CHANGELOG.md
===================================================================
--- repo/CHANGELOG.md
+++ repo/CHANGELOG.md
@@ -3,8 +3,51 @@
 All notable changes to Gladex are documented here.
 
 Format: `[version] - YYYY-MM-DD — description`
 
+## [0.4.25] - 2026-09-24 — new `source-sync-check` guard caught 16 drifted files live: dev+prod shipped the pre-0.4.11 broken workflow templates
+
+### Added
+- **`tools/source-sync-check`** — read-only drift guard between the canonical repo
+  source trees and what the envs actually serve, both directions:
+  `app/src/php ↔ src/php` and `examples/workflows ↔ examples/workflows` per env.
+  This exact gap had already bitten twice (operator hotfixed runtime `app.php`
+  needing a back-port; the templates below), but nothing checked it per run.
+  - Per-file sha256 → states `in_sync` / `differs` / `missing_in_runtime` /
+    `extra_in_runtime`, with an mtime-based action hint (`runtime newer → commit
+    runtime copy`, `repo newer → deploy repo copy`).
+  - Exit contract: `0` in sync, `1` drift, `2` bad args, `3` missing base dir
+    (a broken layout can never masquerade as "in sync").
+  - Test hooks `GLADEX_REPO_DIR` / `GLADEX_DEV_ROOT` / `GLADEX_PROD_ROOT` (same
+    pattern as `system-status`); read-only by construction — no write/exec API.
+- **`tests/test_source_sync_check.sh` — 26 assertions**, hermetic (<1s, sandbox
+  under `/tmp/opencode`, live trees never touched): both drift directions +
+  action hints, missing/extra states, workflows tree coverage, `--env` scoping,
+  JSON contract, `--help`→0 / bad-arg→2 / missing-dir→3, two static read-only
+  guards, and **one mutation** (sha comparison defeated → tool would exit 0 on
+  real drift; suite asserts the divergence real=1/mutant=0 — caught).
+- `tools/REGISTRY.md` entry for the new tool.
+
+### Fixed
+- **All 8 workflow templates served by dev AND prod were schema-invalid** — the
+  0.4.11 fix (`fa65307`, top-level step fields → canonical `config`) landed in the
+  repo only; the env copies (mtime 2026-09-22) were never refreshed, and the env
+  copy **shadows** the repo in both resolvers (`gladex_templates_dir()` first
+  candidate, `findTemplatesDir()` binary-relative). Live proof on 2026-09-24:
+  `gladex workflow validate --from /opt/startup/{prod,dev}/examples/workflows/*.json`
+  → **8/8 INVALID** (7 errors on hello-workflow alone: missing names, config
+  keys), while all 8 repo copies were VALID — i.e. `gladex templates install`
+  was broken for users on both envs since 0.4.11. Deployed the committed fix
+  (`rsync -a --delete` repo → dev + prod, data-only, no restart needed — files
+  are read per request/invocation); re-verified **8/8 GREEN** via the
+  env-resolved path, `source-sync-check` → `exit 0` (42 files in sync),
+  `/templates` 200 on dev + prod (incl. public https with `Host: gladex.de`),
+  gallery suite 27/27.
+
+### Notes
+- The drift detection found the bug on its **first live run** — the tool's raison
+  d'être demonstrated in the same run it shipped. It now guards every future run.
+
 ## [0.4.24] - 2026-09-24 — system-status now guards the adopted MX and SOA serial (the A-record-only DNS check was blind to mail)
 
