Gladex Agent Logs

  a served tree. But `promote-dev-to-prod` rsync'd **only** `app/src/php/`
  (grep `rsync` → one line), so (a) a template edit **never reached prod via
  promote** and the drift `source-sync-check` flags there was never fixed by a
  promote, and (b) editing the gallery did **not** staleness-check the verdict.
  Fixed both with one shared list:
  - New `PROMOTED_TREES = [("app/src/php","src/php"),
    ("examples/workflows","examples/workflows")]` drives **both** the rsync
    loop and `newest_source_mtime()` — "what we ship" and "what we
    staleness-check" can no longer diverge.
  - promote now rsyncs **each** tree (`--delete`); freshness = newest file in
    **any** promoted tree. `tools/` deliberately stays out: promote only
    *executes* `tools/healthcheck`, never deploys it, so a tool edit cannot
    change what prod serves (documented in `--help` + REGISTRY).
  - Fixed a latent crash found while editing: the `--help` epilog still
    referenced the removed `PROMOTED_TREE` constant → `NameError` on
    `--help`. Caught before commit; `--help` now renders both trees.
- **Verified**:
  - `tests/test_promote_gate.sh` → **43 assertions, 0 failed** (was 32).
    New coverage: gallery edit stales the verdict (names `examples/workflows`,
    plans no deploy); fresh verdict **rsync-planned for both trees**; and a
    **divergence guard** asserting this tool's promoted set equals
    `source-sync-check`'s compared set (parse both literals — catches "tree
    added to one tool but not the other").
  - **3 mutations, all caught** (was 2): gate result ignored `5|0`; any verdict
    accepted `5|0`; **freshness scope narrowed back to `app/src/php` only
    `5|0`** — the widened scope is pinned, not merely present. Every
    invocation is `--dry-run`, so the live prod service can never be
    restarted by the suite.
  - **Live, read-only**: `promote-dev-to-prod --dry-run` → **exit 5**
    (`no verdict … prod untouched`, mailbox empty between reviews — correct
    fail-closed state); `source-sync-check` → **0** (both trees, both envs,
    0 drift — so adding the second rsync changes **no bytes today**, safe);
    `healthcheck prod` → 200 / v0.4.28; `/templates` **200** locally on
    :8001 **and** publicly via `https://gladex.de/templates` (gallery renders
    `hello-workflow`/`code-review`/`security-audit`).
  - **Full suite 20/20 green** (14 PHP + 6 shell).
- **Docs updated**: `tools/REGISTRY.md` (promoted-tree table, freshness rule,
  operation steps, 43 assertions/3 mutations); `STRUCTURE.md` workflow step 5
  + the template-gallery paragraph now records that the env copy shadows the
  repo **and** is deployed by promote (the pre-2026-09-24 gap).
- **Health**: model spend **0.00** (`*-free` only), no money spent, no DNS
  write, no secret read, no paid API key touched.
- **NEEDS-INVESTOR (unchanged, still open)**: (a) **A/B/C public-gating
  decision** (msg **#57**, still unopened) — investor surface remains
  world-reachable via Apache `:443` ProxyPass; recommend **A**, or A+B; no
  config change until the call. (b) **SOA MNAME placeholder** — provider
  panel only, surfaces each run as the `SOA:gladex.de` warning.
- **Next-candidate queued, not actioned**: the tool is named
  `promote-dev-to-prod` but step 2 copies **repo → prod**, never **dev → prod**
  — an uncommitted/hot-reployed change living only in the dev env would be
  silently dropped by a promote, and nothing cross-checks dev against the repo
  first (even though `source-sync-check` already computes exactly that drift).
  Either invoke `source-sync-check` pre-promote and refuse on dev≠repo, or
  rename to `promote-repo-to-prod` so the contract is honest. Minor cosmetic
  seen in the same run: on a gate refusal, stderr ("Promotion aborted…")
  prints *before* stdout ("Starting promotion…") due to stream buffering.
EOF
echo "APPENDED"; tail -5 /data/repo/agent-logs/PROGRESS.md
APPENDED
  first (even though `source-sync-check` already computes exactly that drift).
  Either invoke `source-sync-check` pre-promote and refuse on dev≠repo, or
  rename to `promote-repo-to-prod` so the contract is honest. Minor cosmetic
  seen in the same run: on a gate refusal, stderr ("Promotion aborted…")
  prints *before* stdout ("Starting promotion…") due to stream buffering.
> build · mimo-v2.6-flash-free
Now committing and pushing:
$ cd /data/repo && git diff | grep -iE "^\+.*(password|secret|token|api[_-]?key|BEGIN .*PRIVATE)" | head; echo "SECRET_SCAN_RC=$? (1 = clean)"
+  write, no secret read, no paid API key touched.
SECRET_SCAN_RC=0 (1 = clean)
$ cd /data/repo && git status --short && echo "=== diffstat ===" && git diff --stat
M STRUCTURE.md
 M agent-logs/PROGRESS.md
 M tests/test_promote_gate.sh
 M tools/REGISTRY.md
 M tools/promote-dev-to-prod
=== diffstat ===
 STRUCTURE.md               |  18 ++++++--
 agent-logs/PROGRESS.md     |  72 ++++++++++++++++++++++++++++++
 tests/test_promote_gate.sh |  93 ++++++++++++++++++++++++++++++++++++--
 tools/REGISTRY.md          |  32 ++++++++++---
 tools/promote-dev-to-prod  | 109 ++++++++++++++++++++++++++++-----------------
 5 files changed, 270 insertions(+), 54 deletions(-)
> build · mimo-v2.6-flash-free
Secret scan clean (only my own "no secret read" prose matched). Committing:
$ cd /data/repo && git add -A && git commit -q -F - <<'EOF'
feat: promote ships AND staleness-checks every tree the envs serve — one PROMOTED_TREES list drives both the rsync loop and the verdict gate's freshness check

Gap (queued at run-33): the gate keyed freshness off app/src/php/ only, but
app/src/php/templates.php resolves its gallery env-relative FIRST
(/opt/startup/{dev,prod}/examples/workflows), i.e. the env copy SHADOWS the
repo — examples/workflows/ is shipped product surface on the public /templates
route and source-sync-check already compares it as a served tree. Yet
promote-dev-to-prod rsync'd only app/src/php/ (one rsync line), so a template
edit never reached prod via promote (source-sync-check drift there was never
fixed by a promote) and editing the gallery did not staleness the verdict.

Fix: PROMOTED_TREES = [("app/src/php","src/php"),
("examples/workflows","examples/workflows")] now drives BOTH newest_source_mtime()
and the rsync loop, so "what we ship" and "what we staleness-check" cannot
diverge. Freshness = newest file in ANY promoted tree; tools/ deliberately
excluded (promote only executes tools/healthcheck, never deploys it — a tool
edit cannot change what prod serves). Also fixes a latent NameError: the --help
epilog still referenced the removed PROMOTED_TREE constant, so --help crashed.

Verified: tests/test_promote_gate.sh 43 assertions 0 failed (was 32) with new
coverage for gallery staleness, both trees being rsync-planned, and a divergence
guard asserting promote's tree set == source-sync-check's compared set;
3 mutations all caught (was 2) including freshness narrowed back to app/src/php
only -> 5|0, pinning the widened scope; every invocation --dry-run so the live
prod service can never be restarted by the suite. Live read-only:
promote --dry-run exit 5 (mailbox empty, fail-closed), source-sync-check 0
(both trees both envs 0 drift — the second rsync changes no bytes today),
healthcheck prod 200/v0.4.28, /templates 200 on :8001 AND publicly via
https://gladex.de/templates. Full suite 20/20 (14 PHP + 6 shell).

Docs: REGISTRY.md promoted-tree table + freshness rule + operation steps +
43/3 counts; STRUCTURE.md step 5 and the template-gallery paragraph now record
that the env copy shadows the repo and is deployed by promote. PROGRESS.md
run-34 records STEP 0 (0 unread investor rows dev+prod, 65/65 INBOX handled).
EOF
echo "COMMIT_RC=$?"; git log --oneline -1
COMMIT_RC=0
e9d3530 feat: promote ships AND staleness-checks every tree the envs serve — one PROMOTED_TREES list drives both the rsync loop and the verdict gate's freshness check
> build · mimo-v2.6-flash-free
$ cd /data/repo && git push origin main 2>&1 | tail -5; echo "PUSH_RC=${PIPESTATUS[0]}"; git ls-remote origin main
To git://git.gladex.de/gladex.git
   aebda2c..e9d3530  main -> main
PUSH_RC=0
e9d3530f67be58c5f81f3a36654fef318a4585b6	refs/heads/main
> build · mimo-v2.6-flash-free
Pushed (`aebda2c..e9d3530`). Final health check to close the run:
$ cd /data/repo && ./tools/budget-show 2>&1 | head -15; echo "=== UNITS ==="; systemctl is-active investor-app-dev investor-app-prod apache2 postfix dovecot git-daemon 2>&1 | tr '\n' ' '; echo; echo "=== WATCHDOG ==="; systemctl list-timers agent-loop-watchdog.timer --no-pager 2>&1 | sed -n '1,3p'
=== Budget Status ===
Month:       2026-09
Allowance:   5.00 €
Spent:       1.50 (gladex.de — investor-approved 2026-09-20, purchase pending at registrar) €
Remaining:   3.50 €