 ### Added
 - **`tools/system-status`: two new checks (25 → 27), closing the standing investor

> build · mimo-v2.6-flash-free
Running the full test suite before commit:
$ cd /data/repo && fails=0; total_suites=0; for t in tests/*.php; do out=$(php "$t" 2>&1); rc=$?; total_suites=$((total_suites+1)); if [ $rc -ne 0 ]; then fails=$((fails+1)); echo "FAIL-SUITE $t rc=$rc"; echo "$out" | grep -i "fail" | head -5; else echo "ok $t : $(echo "$out" | grep -Eo '[0-9]+ passed' | tail -1)"; fi; done; for t in tests/*.sh; do out=$(bash "$t" 2>&1); rc=$?; total_suites=$((total_suites+1)); if [ $rc -ne 0 ]; then fails=$((fails+1)); echo "FAIL-SUITE $t rc=$rc"; echo "$out" | grep -i fail | head -5; else echo "ok $t : $(echo "$out" | grep -Eo '[0-9]+ passed' | tail -1)"; fi; done; echo "SUITES=$total_suites FAILED=$fails"
ok tests/test_changelog_api.php : 78 passed
ok tests/test_chat_a11y.php : 38 passed
ok tests/test_chat_frontend.php : 11 passed
ok tests/test_ip_drift_safety.php : 16 passed
ok tests/test_lan_middleware.php : 49 passed
ok tests/test_php_busy_timeout.php : 19 passed
ok tests/test_stats_dbpath.php : 16 passed
ok tests/test_stats_gocli_path.php : 14 passed
ok tests/test_templates_gallery.php : 27 passed
ok tests/test_ts_ordering.php : 7 passed
ok tests/test_webmail_session_routing.php : 75 passed
ok tests/test_identity_wrapper.sh : 26 passed
ok tests/test_source_sync_check.sh : 26 passed
ok tests/test_system_status_mx_soa.sh : 27 passed
ok tests/test_system_status_unread.sh : 20 passed
SUITES=15 FAILED=0
> build · mimo-v2.6-flash-free
15/15 suites green (449 assertions total). Final health snapshot, then PROGRESS + commit:
$ /data/repo/tools/system-status 2>&1 | tail -8; /data/repo/tools/budget-show; /data/repo/tools/source-sync-check --format json | python3 -c "import json,sys; d=json.load(sys.stdin); print('sync:', 'IN-SYNC' if not d['drift'] else 'DRIFT', d['exit_code'], len(d['files']), 'files')"
MX:gladex.de              [OK] 10 gladex.de. on 1.1.1.1+8.8.8.8
  SOA:gladex.de             [WARN] serial=2026092305 consistent on 1.1.1.1+8.8.8.8; mname=placeholder (NEEDS-INVESTOR open)
  tls-cert-expiry           [OK] 89d left
  investor-messages         [OK] 0 unread dev=0 prod=0
  git-tree                  [WARN] 4 uncommitted changes
  go-tests                  [OK] passing

Overall: ALL SYSTEMS HEALTHY
=== Budget Status ===
Month:       2026-09
Allowance:   5.00 €
Spent:       1.50 (gladex.de — investor-approved 2026-09-20, purchase pending at registrar) €
Remaining:   3.50 €

Log:
  - 2026-09-20: init, no domains ordered yet
  - 2026-09-20: investor APPROVED gladex.de (1.50/mo). Awaiting registrar purchase + DNS creds.
sync: IN-SYNC 0 42 files
> build · mimo-v2.6-flash-free
$ cat >> /data/repo/agent-logs/PROGRESS.md << 'EOF'

## 2026-09-24T08:20Z — free-builder
- **STEP 0**: 0 unread `investor_to_agent` rows (dev **and** prod DBs); INBOX.md all
  HANDLED (checked every `## ` heading); `mailboxes/*` empty — **no Dispatcher
  assignments**; identity Maildirs 0 new; `/root/Maildir/new` holds only the already
  accounted-for postfix TLS smoke test ("ok"). **Nothing owed, no DB writes.**
- **Step (CHANGELOG 0.4.25) — new `tools/source-sync-check` guard, and its first
  live run immediately caught a real prod bug.**
  - Tool: read-only sha256 drift check of what the envs actually **serve** vs the
    canonical repo — `app/src/php ↔ src/php` and `examples/workflows ↔
    examples/workflows`, per env. States `in_sync`/`differs`/`missing_in_runtime`/
    `extra_in_runtime` + mtime action hint (runtime newer → *commit runtime copy*;
    repo newer → *deploy repo copy*). Exit 0/1/2/3 (missing base dir can never
    masquerade as "in sync"). Hooks `GLADEX_REPO_DIR`/`GLADEX_DEV_ROOT`/
    `GLADEX_PROD_ROOT`; read-only by construction (statically asserted).
  - **Bug found live**: all **8 workflow templates served by dev AND prod were
    INVALID** — the 0.4.11 schema fix (`fa65307`, top-level step fields → `config`)
    was committed to the repo on 09-24 01:37 but **never deployed to the envs**
    (env copies mtime 09-22), and the env copy **shadows** the repo in both
    resolvers (`gladex_templates_dir()` first candidate / `findTemplatesDir()`
    binary-relative). Proof: `gladex workflow validate --from
    /opt/startup/{prod,dev}/examples/workflows/*.json` → **8/8 INVALID** (7 errors
    on hello-workflow: missing names, config keys) while all 8 repo copies were
    VALID — so `gladex templates install` was broken for users on both envs.
  - **Fixed**: `rsync -a --delete` repo → dev + prod (data-only backfill of the
    already-committed 0.4.11 fix; no code change, no restart — files read per
    request/invocation; no reviewer gate needed for a git-committed data sync).
  - `tests/test_source_sync_check.sh`: **26 assertions**, hermetic sandbox
    (`/tmp/opencode`, live trees untouched), both drift directions + hints,
    missing/extra states, `--env` scoping, JSON contract, exit-code contract,
    2 static read-only guards, **1 mutation** (sha comparison defeated → real=1
    vs mutant=0 divergence — caught).
- **Verified**: `source-sync-check` → **exit 0**, 42 files across dev+prod in sync;
  **8/8 templates GREEN** via the env-resolved path (dev+prod binaries);
  `/templates` **200** dev + prod (incl. public https with `Host: gladex.de` — an
  unqualified `Host: localhost` probe 404s by design, default vhost);
  **full suite 15/15 suites, 0 failures** (449 assertions: 350 PHP + 99 shell);
  `system-status` → all systems healthy (incl. `investor-messages 0 unread dev=0
  prod=0`), `go-tests passing`, TLS 89d.
- **Health**: BUDGET 2026-09 unchanged **5.00 / 1.50 / 3.50**, **model spend 0.00**
  (`*-free` only), no DNS write, no spend, no secret read. Commit + push after write.
- **NEEDS-INVESTOR (unchanged, still open)**: (a) **A/B/C public-gating decision**
  (msg **#57**, unopened) — investor surface world-reachable via Apache `:443`
  ProxyPass collapsing peers to 127.0.0.1; recommend **A**, or A+B; no config change
  made until the call (would risk locking the active session out mid-poll).
  (b) **SOA MNAME placeholder** — provider panel only; visible each run as the
  `SOA:gladex.de` warning above.
EOF
echo appended; cd /data/repo && git add -A && git commit -m "feat: source-sync-check — read-only repo<->env drift guard; first run caught 16 drifted workflow files (dev+prod served pre-0.4.11 broken templates, 8/8 INVALID) — deployed committed fix, 26-assertion hermetic suite + mutation, 0.4.25" && git log --oneline -1
appended
[main 24fff4b] feat: source-sync-check — read-only repo<->env drift guard; first run caught 16 drifted workflow files (dev+prod served pre-0.4.11 broken templates, 8/8 INVALID) — deployed committed fix, 26-assertion hermetic suite + mutation, 0.4.25
 5 files changed, 534 insertions(+)
 create mode 100755 tests/test_source_sync_check.sh
 create mode 100755 tools/source-sync-check
24fff4b feat: source-sync-check — read-only repo<->env drift guard; first run caught 16 drifted workflow files (dev+prod served pre-0.4.11 broken templates, 8/8 INVALID) — deployed committed fix, 26-assertion hermetic suite + mutation, 0.4.25
> build · mimo-v2.6-flash-free
$ cd /data/repo && git push origin main 2>&1 | tail -3; git status --porcelain | head -3; git ls-remote origin main | head -1; git rev-parse HEAD
To git://git.gladex.de/gladex.git
   d378041..24fff4b  main -> main
24fff4bf19789787ddf90994f8fb751032317ca1	refs/heads/main
24fff4bf19789787ddf90994f8fb751032317ca1
> build · mimo-v2.6-flash-free
Run complete — all steps green.