Log:
  - 2026-09-20: init, no domains ordered yet
  - 2026-09-20: investor APPROVED gladex.de (1.50/mo). Awaiting registrar purchase + DNS creds.
=== UNITS ===
active active active active active active 
=== WATCHDOG ===
NEXT                         LEFT LAST                           PASSED UNIT                      ACTIVATES
Thu 2026-09-24 13:47:30 CEST 6min Thu 2026-09-24 13:32:30 CEST 8min ago agent-loop-watchdog.timer agent-loop-watchdog.service
$ cd /data/repo && ./tools/system-status --format json 2>&1 | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    print('keys:', list(d)[:12])
    for k in ('checks','summary','health'):
        if k in d: print(k, '->', json.dumps(d[k])[:600])
except Exception as e:
    print('non-json or partial:', e)
" 2>&1 | head -20; echo "SS_RC=$?"
keys: ['overall', 'errors', 'checks']
checks -> [{"name": "investor-app-dev", "status": "ok", "detail": "active"}, {"name": "investor-app-prod", "status": "ok", "detail": "active"}, {"name": "git-daemon", "status": "ok", "detail": "active"}, {"name": "apache2", "status": "ok", "detail": "active"}, {"name": "certbot-renew", "status": "ok", "detail": "active"}, {"name": "watchdog", "status": "ok", "detail": "active"}, {"name": "healthz-dev", "status": "ok", "detail": "200"}, {"name": "healthz-prod", "status": "ok", "detail": "200"}, {"name": "download", "status": "ok", "detail": "200"}, {"name": "api-health", "status": "ok", "detail": "200"},
SS_RC=0
> build · mimo-v2.6-flash-free
Run complete. Everything green.

## STEP 0 — investor comms (done first)

| Check | Result |
|---|---|
| `investor_to_agent` unread (dev DB) | **0** (24/24 read) |
| `investor_to_agent` unread (prod mirror) | **0** (3/3 read) |
| `INBOX.md` entries | 65, **0 without `HANDLED`** |

No unread messages → nothing to reply to. Recorded explicitly in `PROGRESS.md` rather than skipped, per the standing "unanswered investor = failed run" rule.

**Still open, waiting on the investor** (not mine to close):
- **A/B/C public-gating decision** (msg **#57**, still unopened) — investor routes are world-reachable through Apache's `:443` `ProxyPass`, so `/investor`, `/api/messages`, `/mailbox` (+ send form) answer 200 from the internet and scanners have probed them. Recommended A (VPS `X-Forwarded-For` + `mod_remoteip`) or A+B. No config change made until they call.
- **SOA MNAME placeholder** — provider panel only.

## The step taken (queued item from run-33)

The verdict gate keyed freshness off `app/src/php/` only. I verified what that actually missed: `templates.php` resolves its gallery **env-relative first**, so `examples/workflows/` is shipped surface on the public `/templates` route — and `source-sync-check` already compares it as served. But `promote-dev-to-prod` had exactly **one** `rsync` line, meaning:

- a template edit **never reached prod via promote**, and the drift that tool flags there was never fixed by a promote;
- editing the gallery **didn't staleness** the verdict.

Fix: one `PROMOTED_TREES` list now drives **both** `newest_source_mtime()` and the rsync loop, so "what we ship" and "what we check" can't diverge. `tools/` is deliberately excluded (promote only *executes* `healthcheck`, never deploys it).

I also caught a latent `NameError` — the `--help` epilog still referenced the removed `PROMOTED_TREE` constant, so `--help` would have crashed. Fixed before commit.

## Verification

- `tests/test_promote_gate.sh` → **43 assertions, 0 failed** (was 32), including a divergence guard asserting promote's tree set **equals** `source-sync-check`'s compared set.
- **3 mutations all caught** (was 2), including one narrowing freshness back to `app/src/php` only → `5|0`, which pins the widened scope rather than just containing it.
- Live, read-only: `promote --dry-run` → **exit 5** fail-closed; `source-sync-check` → **0** drift (so the second rsync changes *no bytes today* — safe); `healthcheck prod` → 200/v0.4.28; `/templates` → **200** on `:8001` *and* publicly.
- **Full suite 20/20** (14 PHP + 6 shell).
- Budget **5.00 / 1.50 / 3.50**, **model spend 0.00** (`*-free` only), no DNS write, no secret read. All units active, watchdog fresh.

Committed and pushed: `aebda2c..e9d3530`.

**Queued for next run:** the tool is named `promote-dev-to-prod` but step 2 copies **repo → prod**, never dev → prod — a change living only in the dev env would be silently dropped, and nothing cross-checks dev against the repo first even though `source-sync-check` computes exactly that drift.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Sep 25 01:37:40 2026] 127.0.0.1:60462 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60462 Closing
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37798 Accepted
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37798 Closing
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37802 Accepted
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37802 Closing
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37814 Accepted
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37814 Closing
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37818 Accepted
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37818 Closing
[Fri Sep 25 01:42:54 2026] 127.0.0.1:37824 Accepted
[Fri Sep 25 01:42:54 2026] 127.0.0.1:37824 Closing
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44098 Accepted
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44098 Closing
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44106 Accepted
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44106 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44120 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44120 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44134 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44134 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Closing
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Accepted
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Closing
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Accepted
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53610 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53610 Closing
[Fri Sep 25 01:43:39 2026] 127.0.0.1:34760 Accepted
[Fri Sep 25 01:43:39 2026] 127.0.0.1:34760 Closing
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34764 Accepted
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34764 Closing
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34780 Accepted
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34780 Closing
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51444 Accepted
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51444 Closing
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51450 Accepted
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51450 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51462 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51462 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51470 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51470 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51474 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51474 Closing
[Fri Sep 25 01:44:41 2026] 127.0.0.1:51486 Accepted
[Fri Sep 25 01:44:41 2026] 127.0.0.1:51486 Closing
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51490 Accepted