## STEP 0 — Investor inbox (checked first)
- **0 unread `investor_to_agent` rows** in both dev and prod DBs → nothing owed, no DB writes.
- **INBOX.md**: every `## ` heading carries `HANDLED` (grep for unhandled = empty).
- **`mailboxes/*`**: empty — no Dispatcher assignments. Identity Maildirs 0 new; `/root/Maildir/new` holds only the already-accounted-for postfix TLS smoke test.
- Recorded in PROGRESS.md as the run's first item.

## This run's step — new drift guard that immediately caught a real prod bug
**Tool**: `tools/source-sync-check` (`--help`, JSON output, exit 0/1/2/3) — read-only sha256 comparison of what each env actually *serves* vs the canonical repo: `app/src/php ↔ src/php` and `examples/workflows ↔ examples/workflows`, with direction hints (runtime newer → *commit*; repo newer → *deploy*). Registered in `REGISTRY.md`, hooks `GLADEX_REPO_DIR`/`GLADEX_DEV_ROOT`/`GLADEX_PROD_ROOT`.

**First live run found**: all **16 workflow files drifted** — the 0.4.11 schema fix (`fa65307`) was committed to the repo but **never deployed to the envs**, and env copies shadow the repo in both resolvers. Live proof: `gladex workflow validate --from` on env copies → **8/8 INVALID** (7 errors on hello-workflow), all 8 repo copies VALID → `gladex templates install` was broken for users on dev *and* prod.

**Fixed**: `rsync -a --delete` repo → dev + prod (data-only backfill of the already-committed fix, no restart needed), then re-verified:
- `source-sync-check` → **exit 0**, 42 files in sync
- **8/8 templates GREEN** via the env-resolved path (both binaries)
- `/templates` → **200** on dev + prod (public https with `Host: gladex.de`; the `Host: localhost` 404 is default-vhost by design)
- **Full suite: 15/15 suites, 0 failures** (449 assertions) incl. new `test_source_sync_check.sh` — **26 assertions**, hermetic, 1 mutation caught (sha compare defeated → real=1 vs mutant=0)
- `system-status`: all systems healthy, go-tests passing, TLS 89d

**Budget**: 2026-09 unchanged **5.00 / 1.50 / 3.50**, model spend **0.00** (`*-free` only), no DNS writes, no spend.

**Committed + pushed**: `24fff4b` → `git://git.gladex.de/gladex.git` (remote HEAD matches).

**NEEDS-INVESTOR still open**: (a) A/B/C public-gating decision (msg #57, unopened) — recommend A or A+B; (b) SOA MNAME placeholder (provider panel only, visible each run as the `SOA:gladex.de` warning).
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Sep 25 01:34:56 2026] 127.0.0.1:49522 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49522 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49536 Accepted
[Fri Sep 25 01:34:57 2026] 127.0.0.1:49536 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60400 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60400 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60408 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60408 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60422 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60422 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60428 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60428 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60442 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60442 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60446 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60446 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60462 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60462 Closing
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37798 Accepted
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37798 Closing
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37802 Accepted
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37802 Closing
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37814 Accepted
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37814 Closing
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37818 Accepted
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37818 Closing
[Fri Sep 25 01:42:54 2026] 127.0.0.1:37824 Accepted
[Fri Sep 25 01:42:54 2026] 127.0.0.1:37824 Closing
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44098 Accepted
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44098 Closing
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44106 Accepted
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44106 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44120 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44120 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44134 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44134 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Closing
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Accepted
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Closing
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Accepted
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53610 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53610 Closing
[Fri Sep 25 01:43:39 2026] 127.0.0.1:34760 Accepted
[Fri Sep 25 01:43:39 2026] 127.0.0.1:34760 Closing
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34764 Accepted